dc659d0624712f8331b4240509896a60eb6277bc26ebf041573de9039610aa91[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
dc659d0624712f8331b4240509896a60eb6277bc26ebf041573de9039610aa91.zip
Size 120KB
Sample221114-gff4cafb48
SHA256 283cbc75ed8f404e2f3e0453f18faf214193844cbfe9ce478c8b8714ad4d1048
MD5 07666da03fe703d3e91345edfe53a9c9
SHA1 c4844d25732c5c9f3b624a86f7d641770c9e9127
SHA512 5aaed87060f549875c16b26963c8749e7821162baf0f4a3b3fa209191d9071ffd4400fe80b468f6ffbcb2ca5df689d196fc722b26267a0fced7b273abd9908fb
SSDEEP 3072:QY70BoYExF9l0quM5CvJ4Qq0xAVa/HFkHMFwLSGIf:Zx3l0qurvqQq0x9/HCHUvf
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

dc659d0624712f8331b4240509896a60eb6277bc26ebf041573de9039610aa91.zip

.zip 120KB
dc659d0624712f8331b4240509896a60eb6277bc26ebf041573de9039610aa91.exe

.exe 189KB

dc659d0624712f8331b4240509896a60eb6277bc26ebf041573de9039610aa91.zip

SHA256 283cbc75ed8f404e2f3e0453f18faf214193844cbfe9ce478c8b8714ad4d1048
MD5 07666da03fe703d3e91345edfe53a9c9
SHA1 c4844d25732c5c9f3b624a86f7d641770c9e9127
SHA512 5aaed87060f549875c16b26963c8749e7821162baf0f4a3b3fa209191d9071ffd4400fe80b468f6ffbcb2ca5df689d196fc722b26267a0fced7b273abd9908fb
SSDEEP 3072:QY70BoYExF9l0quM5CvJ4Qq0xAVa/HFkHMFwLSGIf:Zx3l0qurvqQq0x9/HCHUvf
MD5 SHA1 SHA512 SSDEEP

Password

infected

dc659d0624712f8331b4240509896a60eb6277bc26ebf041573de9039610aa91.exe

IMPHASH c0a133dd98be309680d2bde15e774a17
SHA256 dc659d0624712f8331b4240509896a60eb6277bc26ebf041573de9039610aa91
MD5 c8440437385f5d0018a1b47af689d948
SHA1 88ccafc5f1b5d31e6886f34e1176253267ac80d4
SHA512 86832d9cb60792575166dd64582b44d1758f1433b7de09ecae40b66d923a3cb5220604eab44fee460485bdd10a8922b737c998a5c99cfff17e8683bddcd978a8
SSDEEP 3072:RplB7e7MRzRTrPU39BLGiKMll6rmsH5LIJIp+f5CC3CvcZtsSp:DlB7e7WzR/Ps9pK4l6rmoOIp+xWcZtpp
MD5 SHA1 SHA512 SSDEEP

windows x64

Password

infected

Minor OS version

Major OS version

Entry point

73408

Magic Number

523

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP IMAGE_FILE_NET_RUN_FROM_SWAP

PDB paths

msvcrt

_wtoi wcschr _wcsnicmp _vsnwprintf _vscprintf vsprintf_s vswprintf_s _vscwprintf swscanf_s fgetws memcmp _onexit __dllonexit _unlock _lock ??1type_info@@UEAA@XZ ?terminate@@YAXXZ _commode _fmode _wfopen _initterm __setusermatherr _cexit _exit exit __set_app_type __getmainargs _amsg_exit _XcptFilter _CxxThrowException _callnewh ?what@exception@@UEBAPEBDXZ ??1exception@@UEAA@XZ ??0exception@@QEAA@AEBV0@@Z ??0exception@@QEAA@AEBQEBDH@Z memset _wcsicmp wcscpy_s _beginthreadex wcsstr wcsrchr wcstok_s fclose __C_specific_handler calloc iswctype strrchr _ismbblead memmove_s malloc memcpy_s _purecall _vsnprintf __CxxFrameHandler3 feof _acmdln free towlower memcpy

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter SetLastError SetErrorMode GetLastError UnhandledExceptionFilter RaiseException

api-ms-win-core-synch-l1-1-0

LeaveCriticalSection WaitForSingleObjectEx CreateMutexA OpenEventW SetEvent WaitForMultipleObjectsEx InitializeCriticalSection WaitForSingleObject DeleteCriticalSection CreateMutexW ReleaseMutex CreateEventExW EnterCriticalSection

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-com-l1-1-0

CoInitializeSecurity CoTaskMemFree CoCreateInstance CoRevokeClassObject CLSIDFromString CoRegisterClassObject ProgIDFromCLSID CoUninitialize CoInitializeEx CoRegisterPSClsid

api-ms-win-security-base-l1-1-0

SetSecurityDescriptorOwner SetSecurityDescriptorDacl FreeSid AddAce GetSidLengthRequired InitializeSid GetSidSubAuthority GetSecurityDescriptorOwner IsValidSid CopySid GetAclInformation GetLengthSid AllocateAndInitializeSid GetSecurityDescriptorSacl IsValidSecurityDescriptor AddAccessAllowedAce GetSecurityDescriptorDacl InitializeSecurityDescriptor GetSecurityDescriptorGroup GetSecurityDescriptorControl MakeAbsoluteSD InitializeAcl EqualSid GetTokenInformation SetSecurityDescriptorGroup CheckTokenMembership

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW GetCommandLineW SearchPathW

api-ms-win-core-localization-l1-2-0

SetThreadUILanguage FormatMessageA FormatMessageW

api-ms-win-core-processthreads-l1-1-0

GetCurrentThread OpenThreadToken GetStartupInfoW OpenProcessToken TlsFree GetCurrentProcessId ExitProcess TerminateProcess TlsGetValue GetCurrentThreadId GetCurrentProcess TlsSetValue TlsAlloc

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent DebugBreak OutputDebugStringA OutputDebugStringW

api-ms-win-core-libraryloader-l1-1-0

GetModuleHandleW LoadStringW LoadLibraryExW FreeLibrary LoadResource GetModuleFileNameW FindResourceExW GetModuleHandleExW GetModuleFileNameA GetProcAddress

api-ms-win-core-heap-l1-1-0

HeapSize HeapAlloc HeapFree GetProcessHeap HeapReAlloc HeapDestroy

api-ms-win-core-string-l1-1-0

WideCharToMultiByte MultiByteToWideChar

api-ms-win-core-kernel32-legacy-l1-1-0

CreateFileMappingA

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind RtlCaptureContext RtlLookupFunctionEntry

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetWindowsDirectoryW GetSystemTimeAsFileTime GetTickCount GetVersion GetLocalTime GetVersionExW GetSystemWindowsDirectoryW

oleaut32

SystemTimeToVariantTime VariantTimeToSystemTime CreateErrorInfo SetErrorInfo LoadTypeLi LoadRegTypeLi SysStringLen SysAllocString SysFreeString SysAllocStringLen

api-ms-win-core-file-l1-1-0

FlushFileBuffers WriteFile SetFilePointer CreateFileA DeleteFileA GetTempFileNameW DeleteFileW CreateFileW GetFileSizeEx GetFileSize

api-ms-win-core-heap-obsolete-l1-1-0

LocalFree

api-ms-win-core-memory-l1-1-0

VirtualQuery UnmapViewOfFile CreateFileMappingW MapViewOfFile

api-ms-win-core-io-l1-1-0

DeviceIoControl

ntdll

RtlGetVersion RtlFreeHeap RtlAllocateHeap RtlNtStatusToDosError