111[.]zip | Triage

Sharing

Copy URL Twitter E-mail

General

Target

111.zip
Size

57KB
MD5

3c1e99e95b620e06e232c9dbc5f6b965
SHA1

584cbab3c060facfef4b57e759e5f7d99cc5151b
SHA256

e51fe62fb4ce67ef6cd48d61476b45746ddc32c3f877a910e3b97c3e0a92a166
SHA512

4d76c28a50caac3774f795f7702e451cb171992396eac6b05444f0dddc4f2e1634129ab0e1a7cefd64cb5ea7795fea6ff85049c59b5d838f9b325b9ac21e8bb6
SSDEEP

1536:M+TX0yYivkIttytWIq0MVRoVeX69EF7b7sT9s7Nd:MAkItta608mUoSnA9Y

Score

N/A

Malware Config

Signatures

Files

111.zip
.zip
can/disintoxicating.dll
.dll windows x64

f6ebd61dacc0ec5da3dc27008a264683

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

CreateEventW
WaitForSingleObject

shlwapi

StrCmpW
StrNCatW

ole32

CoLockObjectExternal
HGLOBAL_UserMarshal
OleRegEnumFormatEtc
CoResumeClassObjects

Exports

Exports

ATFHLljaeESOtabvodWQnJ
BTAvrZdGsoVHshzcMbqWFtF
DUHdEGJtQkoDpWZOmyhYYohfIowmXuo
EJEXKbUIktXhkfxYaEUzK
EJdkyxPLhzMoSqBjMrqwVxuLdict
ESwbnqHjfkWXUPKFQlXQ
EpdcYIHsUwcqAQMLE
FNGhAvuHjjqcbBgFNzWQxXUxUWwVBPX
IsABNVtSTVTacnfxB
LCdrvbZAMQvCTkpSAYsoHMGOhP
LxgcMcHSqojcYFvFhwbYs
MvkTQsVXctobAaUPylYCEQFkvJHcVO
PkkQjwqBZFPjVZlGLP
QEzLsjKMukuzHEVFqaObIUCawd
RPYADyEYfGSgEkLsDbxq
RYFBYgeKRqSGVwerNWQ
TXVwMMemBfvrbKEUmoKzGG
UGpAaiMziZqOMIQAwdad
XZQHNIYlwyQjfdGjmuZxd
ZpfJVLmyvlGKocOXOahaeJAlJZ
dDhWOTpVVrbDoYLHwLNlUPKuEeT
dZLXLNVQmKTLdDvNZCqxKqIcVZvbuSH
daMXfSaIsxLrxluIYVoJNOcKUV
dbugOkExxpISeqnSxHyQY
eoEvOFhhhLuXxnokPYlwXVUgLR
fqCpPVZvnEmBpycBmjxlnwlr
ftzQXKplsGYbfXLAK
hEUrzIgKrfsygCutLiQLeGa
pOXGrYWWkbDuubalEALNkZZ
qZYDvfkWRZCIESQgONVAZWOUcDM
sILAkvEyhujSUHWLslfbQrw
uElvaszSWVIMbJEXFznbuijElpvQpM
uNcezdEOfpfriYsni
ygasbdjkbsydujhaksdasds
ysRIiviVNuLKQwDWEfacfXahcCulfo

Sections

.text
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 65KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 36B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pxUm
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
can/episode.bat
documents.lnk
.lnk

Sharing

General

Malware Config

Signatures

Files

f6ebd61dacc0ec5da3dc27008a264683

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

shlwapi

ole32

Exports

Exports

Sections

.text Size: 31KB - Virtual size: 31KB

.rdata Size: 65KB - Virtual size: 64KB

.data Size: - Virtual size: 36B

.rsrc Size: 512B - Virtual size: 480B

.pxUm Size: 1024B - Virtual size: 1024B

.text
Size: 31KB - Virtual size: 31KB

.rdata
Size: 65KB - Virtual size: 64KB

.data
Size: - Virtual size: 36B

.rsrc
Size: 512B - Virtual size: 480B

.pxUm
Size: 1024B - Virtual size: 1024B