08467a897695c14e4f4ec7c389de6d2031c54e9c2a7dbbce0b8aaccae3d647c2[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
08467a897695c14e4f4ec7c389de6d2031c54e9c2a7dbbce0b8aaccae3d647c2.zip
Size 352KB
Sample230308-mfvjmafd67
SHA256 bd1f6c94b97c7cefb0d872ba5b3a92ef93f31b7ce65ba4ee2bf10f8a155ac2e4
MD5 45d3dad95ca411f61f4af955c286cba3
SHA1 110d12292ebf70152ebd2770cad7a16c18963411
SHA512 8dcd895bb427f932043149a24c8b5179da1bcc8f10fcbd49d6939750eb2be92727a1374ae40c9d34b200f531703f2ef88499a9200dfaf24826ce8d238becf877
SSDEEP 6144:yD9iIuNs4Hdm3JxGoW2yH/vwSO2K2+KwusBm5C2Z6p3Ikg0V2vl9+TyL5H6H5UtE:YUXeVJhyH1OKwuLgp3IkgcUvpNa+Ht4
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

08467a897695c14e4f4ec7c389de6d2031c54e9c2a7dbbce0b8aaccae3d647c2.zip

.zip 352KB
08467a897695c14e4f4ec7c389de6d2031c54e9c2a7dbbce0b8aaccae3d647c2.zip

.zip 893KB
W00LrSyV20BPznMiaFg.dll

.dll 544.7MB

08467a897695c14e4f4ec7c389de6d2031c54e9c2a7dbbce0b8aaccae3d647c2.zip

SHA256 bd1f6c94b97c7cefb0d872ba5b3a92ef93f31b7ce65ba4ee2bf10f8a155ac2e4
MD5 45d3dad95ca411f61f4af955c286cba3
SHA1 110d12292ebf70152ebd2770cad7a16c18963411
SHA512 8dcd895bb427f932043149a24c8b5179da1bcc8f10fcbd49d6939750eb2be92727a1374ae40c9d34b200f531703f2ef88499a9200dfaf24826ce8d238becf877
SSDEEP 6144:yD9iIuNs4Hdm3JxGoW2yH/vwSO2K2+KwusBm5C2Z6p3Ikg0V2vl9+TyL5H6H5UtE:YUXeVJhyH1OKwuLgp3IkgcUvpNa+Ht4
MD5 SHA1 SHA512 SSDEEP

Password

infected

W00LrSyV20BPznMiaFg.dll

IMPHASH cc3581383698e8ac046128bd4d34bc22
SHA256 2112b5695e7bbe910a6efbab32332027a7fd6384f54c55c6e61a26812ad47e6d
MD5 b51cf179d0ef3cd33c567cca4f007e6f
SHA1 ff336f4006ce1834996062aa78a2b9f7bac394a7
SHA512 f094830e17045bd622e811f952383e27a64bab602a52f7e9a5707803a15cd59a38f0df6ffc27065c49ca87f8f394afa9f7a53666627c456888fff9cf86e3b03e
SSDEEP 24576:nbHoJMjx4c3wcFZSSpyNlcixzNQa0/mofqkU8jG:boJMjyc3w4WzNps
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows x64

Password

infected

Minor OS version

Major OS version

Entry point

4864

Magic Number

523

Subsystem

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

kernel32

AddVectoredExceptionHandler CloseHandle CreateDirectoryA CreateFileA CreateFileW DeleteCriticalSection DeleteFileA EnterCriticalSection ExitProcess FreeEnvironmentStringsW GetACP GetCPInfo GetCurrentProcessId GetCurrentThreadId GetDateFormatA GetEnvironmentStrings GetEnvironmentStringsW GetFileAttributesA GetFileAttributesW GetFileSize GetFileType GetLastError GetLocalTime GetLocaleInfoA GetModuleFileNameA GetModuleHandleA GetOEMCP GetProcAddress GetProcessHeap GetStartupInfoA GetStdHandle GetStringTypeA GetStringTypeW GetSystemDefaultLangID GetSystemInfo GetTickCount GetTimeZoneInformation GetUserDefaultLCID GetVersion GetVersionExA HeapAlloc HeapFree InitializeCriticalSection InitializeCriticalSectionAndSpinCount IsDBCSLeadByteEx IsDebuggerPresent IsValidLocale LCMapStringA LeaveCriticalSection LoadLibraryA LoadLibraryW LocalFileTimeToFileTime MultiByteToWideChar RaiseException ReadFile RemoveDirectoryA RemoveVectoredExceptionHandler RtlCaptureContext SetConsoleCtrlHandler SetEndOfFile SetFilePointer SetFileTime SetHandleCount SetLastError SetThreadLocale Sleep SleepEx SystemTimeToFileTime TlsAlloc TlsFree TlsGetValue TlsSetValue VirtualAlloc VirtualFree VirtualQuery WideCharToMultiByte WriteFile RtlRestoreContext RtlUnwindEx

user32

EnumThreadWindows MessageBoxA wsprintfA

AJnzwdBqMvQICBAjnC APQGYdJtrkXhXkwzKFBCTvI AQuPFhYruxzxA AbBwdZitlWefdERaOavJlIen AbPYWiwTVDHFpfYBJn AfvxTJEA AvxJWNrnX BUERlq Bqptqdk BslfqQGNXqTuUepvauCkQ CNsPbULXjYvkd CXSfiCTm CfdextKrifuW CfsWcZWQVlifNwBDgGRZIqif CgdlGBNRFRzTzmfguqz ClqIyzBkLjDFLJ DCLGmuYl DCQZVUAVgMiARD DEaqEFNRtMCaaVnaAUQtMbKum DIXpgfZZxsBhi DJFaUyIipeGIfwlkpX DVPdiFeTcDmXs DhYIKjxmGGYY DiwnEUvduBkM DllRegisterServer DrgYCMNiVbrUGwRTpRdvxI EEjaFHKntpLIhbdTrDK EdTDhMMiYAFBShyYKs EkMGlO EnsJjCOccyCjAVZkRnVMDMVZ EpwzPNUZHdojuinzfIpfYQ EyuImeQbPHMFKzOFVqc FJAVswpuwGKsMXPsiiQRYv FOWbUDfELrAQAEKqJf FQLPnQNLD FQbFKHXX FWSKyRQMOuWSm FWVdsLrtEVBzLaCmZNEpx FeGqog FkcAXdH FqDNSXzugPznspUD GQAlasmiaEy GQjtxdyXvtsqdfVrQBqm GdiMTODVmsR GxxJJdRIqTBJAMnBIcxq HOnlfLBWkQCooC HWTqOVHRABB IOMcKFaJXihdqDAogVN IpoojIRy IvvQFcaABzyyLhduvbY JFrkuFzJMrWvkaYOQlJ JUBJYfmZGotuEKSafNPlGEAMy JheZxhw JkoaHQBWgZLoeIqdRFVkMlq JlscSxwnKrxRmaJ JpqPCRXJWOy JvcfiztFAuNa KStKTzwWJbprlqO KWLauUGkNHofayeYLCFSpOfuXl KYEVLHhbRMHw KZwwxlBTSHOg KnTTKeu KrldazbljxeAJoh KvQcPVBCIwQMISVMmy KwTVqLAsKCaCz KyLhcvzfifBtOE KzpAtJXTRJRN LDldVNlhAieNMMtCa LXxoKBfNdArZYQncLEi LbGmmSnPyxEOeYshUChQLjrUg LjYfYsPmJSQelB LmWCjcoahmWddnrJDCdVjMCP LsRdEHOPPdahSbSInABkwrMNTG LyVkxcsxNAO MGqpEIkKUqfuIIRGJf MhQzjcZQZGKJujrtxnsjvOac MmEjplkckpWrpOf NIKNvsLIWHCElYtcPVqWMgP NRMKBIH NePIeZGONkQjUvXNTYvpeXYQb NgzABGvEESdUfiZWe NosHdaw NwCuOMJGpb OHaEUpdkkaBsGWFrglzCKs OKeSJkGvyrmApuQLkKPpIqTOSC OXUuTvhY OkETKe OpkiztjhLCVqnzyZAbVwNk PZuIoYMkINUQLlKPlmdF PhpnSepE PmSnkwX PpWgDHAeXILHiCygAcfdxRJbP PqHtVBMURxczujoUKke PsyROYrnfJDpwoGRDaJxAE QPHbrPddtRYCveIyNrsOqVm QPwNYoqkBabxMQwMGzissfXlHv QUkwLPNCmZS QVjMnqKKeFqiftMeC QYBYuVdz QkLLajfyCzZoWjmMbQldzVE QlpPhv QxOcSPqBF QyVUmZZObsTkQXqXuVfJlFfwm RDFzlwKz RdwgWDYqEPKBezGmIkchzgkJ RgXZlcb RhKyShmDIEu RrZLbYnRmLlOBgTNlJvBwJ RuKUQwCvvlVTBu SGGVzpmKSOzmCaZCxrGFJ SfksSUIfdENQGLog SfrUZPkIvHdeahJHdDQcIVOCn SiIsTUGJvWCXYCsvWzks StRbaMQcgaoFqFggirqzxSnXSq TDNrlXdyCZ TIgcLAeEBwATdpbXDAmpAH TJOEoNDMxCzrBbOzwuHQqd TLFJWdWmHRZ ThCGtkkZwxuMjDYELaHlUmqKb TtSFvwemoFmMsVfdYbKeGwwh TwfIxQvQlwnLdvyU UKwiQweYnURb UtUuRYnV WcgTHvUmcWfSzivUFb WsSAfPmGdHtHyUgGGWiQI XVFIYNrPgOSRkjDtJtPeVoA XYbiVVefjYKdkkod XZYSdDSyojdYRSWPzlx XcmMbCtnpxbZvYnaTLJbjH XyYNsSUwyJKaPYIlhGgKHruIC YZRjjKsCGXHRCRAbJt YdkQNRUSJNEYyt ZRFUliCTbEoxaAHUlMEt ZaXMRhn ZglxxBbO ZtPOwyggsjmULkxAh __CPPdebugHook aHqSyyBCczjr aLLJUdCR aPALmAJPUnxqENrTtKT aQqqVVKQnfCQXUzx aYqpVXoiWiQFljpTXB asuILd axBWLoMOyPwrMKQiCQvbaxNJi bEtkbvcRAtSwuBJao bJBiOailghbjXltnxmqfvZB bJkNTIWMTdK bOBZmyiQ bVAnfZEiFwiJcStuMocfe bbxIUdkkMxtIJ bfJyvMjtLvzPAx bsbndIzEdDjKCIRwqZ cNuctyEqWkaRHVokRI cUkHDcmLZZxzyW cbRKXoIDRrnlORpqqKSjHqn cgzJwkNJEqOFpNRKSFBvYp dihuhx dwolhkMuzZhLlDIJtKSAswiBbf egoJLXzT eweZayoaolvwWCnq fEJBMEUixoQKLf fPXvjnsLMhLsdHeYuB fhDJMyKvTjVldTemWuzfZkYGNi fzzuObpfVcsdduHrFJLDp gMAtohygPzzEOfz gZaIjywAcVvXYETDpBc gvxQacFHDhbRFRkPLlZUgxe hDfHTm hFQaUdDIHpqDbH hIIVIsqca hSWMIwkbnjCLRffi hpKIVIMfqgulzOixWN iOFhNHqtmwdUzoOAR iZhkiLLME iadAvSbbVmbSDCJxVvnvI jBjZPBUdbXdbRDXBC jCglBkSSNUyaNxSpdGfYfH jDqCGSKskukTfSy jPsztVHfDUSvwDrYbhwCzSn jXORpeTJxJkWOkjGzmkaU kDVZBp kKjdhXAKDZlTOCqMTgeN kQqXdABvGBzFbXWUMUlntkB kSqwFkyOpHTUryvMZvwiuJMhPd kjIrLoztGBotqEFc knxSTS lIuoCrbQvPFPkmhdUEWBwtSoN lKbHnztSwTlRnMlTcugfGGHYtN lLvcHiTiCksjKsHnzPCIw lXtYCQOVHlGyWcNsEDBdkYH lhjqquNDOVLUeebdqhzXB lumEaWYgu luzEwht lxxlVkfjgaTC mNeoRfND mRWxUaMhcBTRhTDlr mZVRwkIqXuPXlWndwCAj mpLQUkC mvosOqVmtCcjSLSXEvSBXz nAHXpojGOndMX nBLkNEachGpAXQlbfJiInl nTlpZjrWkCLiXNwwAhZpOxk ncmXqHgOebKARTOjkrUw nrCtbLxItjzViyyCvBmr nwCUOYvZpelNktzlFqiJgQcxO oJqZNcjCWtT ofaQOA okDiBHaBnPJXeNRMVWwCH okRDPPCCBRNSGCEiPQOkzrZB pCZoxeLinpeufdWEiDDiiIy pFQhqTXuVdix pymgUCZ qTuAeA qUdQkOn qZdoBugJCUZtRZcdE rmIxqjojFhuFZLXxHiteMuOkVL sNDTiuW slMJaxiCcIThgQA spgLgyzgkQYeto sshbcwqurPCAKMQ szfgevVIcioSohOWrpinUHnfh tJFfrAAcsVHwTDRhAtonI tZcVFZKmQrQhCMkmciFJDUuO tjnixTitrIHuvdTzVlMZySCQ tnaAJa uMNXLG uMXbdxS uRdrnUDf uXmpqanhmvL ujCZbHCZXY vHDfRjlcmgBnKxvgJCTAei vHzzLqLMgeXnooDSttqLgETGzM vUaKcfShuz vcuEhCyMBctZLfs vqSSYUGZkxO wBQkMlcY wfDKSZnAwYvN wfserVKKZPwicQlBVg wiRhtGKiduXVGl wjWEmnMAdSRtxvYx xXMGTlBJRZVlReQpmLElglM xfZyPSfMFRFJoRVZsu xjfncDStWLmzgW xslwsTCXApGTE xuxFPElTWtIFU xxnFTJffTJFAkZ yqnbQfcUHVCkRBtMc yxmCvjLxAkQRVBsxAGNXA zAFYizUk zEZCKKqcxxzbRybKZOVxkhDn zQwXqbHusmB zrVfblTwHHQuPiHmiDfK

Name

.text

Size

309KB

Virtual Size

308KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rodata

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

57KB

Virtual Size

139KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

17KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

26KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.edata

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

175KB

Virtual Size

175KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ