094cf4376c50843d5bd42b55e9f2a84110057adbf22c61f7a1d3695c3a074fdb[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

094cf4376c50843d5bd42b55e9f2a84110057adbf22c61f7a1d3695c3a074fdb.zip
Size

1.5MB
MD5

8e8e8ca62e6dd4aa0949d4ae2bedd180
SHA1

42df6242aa9e971b7cb05b8391643bee7ad5b339
SHA256

d943a62a38633ac6fa5eb4618a576cb90a8e568108458890766885545867a0e9
SHA512

7f970042a9e5a35dbbc0096281ff31e1fa9bbc7bb61aff6565618441e7668e7dc780b87e51e9e3ee2d61f58f073321d4c265f96d62cf292c4e9788e056cad384
SSDEEP

24576:mRkllO92DDrLy0CFGOfBI0S3iwrikiMGZAGMq1oZ4TnzJTdl0568cZsfi2i:9lOIfrLQLES9kiMGJMq1zToIfZsfri

Score

1^/10

Malware Config

Signatures

Files

094cf4376c50843d5bd42b55e9f2a84110057adbf22c61f7a1d3695c3a074fdb.zip
.zip

Password: threatbook
094cf4376c50843d5bd42b55e9f2a84110057adbf22c61f7a1d3695c3a074fdb
.exe windows x86

Password: threatbook

35542071843e198ed651454a4b2e494c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetFileTime
LocalFileTimeToFileTime
GetCurrentDirectoryW
GetFileAttributesW
lstrlenW
GetACP
ExitProcess
MulDiv
lstrcpynW
InterlockedIncrement
InterlockedDecrement
SetLastError
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
SleepEx
FormatMessageA
FreeLibrary
WaitForMultipleObjects
GetFileType
GetStdHandle
PeekNamedPipe
VerSetConditionMask
LoadLibraryA
GetModuleHandleA
VerifyVersionInfoA
MoveFileW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindFirstFileExW
GetFullPathNameW
SetStdHandle
GetTimeZoneInformation
CreateMutexW
GetUserDefaultLCID
SetFilePointer
FlushFileBuffers
GetConsoleCP
ReadConsoleW
GetConsoleMode
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetDriveTypeW
SetFilePointerEx
FreeLibraryAndExitThread
ExitThread
GetModuleHandleExW
LoadLibraryExW
RtlUnwind
GetStringTypeW
GetLocaleInfoW
LCMapStringW
CompareStringW
GetCPInfo
EncodePointer
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SwitchToThread
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
QueryPerformanceCounter
GetStartupInfoW
IsDebuggerPresent
WaitForSingleObjectEx
ResetEvent
SetEvent
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
FreeResource
IsBadCodePtr
CopyFileW
ExpandEnvironmentStringsA
SetEndOfFile
CreateEventW
EnumSystemLocalesW
FormatMessageW
SetFileAttributesA
WritePrivateProfileStringA
WriteConsoleW
SizeofResource
HeapFree
InitializeCriticalSectionAndSpinCount
OutputDebugStringW
GetTempPathA
OutputDebugStringA
DeleteFileA
GetTickCount
SystemTimeToFileTime
GetCurrentProcessId
GetLocalTime
GetExitCodeProcess
GlobalUnlock
lstrcmpiW
CreateDirectoryA
lstrcpyW
GetFileSize
GlobalLock
SetCurrentDirectoryW
CreateThread
LoadLibraryW
CloseHandle
Process32FirstW
DeleteFileW
GlobalAlloc
lstrcatW
GetSystemDirectoryA
GetCurrentThread
Process32NextW
GetDiskFreeSpaceA
Sleep
CreateToolhelp32Snapshot
OpenProcess
CreateFileW
WaitForSingleObject
FindClose
GetTempPathW
GetEnvironmentVariableW
SetThreadPriority
GetProcessId
GetModuleFileNameW
RemoveDirectoryW
TerminateProcess
GetShortPathNameW
WriteFile
GetCurrentProcess
FindNextFileW
SetPriorityClass
FindFirstFileW
ReadFile
CreateDirectoryW
WideCharToMultiByte
GetComputerNameW
LocalFree
GetSystemDirectoryW
GetVolumeInformationW
GetModuleHandleW
GetProcessHeap
DeleteCriticalSection
GetProcAddress
HeapDestroy
DecodePointer
HeapAlloc
FindResourceW
HeapSize
LoadResource
FindResourceExW
RaiseException
HeapReAlloc
LockResource
GetLastError
MultiByteToWideChar
IsValidLocale
LoadLibraryA
GetProcAddress
GetLastError
FreeLibrary
InitializeCriticalSection
GetModuleFileNameW
GetModuleHandleW
TerminateProcess
GetCurrentProcess
DeleteCriticalSection
LoadLibraryW
CreateEventW
CompareStringW
SetLastError
GetModuleHandleA
VirtualProtect
GetTickCount
EnterCriticalSection
LeaveCriticalSection
VirtualFree
VirtualAlloc
WriteProcessMemory
CreateToolhelp32Snapshot
GetCurrentProcessId
GetCurrentThreadId
Thread32First
OpenThread
Thread32Next
CloseHandle
SuspendThread
ResumeThread
GetSystemInfo
LoadResource
MultiByteToWideChar
WideCharToMultiByte
FindResourceExW
FindResourceExA
GetThreadLocale
GetUserDefaultLCID
GetSystemDefaultLCID
EnumResourceNamesA
EnumResourceNamesW
EnumResourceLanguagesA
EnumResourceLanguagesW
EnumResourceTypesA
EnumResourceTypesW
HeapAlloc
HeapFree
HeapDestroy
HeapCreate
GetSystemTime
GetLocalTime
SystemTimeToFileTime
CompareFileTime
GetCommandLineA
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
LCMapStringA
LCMapStringW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
WriteFile
GetStdHandle
GetModuleFileNameA
RaiseException
Sleep
ExitProcess
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetSystemTimeAsFileTime
HeapReAlloc
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
RtlUnwind
HeapSize
SetFilePointer
GetConsoleCP
GetConsoleMode
InitializeCriticalSectionAndSpinCount
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
FlushFileBuffers
VirtualQuery
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

SetCaretPos
ShowCaret
HideCaret
GetCaretBlinkTime
CreateCaret
TrackPopupMenu
AppendMenuW
EnableMenuItem
DestroyMenu
CreatePopupMenu
SetRect
FillRect
DrawTextW
CharPrevW
GetWindowRgn
ClientToScreen
IsWindowEnabled
UpdateWindow
EqualRect
SetWindowTextW
GetWindowTextW
GetWindowTextLengthW
wsprintfA
DrawTextA
DefWindowProcW
LoadCursorW
GetKeyboardLayout
wsprintfW
CharLowerA
SendMessageW
PostMessageW
PostQuitMessage
UpdateLayeredWindow
SetWindowRgn
GetKeyNameTextW
CreateAcceleratorTableW
SetForegroundWindow
InvalidateRgn
GetGUIThreadInfo
GetCaretPos
GetPropW
CallWindowProcW
SetTimer
MessageBoxW
IsZoomed
MoveWindow
ShowWindow
GetWindowRect
LoadIconW
GetMessageW
TranslateMessage
DispatchMessageW
CreateWindowExW
IsWindow
DestroyWindow
SetWindowPos
IsWindowVisible
IsIconic
CharNextW
SetFocus
GetActiveWindow
GetFocus
GetKeyState
SetCapture
ReleaseCapture
KillTimer
GetDC
ReleaseDC
BeginPaint
EndPaint
GetUpdateRect
InvalidateRect
GetClientRect
GetCursorPos
ScreenToClient
MapWindowPoints
GetSysColor
IntersectRect
UnionRect
OffsetRect
IsRectEmpty
PtInRect
GetWindowLongW
SetWindowLongW
GetParent
GetWindow
LoadImageW
MonitorFromWindow
GetMonitorInfoW
SetCursor
InflateRect
MapVirtualKeyExW
SetPropW
EnableWindow
GetClassInfoExW
RegisterClassExW
RegisterClassW
MessageBoxW
CharUpperBuffW

gdi32

RemoveFontMemResourceEx
AddFontMemResourceEx
GetStockObject
GetDeviceCaps
SelectObject
DeleteDC
CreatePen
CreateFontIndirectW
CreateDIBitmap
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
CloseEnhMetaFile
CreateEnhMetaFileW
GetEnhMetaFileHeader
PlayEnhMetaFile
GetTextMetricsW
GetObjectW
SetWindowOrgEx
CreateRoundRectRgn
CreateRectRgn
PtInRegion
Rectangle
CombineRgn
CreatePenIndirect
CreateRectRgnIndirect
CreateSolidBrush
GetCharABCWidthsW
GetClipBox
GetTextExtentPoint32W
LineTo
SelectClipRgn
ExtSelectClipRgn
SetBkMode
StretchBlt
SetStretchBltMode
SetTextColor
GetObjectA
MoveToEx
TextOutW
GdiFlush
CreatePatternBrush
GetTextExtentPointA
GetBitmapBits
SetBitmapBits
RestoreDC
CreateDIBSection
SaveDC
DeleteObject
SetBkColor

advapi32

RegQueryValueExW
RegCloseKey
LookupAccountNameW
CryptGetHashParam
ConvertSidToStringSidW
CryptEncrypt
CryptImportKey
CryptDestroyKey
CryptAcquireContextA
RegDeleteKeyW
RegEnumKeyExW
RegFlushKey
RegCreateKeyExW
RegSetValueExW
CryptDestroyHash
CryptReleaseContext
RegQueryInfoKeyA
RegQueryValueExA
RegOpenKeyExA
RegEnumKeyExA
OpenProcessToken
GetTokenInformation
CryptAcquireContextW
CryptCreateHash
CryptHashData
RegOpenKeyExW

shell32

SHGetFolderPathA
ShellExecuteExW
SHGetSpecialFolderPathW
ord190
DragQueryFileW
ShellExecuteW
SHGetFolderPathW

ole32

CLSIDFromProgID
CLSIDFromString
CreateStreamOnHGlobal
ReleaseStgMedium
OleLockRunning
DoDragDrop
CoUninitialize
OleDuplicateData
CoCreateInstance
CoCreateGuid
CoInitialize

oleaut32

VariantInit
VariantClear
SysAllocString
SysFreeString

shlwapi

PathRemoveExtensionW
PathFileExistsW
PathFileExistsA

comctl32

InitCommonControlsEx
_TrackMouseEvent
ord17

gdiplus

GdipDrawImageRectI
GdipGetPropertyItem
GdipGetPropertyItemSize
GdipImageSelectActiveFrame
GdipTranslateWorldTransform
GdipRotateWorldTransform
GdipImageGetFrameDimensionsList
GdipImageGetFrameDimensionsCount
GdipGetImageHeight
GdipGetImageWidth
GdipSetStringFormatTrimming
GdipSetStringFormatLineAlign
GdipSetStringFormatAlign
GdipSetStringFormatFlags
GdipCloneStringFormat
GdipDeleteStringFormat
GdipStringFormatGetGenericTypographic
GdipMeasureString
GdipDrawString
GdipDeleteFont
GdipCreateFontFromLogfontA
GdipCreateFontFromDC
GdipFillPath
GdipFillRectangleI
GdipDrawPath
GdipDrawRectangleI
GdipSetInterpolationMode
GdipSetTextRenderingHint
GdipSetSmoothingMode
GdipDeleteGraphics
GdipCreateFromHDC
GdipDisposeImage
GdipCloneImage
GdipLoadImageFromStreamICM
GdipLoadImageFromStream
GdipSetPenMode
GdipDeletePen
GdipCreatePen1
GdipCreateSolidFill
GdipDeleteBrush
GdipCloneBrush
ord1
GdipAddPathLine
GdipDeletePath
GdipCreatePath
GdipFree
GdipAlloc
GdiplusShutdown
GdiplusStartup
GdipImageGetFrameCount

imm32

ImmGetContext
ImmReleaseContext
ImmSetCompositionWindow

wldap32

ord33
ord35
ord79
ord32
ord200
ord301
ord27
ord143
ord30
ord26
ord46
ord211
ord60
ord50
ord41
ord22

ws2_32

WSACreateEvent
ntohl
WSACleanup
gethostbyname
gethostname
WSAGetLastError
__WSAFDIsSet
select
WSASetLastError
recv
send
bind
closesocket
connect
getpeername
getsockname
getsockopt
setsockopt
WSAIoctl
getaddrinfo
freeaddrinfo
accept
listen
ioctlsocket
WSAStartup
inet_addr
WSAEventSelect
socket
ntohs
WSAWaitForMultipleEvents
recvfrom
WSAEnumNetworkEvents
htons
sendto

iphlpapi

GetAdaptersInfo
GetAdaptersAddresses

psapi

EnumDeviceDrivers
GetDeviceDriverBaseNameA

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 295KB - Virtual size: 294KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.nfw0
Size: 862KB - Virtual size: 862KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.nfw1
Size: 61KB - Virtual size: 61KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 61KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 120KB - Virtual size: 119KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: threatbook

Password: threatbook

35542071843e198ed651454a4b2e494c

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

gdiplus

imm32

wldap32

ws2_32

iphlpapi

psapi

Sections

.text Size: 1.2MB - Virtual size: 1.2MB

.rdata Size: 295KB - Virtual size: 294KB

.data Size: 9KB - Virtual size: 15KB

.nfw0 Size: 862KB - Virtual size: 862KB

.nfw1 Size: 61KB - Virtual size: 61KB

.reloc Size: 61KB - Virtual size: 60KB

.rsrc Size: 120KB - Virtual size: 119KB

.text
Size: 1.2MB - Virtual size: 1.2MB

.rdata
Size: 295KB - Virtual size: 294KB

.data
Size: 9KB - Virtual size: 15KB

.nfw0
Size: 862KB - Virtual size: 862KB

.nfw1
Size: 61KB - Virtual size: 61KB

.reloc
Size: 61KB - Virtual size: 60KB

.rsrc
Size: 120KB - Virtual size: 119KB