dcc46d8207d79029bf308c4a4cd99d2202e45d16ec7f95277e15ca9e5d2f3977[.]bin[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
dcc46d8207d79029bf308c4a4cd99d2202e45d16ec7f95277e15ca9e5d2f3977.bin.exe
Size 1.9MB
Sample261110-n58yzsxt8j
SHA256 dcc46d8207d79029bf308c4a4cd99d2202e45d16ec7f95277e15ca9e5d2f3977
MD5 b5cf4c5c5dc8ac0eaf450b3e942a1348
SHA1 d476f663b1701fed8fb20ba294b4459a4b593a87
SHA512 e177ce42041f9ea47d2eff0975515b8bcb53d01ec464638a63bba641528ba952e58e1d5c1ff6410f49eb25207c17d5055575867136a4ec1c22573527aae07ef0
SSDEEP 24576:6MMmIxiB7jtDi272DZ9IGReClIsXx+aJWNsBj6mpYdAUiCggqtLxQQi:6MNzBc26nIGReClvhPOYydAN
TLSH
T1AB958E17A26800EDD0B7C179C9075A07EBB2B4050731AAEB57D09B662F27EE15B7F720
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dcc46d8207d79029bf308c4a4cd99d2202e45d16ec7f95277e15ca9e5d2f3977.bin.exe

File Explorer

dcc46d8207d79029bf308c4a4cd99d2202e45d16ec7f95277e15ca9e5d2f3977.bin.exe

.exe 1.9MB

dcc46d8207d79029bf308c4a4cd99d2202e45d16ec7f95277e15ca9e5d2f3977.bin.exe

IMPHASH 3a1a73eb54b12058ed637911178cc06f
SHA256 dcc46d8207d79029bf308c4a4cd99d2202e45d16ec7f95277e15ca9e5d2f3977
MD5 b5cf4c5c5dc8ac0eaf450b3e942a1348
SHA1 d476f663b1701fed8fb20ba294b4459a4b593a87
SHA512 e177ce42041f9ea47d2eff0975515b8bcb53d01ec464638a63bba641528ba952e58e1d5c1ff6410f49eb25207c17d5055575867136a4ec1c22573527aae07ef0
SSDEEP 24576:6MMmIxiB7jtDi272DZ9IGReClIsXx+aJWNsBj6mpYdAUiCggqtLxQQi:6MNzBc26nIGReClvhPOYydAN
TLSH
T1AB958E17A26800EDD0B7C179C9075A07EBB2B4050731AAEB57D09B662F27EE15B7F720
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1285552

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ole32

CoTaskMemFree IIDFromString CLSIDFromString CoCreateInstance CoSetProxyBlanket CoInitializeEx

oleaut32

SysStringByteLen SysAllocStringByteLen SysFreeString

shell32

ShellExecuteW SHGetFolderPathW SHGetKnownFolderPath

winhttp

WinHttpOpen WinHttpCloseHandle WinHttpConnect WinHttpReadData WinHttpQueryHeaders WinHttpReceiveResponse WinHttpSendRequest WinHttpAddRequestHeaders WinHttpOpenRequest WinHttpSetTimeouts WinHttpQueryDataAvailable

gdiplus

GdipAlloc GdipFree GdiplusStartup GdiplusShutdown GdipCloneImage GdipDisposeImage GdipSaveImageToFile GdipCreateBitmapFromHBITMAP GdipGetImageEncodersSize GdipGetImageEncoders

gdi32

SelectObject GetDeviceCaps EnumFontFamiliesExW DeleteDC CreateCompatibleDC CreateCompatibleBitmap BitBlt DeleteObject

user32

CloseClipboard wsprintfA GetClipboardData CharLowerBuffW GetSystemMetrics GetDC ReleaseDC EnumDisplayDevicesW OpenClipboard

advapi32

ConvertSidToStringSidA QueryServiceConfigW OpenServiceW OpenSCManagerW CloseServiceHandle RegQueryValueExA RegOpenKeyExA RegEnumKeyExA LookupPrivilegeValueA RevertToSelf ImpersonateLoggedOnUser DuplicateTokenEx AdjustTokenPrivileges

kernel32

LoadLibraryExW UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext GetStdHandle TerminateProcess IsProcessorFeaturePresent FreeLibraryAndExitThread GetFileSizeEx ExitThread CreateThread CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetConsoleMode GetUserDefaultLCID EnumSystemLocalesW GetConsoleOutputCP FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader ReadConsoleW GetTimeZoneInformation IsValidCodePage GetACP GetOEMCP GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle WriteConsoleW FormatMessageA GetCommandLineA GetCurrentDirectoryW CreateFileW DeleteFileW GetFileType GetFinalPathNameByHandleW GetVolumeInformationW ReadFile SetFilePointerEx WriteFile GetTempPathW OutputDebugStringA CloseHandle DuplicateHandle SetUnhandledExceptionFilter GetLastError QueryPerformanceCounter QueryPerformanceFrequency WaitForSingleObject Sleep GetCurrentProcess GetCurrentProcessId ExitProcess CreateProcessW OpenProcess GlobalMemoryStatusEx GetSystemInfo GetSystemTime GetSystemTimeAsFileTime GetLocalTime GetTickCount64 GetLogicalProcessorInformation VirtualProtect GetModuleFileNameA GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetModuleHandleExW GetProcAddress LoadResource LockResource SizeofResource FindResourceW LoadLibraryA LoadLibraryW GlobalUnlock GlobalLock LocalFree MoveFileExW GetDynamicTimeZoneInformation MultiByteToWideChar WideCharToMultiByte GetUserDefaultLocaleName CreateToolhelp32Snapshot Process32FirstW Process32NextW FlushFileBuffers GetTickCount MapViewOfFile CreateFileMappingW RtlUnwind FreeLibrary SystemTimeToFileTime GetProcessHeap GetFileSize LockFileEx UnlockFile HeapDestroy HeapCompact HeapAlloc GetNativeSystemInfo HeapReAlloc DeleteFileA WaitForSingleObjectEx CreateFileA FlushViewOfFile OutputDebugStringW GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA FormatMessageW GetTempPathA HeapSize HeapValidate UnmapViewOfFile GetFileAttributesW CreateMutexW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile GetDiskFreeSpaceW GetFullPathNameW HeapFree HeapCreate AreFileApisANSI RaiseException InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection GetCurrentThreadId GetLocaleInfoEx GetExitCodeThread CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileInformationByHandle SetFileInformationByHandle CreateFile2 CopyFile2 GetFileInformationByHandleEx InitializeCriticalSectionEx ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo GetStartupInfoW InitializeSListHead

Name

.text

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

299KB

Virtual Size

298KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

21KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

67KB

Virtual Size

67KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

19KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

dcc46d8207d79029bf308c4a4cd99d2202e45d16ec7f95277e15ca9e5d2f3977.bin.exe

ole32

oleaut32

shell32

winhttp

gdiplus

gdi32

user32

advapi32

kernel32

generic