f6c9022a1fcf00dd0b1a31053978e45a4ab4040215abe3f44333b96920ee46e6[.]bin

Sharing

Copy URL Twitter E-mail

General

Target
f6c9022a1fcf00dd0b1a31053978e45a4ab4040215abe3f44333b96920ee46e6.bin
Size 6.8MB
Sample260701-dq9a4afs21
SHA256 f6c9022a1fcf00dd0b1a31053978e45a4ab4040215abe3f44333b96920ee46e6
MD5 e3e8a5ffff375d930c5a1b4889943f87
SHA1 721ba998a989e99607ab5f96217ca6e193e66093
SHA512 912a9d42ef5cbf25a2689247cc4bab2cbe48431c795e18053d9a7887b811aa671f49b1c484866ee326d265ecc6f265829e62171f185989c4bf12b83dc26f0075
SSDEEP 196608:s1Tdu6JdemyMjpu6a67buEjcmUInErzvF:YoQdemyMlu6arEbUInErzvF
TLSH
T15076EF13D5E6CEF4C12BE6BC4A629332A91474884E32B12D65D5F3666FF0E38A15DB30
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f6c9022a1fcf00dd0b1a31053978e45a4ab4040215abe3f44333b96920ee46e6.bin

File Explorer

f6c9022a1fcf00dd0b1a31053978e45a4ab4040215abe3f44333b96920ee46e6.bin

.exe 6.8MB

f6c9022a1fcf00dd0b1a31053978e45a4ab4040215abe3f44333b96920ee46e6.bin

IMPHASH a67b76d63af009be4798a1e88a5aa5c7
SHA256 f6c9022a1fcf00dd0b1a31053978e45a4ab4040215abe3f44333b96920ee46e6
MD5 e3e8a5ffff375d930c5a1b4889943f87
SHA1 721ba998a989e99607ab5f96217ca6e193e66093
SHA512 912a9d42ef5cbf25a2689247cc4bab2cbe48431c795e18053d9a7887b811aa671f49b1c484866ee326d265ecc6f265829e62171f185989c4bf12b83dc26f0075
SSDEEP 196608:s1Tdu6JdemyMjpu6a67buEjcmUInErzvF:YoQdemyMlu6arEbUInErzvF
TLSH
T15076EF13D5E6CEF4C12BE6BC4A629332A91474884E32B12D65D5F3666FF0E38A15DB30
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5184

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

RegCloseKey RegCreateKeyExA RegDeleteValueA RegOpenKeyExA RegQueryValueExA RegSetValueExA

kernel32

CloseHandle CreateDirectoryA CreateEventA CreateSemaphoreA DeleteCriticalSection DeleteFileA DuplicateHandle EnterCriticalSection FindClose FindFirstFileA FindNextFileA FlushViewOfFile FormatMessageA GetCPInfo GetCommandLineW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetEnvironmentVariableA GetExitCodeProcess GetFileInformationByHandle GetLastError GetModuleFileNameA GetModuleHandleA GetProcAddress GetProcessAffinityMask GetSystemInfo GetSystemTimeAsFileTime GetTempPathA GetThreadContext GetThreadPriority GetTickCount GetTickCount64 InitializeCriticalSection IsProcessorFeaturePresent LeaveCriticalSection LoadLibraryW LocalFree MoveFileExA MultiByteToWideChar OpenProcess OutputDebugStringA QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReleaseSemaphore ResetEvent ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetEvent SetLastError SetPriorityClass SetProcessAffinityMask SetThreadContext SetThreadPriority SetUnhandledExceptionFilter Sleep SuspendThread TerminateProcess TlsAlloc TlsGetValue TlsSetValue TryEnterCriticalSection VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WideCharToMultiByte

msvcrt

_XcptFilter ___lc_codepage_func ___mb_cur_max_func __getmainargs __initenv __iob_func __set_app_type __setusermatherr _amsg_exit _assert _beginthreadex _cexit _commode _endthreadex _errno _exit _fdopen _filelengthi64 _fileno _fileno _fmode _fstat64 _get_osfhandle _initterm _lock _lseeki64 _read _setjmp _setmode _strdup _strtoi64 _strtoui64 _time64 _unlock _vscprintf _vsnprintf _wfopen _write abort atexit calloc exit fclose fflush fgetpos fopen fprintf fputc fputs fread free fsetpos fwrite getc getenv getwc iswctype localeconv longjmp malloc memchr memcmp memcpy memmove memset putc putwc rand realloc setlocale setvbuf srand strchr strcmp strcoll strerror strftime strlen strncmp strtoul strxfrm tolower towupper ungetwc towlower ungetc vfprintf vswprintf_s wcscoll wcscpy_s wcsftime wcslen wcstombs wcsxfrm

ntdll

NtClose NtCreateSection NtMapViewOfSection NtOpenFile NtSetInformationFile NtWriteFile RtlInitUnicodeString

ole32

CoCreateInstance CoInitializeEx CoSetProxyBlanket CoUninitialize

oleaut32

SysAllocString SysFreeString VariantClear VariantInit

shell32

CommandLineToArgvW SHGetFolderPathA

winhttp

WinHttpCloseHandle WinHttpConnect WinHttpCrackUrl WinHttpOpen WinHttpOpenRequest WinHttpQueryDataAvailable WinHttpQueryHeaders WinHttpReadData WinHttpReceiveResponse WinHttpSendRequest

Name

.orpc

Size

1.9MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.sdata

Size

328KB

Virtual Size

328KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

CONST

Size

512B

Virtual Size

288B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

56KB

Virtual Size

55KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

86KB

Virtual Size

85KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4.5MB

Virtual Size

4.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

f6c9022a1fcf00dd0b1a31053978e45a4ab4040215abe3f44333b96920ee46e6.bin

advapi32

kernel32

msvcrt

ntdll

ole32

oleaut32

shell32

winhttp

generic