Desktop[.]zip | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Desktop.zip
Size

154KB
MD5

e8f724a696186cb3ea4599f009e15ec4
SHA1

f7f8275f4ff4d0399bd8a03243fecc93057c9033
SHA256

b35ec472cf79922e41c3a67d9cf8cc1aab767765c499c95f056ce39f1878b5f0
SHA512

8ed9e3edc86b3004cc44c117f0002a55635085f37cc26757144fce735552638ad119ae72d625bf52097c278442cbe500b30e676efb9dd420301cd3c4fdba0eea
SSDEEP

3072:2i7fnEcWJ0Qpn6KQLH9q09L/aLvN4w2GnUrsl2j3F52sIn059:rfnEJnYaLF47mUrs4j3f23na

Score

N/A

Malware Config

Signatures

Files

Desktop.zip
.zip
REF_Scan.lnk
.lnk
armeta.dat
.dll windows x64

88acb35eda01b8669f5b68b19160e655

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

CloseHandle
CreateFileMappingA
DeleteCriticalSection
EnterCriticalSection
GetFileAttributesA
GetFileAttributesExA
GetFullPathNameA
GetLastError
GetLongPathNameA
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GetTempPathA
GetWindowsDirectoryA
InitializeCriticalSection
IsDBCSLeadByteEx
LeaveCriticalSection
LoadLibraryA
MapViewOfFile
MultiByteToWideChar
Sleep
TlsGetValue
UnmapViewOfFile
VirtualProtect
VirtualQuery

msvcrt

___lc_codepage_func
___mb_cur_max_func
__iob_func
_access
_amsg_exit
_assert
_chmod
_close
_errno
_fdopen
_findclose
_findfirst64
_findnext64
_fullpath
_get_osfhandle
_initterm
_lock
_locking
_mbsrchr
_mkdir
_open
_read
_rmdir
_sopen
_stat64
_strdup
_time64
_unlink
_unlock
abort
atoi
calloc
fclose
fflush
free
fwrite
getc
getenv
isalpha
islower
isspace
isupper
isxdigit
_write
localeconv
malloc
memchr
memcmp
memcpy
memmove
memset
perror
qsort
realloc
rand
rename
srand
strcat
strchr
strcmp
strcpy
strerror
strlen
strncat
strncmp
strncpy
strpbrk
strrchr
strstr
strtol
strtoul
tolower
ungetc
vfprintf

Exports

Exports

hcAtomicCreate
hcAtomicDeleteNew
hcAtomicDestroy
hcAtomicLock
hcAtomicNewFile
hcAtomicOrigFile
hcAtomicReplaceOrig
hcAtomicUnlock
hcBlanksAdd
hcBlanksCreate
hcBlanksDestroy
hcBlanksIsMember
hcCacheCopySet
hcCacheCreateTagFile
hcCacheDir
hcCacheNumFont
hcCacheNumSubdir
hcCacheSubdir
hcCharSetAddChar
hcCharSetCopy
hcCharSetCount
hcCharSetCoverage
hcCharSetCreate
hcCharSetDelChar
hcCharSetDestroy
hcCharSetEqual
hcCharSetFirstPage
hcCharSetHasChar
hcCharSetIntersect
hcCharSetIntersectCount
hcCharSetIsSubset
hcCharSetMerge
hcCharSetNew
hcCharSetNextPage
hcCharSetSubtract
hcCharSetSubtractCount
hcCharSetUnion
hcConfigAppFontAddDir
hcConfigAppFontAddFile
hcConfigAppFontClear
hcConfigBuildFonts
hcConfigCreate
hcConfigDestroy
hcConfigEnableHome
hcConfigFileInfoIterGet
hcConfigFileInfoIterInit
hcConfigFileInfoIterNext
hcConfigFilename
hcConfigGetBlanks
hcConfigGetCache
hcConfigGetCacheDirs
hcConfigGetConfigDirs
hcConfigGetConfigFiles
hcConfigGetCurrent
hcConfigGetFilename
hcConfigGetFontDirs
hcConfigGetFonts
hcConfigGetRescanInterval
hcConfigGetRescanInverval
hcConfigGetSysRoot
hcConfigHome
hcConfigParseAndLoad
hcConfigParseAndLoadFromMemory
hcConfigReference
hcConfigSetCurrent
hcConfigSetRescanInterval
hcConfigSetRescanInverval
hcConfigSetSysRoot
hcConfigSubstitute
hcConfigSubstituteWithPat
hcConfigUptoDate
hcDefaultSubstitute
hcDirCacheClean
hcDirCacheCreateUUID
hcDirCacheDeleteUUID
hcDirCacheLoad
hcDirCacheLoadFile
hcDirCacheRead
hcDirCacheRescan
hcDirCacheUnlink
hcDirCacheUnload
hcDirCacheValid
hcDirSave
hcDirScan
hcFileIsDir
hcFileScan
hcFini
hcFontList
hcFontMatch
hcFontRenderPrepare
hcFontSetAdd
hcFontSetCreate
hcFontSetDestroy
hcFontSetList
hcFontSetMatch
hcFontSetPrint
hcFontSetSort
hcFontSetSortDestroy
hcFontSort
hcFreeTypeCharIndex
hcFreeTypeCharSet
hcFreeTypeCharSetAndSpacing
hcFreeTypeQuery
hcFreeTypeQueryAll
hcFreeTypeQueryFace
hcGetDefaultLangs
hcGetLangs
hcGetVersion
hcInit
hcInitBringUptoDate
hcInitLoadConfig
hcInitLoadConfigAndFonts
hcInitReinitialize
hcLangGetCharSet
hcLangNormalize
hcLangSetAdd
hcLangSetCompare
hcLangSetContains
hcLangSetCopy
hcLangSetCreate
hcLangSetDel
hcLangSetDestroy
hcLangSetEqual
hcLangSetGetLangs
hcLangSetHasLang
hcLangSetHash
hcLangSetSubtract
hcLangSetUnion
hcMatrixCopy
hcMatrixEqual
hcMatrixMultiply
hcMatrixRotate
hcMatrixScale
hcMatrixShear
hcNameConstant
hcNameGetConstant
hcNameGetObjectType
hcNameParse
hcNameRegisterConstants
hcNameRegisterObjectTypes
hcNameUnparse
hcNameUnregisterConstants
hcNameUnregisterObjectTypes
hcObjectSetAdd
hcObjectSetBuild
hcObjectSetCreate
hcObjectSetDestroy
hcObjectSetVaBuild
hcPatternAdd
hcPatternAddBool
hcPatternAddCharSet
hcPatternAddDouble
hcPatternAddFTFace
hcPatternAddInteger
hcPatternAddLangSet
hcPatternAddMatrix
hcPatternAddRange
hcPatternAddString
hcPatternAddWeak
hcPatternBuild
hcPatternCreate
hcPatternDel
hcPatternDestroy
hcPatternDuplicate
hcPatternEqual
hcPatternEqualSubset
hcPatternFilter
hcPatternFindIter
hcPatternFormat
hcPatternGet
hcPatternGetBool
hcPatternGetCharSet
hcPatternGetDouble
hcPatternGetFTFace
hcPatternGetInteger
hcPatternGetLangSet
hcPatternGetMatrix
hcPatternGetRange
hcPatternGetString
hcPatternGetWithBinding
hcPatternHash
hcPatternIterEqual
hcPatternIterGetObject
hcPatternIterGetValue
hcPatternIterIsValid
hcPatternIterNext
hcPatternIterStart
hcPatternIterValueCount
hcPatternObjectCount
hcPatternPrint
hcPatternReference
hcPatternRemove
hcPatternVaBuild
hcRangeCopy
hcRangeCreateDouble
hcRangeCreateInteger
hcRangeDestroy
hcRangeGetDouble
hcStrBasename
hcStrBuildFilename
hcStrCmp
hcStrCmpIgnoreCase
hcStrCopy
hcStrCopyFilename
hcStrDirname
hcStrDowncase
hcStrFree
hcStrListCreate
hcStrListDone
hcStrListFirst
hcStrListNext
hcStrPlus
hcStrSetAdd
hcStrSetAddFilename
hcStrSetCreate
hcStrSetDel
hcStrSetDestroy
hcStrSetEqual
hcStrSetMember
hcStrStr
hcStrStrIgnoreCase
hcUcs4ToUtf8
hcUtf16Len
hcUtf16ToUcs4
hcUtf8Len
hcUtf8ToUcs4
hcValueDestroy
hcValueEqual
hcValuePrint
hcValueSave
hcWeightFromOpenType
hcWeightFromOpenTypeDouble
hcWeightToOpenType
init

Sections

.text
Size: 195KB - Virtual size: 194KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 75KB - Virtual size: 75KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 5KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

88acb35eda01b8669f5b68b19160e655

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msvcrt

Exports

Exports

Sections

.text Size: 195KB - Virtual size: 194KB

.data Size: 512B - Virtual size: 256B

.rdata Size: 75KB - Virtual size: 75KB

.pdata Size: 8KB - Virtual size: 7KB

.xdata Size: 8KB - Virtual size: 8KB

.bss Size: - Virtual size: 5KB

.edata Size: 6KB - Virtual size: 6KB

.idata Size: 5KB - Virtual size: 5KB

.CRT Size: 512B - Virtual size: 88B

.tls Size: 512B - Virtual size: 16B

.reloc Size: 16KB - Virtual size: 12KB

.text
Size: 195KB - Virtual size: 194KB

.data
Size: 512B - Virtual size: 256B

.rdata
Size: 75KB - Virtual size: 75KB

.pdata
Size: 8KB - Virtual size: 7KB

.xdata
Size: 8KB - Virtual size: 8KB

.bss
Size: - Virtual size: 5KB

.edata
Size: 6KB - Virtual size: 6KB

.idata
Size: 5KB - Virtual size: 5KB

.CRT
Size: 512B - Virtual size: 88B

.tls
Size: 512B - Virtual size: 16B

.reloc
Size: 16KB - Virtual size: 12KB