e014dadf6d93b312b93e2fc857791c241692da4015da7a24a4d42a946551add2[.]bin

Sharing

Copy URL Twitter E-mail

General

Target
e014dadf6d93b312b93e2fc857791c241692da4015da7a24a4d42a946551add2.bin
Size 2.9MB
Sample260912-xepbbssflc
SHA256 e014dadf6d93b312b93e2fc857791c241692da4015da7a24a4d42a946551add2
MD5 cdf8f8a09a04c3c2e1c0e75e4a21d7da
SHA1 355299da48c613a85783e662acd044e542ddf016
SHA512 6bb28d48704e6c363be6ec47fb882800344b31a60f8ecd1e3cb28ac92cc4b375dffc7e73474d080fa7cf6f11db9c54eb3c050e53e43973b42eacc4c180eda165
SSDEEP 49152:MOKQm8qRmfFGJDKfJQebVuITn3dTOeBRpV+:yebptBRpV+
TLSH
T195D5F84369DB0DE9CDD677B861C76335A738FD318E295F2BA608C2212D536C4AE1EB40
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e014dadf6d93b312b93e2fc857791c241692da4015da7a24a4d42a946551add2.bin

File Explorer

e014dadf6d93b312b93e2fc857791c241692da4015da7a24a4d42a946551add2.bin

.exe 2.9MB

e014dadf6d93b312b93e2fc857791c241692da4015da7a24a4d42a946551add2.bin

IMPHASH a285969101a563c6f30fc1c0f71c6d51
SHA256 e014dadf6d93b312b93e2fc857791c241692da4015da7a24a4d42a946551add2
MD5 cdf8f8a09a04c3c2e1c0e75e4a21d7da
SHA1 355299da48c613a85783e662acd044e542ddf016
SHA512 6bb28d48704e6c363be6ec47fb882800344b31a60f8ecd1e3cb28ac92cc4b375dffc7e73474d080fa7cf6f11db9c54eb3c050e53e43973b42eacc4c180eda165
SSDEEP 49152:MOKQm8qRmfFGJDKfJQebVuITn3dTOeBRpV+:yebptBRpV+
TLSH
T195D5F84369DB0DE9CDD677B861C76335A738FD318E295F2BA608C2212D536C4AE1EB40
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5248

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

iphlpapi

GetAdaptersInfo

kernel32

CloseHandle CopyFileA CreateEventA CreateThread DeleteCriticalSection EnterCriticalSection ExitThread FormatMessageA FreeLibrary GetConsoleWindow GetCurrentProcess GetLastError GetModuleFileNameA GetProcAddress GetSystemDirectoryA InitializeCriticalSection IsProcessorFeaturePresent LeaveCriticalSection LoadLibraryA LocalFree RaiseException ResetEvent RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetEvent SetUnhandledExceptionFilter Sleep TerminateProcess TerminateThread VirtualProtect VirtualQuery WaitForSingleObject

libmodbus-5

modbus_connect modbus_free modbus_new_tcp modbus_read_bits modbus_read_registers modbus_write_bit modbus_write_register

api-ms-win-crt-convert-l1-1-0

_itoa mbrtowc strtoul wcrtomb

api-ms-win-crt-environment-l1-1-0

__p__environ getenv

api-ms-win-crt-filesystem-l1-1-0

_fstat64

api-ms-win-crt-heap-l1-1-0

_set_new_mode free malloc realloc

api-ms-win-crt-locale-l1-1-0

___mb_cur_max_func _configthreadlocale localeconv setlocale

api-ms-win-crt-math-l1-1-0

__setusermatherr _fdopen

api-ms-win-crt-private-l1-1-0

memchr memcmp memcpy memmove strchr

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv _cexit _configure_narrow_argv _crt_atexit _errno _exit _initialize_narrow_environment _seh_filter_exe _initterm _initterm_e _set_app_type _set_invalid_parameter_handler abort exit strerror

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf _fileno _get_osfhandle _lseeki64 _read _wfopen _write fclose fflush fopen fputc fputs fwrite setvbuf

api-ms-win-crt-string-l1-1-0

iswctype memset strcat strcat_s strcmp strcoll strcpy strlen strncmp strncpy strnlen strxfrm towlower towupper wcscoll wcslen wcsnlen wcsxfrm wctype

api-ms-win-crt-time-l1-1-0

_ctime64 _localtime64 _time64 strftime wcsftime

api-ms-win-crt-utility-l1-1-0

rand rand_s

libwinpthread-1

clock_gettime64 nanosleep64 pthread_cond_broadcast pthread_cond_wait pthread_mutex_destroy pthread_mutex_init pthread_mutex_lock pthread_mutex_unlock pthread_once

shell32

SHGetFolderPathA

user32

ShowWindow

winmm

timeBeginPeriod timeEndPeriod timeGetTime

ws2_32

WSACleanup WSAGetLastError WSAStartup accept bind closesocket connect getpeername getsockname htons inet_addr inet_ntoa inet_pton ioctlsocket listen recv select send setsockopt shutdown socket

Cli_ABRead Cli_ABWrite Cli_AsABRead Cli_AsABWrite Cli_AsCTRead Cli_AsCTWrite Cli_AsCompress Cli_AsCopyRamToRom Cli_AsDBFill Cli_AsDBGet Cli_AsDBRead Cli_AsDBWrite Cli_AsDownload Cli_AsEBRead Cli_AsEBWrite Cli_AsFullUpload Cli_AsListBlocksOfType Cli_AsMBRead Cli_AsMBWrite Cli_AsReadArea Cli_AsReadSZL Cli_AsReadSZLList Cli_AsTMRead Cli_AsTMWrite Cli_AsUpload Cli_AsWriteArea Cli_CTRead Cli_CTWrite Cli_CheckAsCompletion Cli_ClearSessionPassword Cli_Compress Cli_Connect Cli_ConnectTo Cli_CopyRamToRom Cli_Create Cli_DBFill Cli_DBGet Cli_DBRead Cli_DBWrite Cli_Delete Cli_Destroy Cli_Disconnect Cli_Download Cli_EBRead Cli_EBWrite Cli_ErrorText Cli_FullUpload Cli_GetAgBlockInfo Cli_GetConnected Cli_GetCpInfo Cli_GetCpuInfo Cli_GetExecTime Cli_GetLastError Cli_GetOrderCode Cli_GetParam Cli_GetPduLength Cli_GetPgBlockInfo Cli_GetPlcDateTime Cli_GetPlcStatus Cli_GetProtection Cli_IsoExchangeBuffer Cli_ListBlocks Cli_ListBlocksOfType Cli_MBRead Cli_MBWrite Cli_PlcColdStart Cli_PlcHotStart Cli_PlcStop Cli_ReadArea Cli_ReadMultiVars Cli_ReadSZL Cli_ReadSZLList Cli_SetAsCallback Cli_SetConnectionParams Cli_SetConnectionType Cli_SetParam Cli_SetPlcDateTime Cli_SetPlcSystemDateTime Cli_SetSessionPassword Cli_TMRead Cli_TMWrite Cli_Upload Cli_WaitAsCompletion Cli_WriteArea Cli_WriteMultiVars Par_AsBSend Par_BRecv Par_BSend Par_CheckAsBRecvCompletion Par_CheckAsBSendCompletion Par_Create Par_Destroy Par_ErrorText Par_GetLastError Par_GetParam Par_GetStats Par_GetStatus Par_GetTimes Par_SetParam Par_SetRecvCallback Par_SetSendCallback Par_Start Par_StartTo Par_Stop Par_WaitAsBSendCompletion Srv_ClearEvents Srv_Create Srv_Destroy Srv_ErrorText Srv_EventText Srv_GetMask Srv_GetParam Srv_GetStatus Srv_LockArea Srv_PickEvent Srv_RegisterArea Srv_SetCpuStatus Srv_SetEventsCallback Srv_SetMask Srv_SetParam Srv_SetRWAreaCallback Srv_SetReadEventsCallback Srv_Start Srv_StartTo Srv_Stop Srv_UnlockArea Srv_UnregisterArea

Name

.text

Size

960KB

Virtual Size

960KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

22KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

77KB

Virtual Size

77KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

52KB

Virtual Size

51KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

70KB

Virtual Size

69KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

800B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

e014dadf6d93b312b93e2fc857791c241692da4015da7a24a4d42a946551add2.bin

iphlpapi

kernel32

libmodbus-5

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

libwinpthread-1

shell32

user32

winmm

ws2_32

generic