43f1fd493804d7786d9aedd1ed6af94e88ed0cdda7f0da4bc95856ce295ecb6d[.]zip

Sharing

Copy URL

Twitter E-mail

General

Target

43f1fd493804d7786d9aedd1ed6af94e88ed0cdda7f0da4bc95856ce295ecb6d.zip
Size

5.1MB
MD5

e5fabc567a06fd055323429a999a8f7e
SHA1

f775a89533427d71e1c4a9cc5f8c59e85865fdf8
SHA256

6cbe2e14835533de2b22a2a5df43eb2327bd2c1336f7ef3b7d35e33b6b576d24
SHA512

f8f50da757b82c39fb4eeb44bd2d1b36500f297c7fd931c113be01e6591d3a1edff8d2abe9faea59f245d87f733507fd0a4832d1c6a2ff965a080ab97cf185e4
SSDEEP

98304:VXynCZj6jL3bTEJKln/ovuP+EpBMeOZNcQQKXM3Qq7ST/zCflC+A+v:JyCZab0KFovTuMeODTMrSXC9C+d

Score

1^/10

Malware Config

Signatures

Files

43f1fd493804d7786d9aedd1ed6af94e88ed0cdda7f0da4bc95856ce295ecb6d.zip
.zip

Password: infected
43f1fd493804d7786d9aedd1ed6af94e88ed0cdda7f0da4bc95856ce295ecb6d.exe
.exe windows x64

Password: infected

9b8015e27c54b17330ad03cb7eb324c1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

CloseHandle
FormatMessageA
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetSystemDirectoryA
GetSystemTimeAsFileTime
GetThreadLocale
HeapCreate
InitializeSListHead
IsDebuggerPresent
IsProcessorFeaturePresent
IsWow64Process
LoadLibraryA
QueryPerformanceCounter
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetUnhandledExceptionFilter
Sleep
TerminateProcess
UnhandledExceptionFilter
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress

msvcp140

??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0_Lockit@std@@QEAA@H@Z
??0ios_base@std@@IEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1_Lockit@std@@QEAA@XZ
??1ios_base@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Id_cnt@id@locale@std@@0HA
?_Xlength_error@std@@YAXPEBD@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?good@ios_base@std@@QEBA_NXZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IEAAXPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z

vcruntime140

_CxxThrowException
__C_specific_handler
__CxxFrameHandler3
__current_exception
__current_exception_context
__std_exception_copy
__std_exception_destroy
__std_terminate
memcpy
memmove
memset

api-ms-win-crt-time-l1-1-0

_difftime64
_time64

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func
__p__commode
__stdio_common_vfprintf
__stdio_common_vsprintf
_fseeki64
_get_stream_buffer_pointers
_set_fmode
fclose
fflush
fgetc
fgetpos
fputc
fread
fsetpos
fwrite
setvbuf
ungetc

api-ms-win-crt-runtime-l1-1-0

__p___argc
__p___argv
_c_exit
_cexit
_configure_narrow_argv
_crt_atexit
_errno
_exit
_get_initial_narrow_environment
_initialize_narrow_environment
_initialize_onexit_table
_initterm
_initterm_e
_invalid_parameter_noinfo_noreturn
_register_onexit_function
_register_thread_local_exe_atexit_callback
_seh_filter_exe
_set_app_type
exit
terminate

api-ms-win-crt-filesystem-l1-1-0

_lock_file
_unlock_file

api-ms-win-crt-heap-l1-1-0

_callnewh
_set_new_mode
free
malloc

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-string-l1-1-0

strlen
strncpy

api-ms-win-crt-environment-l1-1-0

getenv

Sections

.text
Size: - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

$^TWEFDC
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.0Dev
Size: - Virtual size: 116KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

$^TWEFDC
Size: - Virtual size: 2.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

$^TWEFDC
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

$^TWEFDC
Size: 5.7MB - Virtual size: 5.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

9b8015e27c54b17330ad03cb7eb324c1

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msvcp140

vcruntime140

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-environment-l1-1-0

Sections

.text Size: - Virtual size: 1.3MB

.data Size: - Virtual size: 7KB

$^TWEFDC Size: - Virtual size: 1KB

.0Dev Size: - Virtual size: 116KB

$^TWEFDC Size: - Virtual size: 2.7MB

$^TWEFDC Size: 2KB - Virtual size: 1KB

$^TWEFDC Size: 5.7MB - Virtual size: 5.7MB

.rsrc Size: 4KB - Virtual size: 4KB

.text
Size: - Virtual size: 1.3MB

.data
Size: - Virtual size: 7KB

$^TWEFDC
Size: - Virtual size: 1KB

.0Dev
Size: - Virtual size: 116KB

$^TWEFDC
Size: - Virtual size: 2.7MB

$^TWEFDC
Size: 2KB - Virtual size: 1KB

$^TWEFDC
Size: 5.7MB - Virtual size: 5.7MB

.rsrc
Size: 4KB - Virtual size: 4KB