stage2[.]bin | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
stage2.bin
Size 17.9MB
Sample260820-wp6spasgpc
SHA256 2249bf4d4e7c16fe4c08fec36033f85e4eb95a3ce9b3b79802994eec4af88857
MD5 cf263f183e79cf81845abe08b4aa1bfd
SHA1 2f4a08957847790e4e938ea3866645a9e75a777b
SHA512 acdc0da1b078d877fc3a3e463e9b2908ee812dca07796a60169cddc9f1bbe23f1dcef864f156bcbef63d6faefa84237f59b464d5e18030b61fac0c0770746396
SSDEEP 393216:8eCFNeVtmh3Tu/3S3duObte7/bWOE1pq:kgW3Tu/3Q0x7KXq
TLSH
T1291712E925D0917DC4D18234E14A57F9F0C97C8C4DB9182BBFC358512734CEAE8BAAB6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
stage2.bin

File Explorer

stage2.bin

.dll 17.9MB

stage2.bin

IMPHASH 645158ae30c04cdd2d061979c2e83346
SHA256 2249bf4d4e7c16fe4c08fec36033f85e4eb95a3ce9b3b79802994eec4af88857
MD5 cf263f183e79cf81845abe08b4aa1bfd
SHA1 2f4a08957847790e4e938ea3866645a9e75a777b
SHA512 acdc0da1b078d877fc3a3e463e9b2908ee812dca07796a60169cddc9f1bbe23f1dcef864f156bcbef63d6faefa84237f59b464d5e18030b61fac0c0770746396
SSDEEP 393216:8eCFNeVtmh3Tu/3S3duObte7/bWOE1pq:kgW3Tu/3Q0x7KXq
TLSH
T1291712E925D0917DC4D18234E14A57F9F0C97C8C4DB9182BBFC358512734CEAE8BAAB6
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

29424639

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

ws2_32

WSAGetLastError setsockopt ioctlsocket getsockname __WSAFDIsSet WSAIoctl closesocket select shutdown inet_pton WSAStartup socket connect recv getsockopt htons send

iphlpapi

SendARP GetIpForwardTable2 ResolveIpNetEntry2 GetAdaptersAddresses FreeMibTable

winhttp

WinHttpQueryDataAvailable WinHttpCrackUrl WinHttpConnect WinHttpReceiveResponse WinHttpOpen WinHttpQueryHeaders WinHttpReadData WinHttpOpenRequest WinHttpSetOption WinHttpCloseHandle WinHttpSendRequest WinHttpSetTimeouts WinHttpQueryOption

kernel32

GetFileAttributesExW CreateProcessW GetExitCodeProcess ReadConsoleInputW SetConsoleMode GetConsoleMode GetConsoleOutputCP FlushFileBuffers ReadFile FindFirstFileW VirtualFree FindNextFileW GetCurrentProcess WriteFile VirtualAlloc RemoveDirectoryW GetEnvironmentVariableW FindClose CreateFileW DuplicateHandle GetModuleHandleA OpenProcess SetFileAttributesW DeleteFileW CloseHandle GetProcAddress GetFileSize GetCurrentProcessId GetConsoleScreenBufferInfo SetConsoleTextAttribute GetStdHandle SetCurrentConsoleFontEx DeviceIoControl TerminateProcess GetDriveTypeA InitializeCriticalSection SetFilePointerEx WaitForSingleObject CreateToolhelp32Snapshot Sleep Process32NextW FillConsoleOutputCharacterW CreateFileA DisableThreadLibraryCalls GetFileSizeEx Process32FirstW CreateThread FillConsoleOutputAttribute WriteConsoleW DeleteCriticalSection GetDiskFreeSpaceExA SetConsoleCursorPosition EnterCriticalSection LeaveCriticalSection LoadLibraryA GetLastError FindFirstStreamW FindNextStreamW RemoveVectoredExceptionHandler AddVectoredExceptionHandler GetModuleHandleW RtlDeleteFunctionTable QueryPerformanceCounter SetLastError GetSystemFirmwareTable HeapFree HeapAlloc GetProcessHeap WideCharToMultiByte GetFirmwareEnvironmentVariableW LoadLibraryW FreeLibrary lstrcmpiA LoadLibraryExW EnumSystemFirmwareTables LCMapStringW CompareStringW GetTempPathW FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW RtlUnwind MultiByteToWideChar GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetStringTypeW VirtualProtect InitializeCriticalSectionEx FlsFree FlsSetValue FlsGetValue FlsAlloc GetFileType GetModuleFileNameW GetModuleHandleExW ExitProcess GetConsoleCP TlsFree SetStdHandle HeapSize HeapReAlloc TerminateThread TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount EncodePointer InterlockedFlushSList RaiseException RtlPcToFileHeader RtlUnwindEx InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetStartupInfoW ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent IsDebuggerPresent

user32

wsprintfA MessageBoxA wsprintfW

advapi32

EnumServicesStatusA ControlService ChangeServiceConfigA OpenSCManagerA CloseServiceHandle RegCloseKey RegQueryValueExW LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken RegCreateKeyA RegDeleteTreeA ControlTraceA OpenServiceA

shell32

ord680

shlwapi

StrStrIA PathFileExistsW StrStrIW

secur32

AcquireCredentialsHandleW InitializeSecurityContextW FreeCredentialsHandle DecryptMessage ApplyControlToken FreeContextBuffer EncryptMessage QueryContextAttributesW DeleteSecurityContext

crypt32

CryptHashCertificate2 CertFreeCertificateChain CertFreeCertificateContext CertGetCertificateChain

dxgi

CreateDXGIFactory

setupapi

SetupDiGetDeviceRegistryPropertyA SetupDiGetClassDevsA SetupDiGetDeviceInstanceIdW SetupDiOpenDevRegKey CM_Get_DevNode_Status SetupDiGetClassDevsW SetupDiGetDeviceRegistryPropertyW SetupDiEnumDeviceInfo SetupDiDestroyDeviceInfoList

Name

.text

Size

Virtual Size

282KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

60KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.orM

Size

Virtual Size

11.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.u?H

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.$U`

Size

17.9MB

Virtual Size

17.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

469B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

188B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

stage2.bin

ws2_32

iphlpapi

winhttp

kernel32

user32

advapi32

shell32

shlwapi

secur32

crypt32

dxgi

setupapi

generic