54f32e3f2e544455d68d50a45a4e36e1cf5048885179dd23647136a2526eb7b4[.]zip

General

Target

54f32e3f2e544455d68d50a45a4e36e1cf5048885179dd23647136a2526eb7b4.zip
Size

520KB
MD5

0f8ca282cc1e7459a9e2c6915e80b88b
SHA1

5e05b98c1c7fa8237828b867ace2beebddbda6ea
SHA256

a922de350229c9d7e2c06be30e12bfa25b1d22a3a03e3414ffdea32c4c392ce8
SHA512

efcf1c0d2a9d93362de83ce897f5ef3aa4066d9087b30b92247cb0f004263b98470465ef33ebfaafeb79b48c9498f0c453b295b84127c81313fa47d1cd76c5e9
SSDEEP

12288:ozcKgrOCmjCVEnvJOZ1eNEowGxI8jZwT8FB6AYTHySmS:laO2nvsZ1ewAuTSQAYTSHS

Score

N/A

Malware Config

Signatures

Files

54f32e3f2e544455d68d50a45a4e36e1cf5048885179dd23647136a2526eb7b4.zip
.zip

Password: infected
54f32e3f2e544455d68d50a45a4e36e1cf5048885179dd23647136a2526eb7b4_dump_0x00370000
.exe windows x86

Password: infected

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 332KB - Virtual size: 332KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 87KB - Virtual size: 86KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
54f32e3f2e544455d68d50a45a4e36e1cf5048885179dd23647136a2526eb7b4_unpacked
.exe windows x86

Password: infected

4734b1ec93da5689fdfe3f845e91ef9f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

HeapAlloc
HeapReAlloc
HeapFree
VirtualAlloc
EncodePointer
SetEnvironmentVariableA
FlushInstructionCache
GetProcessHeap
UnhandledExceptionFilter
ExitProcess
ReadProcessMemory
GetSystemInfo
GetCurrentProcess
GetProcAddress
Sleep
GetModuleHandleA
TerminateProcess
RtlUnwind
SetUnhandledExceptionFilter

advapi32

CryptHashData
CryptCreateHash
CryptReleaseContext
CryptDestroyHash
CryptAcquireContextW
CryptGetHashParam

msvcrt

strlen
memset

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 248KB - Virtual size: 248KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 440B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.bound2
Size: 512B - Virtual size: 337B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

Headers

DLL Characteristics

File Characteristics

Sections

.text Size: 332KB - Virtual size: 332KB

.rdata Size: 87KB - Virtual size: 86KB

.data Size: 1KB - Virtual size: 17KB

.reloc Size: 22KB - Virtual size: 22KB

Password: infected

4734b1ec93da5689fdfe3f845e91ef9f

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

msvcrt

Sections

.text Size: 7KB - Virtual size: 6KB

.rdata Size: 1KB - Virtual size: 1KB

.data Size: 248KB - Virtual size: 248KB

.reloc Size: 512B - Virtual size: 440B

.bound2 Size: 512B - Virtual size: 337B

.text
Size: 332KB - Virtual size: 332KB

.rdata
Size: 87KB - Virtual size: 86KB

.data
Size: 1KB - Virtual size: 17KB

.reloc
Size: 22KB - Virtual size: 22KB

.text
Size: 7KB - Virtual size: 6KB

.rdata
Size: 1KB - Virtual size: 1KB

.data
Size: 248KB - Virtual size: 248KB

.reloc
Size: 512B - Virtual size: 440B

.bound2
Size: 512B - Virtual size: 337B