176[.]65[.]144[.]144_sample[.]bin

Sharing

Copy URL Twitter E-mail

General

Target
176.65.144.144_sample.bin
Size 1.9MB
Sample261017-t4yphsaw7s
SHA256 38489950659ccb62d430f2805bafa2ad5ae4677770900803a7803bab0a74ff4e
MD5 a09445b8e49e52465126e96edf1b5a8d
SHA1 150991c0322724c77f53fe7f76ef654cbbaec0dc
SHA512 9c57b7d72590578502d0b5e0e75289d15cb597f7575e86a633e0285fdfe6caa810a09ad38ed05710732e1daaabd61dfb774f046456c66ec9cdfda8457505ec59
SSDEEP 24576:IRfqQKFbnTwprZMo9wxGmUGJZ4bkFFJ8dtAGcMVTvHdOmdVIH06iy9FMsYX:IoQKVqrZMoob4bkFJ8oGrVBbIU6isvW
TLSH
T196956D03F69580FCC55EC1788347A632EA22BC8E092576EB27D09B253E76F915F0DB19
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
176.65.144.144_sample.bin

File Explorer

176.65.144.144_sample.bin

.exe 1.9MB

176.65.144.144_sample.bin

IMPHASH cdb284481e0ae3463deb8f461d5e56ac
SHA256 38489950659ccb62d430f2805bafa2ad5ae4677770900803a7803bab0a74ff4e
MD5 a09445b8e49e52465126e96edf1b5a8d
SHA1 150991c0322724c77f53fe7f76ef654cbbaec0dc
SHA512 9c57b7d72590578502d0b5e0e75289d15cb597f7575e86a633e0285fdfe6caa810a09ad38ed05710732e1daaabd61dfb774f046456c66ec9cdfda8457505ec59
SSDEEP 24576:IRfqQKFbnTwprZMo9wxGmUGJZ4bkFFJ8dtAGcMVTvHdOmdVIH06iy9FMsYX:IoQKVqrZMoob4bkFJ8oGrVBbIU6isvW
TLSH
T196956D03F69580FCC55EC1788347A632EA22BC8E092576EB27D09B253E76F915F0DB19
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5136

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

kernel32

CancelIo CancelIoEx CloseHandle CopyFileExW CreateDirectoryW CreateEventW CreateFileW CreateIoCompletionPort CreateProcessW CreateThread CreateWaitableTimerExW DuplicateHandle FindClose FindFirstFileExW FlsAlloc FlsFree FlsSetValue GetCurrentProcess GetCurrentThread GetCurrentThreadId GetExitCodeProcess GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFinalPathNameByHandleW GetFullPathNameW GetLastError GetOverlappedResult GetQueuedCompletionStatusEx InitOnceBeginInitialize InitOnceComplete IsThreadAFiber OpenProcess PostQueuedCompletionStatus ReadFile ReadFileEx SetFileCompletionNotificationModes SetFileInformationByHandle SetFileTime SetHandleInformation SetLastError SetThreadStackGuarantee SetWaitableTimer Sleep SleepEx TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue WaitForMultipleObjects WaitForSingleObject WriteFile WriteFileEx AddVectoredExceptionHandler CompareStringOrdinal CreateFileMappingA CreateToolhelp32Snapshot FormatMessageW FreeEnvironmentStringsW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetEnvironmentStringsW GetEnvironmentVariableW GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetProcAddress GetProcessHeap GetStdHandle GetSystemDirectoryW GetSystemTimePreciseAsFileTime GetWindowsDirectoryW HeapAlloc HeapFree HeapReAlloc MapViewOfFile Module32FirstW Module32NextW MultiByteToWideChar Process32FirstW Process32NextW QueryPerformanceCounter QueryPerformanceFrequency RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind SetConsoleCtrlHandler SetUnhandledExceptionFilter UnmapViewOfFile WriteConsoleW DeleteCriticalSection EnterCriticalSection InitializeCriticalSection LeaveCriticalSection RaiseException RtlUnwindEx VirtualProtect VirtualQuery __C_specific_handler

ntdll

NtCancelIoFileEx NtCreateFile NtDeviceIoControlFile NtOpenFile NtReadFile NtWriteFile RtlNtStatusToDosError NtCreateNamedPipeFile

ws2_32

WSAGetLastError WSAIoctl WSASend WSASocketW WSAStartup bind closesocket connect freeaddrinfo getaddrinfo getpeername getsockname getsockopt ioctlsocket recv send setsockopt shutdown

advapi32

RegCloseKey RegCreateKeyExW RegOpenKeyExW RegQueryValueExW RegSetValueExW SystemFunction036

gdi32

BitBlt CreateCompatibleBitmap CreateCompatibleDC DeleteDC DeleteObject GetDIBits SelectObject

user32

GetDC GetDesktopWindow GetSystemMetrics ReleaseDC

bcrypt

BCryptGenRandom

msvcrt

__getmainargs __initenv __iob_func __set_app_type __setusermatherr _amsg_exit _cexit _commode _fmode _fpreset _initterm _onexit abort calloc exit fprintf free fwrite malloc memcmp memcpy memmove memset signal strlen strncmp vfprintf wcslen

Name

.text

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

528KB

Virtual Size

528KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

38KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

52KB

Virtual Size

51KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

544B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

96B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

176.65.144.144_sample.bin

bcryptprimitives

api-ms-win-core-synch-l1-2-0

kernel32

ntdll

ws2_32

advapi32

gdi32

user32

bcrypt

msvcrt

generic