0db2854d288cd23225a48a4dcfc1288015b538059ffbf0f23aaff8a02779f44a[.]bin

Sharing

Copy URL Twitter E-mail

General

Target
0db2854d288cd23225a48a4dcfc1288015b538059ffbf0f23aaff8a02779f44a.bin
Size 7.4MB
Sample260818-x1bblaah63
SHA256 0db2854d288cd23225a48a4dcfc1288015b538059ffbf0f23aaff8a02779f44a
MD5 7deed8050d320607974722fe11468475
SHA1 c695e4bb2a32ecf923091df4544375cfc21d6a46
SHA512 f17d5ed580575ebf8e5e5706c8e00ddb6d3a68ee509986e52724478f5b8463912b18de18a3cbdd418004b0621041876dc13f5a0b565cc26f5c1e7e88db1efaf0
SSDEEP 98304:4xMO/rl9UnhAqjcokdXuruh66zLcx+Go:4Ph96AhBur6m+Go
TLSH
T14D76AE18A3E809B5E52BDB38CA61D333C6B0BCA25776C14F095DF6461F73A508B2F625
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0db2854d288cd23225a48a4dcfc1288015b538059ffbf0f23aaff8a02779f44a.bin

File Explorer

0db2854d288cd23225a48a4dcfc1288015b538059ffbf0f23aaff8a02779f44a.bin

.dll 7.4MB

0db2854d288cd23225a48a4dcfc1288015b538059ffbf0f23aaff8a02779f44a.bin

IMPHASH 9e1c5e753d9730385056638ab1d72c60
SHA256 0db2854d288cd23225a48a4dcfc1288015b538059ffbf0f23aaff8a02779f44a
MD5 7deed8050d320607974722fe11468475
SHA1 c695e4bb2a32ecf923091df4544375cfc21d6a46
SHA512 f17d5ed580575ebf8e5e5706c8e00ddb6d3a68ee509986e52724478f5b8463912b18de18a3cbdd418004b0621041876dc13f5a0b565cc26f5c1e7e88db1efaf0
SSDEEP 98304:4xMO/rl9UnhAqjcokdXuruh66zLcx+Go:4Ph96AhBur6m+Go
TLSH
T14D76AE18A3E809B5E52BDB38CA61D333C6B0BCA25776C14F095DF6461F73A508B2F625
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4273456

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

advapi32

AdjustTokenPrivileges DeregisterEventSource LookupPrivilegeValueW OpenProcessToken RegCloseKey RegCreateKeyExW RegEnumKeyExW RegEnumValueW RegOpenKeyExW RegQueryValueExW RegSetValueExW RegisterEventSourceW ReportEventW

bcrypt

BCryptOpenAlgorithmProvider BCryptImportKeyPair BCryptImportKey BCryptHashData BCryptGetProperty BCryptGenRandom BCryptFinishHash BCryptExportKey BCryptEncrypt BCryptDestroyKey BCryptDestroyHash BCryptDecrypt BCryptCreateHash BCryptCloseAlgorithmProvider BCryptSetProperty

crypt32

CryptImportPublicKeyInfoEx2 CryptFormatObject CryptFindOIDInfo CryptDecodeObject CertOpenStore CertNameToStrW CertGetNameStringW CertGetCertificateContextProperty CertGetCertificateChain CertControlStore CertFreeCertificateContext CertFreeCertificateChain CertEnumCertificatesInStore CertDuplicateCertificateContext CertCloseStore

kernel32

SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent InitializeSListHead RtlUnwindEx InterlockedFlushSList RtlPcToFileHeader RaiseException EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree CancelIoEx CancelSynchronousIo CancelThreadpoolIo CloseHandle CloseThreadpoolIo CloseThreadpoolWait CloseThreadpoolWork CompareStringEx CompareStringOrdinal CopyFileExW CreateDirectoryW CreateEventExW CreateFileW CreateThread CreateThreadpoolIo CreateThreadpoolTimer CreateThreadpoolWait CreateThreadpoolWork DeleteCriticalSection DeleteFileW DeviceIoControl DuplicateHandle EnterCriticalSection EnumCalendarInfoExEx EnumTimeFormatsEx ExitProcess ExpandEnvironmentStringsW FileTimeToSystemTime FindClose FindFirstFileExW FindNLSStringEx FindStringOrdinal FlushFileBuffers FlushInstructionCache FormatMessageW FreeConsole FreeLibrary GetCPInfo GetCPInfoExW GetCalendarInfoEx GetConsoleMode GetConsoleOutputCP GetCurrentProcess GetCurrentProcessId GetCurrentProcessorNumberEx GetCurrentThread GetCurrentThreadId GetDynamicTimeZoneInformation GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesExW GetFileInformationByHandleEx GetFileType GetFullPathNameW GetLastError GetLocaleInfoEx GetLongPathNameW GetModuleFileNameW GetModuleHandleA GetOverlappedResult GetProcAddress GetProcessId GetStdHandle GetSystemDirectoryW GetSystemTime GetThreadPriority GetTickCount64 GetTimeZoneInformation GetUserPreferredUILanguages InitializeConditionVariable InitializeCriticalSection IsDebuggerPresent IsWow64Process K32EnumProcessModulesEx K32EnumProcesses K32GetModuleBaseNameW K32GetModuleFileNameExW K32GetModuleInformation LCMapStringEx LeaveCriticalSection LoadLibraryExW LocalAlloc LocalFree LocaleNameToLCID MoveFileExW MultiByteToWideChar OpenProcess OpenThread QueryPerformanceCounter QueryPerformanceFrequency QueryUnbiasedInterruptTime RaiseFailFastException ReadConsoleW ReadFile ReadProcessMemory ResetEvent ResolveLocaleName ResumeThread SetEvent SetFileAttributesW SetFileInformationByHandle SetLastError SetThreadErrorMode SetThreadPriority SetThreadpoolTimer SetThreadpoolWait Sleep SleepConditionVariableCS StartThreadpoolIo SubmitThreadpoolWork SystemTimeToFileTime TzSpecificLocalTimeToSystemTime VirtualAlloc VirtualAllocEx VirtualFree VirtualProtectEx WaitForMultipleObjectsEx WaitForSingleObject WaitForThreadpoolWaitCallbacks WakeConditionVariable WideCharToMultiByte WriteConsoleW WriteFile WriteProcessMemory FlushProcessWriteBuffers WaitForSingleObjectEx AddVectoredExceptionHandler GetModuleHandleW RtlVirtualUnwind RtlCaptureContext RtlRestoreContext VerSetConditionMask FlsAlloc FlsGetValue FlsSetValue CreateEventW SwitchToThread SuspendThread GetThreadContext SetThreadContext VirtualProtect CreateMemoryResourceNotification QueryInformationJobObject GetModuleHandleExW GetProcessAffinityMask VerifyVersionInfoW InitializeContext GetEnabledXStateFeatures LocateXStateFeature SetXStateFeaturesMask VirtualQuery GetSystemTimeAsFileTime InitializeCriticalSectionEx SleepEx DebugBreak GlobalMemoryStatusEx GetSystemInfo GetLogicalProcessorInformation GetLogicalProcessorInformationEx GetLargePageMinimum VirtualUnlock VirtualAllocExNuma IsProcessInJob GetNumaHighestNodeNumber GetProcessGroupAffinity K32GetProcessMemoryInfo UnhandledExceptionFilter RtlLookupFunctionEntry

ncrypt

NCryptDeleteKey NCryptGetProperty NCryptImportKey NCryptOpenKey NCryptOpenStorageProvider NCryptSetProperty NCryptFreeObject

ole32

CoCreateGuid CoGetApartmentType CoTaskMemAlloc CoTaskMemFree CoUninitialize CoWaitForMultipleHandles CoInitializeEx

user32

LoadStringW

api-ms-win-crt-math-l1-1-0

log tan sin pow modf ceil cos floor fmod fmodf

api-ms-win-crt-heap-l1-1-0

malloc free calloc _callnewh

api-ms-win-crt-string-l1-1-0

wcsncmp strcpy_s _stricmp strcmp strncpy_s

api-ms-win-crt-convert-l1-1-0

strtoull

api-ms-win-crt-runtime-l1-1-0

_crt_atexit _execute_onexit_table _register_onexit_function _configure_narrow_argv _initialize_narrow_environment _initterm_e _cexit _seh_filter_dll terminate _initialize_onexit_table abort _initterm

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf_s __stdio_common_vsscanf __stdio_common_vfprintf __acrt_iob_func