129a8e84e98d3c03742f8dc2875dac76162c0ceb5e128c29eb05598f21c5d9ae[.]bin

Sharing

Copy URL Twitter E-mail

General

Target
129a8e84e98d3c03742f8dc2875dac76162c0ceb5e128c29eb05598f21c5d9ae.bin
Size 7.0MB
Sample260702-ppdnksas5v
SHA256 129a8e84e98d3c03742f8dc2875dac76162c0ceb5e128c29eb05598f21c5d9ae
MD5 7d5dc4cd4de21632f8daf21f9038e0b5
SHA1 5febfbdafacec52ae35af76303a18c94ea6d5cc7
SHA512 d5265f48a1ac3789305800cbf18e65063bb8123d1623cdbc34d1f4847ea87ccb7f0160a79d80a671fa7988604f18364bae7b5e5157deb7b48c2b52a02f9099f0
SSDEEP 196608:Otkw49t5fNbuQTgEJyTJitRjoInErzvu:cMt5fNbuQTgEmifoInErzvu
TLSH
T15A76EF13D5EA8EF4D11BE6BD4A629332AA14708C5E32B12C25D5F3666FF0D38A15DB30
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
129a8e84e98d3c03742f8dc2875dac76162c0ceb5e128c29eb05598f21c5d9ae.bin

File Explorer

129a8e84e98d3c03742f8dc2875dac76162c0ceb5e128c29eb05598f21c5d9ae.bin

.exe 7.0MB

129a8e84e98d3c03742f8dc2875dac76162c0ceb5e128c29eb05598f21c5d9ae.bin

IMPHASH 621f438e5ae84c0a14d766cce7016b6d
SHA256 129a8e84e98d3c03742f8dc2875dac76162c0ceb5e128c29eb05598f21c5d9ae
MD5 7d5dc4cd4de21632f8daf21f9038e0b5
SHA1 5febfbdafacec52ae35af76303a18c94ea6d5cc7
SHA512 d5265f48a1ac3789305800cbf18e65063bb8123d1623cdbc34d1f4847ea87ccb7f0160a79d80a671fa7988604f18364bae7b5e5157deb7b48c2b52a02f9099f0
SSDEEP 196608:Otkw49t5fNbuQTgEJyTJitRjoInErzvu:cMt5fNbuQTgEmifoInErzvu
TLSH
T15A76EF13D5EA8EF4D11BE6BD4A629332AA14708C5E32B12C25D5F3666FF0D38A15DB30
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5184

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

RegCloseKey RegCreateKeyExA RegDeleteValueA RegOpenKeyExA RegQueryValueExA RegSetValueExA

kernel32

CloseHandle CreateDirectoryA CreateEventA CreateSemaphoreA CreateThread DeleteCriticalSection DeleteFileA DuplicateHandle EnterCriticalSection ExitThread FindClose FindFirstFileA FindNextFileA FormatMessageA GetCPInfo GetCommandLineW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetEnvironmentVariableA GetEnvironmentVariableW GetExitCodeProcess GetFileInformationByHandle GetLastError GetModuleFileNameA GetModuleHandleA GetProcAddress GetProcessAffinityMask GetSystemInfo GetSystemTimeAsFileTime GetTempPathA GetThreadContext GetThreadPriority GetTickCount GetTickCount64 InitializeCriticalSection IsProcessorFeaturePresent K32EmptyWorkingSet LeaveCriticalSection LoadLibraryA LoadLibraryW LocalFree MoveFileExA MultiByteToWideChar OpenEventA OpenProcess OutputDebugStringA QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReleaseSemaphore ResetEvent ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetEnvironmentVariableA SetEnvironmentVariableW SetEvent SetLastError SetProcessAffinityMask SetThreadContext SetThreadPriority SetUnhandledExceptionFilter Sleep SuspendThread TerminateProcess TlsAlloc TlsGetValue TlsSetValue TryEnterCriticalSection UnhandledExceptionFilter VirtualAlloc VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WideCharToMultiByte

msvcrt

_XcptFilter ___lc_codepage_func ___mb_cur_max_func __getmainargs __initenv __iob_func __set_app_type __setusermatherr _amsg_exit _assert _beginthreadex _cexit _commode _endthreadex _errno _exit _fdopen _filelengthi64 _fileno _fileno _fmode _fstat64 _get_osfhandle _initterm _lseeki64 _read _setjmp _setmode _strdup _strtoi64 _strtoui64 _time64 _vscprintf _vsnprintf _wfopen _write abort atexit calloc exit fclose fflush fgetpos fopen fprintf fputc fputs fread free fsetpos fwrite getc getenv getwc iswctype localeconv longjmp malloc memchr memcmp memcpy memmove memset putc putwc rand realloc setlocale setvbuf srand strcat_s strchr strcmp strcoll strcpy_s strerror strftime strlen strncmp strtok_s strtoul strxfrm tolower towupper ungetwc towlower ungetc vfprintf wcscat_s wcscoll wcscpy_s wcscspn wcsftime wcslen wcsspn wcstombs wcsxfrm

ole32

CoCreateInstance CoInitializeEx CoSetProxyBlanket CoUninitialize

oleaut32

SysAllocString SysFreeString VariantClear VariantInit

shell32

CommandLineToArgvW SHGetFolderPathA

winhttp

WinHttpCloseHandle WinHttpConnect WinHttpCrackUrl WinHttpOpen WinHttpOpenRequest WinHttpQueryDataAvailable WinHttpQueryHeaders WinHttpReadData WinHttpReceiveResponse WinHttpSendRequest

Name

.itext

Size

2.0MB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

DATA

Size

409KB

Virtual Size

409KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

288B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

57KB

Virtual Size

56KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

87KB

Virtual Size

86KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4.5MB

Virtual Size

4.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

129a8e84e98d3c03742f8dc2875dac76162c0ceb5e128c29eb05598f21c5d9ae.bin

advapi32

kernel32

msvcrt

ole32

oleaut32

shell32

winhttp

generic