6278c5d5f5ae25c76da912cd2d094898ae7c91972cdc8ebac25b7b8ab2bef602[.]bin

Sharing

Copy URL Twitter E-mail

General

Target
6278c5d5f5ae25c76da912cd2d094898ae7c91972cdc8ebac25b7b8ab2bef602.bin
Size 9.7MB
Sample261023-b8dk2abv3n
SHA256 6278c5d5f5ae25c76da912cd2d094898ae7c91972cdc8ebac25b7b8ab2bef602
MD5 9fe0de8543922229d1c736a17458ce6b
SHA1 bdd17a0b6ad9c2f9c50ebc42e777cf7e49765df5
SHA512 1950d387eace4e1bac3c63d00ca1d5a64763ec06269664b0c6b88fb2b2321dd36f1654ab8efbf7138570300098beb9f2532233fbe28a166f4d1f9395b7fb2b04
SSDEEP 98304:QegXEVgFAnXnzHgzyfGU1KnicGbfozYWP:PyEV2KXnzAzyuU1KnicQfc
TLSH
T125A60968C79DD448E221A87CDA352A93CBF03D5C1217EF9794C13D172B77A9C932A9C8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6278c5d5f5ae25c76da912cd2d094898ae7c91972cdc8ebac25b7b8ab2bef602.bin

File Explorer

6278c5d5f5ae25c76da912cd2d094898ae7c91972cdc8ebac25b7b8ab2bef602.bin

.exe 9.7MB

6278c5d5f5ae25c76da912cd2d094898ae7c91972cdc8ebac25b7b8ab2bef602.bin

IMPHASH ff42fb4a46b8bc6d5144c3333b37cf5c
SHA256 6278c5d5f5ae25c76da912cd2d094898ae7c91972cdc8ebac25b7b8ab2bef602
MD5 9fe0de8543922229d1c736a17458ce6b
SHA1 bdd17a0b6ad9c2f9c50ebc42e777cf7e49765df5
SHA512 1950d387eace4e1bac3c63d00ca1d5a64763ec06269664b0c6b88fb2b2321dd36f1654ab8efbf7138570300098beb9f2532233fbe28a166f4d1f9395b7fb2b04
SSDEEP 98304:QegXEVgFAnXnzHgzyfGU1KnicGbfozYWP:PyEV2KXnzAzyuU1KnicQfc
TLSH
T125A60968C79DD448E221A87CDA352A93CBF03D5C1217EF9794C13D172B77A9C932A9C8
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

71392

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

FindResourceW DuplicateHandle SetLastError ReleaseMutex WaitForSingleObject CreateMutexW OpenMutexW CreateEventW OpenEventW Sleep GetCurrentProcess CreateThread CreateRemoteThread GetExitCodeThread FlushInstructionCache OpenProcess GetSystemDirectoryW VirtualAllocEx VirtualProtectEx WriteProcessMemory VirtualFreeEx IsWow64Process GetModuleHandleA GetProcAddress LoadLibraryW QueryFullProcessImageNameA MultiByteToWideChar WideCharToMultiByte CreateToolhelp32Snapshot Process32FirstW Process32NextW Module32FirstW SizeofResource SetEndOfFile WriteConsoleW HeapSize SetStdHandle GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA FindNextFileW FindFirstFileExW FindClose HeapReAlloc GetOEMCP GetACP IsValidCodePage ReadConsoleW SetFilePointerEx ReadFile GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW LockResource LoadResource GetModuleHandleW GetLocalTime DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection GetLastError CloseHandle GetTempPathW WriteFile GetFileSizeEx GetFileAttributesW DeleteFileW CreateFileW Module32NextW CreateDirectoryW RtlUnwind LoadLibraryExW VirtualProtect HeapFree HeapAlloc UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext GetStdHandle GetModuleFileNameW GetModuleHandleExW FreeLibrary TerminateProcess ExitProcess IsProcessorFeaturePresent FlsFree FlsSetValue InitializeCriticalSectionEx EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW SetUnhandledExceptionFilter GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx FlsAlloc FlsGetValue

user32

MessageBoxW TrackMouseEvent GetMessageA TranslateMessage DispatchMessageA SendMessageA DefWindowProcA PostQuitMessage RegisterClassExA CreateWindowExA DestroyWindow ShowWindow SetCapture ReleaseCapture SetTimer KillTimer LoadIconW LoadIconA LoadCursorW SetWindowLongPtrA GetWindowLongPtrA PtInRect FillRect ScreenToClient InvalidateRect SetWindowRgn EndPaint BeginPaint DrawTextA GetSystemMetrics

gdi32

MoveToEx SetTextColor SetBkMode SelectObject SelectClipRgn RoundRect LineTo GetStockObject DeleteObject DeleteDC CreateSolidBrush CreateRoundRectRgn CreatePen CreateFontA CreateCompatibleDC CreateCompatibleBitmap BitBlt

gdiplus

GdiplusShutdown GdipLoadImageFromStream GdipCloneImage GdipDisposeImage GdipAlloc GdipGetImageHeight GdipCreateFromHDC GdipDeleteGraphics GdipSetCompositingMode GdipSetInterpolationMode GdipDrawImageRectRectI GdipFree GdipGetImageWidth GdiplusStartup

shlwapi

ord12

dwmapi

DwmExtendFrameIntoClientArea

msimg32

GradientFill

Name

.text

Size

213KB

Virtual Size

213KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

89KB

Virtual Size

89KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

9.4MB

Virtual Size

9.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

6278c5d5f5ae25c76da912cd2d094898ae7c91972cdc8ebac25b7b8ab2bef602.bin

kernel32

user32

gdi32

gdiplus

shlwapi

dwmapi

msimg32

generic