pig[.]bin | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
pig.bin
Size 201KB
Sample260926-tp24dsxyev
SHA256 95d1ede9aa3fb775730aeb5512ded8f6a111f753eed7ab33370b26a5bcc6bacc
MD5 6a9853f16187ca0b9262034352432f43
SHA1 13bb6174fc1069f0065dfeae6f2b88d91ff49724
SHA512 8d02b52afd708d31617ddb2748bf5a1e80a27c1cf8d9799eb559fdd09ce7efd0f74818990a25e0536b310fadd0e73dfb151d18d55280b306cfee9be0f3ca06c0
SSDEEP 3072:OepolwptXkVsBdqOqzRlkcVybY+2XQ9avq7hc5IQyQ9KqqnPAW5oiUKj:OepolwphxMRycVlXE4SwRqnIYlj
TLSH
T1A6146C11B7E911FAE2778578C9620902EB337C5647709ADF07900AB69F23BD09E3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
pig.bin

File Explorer

pig.bin

.exe 201KB

pig.bin

IMPHASH 296a2b8b3eded2d74f9ff05fe78bf7f6
SHA256 95d1ede9aa3fb775730aeb5512ded8f6a111f753eed7ab33370b26a5bcc6bacc
MD5 6a9853f16187ca0b9262034352432f43
SHA1 13bb6174fc1069f0065dfeae6f2b88d91ff49724
SHA512 8d02b52afd708d31617ddb2748bf5a1e80a27c1cf8d9799eb559fdd09ce7efd0f74818990a25e0536b310fadd0e73dfb151d18d55280b306cfee9be0f3ca06c0
SSDEEP 3072:OepolwptXkVsBdqOqzRlkcVybY+2XQ9avq7hc5IQyQ9KqqnPAW5oiUKj:OepolwphxMRycVlXE4SwRqnIYlj
TLSH
T1A6146C11B7E911FAE2778578C9620902EB337C5647709ADF07900AB69F23BD09E3E712
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

25856

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

ShowWindow

ntdll

RtlUnwindEx RtlPcToFileHeader NtRaiseHardError RtlAdjustPrivilege RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind

advapi32

CheckTokenMembership GetUserNameW RegSetValueExW RegOpenKeyExW RegCreateKeyExW OpenProcessToken AdjustTokenPrivileges AllocateAndInitializeSid LookupPrivilegeValueW FreeSid RegCloseKey

shell32

SHGetFolderPathW ShellExecuteExW

kernel32

HeapReAlloc GetConsoleOutputCP GetConsoleMode WriteConsoleW LCMapStringW CompareStringW GetEnvironmentVariableW GetConsoleWindow CloseHandle GetLastError WaitForSingleObject GetCurrentProcess CreateProcessW SetFileAttributesW GetModuleFileNameW CopyFileW CreateFileW DeleteVolumeMountPointW FindFirstVolumeW FindNextVolumeW FindVolumeClose FlushFileBuffers GetFileAttributesW GetFileSize ReadFile WriteFile Sleep CreateThread LoadResource LockResource SizeofResource FindResourceW SetFirmwareEnvironmentVariableExW SetVolumeMountPointW FindClose FindFirstFileW FindNextFileW SetFilePointer MoveFileW CreateDirectoryW GetDriveTypeW GetLogicalDrives QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW HeapSize LoadLibraryExW SetFilePointerEx RaiseException SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection GetStdHandle ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW GetProcAddress GetCommandLineA GetCommandLineW IsProcessorFeaturePresent IsDebuggerPresent UnhandledExceptionFilter HeapFree HeapAlloc GetFileType FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetStringTypeW VirtualProtect GetProcessHeap

Name

.text

Size

114KB

Virtual Size

113KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

62KB

Virtual Size

61KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

pig.bin

user32

ntdll

advapi32

shell32

kernel32

generic