57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279[.]bin[.]gz

Sharing

Copy URL Twitter E-mail

General

Target
57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279.bin.gz
Size 812KB
Sample261102-m2ltlsg13v
SHA256 cfc13188874868af7dfd5f1fa181008feec5f840cce67779df5e5400320427eb
MD5 2b9aa1362f52059fc1a202e43d0d8426
SHA1 7805f6b042d51fe263b55d17e570f2328b112a38
SHA512 b2d762dd29382c0ea34aa36d1465be3d3ca7e296e52f957e2f8b2887b72d76958de672d0f1b7dfc99a539b640343f000ef5f20d5f96e6c5b88f7ad0d1aed6673
SSDEEP 12288:XD0uinc74RMWh+ACxrUAjPImEHVmu/E/izc00k7IF/1yhCuXNQNPNMo0O8XkVHMU:z0pJ+AYA4wp3E/+c00k7G1yR+iCFohy
TLSH
T1E10533FBA72FD7B43464F429C9604E068BA9FDB8AB451BBF1C4A6263B3254570787C10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279.bin

File Explorer

57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279.bin.gz

.gz 812KB
57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279.bin

.exe 1.6MB

57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279.bin.gz

SHA256 cfc13188874868af7dfd5f1fa181008feec5f840cce67779df5e5400320427eb
MD5 2b9aa1362f52059fc1a202e43d0d8426
SHA1 7805f6b042d51fe263b55d17e570f2328b112a38
SHA512 b2d762dd29382c0ea34aa36d1465be3d3ca7e296e52f957e2f8b2887b72d76958de672d0f1b7dfc99a539b640343f000ef5f20d5f96e6c5b88f7ad0d1aed6673
SSDEEP 12288:XD0uinc74RMWh+ACxrUAjPImEHVmu/E/izc00k7IF/1yhCuXNQNPNMo0O8XkVHMU:z0pJ+AYA4wp3E/+c00k7G1yR+iCFohy
TLSH
T1E10533FBA72FD7B43464F429C9604E068BA9FDB8AB451BBF1C4A6263B3254570787C10
MD5 SHA1 SHA512 SSDEEP TLSH

57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279.bin

IMPHASH cf24a9f04db99e5f2c86bff87690bc8f
SHA256 57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279
MD5 4632e6d7c4ea43050d5b57b2106c9f3d
SHA1 072863bda727c6859004d8324c20cbfb9ff816cf
SHA512 a5b3097e0efbbe613a507ee6d283b5d44b73e855ef346dc7fb0c181e060b75228e42ed274403552c3f5949da0351d81911ee3208c123facff7a28164b9a59492
SSDEEP 49152:n7uzkYJ0/19xRjx+upZOCmITTCTI0iy0A:GKt9DRZb
TLSH
T1FF755B47E5A250EDC41AC2B1930BA232B575B4054A34BDEF52A0CF612FA2FD05F7DB68
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4096

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

bcrypt

BCryptCloseAlgorithmProvider BCryptDecrypt BCryptDeriveKeyPBKDF2 BCryptDestroyKey BCryptEncrypt BCryptGenerateSymmetricKey BCryptHash BCryptOpenAlgorithmProvider BCryptSetProperty

crypt32

CryptUnprotectData

ncrypt

NCryptDecrypt NCryptFreeObject NCryptOpenKey NCryptOpenStorageProvider

ole32

CoCreateGuid CoCreateInstance CoInitializeEx CoSetProxyBlanket CoUninitialize CreateStreamOnHGlobal GetHGlobalFromStream

oleaut32

SysAllocString VariantClear VariantInit

advapi32

AdjustTokenPrivileges AllocateAndInitializeSid CheckTokenMembership CryptAcquireContextW CryptGenRandom CryptReleaseContext DuplicateTokenEx FreeSid GetUserNameA ImpersonateLoggedOnUser LookupPrivilegeValueA OpenProcessToken RegCloseKey RegEnumKeyExA RegEnumValueA RegGetValueA RegOpenKeyExA RegOpenKeyExW RegQueryInfoKeyA RegQueryValueExA RegQueryValueExW RevertToSelf

shell32

SHFileOperationW

gdi32

BitBlt CreateCompatibleBitmap CreateCompatibleDC DeleteDC DeleteObject SelectObject

gdiplus

GdipAlloc GdipCloneBrush GdipCloneImage GdipCreateBitmapFromHBITMAP GdipCreateFont GdipCreateFontFamilyFromName GdipCreateSolidFill GdipDeleteBrush GdipDeleteFont GdipDeleteFontFamily GdipDeleteGraphics GdipDisposeImage GdipDrawString GdipFillRectangle GdipFree GdipGetImageEncoders GdipGetImageEncodersSize GdipGetImageGraphicsContext GdipMeasureString GdipSaveImageToStream GdiplusShutdown GdiplusStartup

winhttp

WinHttpAddRequestHeaders WinHttpCloseHandle WinHttpConnect WinHttpOpen WinHttpOpenRequest WinHttpQueryHeaders WinHttpReadData WinHttpReceiveResponse WinHttpSendRequest WinHttpSetOption WinHttpSetTimeouts

wlanapi

WlanCloseHandle WlanEnumInterfaces WlanFreeMemory WlanGetNetworkBssList WlanGetProfile WlanGetProfileList WlanOpenHandle

rstrtmgr

RmEndSession RmGetList RmRegisterResources RmStartSession

secur32

GetUserNameExW

kernel32

AreFileApisANSI CloseHandle CopyFileW CreateDirectoryA CreateEventW CreateFileA CreateFileMappingW CreateFileW CreateMutexA CreateMutexW CreateProcessW CreateThread CreateToolhelp32Snapshot DeleteCriticalSection DeleteFileA DeleteFileW EnterCriticalSection ExitProcess ExpandEnvironmentStringsA FileTimeToSystemTime FindClose FindFirstFileA FindFirstFileW FindNextFileA FindNextFileW FlushFileBuffers FlushInstructionCache FlushViewOfFile FormatMessageA FormatMessageW FreeLibrary GetComputerNameA GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetDiskFreeSpaceA GetDiskFreeSpaceW GetFileAttributesA GetFileAttributesExW GetFileAttributesW GetFileSize GetFileSizeEx GetFullPathNameA GetFullPathNameW GetLastError GetLocaleInfoA GetLogicalDriveStringsW GetModuleFileNameA GetModuleHandleA GetModuleHandleW GetProcAddress GetProcessHeap GetStartupInfoA GetSystemInfo GetSystemTime GetSystemTimeAsFileTime GetTempPathA GetTempPathW GetTickCount GetTickCount64 GetTimeZoneInformation GetVolumeInformationA GlobalLock GlobalMemoryStatusEx GlobalSize GlobalUnlock HeapAlloc HeapCompact HeapCreate HeapDestroy HeapFree HeapReAlloc HeapSize HeapValidate InitializeCriticalSection IsDBCSLeadByte LeaveCriticalSection LoadLibraryA LoadLibraryW LocalFree LockFile LockFileEx MapViewOfFile MultiByteToWideChar OpenProcess OpenThread OutputDebugStringA OutputDebugStringW Process32FirstW Process32NextW QueryDosDeviceW QueryFullProcessImageNameW QueryPerformanceCounter QueueUserAPC ReadFile ReadProcessMemory ResumeThread SetEndOfFile SetErrorMode SetEvent SetFilePointer SetUnhandledExceptionFilter Sleep SystemTimeToFileTime TerminateProcess TlsGetValue TryEnterCriticalSection UnlockFile UnlockFileEx UnmapViewOfFile VirtualAllocEx VirtualFreeEx VirtualProtect VirtualProtectEx VirtualQuery WaitForMultipleObjects WaitForSingleObject WaitForSingleObjectEx WideCharToMultiByte WriteFile WriteProcessMemory

user32

CloseClipboard DrawIconEx GetClipboardData GetCursorInfo GetDC GetIconInfo GetSystemMetrics OpenClipboard ReleaseDC

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf __stdio_common_vsprintf __stdio_common_vsscanf __stdio_common_vswprintf fflush fputc fwrite setvbuf

api-ms-win-crt-string-l1-1-0

_strdup _stricmp _strlwr _wcsicmp _wcslwr _wcsnicmp isalnum isalpha islower isspace isupper isxdigit memset strcat strcmp strcspn strlen strncat strncmp strncpy strnlen strspn strtok_s tolower toupper towlower wcscmp wcscpy wcslen wcsncpy

api-ms-win-crt-convert-l1-1-0

_strtoi64 atof atoi atol strtol strtoul

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv __p__acmdln _beginthreadex _cexit _configure_narrow_argv _crt_atexit _endthreadex _exit _initialize_narrow_environment _initterm _initterm_e _seh_filter_exe _set_app_type _set_invalid_parameter_handler abort exit

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-utility-l1-1-0

bsearch qsort rand srand

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc realloc

api-ms-win-crt-environment-l1-1-0

__p__environ getenv

api-ms-win-crt-private-l1-1-0

memchr memcmp memcpy memmove strchr strrchr strstr wcschr wcsrchr wcsstr

api-ms-win-crt-time-l1-1-0

_localtime64 _mktime64 _time64

api-ms-win-crt-math-l1-1-0

__setusermatherr

Name

.text

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

238KB

Virtual Size

238KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

15KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

23KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279.bin.gz

57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279.bin

bcrypt

crypt32

ncrypt

ole32

oleaut32

advapi32

shell32

gdi32

gdiplus

winhttp

wlanapi

rstrtmgr

secur32

kernel32

user32

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-math-l1-1-0

generic