48689c986eb553e6a7aeba973501b9660cb1418d4ec3ba9d0511f82799d1422c[.]zip

Sharing

Copy URL

Twitter E-mail

General

Target

48689c986eb553e6a7aeba973501b9660cb1418d4ec3ba9d0511f82799d1422c.zip
Size

570KB
MD5

cf82682c4101984695f6bec0b7f11b38
SHA1

0775e154a080b58b9b71778708c19162e2447821
SHA256

90d8071fcbdc74c16258487c86689fa35090169b289233600c3b3dca105a729d
SHA512

be19f6e83887f44ee34a769ef816052ed6af540416a94bf881b636ee88d493bdcb39927cb4b72f86ba7ff1652f5d4fb1ee8b422ef176a79f394ddf601a6ed39a
SSDEEP

12288:VvBN9Eg7u/4xmMXCnVpp8dwDAldGmKh5++2LRejl719Z4JxPrWH5Q7b2:VJvEOF4MXCnPpXclQhb2AjlV4rDWH5wS

Score

1^/10

Malware Config

Signatures

Files

48689c986eb553e6a7aeba973501b9660cb1418d4ec3ba9d0511f82799d1422c.zip
.zip

Password: infected
48689c986eb553e6a7aeba973501b9660cb1418d4ec3ba9d0511f82799d1422c.exe
.exe windows x86

Password: infected

efd88b96a3d1bf9894e7822b198a54f3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrcpynA
InterlockedDecrement
ZombifyActCtx
GetEnvironmentStringsW
SetEvent
GetModuleHandleW
GetWindowsDirectoryA
GetConsoleCP
GetSystemPowerStatus
GetCalendarInfoW
ReadProcessMemory
GetFileAttributesW
AllocConsole
lstrlenW
GetProcAddress
GetProcessHeaps
HeapUnlock
LocalAlloc
HeapLock
GetModuleFileNameA
CreateMutexA
SetFileShortNameA
FindActCtxSectionStringW
CommConfigDialogW
DeleteFileA
GetACP
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCommandLineA
GetStartupInfoA
RaiseException
RtlUnwind
HeapAlloc
GetLastError
HeapFree
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
Sleep
HeapSize
ExitProcess
EnterCriticalSection
LeaveCriticalSection
SetHandleCount
GetStdHandle
GetFileType
DeleteCriticalSection
SetFilePointer
WriteFile
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetConsoleMode
GetCPInfo
GetOEMCP
IsValidCodePage
VirtualAlloc
HeapReAlloc
LoadLibraryA
InitializeCriticalSectionAndSpinCount
CloseHandle
CreateFileA
GetModuleHandleA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
FlushFileBuffers
SetEndOfFile
GetProcessHeap
ReadFile

advapi32

AdjustTokenPrivileges

Sections

.text
Size: 556KB - Virtual size: 556KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 46.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 51KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

efd88b96a3d1bf9894e7822b198a54f3

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

Sections

.text Size: 556KB - Virtual size: 556KB

.rdata Size: 25KB - Virtual size: 25KB

.data Size: 11KB - Virtual size: 46.4MB

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 51KB - Virtual size: 50KB

.text
Size: 556KB - Virtual size: 556KB

.rdata
Size: 25KB - Virtual size: 25KB

.data
Size: 11KB - Virtual size: 46.4MB

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 51KB - Virtual size: 50KB