f82e7de003c78492b0bf89cafb8319092a6da8355159679b8874b02a66cc1748[.]bin[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
f82e7de003c78492b0bf89cafb8319092a6da8355159679b8874b02a66cc1748.bin.exe
Size 1.9MB
Sample261110-n58yzsxt7q
SHA256 f82e7de003c78492b0bf89cafb8319092a6da8355159679b8874b02a66cc1748
MD5 b8bb71414f9e43f782d2ff16f7c22119
SHA1 35a58b316676c1a87d002b00468300969191fba8
SHA512 1d68be06a870ac0c7a8e6d108a12dc0426c3e8764eddc896e0bcdd2ffb582c8b5ccebb038505540c4e0c07a94fca9e861ea18b714033d7a01233fee4b037b9b7
SSDEEP 49152:X/LindvsJDce5zaObGY4NrQ1T0RkYTRwQ:X/enR4Dce5p0RkYTRwQ
TLSH
T185952943E1A718ECC9939774429BA337B731FC648939AF7B8654C6311D13ED06A2EB24
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f82e7de003c78492b0bf89cafb8319092a6da8355159679b8874b02a66cc1748.bin.exe

File Explorer

f82e7de003c78492b0bf89cafb8319092a6da8355159679b8874b02a66cc1748.bin.exe

.exe 1.9MB

f82e7de003c78492b0bf89cafb8319092a6da8355159679b8874b02a66cc1748.bin.exe

IMPHASH e75403efee2245ef54f3d137621051f7
SHA256 f82e7de003c78492b0bf89cafb8319092a6da8355159679b8874b02a66cc1748
MD5 b8bb71414f9e43f782d2ff16f7c22119
SHA1 35a58b316676c1a87d002b00468300969191fba8
SHA512 1d68be06a870ac0c7a8e6d108a12dc0426c3e8764eddc896e0bcdd2ffb582c8b5ccebb038505540c4e0c07a94fca9e861ea18b714033d7a01233fee4b037b9b7
SSDEEP 49152:X/LindvsJDce5zaObGY4NrQ1T0RkYTRwQ:X/enR4Dce5p0RkYTRwQ
TLSH
T185952943E1A718ECC9939774429BA337B731FC648939AF7B8654C6311D13ED06A2EB24
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5248

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

AdjustTokenPrivileges DuplicateTokenEx GetUserNameA LookupPrivilegeValueA OpenProcessToken OpenThreadToken RegCloseKey RegEnumValueA RegOpenKeyExA RegQueryValueExA SetThreadToken

bcrypt

BCryptCloseAlgorithmProvider BCryptCreateHash BCryptDecrypt BCryptDestroyHash BCryptDestroyKey BCryptFinishHash BCryptGenerateSymmetricKey BCryptHashData BCryptOpenAlgorithmProvider BCryptSetProperty

crypt32

CryptStringToBinaryA CryptUnprotectData

gdi32

BitBlt CreateCompatibleBitmap CreateCompatibleDC DeleteDC DeleteObject GetDIBits SelectObject

kernel32

AreFileApisANSI CloseHandle CopyFileA CreateDirectoryA CreateEventW CreateFileA CreateFileMappingW CreateFileW CreateMutexW CreateToolhelp32Snapshot DeleteCriticalSection DeleteFileA DeleteFileW EnterCriticalSection FindClose FindFirstFileA FindNextFileA FlushFileBuffers FlushViewOfFile FormatMessageA FormatMessageW GetComputerNameA GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDiskFreeSpaceA GetDiskFreeSpaceExA GetDiskFreeSpaceW GetEnvironmentVariableA GetFileAttributesA GetFileAttributesExW GetFileAttributesW GetFileSize GetFullPathNameA GetFullPathNameW GetLastError GetModuleHandleA GetProcAddress GetProcessHeap GetSystemInfo GetSystemTime GetSystemTimeAsFileTime GetTempPathA GetTempPathW GetTickCount GlobalFree GlobalMemoryStatusEx HeapAlloc HeapCompact HeapCreate HeapDestroy HeapFree HeapReAlloc HeapSize HeapValidate InitializeCriticalSection IsProcessorFeaturePresent LeaveCriticalSection LocalFree LockFile LockFileEx MapViewOfFile MultiByteToWideChar OpenProcess OutputDebugStringA OutputDebugStringW Process32FirstW Process32NextW QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadFile RemoveDirectoryA RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetEndOfFile SetEvent SetFileAttributesA SetFilePointer SetUnhandledExceptionFilter Sleep SystemTimeToFileTime TerminateProcess UnlockFile UnlockFileEx UnmapViewOfFile VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WaitForSingleObjectEx WideCharToMultiByte WriteFile

api-ms-win-crt-convert-l1-1-0

mbrtowc strtoul wcrtomb

api-ms-win-crt-environment-l1-1-0

__p__environ getenv

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc realloc

api-ms-win-crt-locale-l1-1-0

_configthreadlocale localeconv

api-ms-win-crt-math-l1-1-0

__setusermatherr frexp

api-ms-win-crt-private-l1-1-0

memchr memcmp memcpy memmove strchr strrchr

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv _assert _cexit _configure_narrow_argv _crt_atexit _errno _exit _initialize_narrow_environment _seh_filter_exe _initterm _initterm_e _set_app_type _set_invalid_parameter_handler abort exit strerror

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf _read _write fclose fflush fopen fputc fputs fwrite setvbuf

api-ms-win-crt-string-l1-1-0

_stricmp _wcsicmp memset strcmp strcspn strlen strncmp strnlen strspn tolower wcslen wcsnlen

api-ms-win-crt-time-l1-1-0

_localtime64

api-ms-win-crt-utility-l1-1-0

rand_s

ncrypt

NCryptDecrypt NCryptFreeObject NCryptOpenKey NCryptOpenStorageProvider

shell32

SHGetFolderPathA

user32

EnumWindows GetDC GetSystemMetrics GetWindowThreadProcessId PostMessageA ReleaseDC

winhttp

WinHttpCloseHandle WinHttpConnect WinHttpCrackUrl WinHttpOpen WinHttpOpenRequest WinHttpQueryDataAvailable WinHttpQueryHeaders WinHttpQueryOption WinHttpReadData WinHttpReceiveResponse WinHttpSendRequest WinHttpSetOption

Name

.text

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

14KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

106KB

Virtual Size

106KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

32KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

37KB

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

f82e7de003c78492b0bf89cafb8319092a6da8355159679b8874b02a66cc1748.bin.exe

advapi32

bcrypt

crypt32

gdi32

kernel32

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

ncrypt

shell32

user32

winhttp

generic