de56b90b222c4f01351771e01e82a4d815a837d798e6ba2cb6d68ca34233f8c2[.]bin

Sharing

Copy URL Twitter E-mail

General

Target
de56b90b222c4f01351771e01e82a4d815a837d798e6ba2cb6d68ca34233f8c2.bin
Size 2.2MB
Sample260608-tz654acs2w
SHA256 de56b90b222c4f01351771e01e82a4d815a837d798e6ba2cb6d68ca34233f8c2
MD5 6fa3404dcd5a4dd732f36f59dd24405f
SHA1 3a6134c4837c8616bbce00c0064436483ffde8e2
SHA512 d1440bc92411885597c64fa9a6c152a9276a2f615c02956ac67814d9000cd8c66ed976126d12c603aa20c748700e14b5dc9272548e2683add9a3e72992d10099
SSDEEP 49152:/ZzQqIEjvDQPOnR5mSBn/VSlsBzXHWtSyZS:/YcxyZ
TLSH
T183B54B0272E500D9D257E870CB73DB26E331B84C453876671AE29E6B5F76760B9EE320
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
de56b90b222c4f01351771e01e82a4d815a837d798e6ba2cb6d68ca34233f8c2.bin

File Explorer

de56b90b222c4f01351771e01e82a4d815a837d798e6ba2cb6d68ca34233f8c2.bin

.dll 2.2MB

de56b90b222c4f01351771e01e82a4d815a837d798e6ba2cb6d68ca34233f8c2.bin

IMPHASH e8e38191d0fe46b2260a7da905ae03af
SHA256 de56b90b222c4f01351771e01e82a4d815a837d798e6ba2cb6d68ca34233f8c2
MD5 6fa3404dcd5a4dd732f36f59dd24405f
SHA1 3a6134c4837c8616bbce00c0064436483ffde8e2
SHA512 d1440bc92411885597c64fa9a6c152a9276a2f615c02956ac67814d9000cd8c66ed976126d12c603aa20c748700e14b5dc9272548e2683add9a3e72992d10099
SSDEEP 49152:/ZzQqIEjvDQPOnR5mSBn/VSlsBzXHWtSyZS:/YcxyZ
TLSH
T183B54B0272E500D9D257E870CB73DB26E331B84C453876671AE29E6B5F76760B9EE320
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

349200

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

s:\p4client\C1@W)#ePOwUAD*U%WR!szfvsG6

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

kernel32

LocalFree GetProcessHeap HeapAlloc MapViewOfFile UnmapViewOfFile CreateFileMappingW OpenFileMappingW FreeLibrary LoadLibraryA GetProcAddress RaiseException LoadLibraryExW lstrcmpiW CreateWaitableTimerW CancelWaitableTimer GetTickCount64 GetTickCount SignalObjectAndWait SetWaitableTimer WaitForMultipleObjects GetThreadLocale SetThreadLocale WaitForMultipleObjectsEx CreateMutexW OpenEventW InitializeCriticalSection HeapFree HeapDestroy HeapReAlloc HeapSize CreateFileW SetEndOfFile WriteConsoleW FlushFileBuffers SetStdHandle CreateFileA LoadLibraryW GetSystemTimeAsFileTime GetCurrentProcessId GetEnvironmentStringsW FreeEnvironmentStringsW GetModuleFileNameA LCMapStringW GetConsoleMode GetConsoleCP GetStringTypeW ReadFile GetStartupInfoW GetFileType SetHandleCount SetFilePointer ExitProcess HeapCreate GetVersion HeapSetInformation IsValidCodePage GetOEMCP GetACP GetCPInfo VirtualAlloc GetModuleFileNameW LeaveCriticalSection DuplicateHandle GetCurrentProcess EnterCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount MultiByteToWideChar lstrlenA Sleep ResetEvent FindResourceW SizeofResource LockResource LoadResource FindResourceExW WideCharToMultiByte lstrlenW OutputDebugStringW CreateEventW CreateThread GetLastError CloseHandle WaitForSingleObject SetEvent FlsAlloc SetLastError FlsFree FlsGetValue GetStdHandle WriteFile TerminateProcess RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCommandLineA FlsSetValue GetCurrentThreadId ExitThread RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry EncodePointer DecodePointer FormatMessageA QueryPerformanceFrequency QueryPerformanceCounter

user32

DestroyWindow PostMessageW UnregisterClassW GetClassInfoW RegisterClassW CreateWindowExW RegisterClipboardFormatW CharNextW DefWindowProcW EndDialog

advapi32

RegQueryValueExW RegCloseKey RegDeleteKeyExW ConvertStringSecurityDescriptorToSecurityDescriptorW RegQueryInfoKeyW SetSecurityDescriptorDacl RegSetKeySecurity InitializeSecurityDescriptor RegDeleteValueW RegEnumValueW RegEnumKeyExW RegDeleteKeyW RegSetValueExW RegCreateKeyExW RegOpenKeyExW

ole32

CoCreateInstance PropVariantClear CoTaskMemFree CoTaskMemRealloc CoTaskMemAlloc StringFromGUID2 CLSIDFromString CLSIDFromProgID OleRun CoUninitialize CoInitialize StringFromCLSID

oleaut32

VarUI4FromStr SysAllocString GetErrorInfo VariantClear UnRegisterTypeLi RegisterTypeLi LoadTypeLi SysStringLen SysFreeString

shlwapi

SHDeleteKeyW

avrt

AvSetMmThreadPriority AvSetMmThreadCharacteristicsW

Name

.text

Size

435KB

Virtual Size

435KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

RT_CODE

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

407KB

Virtual Size

407KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

35KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

42KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data1

Size

96KB

Virtual Size

96KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

RT_CONST

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

RT_DATA

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.trace

Size

25KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

80KB

Virtual Size

79KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

29KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

de56b90b222c4f01351771e01e82a4d815a837d798e6ba2cb6d68ca34233f8c2.bin

version

kernel32

user32

advapi32

ole32

oleaut32

shlwapi

avrt

generic