stage2[.]bin | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
stage2.bin
Size 977KB
Sample260930-x755jsx1ds
SHA256 1890573e374d43a23715a97efdc48152830184d9075161d092b4c382d57c579c
MD5 36a59bc498981613f7a087b540038dc6
SHA1 5812bf099252452c9f56c18eb3f6815911329f4d
SHA512 6b07920c8ddf5eb5d8babfd8e67e50598011a39e67abe4a4c82cb8123405b0043e6fe056076652ee286fb2a9757317a7e7f2669c4270f10ebd588d6372b38ab3
SSDEEP 24576:GFpuOGN8dd1V3W+bUbxX7ZEQjEtGndB7RlXR:Ep0+dLTk6QbB75
TLSH
T13C251A045A4311B1D7ECCABDDB20746ED320E82A95FC07DBA17D89DEDE6E09444EE287
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
stage2.bin

File Explorer

stage2.bin

.exe 977KB

stage2.bin

IMPHASH 3093d2fb25c1258f676889504b26267d
SHA256 1890573e374d43a23715a97efdc48152830184d9075161d092b4c382d57c579c
MD5 36a59bc498981613f7a087b540038dc6
SHA1 5812bf099252452c9f56c18eb3f6815911329f4d
SHA512 6b07920c8ddf5eb5d8babfd8e67e50598011a39e67abe4a4c82cb8123405b0043e6fe056076652ee286fb2a9757317a7e7f2669c4270f10ebd588d6372b38ab3
SSDEEP 24576:GFpuOGN8dd1V3W+bUbxX7ZEQjEtGndB7RlXR:Ep0+dLTk6QbB75
TLSH
T13C251A045A4311B1D7ECCABDDB20746ED320E82A95FC07DBA17D89DEDE6E09444EE287
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

68400

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

laded.pdb

kernel32

CloseHandle CompareStringW CreateFileW DeleteCriticalSection EncodePointer EnterCriticalSection ExitProcess FindClose FindFirstFileExW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FormatMessageW FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetEnvironmentStringsW GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFileType GetFullPathNameW GetLastError GetLogicalDriveStringsW GetLogicalDrives GetModuleFileNameW GetModuleHandleExW GetModuleHandleW GetOEMCP GetProcAddress GetProcessHeap GetProcessHeaps GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDefaultUILanguage GetSystemInfo GetSystemTimeAsFileTime GetThreadLocale GetUserDefaultLangID GetVersion HeapAlloc HeapFree HeapReAlloc HeapSize InitializeCriticalSectionEx InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage LCMapStringW LeaveCriticalSection LoadLibraryA LoadLibraryExW MultiByteToWideChar QueryPerformanceCounter RaiseException RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwindEx RtlVirtualUnwind SetEnvironmentVariableW SetFileInformationByHandle SetFilePointerEx SetFileTime SetLastError SetStdHandle SetUnhandledExceptionFilter TerminateProcess UnhandledExceptionFilter VirtualProtect WaitForSingleObject WideCharToMultiByte WriteConsoleW WriteFile

user32

DrawTextW EndPaint FillRect GetActiveWindow GetCaretBlinkTime GetFocus GetForegroundWindow GetMessageExtraInfo GetSysColor GetSystemMetrics InvalidateRect UpdateWindow

gdi32

TextOutW

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

ntdll

NtReadFile NtWriteFile

Name

.text

Size

124KB

Virtual Size

123KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

561KB

Virtual Size

561KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

217B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

273KB

Virtual Size

273KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

stage2.bin

kernel32

user32

gdi32

api-ms-win-core-synch-l1-2-0

ntdll

generic