bc9eb5dab0d00a0de7c8df3b1d342b5ff435bc8a8cb40a04aaadb869755fe081[.]bin

Sharing

Copy URL Twitter E-mail

General

Target
bc9eb5dab0d00a0de7c8df3b1d342b5ff435bc8a8cb40a04aaadb869755fe081.bin
Size 1.5MB
Sample260801-v9g5dsseqb
SHA256 bc9eb5dab0d00a0de7c8df3b1d342b5ff435bc8a8cb40a04aaadb869755fe081
MD5 c51ea79875ad62068673cdd298766d23
SHA1 570f06e2cfffccb933f1e4077463b5f24aece6b1
SHA512 e4c6393d76ce3501fafe113b07571a75aca1c065fc64c3f8f74a269c36dfe3123f27178a54746f6e04f8801c8435da382f83fb40c0a055c597cfadfd25081464
SSDEEP 24576:o7kLsHjLpkqWvMb/Cs+8IbLS+s8d6mbqjkGsyYE9J:o7kLejLmqCMbqzBHLsqvoGEb
TLSH
T10575F7267E5A996DC05BC070C3868AB25A7270CB0F35B9FF458492783F69AF51F3C258
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bc9eb5dab0d00a0de7c8df3b1d342b5ff435bc8a8cb40a04aaadb869755fe081.bin

File Explorer

bc9eb5dab0d00a0de7c8df3b1d342b5ff435bc8a8cb40a04aaadb869755fe081.bin

.exe 1.5MB

bc9eb5dab0d00a0de7c8df3b1d342b5ff435bc8a8cb40a04aaadb869755fe081.bin

IMPHASH 87ce892c1157b44de3e217cce7127172
SHA256 bc9eb5dab0d00a0de7c8df3b1d342b5ff435bc8a8cb40a04aaadb869755fe081
MD5 c51ea79875ad62068673cdd298766d23
SHA1 570f06e2cfffccb933f1e4077463b5f24aece6b1
SHA512 e4c6393d76ce3501fafe113b07571a75aca1c065fc64c3f8f74a269c36dfe3123f27178a54746f6e04f8801c8435da382f83fb40c0a055c597cfadfd25081464
SSDEEP 24576:o7kLsHjLpkqWvMb/Cs+8IbLS+s8d6mbqjkGsyYE9J:o7kLejLmqCMbqzBHLsqvoGEb
TLSH
T10575F7267E5A996DC05BC070C3868AB25A7270CB0F35B9FF458492783F69AF51F3C258
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1071232

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

client.pdb

user32

CreateDesktopW WindowFromPoint ChildWindowFromPoint GetSystemMetrics SendInput CallNextHookEx GetWindowTextW GetForegroundWindow GetKeyState GetKeyNameTextW CloseDesktop UnhookWindowsHookEx GetMessageW SetWindowsHookExW ReleaseDC PrintWindow PostMessageW GetWindowRect IsWindowVisible GetWindow GetTopWindow ShowWindow OpenDesktopW GetParent MapVirtualKeyW ScreenToClient GetWindowLongW SendMessageW SetThreadDesktop GetKeyboardLayoutList EnumDisplayDevicesW GetDC

gdi32

GetDIBits StretchBlt SetStretchBltMode BitBlt DeleteDC DeleteObject SelectObject CreateCompatibleBitmap CreateCompatibleDC

kernel32

GetSystemTimeAsFileTime InitializeSListHead UnhandledExceptionFilter SetUnhandledExceptionFilter GetLastError CreateMutexW GetVolumeInformationW CreateProcessW IsDebuggerPresent GetTimeZoneInformation GetUserGeoID GetSystemDefaultUILanguage GetUserDefaultUILanguage Process32NextW Process32FirstW CreateToolhelp32Snapshot GetCurrentProcess VirtualProtect IsProcessorFeaturePresent LoadLibraryA GetConsoleWindow CloseHandle GetProcAddress SetHandleInformation GetOverlappedResult Sleep GetModuleHandleA UnregisterWaitEx DuplicateHandle GetQueuedCompletionStatusEx WaitForSingleObject CreateIoCompletionPort GetFileInformationByHandle CreateEventW GetVolumePathNamesForVolumeNameW FindVolumeClose FindFirstVolumeW GetComputerNameExW GetDiskFreeSpaceExW CreateFileW GetDriveTypeW GlobalMemoryStatusEx GetTickCount64 GetCurrentProcessId RegisterWaitForSingleObject GetSystemInfo GetTimeZoneInformationForYear DeviceIoControl LocalFree GetProcessIoCounters GetSystemTimes GetExitCodeProcess OpenProcess SetFileCompletionNotificationModes FindNextFileW VirtualQueryEx K32GetPerformanceInfo SwitchToThread GetFileInformationByHandleEx GetProcessTimes TerminateProcess ReadFile FindNextVolumeW GetProcessHeap HeapFree HeapAlloc ReadProcessMemory GetCurrentThreadId QueryPerformanceCounter GetFinalPathNameByHandleW CreateDirectoryW GetSystemTimePreciseAsFileTime WriteFileEx GetWindowsDirectoryW GetSystemDirectoryW PostQueuedCompletionStatus CompareStringOrdinal FreeEnvironmentStringsW GetFileAttributesW SleepEx ReadFileEx WaitForMultipleObjects CreateThread SetWaitableTimer CreateWaitableTimerExW GetConsoleOutputCP GetStdHandle WriteConsoleW MultiByteToWideChar CancelIo QueryPerformanceFrequency ExitProcess GetModuleFileNameW GetTempPathW GetFullPathNameW GetModuleHandleW FormatMessageW HeapReAlloc lstrlenW WideCharToMultiByte WaitForSingleObjectEx CreateMutexA ReleaseMutex SetFileInformationByHandle SetFileTime AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread SetLastError GetCurrentDirectoryW GetEnvironmentStringsW GetEnvironmentVariableW GetConsoleMode FindClose FindFirstFileExW CopyFileExW DeleteFileW

ws2_32

freeaddrinfo WSACleanup WSAStartup shutdown bind WSASocketW WSAGetLastError connect ioctlsocket getsockopt send recv closesocket WSAIoctl getaddrinfo

advapi32

GetLengthSid GetTokenInformation IsValidSid CopySid OpenProcessToken RegCloseKey RegOpenKeyExW RegQueryValueExW

oleaut32

GetErrorInfo

ntdll

NtOpenFile NtWriteFile NtCreateNamedPipeFile RtlCaptureContext RtlLookupFunctionEntry RtlNtStatusToDosError RtlVirtualUnwind NtQuerySystemInformation NtQueryInformationProcess RtlGetVersion NtDeviceIoControlFile NtReadFile NtCreateFile NtCancelIoFileEx

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressSingle WakeByAddressAll

bcryptprimitives

ProcessPrng

shell32

CommandLineToArgvW ShellExecuteW

pdh

PdhCloseQuery PdhRemoveCounter PdhOpenQueryA PdhGetFormattedCounterValue PdhCollectQueryData PdhAddEnglishCounterW

powrprof

CallNtPowerInformation

psapi

GetModuleFileNameExW

vcruntime140

__current_exception_context __CxxFrameHandler3 memcpy memcmp memset memmove __current_exception __C_specific_handler _CxxThrowException

api-ms-win-crt-heap-l1-1-0

free _set_new_mode

api-ms-win-crt-string-l1-1-0

wcslen

api-ms-win-crt-math-l1-1-0

__setusermatherr pow

api-ms-win-crt-runtime-l1-1-0

_initialize_narrow_environment _configure_narrow_argv _get_initial_narrow_environment terminate _set_app_type _crt_atexit _register_onexit_function _initialize_onexit_table _initterm _seh_filter_exe _register_thread_local_exe_atexit_callback _c_exit _cexit __p___argv __p___argc _initterm_e _exit exit

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale