sample-2072703-0c533ce909e6e0328cb285d408d9873a[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

sample-2072703-0c533ce909e6e0328cb285d408d9873a.zip
Size

43KB
MD5

7328d953e0419288db7f8398f5e05e6b
SHA1

f3f9fa62f5403699baa16d89f96f69d6ed9fa5d7
SHA256

be4b709df9758b63dab684935ca2754f2c84c4d5def316b41e744c97c6593083
SHA512

46da8152c77905ce98ee89d956e93dd2f5d4db236b2fad444d97d0ccf010679d32fab185252cf79c052f171f1af9a59a2fc84a70a66ae1be5dfeeb9d25ad0381
SSDEEP

768:twf0+kXDSAY+Hcv6PJYVZkMz4l09CTfaiy0+tVAgfUJw9Zd68so9ePY+WL4hiTO:l+kXuARcsICGfVAgfZU8d9eQZL2i6

Score

N/A

Malware Config

Signatures

Files

sample-2072703-0c533ce909e6e0328cb285d408d9873a.zip
.zip

Password: infected
HaNomuEt26
.dll windows x64

Password: infected

6050138199323249bc1f0597cf7cc525

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ntdll

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
NtClose
RtlAdjustPrivilege
NtSetInformationThread
ZwDuplicateToken
NtOpenProcessToken
NtTerminateThread
NtOpenProcess

kernel32

lstrlenA
OpenProcess
TerminateProcess
ReadFile
CreateFileW
Process32FirstW
Process32NextW
lstrcmpiW
CreateToolhelp32Snapshot
LocalFree
GetCurrentProcess
WaitForSingleObject
FindFirstFileW
FindVolumeClose
GetDriveTypeW
GetLogicalDriveStringsW
SetVolumeMountPointW
WriteFile
GlobalAlloc
FindNextVolumeW
GetVolumePathNamesForVolumeNameW
GetFileAttributesW
lstrcmpW
MoveFileW
GlobalFree
FindClose
LocalAlloc
GetExitCodeThread
PostQueuedCompletionStatus
DeviceIoControl
WaitForMultipleObjects
CloseHandle
GetWindowsDirectoryW
FindFirstVolumeW
GetVolumeNameForVolumeMountPointW
ResumeThread
SetFileAttributesW
CreateThread
HeapDestroy
GetComputerNameW
GetLogicalDrives
GetDiskFreeSpaceExW
GetVolumeInformationW
lstrcmpA
SetFilePointerEx
CreateIoCompletionPort
ExitProcess
CreateFileA
VirtualQuery
CreateProcessW
LoadLibraryW
Wow64DisableWow64FsRedirection
Wow64RevertWow64FsRedirection
CreateProcessA
lstrcatA
GetShortPathNameA
GetProcAddress
GetModuleFileNameA
GetCurrentThreadId
lstrcpyA
QueryFullProcessImageNameW
UnhandledExceptionFilter
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
GetSystemTimeAsFileTime
lstrcatW
GetSystemInfo
GlobalMemoryStatusEx
GetLastError
OpenMutexW
lstrlenW
MultiByteToWideChar
GetModuleFileNameW
HeapCreate
Sleep
WideCharToMultiByte
GetProcessHeap
HeapFree
HeapAlloc
GetNativeSystemInfo
CreateMutexW
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetQueuedCompletionStatus
lstrcpyW
SetUnhandledExceptionFilter
FindNextFileW
GetCommandLineW

user32

wsprintfW
GetKeyboardLayoutList
wsprintfA
ExitWindowsEx
GetSystemMetrics
GetForegroundWindow

advapi32

RegOpenKeyExW
RegCreateKeyExW
CryptGenRandom
CryptAcquireContextW
GetUserNameW
FreeSid
SetEntriesInAclW
AllocateAndInitializeSid
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
EnumServicesStatusExW
ControlService
OpenServiceW
OpenSCManagerW
CloseServiceHandle
RegCloseKey
RegSetValueExW
DeleteService
RegQueryValueExW

shell32

ShellExecuteExW
CommandLineToArgvW

ole32

CoUninitialize
CoInitializeSecurity
CoInitializeEx
CoCreateInstance
CoSetProxyBlanket

oleaut32

SysFreeString
VariantInit
VariantClear
SysAllocString

msvcrt

??1type_info@@UEAA@XZ
_XcptFilter
_initterm
_amsg_exit
_onexit
_lock
__dllonexit
_unlock
_CxxThrowException
__CxxFrameHandler3
isdigit
malloc
calloc
free
??2@YAPEAX_K@Z
??3@YAXPEAX@Z
??_V@YAXPEAX@Z
_snwprintf
memmove
_wcsicmp
pow
memcmp
__C_specific_handler

mpr

WNetOpenEnumW
WNetEnumResourceW
WNetCloseEnum

crypt32

CryptStringToBinaryW
CryptBinaryToStringW

shlwapi

StrToIntW
StrStrW
PathFindFileNameW
PathFindExtensionW
PathAddBackslashW
PathRemoveFileSpecW
PathCombineW

rstrtmgr

RmStartSession
RmGetList
RmRegisterResources

Exports

Exports

Rathbuige
ServiceMain
SvchostPushServiceGlobals

Sections

.text
Size: 75KB - Virtual size: 75KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 216B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

6050138199323249bc1f0597cf7cc525

Headers

DLL Characteristics

File Characteristics

Imports

ntdll

kernel32

user32

advapi32

shell32

ole32

oleaut32

msvcrt

mpr

crypt32

shlwapi

rstrtmgr

Exports

Exports

Sections

.text Size: 75KB - Virtual size: 75KB

.rdata Size: 14KB - Virtual size: 14KB

.data Size: 12KB - Virtual size: 16KB

.pdata Size: 3KB - Virtual size: 2KB

.rsrc Size: 512B - Virtual size: 436B

.reloc Size: 512B - Virtual size: 216B

.text
Size: 75KB - Virtual size: 75KB

.rdata
Size: 14KB - Virtual size: 14KB

.data
Size: 12KB - Virtual size: 16KB

.pdata
Size: 3KB - Virtual size: 2KB

.rsrc
Size: 512B - Virtual size: 436B

.reloc
Size: 512B - Virtual size: 216B