3488164[.]iso | Triage

Resubmissions

26/09/2022, 09:05

220926-k2edesabh8 3

Sharing

Copy URL

Twitter E-mail

General

Target

3488164.iso
Size

556KB
MD5

f7d85c971e9604cc6d2a2ffcac1ee4a3
SHA1

67175143196c17f10776bdf5fbf832e50a646824
SHA256

e999890ce5eb5b456563650145308ae837d940e38aec50d2f02670671d472b99
SHA512

71bd76baf1226f74423d942eed2c436e808e1196ac88e17af3262c800b0d1cb1bcc09cb8253de9629160d786cb77224621c4ac4989c264c12dd87c872032aa78
SSDEEP

12288:aROUwJHGYTZhVyYtmNNEw2nSl5rrPZh5MxOKRgEk:akHJHGYPwPEPSlZZh5MxnBk

Score

N/A

Malware Config

Signatures

Files

3488164.iso
.iso
6570872.lnk
.lnk
me/123.com
.exe windows x86

bb17b2fbbff4bbf5ebdca7d0bb9e4a5b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

_XcptFilter
_onexit
__CxxFrameHandler3
__dllonexit
_wcmdln
__set_app_type
_lock
_cexit
?terminate@@YAXXZ
_vsnwprintf
_initterm
__p__fmode
__setusermatherr
__wgetmainargs
__p__commode
_amsg_exit
_except_handler4_common
exit
_unlock
free
_purecall
_controlfp
_wtoi
memcpy_s
_exit
_callnewh
malloc
memset

api-ms-win-core-com-l1-1-0

CoWaitForMultipleHandles
CoReleaseServerProcess
CLSIDFromString
CoUninitialize
CoCreateInstance
CoRegisterClassObject
CoResumeClassObjects
CoInitializeSecurity
CoRevokeClassObject
CoAddRefServerProcess
CoInitializeEx

api-ms-win-core-file-l1-1-0

CreateFileW
GetFileAttributesW
ReadFile
SetFilePointer

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW
GetModuleFileNameA
GetProcAddress
LoadStringW
FreeLibrary
GetModuleHandleW
LoadLibraryExW

api-ms-win-core-wow64-l1-1-1

GetSystemWow64Directory2W
IsWow64Process2

api-ms-win-core-synch-l1-1-0

WaitForSingleObject
OpenSemaphoreW
AcquireSRWLockShared
WaitForSingleObjectEx
AcquireSRWLockExclusive
SetEvent
ReleaseSRWLockShared
CreateSemaphoreExW
ReleaseSemaphore
CreateMutexExW
CreateEventW
ReleaseSRWLockExclusive
ReleaseMutex

api-ms-win-core-heap-l1-1-0

HeapFree
HeapSetInformation
HeapAlloc
GetProcessHeap

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetErrorMode
SetLastError
SetUnhandledExceptionFilter
GetLastError

api-ms-win-core-processenvironment-l1-1-0

SearchPathW
GetCommandLineW

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
ExitProcess
CreateProcessW
GetCurrentProcess
GetStartupInfoW
GetCurrentThreadId
TerminateProcess

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetSystemDirectoryW
GetTickCount

api-ms-win-core-winrt-error-l1-1-0

RoOriginateError
RoOriginateErrorW

api-ms-win-core-processthreads-l1-1-1

SetProcessMitigationPolicy

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-console-l1-2-0

AttachConsole
FreeConsole

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
DebugBreak
IsDebuggerPresent

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-path-l1-1-0

PathCchAppend

api-ms-win-core-console-l1-1-0

WriteConsoleW

api-ms-win-core-string-l1-1-0

CompareStringW
WideCharToMultiByte

api-ms-win-core-synch-l1-2-0

Sleep
WakeAllConditionVariable
SleepConditionVariableSRW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-kernel32-private-l1-1-0

Wow64EnableWow64FsRedirection

api-ms-win-core-sidebyside-l1-1-0

ReleaseActCtx
DeactivateActCtx
CreateActCtxW
QueryActCtxW
ActivateActCtx

api-ms-win-downlevel-shlwapi-l1-1-1

PathIsRelativeW

api-ms-win-downlevel-shlwapi-l2-1-1

SHSetThreadRef

imagehlp

ImageDirectoryEntryToData

ntdll

NtSetInformationToken
NtOpenProcessToken
RtlNtStatusToDosError
NtQueryInformationToken
RtlSetSearchPathMode
NtSetInformationProcess
RtlWow64IsWowGuestMachineSupported
RtlImageNtHeader
NtQuerySystemInformation
NtClose

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

Sections

.text
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 136B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
me/alsoOne.bat
me/canWell.js
.js
me/itsIt.db
.dll regsvr32 windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Exports

Exports

AXMsDQbUbhdpHgumy
DllRegisterServer
DqvdfVJXumSGuxDbQeifDE
GsvFugemhLmFRebByHWZLIlt
IBDFzyzaYYbvLCdANNWobWzkHefitgP
KWwSSdVAwGpuPZJemC
LRZeayHLHiLXcxFjinEZmyaMXWpoF
LcVopTSimzPyMznceIIepGGLs
OkJXHEIxVkZenNREJnYdhtufvRv
OtsltXyqwGKmKSYm
OvzfwfDhXuXhLmzEvnwCNPcfYAodAip
QQASfqqFsaIyuodrOEzmiYhXFBhK
RNsFxmZdRyUXEpddwSgBPDKQPQW
RxfeQKNVUecCmdLsHQAGMbqVDxDAR
SKRXxPrnvmLVjzGDJ
UOGamDxqKzMifBHNcnBjIecgOy
VHPqYBENjtlIcAUDdVEHyQrPsRjrWb
VHYmMulTaXxJkuTCbDpFOCoWjdFipiT
WJkBmOWdIlTJWBXfKCLRluK
YIskifvVtpCHTPVefoogyKpjNpKk
YqnsziMxolCUEpCyF
aHjfpBCMGTOHtAxeJeqvYJiJipIc
btmXEDkzSVQrIekKBbgAyAjFzB
iZwERsKOdaNkDjJUj
ifNYULjNknlPOsikeeFKq
jZTjetqmFfnLpMHfBmKFXSWNjK
kxNmMsXFaSQwVCttBDpieAV
phDeNsVAkciNIDphsSICKbhrF
srJhGTXYGHCFyCLmlYgSpAB
tvMVzGtbiBFVgcrXhUsAKAuKQXi
vowTIpYzkeDnPYtsuRYfGIGg

Sections

.text
Size: 115KB - Virtual size: 115KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 232KB - Virtual size: 231KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
me/or.jpg
.jpg

Resubmissions

Sharing

General

Malware Config

Signatures

Files

bb17b2fbbff4bbf5ebdca7d0bb9e4a5b

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

api-ms-win-core-com-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-wow64-l1-1-1

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-winrt-error-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-localization-l1-2-0

api-ms-win-core-console-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-path-l1-1-0

api-ms-win-core-console-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-string-l2-1-0

api-ms-win-core-kernel32-private-l1-1-0

api-ms-win-core-sidebyside-l1-1-0

api-ms-win-downlevel-shlwapi-l1-1-1

api-ms-win-downlevel-shlwapi-l2-1-1

imagehlp

ntdll

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

api-ms-win-core-apiquery-l1-1-0

Sections

.text Size: 24KB - Virtual size: 24KB

.data Size: 512B - Virtual size: 1KB

.idata Size: 6KB - Virtual size: 5KB

.didat Size: 512B - Virtual size: 136B

.rsrc Size: 26KB - Virtual size: 25KB

.reloc Size: 2KB - Virtual size: 1KB

Headers

DLL Characteristics

File Characteristics

Exports

Exports

Sections

.text Size: 115KB - Virtual size: 115KB

.rdata Size: 1KB - Virtual size: 1KB

.data Size: 232KB - Virtual size: 231KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 512B - Virtual size: 12B

.text
Size: 24KB - Virtual size: 24KB

.data
Size: 512B - Virtual size: 1KB

.idata
Size: 6KB - Virtual size: 5KB

.didat
Size: 512B - Virtual size: 136B

.rsrc
Size: 26KB - Virtual size: 25KB

.reloc
Size: 2KB - Virtual size: 1KB

.text
Size: 115KB - Virtual size: 115KB

.rdata
Size: 1KB - Virtual size: 1KB

.data
Size: 232KB - Virtual size: 231KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 512B - Virtual size: 12B