binkw32[.]dll | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
binkw32.dll
Size 188KB
Sample261027-2vlmlaef68
SHA256 931cb1bc6751b55bdf0e3825ac23f16a373fad3e1342bd812a0b813c2f86769f
MD5 9899a96606efdd1089ab649b7ea9fd70
SHA1 82dfdb8670a103e42991e691ff611bd802e74f05
SHA512 ceb63f0659b30f3da624d1ab4a7736e28a24f7cae77d8aa627fd98db126e332e506b4b15057cc4be013c3ea3175af7f5add3faec22825563e565cabe604bdd44
SSDEEP 3072:3o43bNvJRhVHPuiIEogdlPvmXUYRMvgfqKRYDV2y6ZD8bjOhHcb36lYH7YWc06/p:VbNvJPFWL0lPvmXUYU7DV2y6ZD8bjOh8
TLSH
T1C014AF42F4D65DB0E8CB1EB6009B2B5799241F15C32942E3EB642FD7AA61DE14D3A3C3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
binkw32.dll

File Explorer

binkw32.dll

.dll 188KB

binkw32.dll

IMPHASH 5654872fe1bf46f5b5bfe50e7a2a0fa7
SHA256 931cb1bc6751b55bdf0e3825ac23f16a373fad3e1342bd812a0b813c2f86769f
MD5 9899a96606efdd1089ab649b7ea9fd70
SHA1 82dfdb8670a103e42991e691ff611bd802e74f05
SHA512 ceb63f0659b30f3da624d1ab4a7736e28a24f7cae77d8aa627fd98db126e332e506b4b15057cc4be013c3ea3175af7f5add3faec22825563e565cabe604bdd44
SSDEEP 3072:3o43bNvJRhVHPuiIEogdlPvmXUYRMvgfqKRYDV2y6ZD8bjOhHcb36lYH7YWc06/p:VbNvJPFWL0lPvmXUYU7DV2y6ZD8bjOh8
TLSH
T1C014AF42F4D65DB0E8CB1EB6009B2B5799241F15C32942E3EB642FD7AA61DE14D3A3C3
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6128

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\Devel\projects\bink\build\binkw32.pdb

user32

DestroyWindow GetClassLongA RegisterClassA ChangeDisplaySettingsA IsWindowVisible GetSystemMetrics GetCursorPos DefWindowProcA ReleaseDC PeekMessageA CreateWindowExA UnregisterClassA ShowCursor GetTopWindow GetWindowLongA GetActiveWindow GetWindowThreadProcessId GetWindow EndPaint ClientToScreen MessageBoxA SetCursor ScreenToClient GetWindowRect IsIconic GetClientRect BeginPaint GetDC

gdi32

CreateDIBSection GetDeviceCaps StretchBlt GetDIBits SetPixel DeleteObject SelectObject CreateCompatibleDC CreateCompatibleBitmap SetStretchBltMode GetPixel DeleteDC

kernel32

RtlUnwind HeapReAlloc VirtualAlloc GetCPInfo GetOEMCP GetACP InterlockedExchange UnhandledExceptionFilter GetEnvironmentStringsW GetLastError WideCharToMultiByte FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA VirtualFree VirtualQuery HeapSize LCMapStringA MultiByteToWideChar LCMapStringW GetStringTypeA GetStringTypeW GetCurrentThreadId GetSystemTimeAsFileTime GetLocaleInfoA VirtualProtect WriteFile WaitForSingleObject GetWindowsDirectoryA GetSystemDirectoryA GetModuleFileNameA SetErrorMode FreeLibrary GetProcAddress LoadLibraryA GetModuleHandleA Sleep GetCurrentProcessId QueryPerformanceCounter GetTickCount QueryPerformanceFrequency CreateFileA SetFilePointer ReadFile CloseHandle HeapAlloc HeapFree HeapCreate GetSystemInfo SetEvent CreateEventA SetThreadPriority WaitForMultipleObjects CreateMutexA ReleaseMutex ResumeThread CreateThread HeapDestroy GetStartupInfoA GetFileType GetStdHandle SetHandleCount GetCurrentProcess TerminateProcess ExitProcess GetVersionExA GetCommandLineA

winmm

waveOutPrepareHeader waveOutOpen waveOutUnprepareHeader waveOutSetVolume waveOutReset waveOutRestart waveOutPause waveOutWrite waveOutClose timeGetTime timeBeginPeriod timeEndPeriod

_BinkBufferBlit@12 _BinkBufferCheckWinPos@12 _BinkBufferClear@8 _BinkBufferClose@4 _BinkBufferGetDescription@4 _BinkBufferGetError@0 _BinkBufferLock@4 _BinkBufferOpen@16 _BinkBufferSetDirectDraw@8 _BinkBufferSetHWND@8 _BinkBufferSetOffset@12 _BinkBufferSetResolution@12 _BinkBufferSetScale@12 _BinkBufferUnlock@4 _BinkCheckCursor@20 _BinkClose@4 _BinkCloseTrack@4 _BinkControlBackgroundIO@8 _BinkControlPlatformFeatures@8 _BinkCopyToBuffer@28 _BinkCopyToBufferRect@44 _BinkDDSurfaceType@4 _BinkDX8SurfaceType@4 _BinkDX9SurfaceType@4 _BinkDoFrame@4 _BinkGetError@0 _BinkGetFrameBuffersInfo@8 _BinkGetKeyFrame@12 _BinkGetPalette@4 _BinkGetRealtime@12 _BinkGetRects@8 _BinkGetSummary@8 _BinkGetTrackData@8 _BinkGetTrackID@8 _BinkGetTrackMaxSize@8 _BinkGetTrackType@8 _BinkGoto@12 _BinkIsSoftwareCursor@8 _BinkLogoAddress@0 _BinkNextFrame@4 _BinkOpen@8 _BinkOpenDirectSound@4 _BinkOpenMiles@4 _BinkOpenTrack@8 _BinkOpenWaveOut@4 _BinkPause@8 _BinkRegisterFrameBuffers@8 _BinkRestoreCursor@4 _BinkService@4 _BinkSetError@4 _BinkSetFrameRate@8 _BinkSetIO@4 _BinkSetIOSize@4 _BinkSetMemory@8 _BinkSetMixBinVolumes@20 _BinkSetMixBins@16 _BinkSetPan@12 _BinkSetSimulate@4 _BinkSetSoundOnOff@8 _BinkSetSoundSystem@8 _BinkSetSoundTrack@8 _BinkSetVideoOnOff@8 _BinkSetVolume@12 _BinkShouldSkip@4 _BinkWait@4 _RADTimerRead@0

Name

.text

Size

23KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

BINK

Size

87KB

Virtual Size

86KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

BINKY12

Size

512B

Virtual Size

506B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

BINKY16

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

BINKP8

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

BINK16

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

BINK32

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BINKBSS

Size

21KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

BINKDATA

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

binkw32.dll

user32

gdi32

kernel32

winmm

generic