94369d7dd3dd401aa2d671b4fb76ef789b2eee7f2851f398e586be6eafe1d195[.]zip

Sharing

Copy URL

Twitter E-mail

General

Target

94369d7dd3dd401aa2d671b4fb76ef789b2eee7f2851f398e586be6eafe1d195.zip
Size

51KB
MD5

b927573e3facc546a89ab627196b93a7
SHA1

578a62dd2fb145695cb7cd07abe67fb6e0501fef
SHA256

11f5b60227cc717d4f836fced36a98198cfbd8d9f6e852f99333463c7953589b
SHA512

fdafb3c1245ab07c33fbd0eddf1e63dcabc708207edafe294e0554e9783681e730f27a9c08dd39651e36d0e7a1b1c5a6989669d29fbfdcf21a751c0a7ac610be
SSDEEP

1536:bZcsfT0T6DrHgOYSLtt7gGN3q5UhQFwMOg:NcsfE6X9PD3qx5

Score

1^/10

Malware Config

Signatures

Files

94369d7dd3dd401aa2d671b4fb76ef789b2eee7f2851f398e586be6eafe1d195.zip
.zip

Password: infected
94369d7dd3dd401aa2d671b4fb76ef789b2eee7f2851f398e586be6eafe1d195
.exe windows x86

a4b666adf97a3b4ea9a41a10c56577c7

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

StrCmpNW
StrToIntExW
StrRChrW
StrChrW

ntdll

RtlNtStatusToDosError
_aulldiv
RtlUnwind

kernel32

UnmapViewOfFile
HeapAlloc
InterlockedIncrement
HeapFree
lstrlenW
GetLastError
lstrcpyW
GetModuleHandleW
GetProcessHeap
GetCommandLineA
CreateFileA
DeleteFileW
MultiByteToWideChar
WideCharToMultiByte
GetDriveTypeW
GetLogicalDriveStringsW
QueryPerformanceCounter
QueryDosDeviceW
GetSystemTimeAsFileTime
SetFileAttributesW
GetFileAttributesW
CreateFileMappingW
GetModuleHandleA
WriteFile
GetCurrentThreadId
Sleep
CloseHandle
GetFileSize
GetModuleFileNameW
SetFilePointer
CreateFileW
MapViewOfFile
GetProcAddress
FindFirstFileW
GetCurrentDirectoryW
EnterCriticalSection
InterlockedDecrement
FindClose
ResetEvent
WaitForSingleObject
SetEvent
WaitForMultipleObjects
FindNextFileW
InitializeCriticalSection
DeleteCriticalSection
CreateEventA
CreateThread
LeaveCriticalSection
GetVersionExA
TerminateProcess
SetStdHandle
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
ExitProcess
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
HeapDestroy
HeapCreate
VirtualFree
GetTickCount
GetCurrentProcessId
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringA
LCMapStringW
LoadLibraryA
VirtualAlloc
HeapReAlloc
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
GetConsoleCP
GetConsoleMode
FlushFileBuffers
HeapSize
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetCurrentProcess

Sections

.text
Size: 60KB - Virtual size: 59KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 448B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

a4b666adf97a3b4ea9a41a10c56577c7

Headers

File Characteristics

Imports

shlwapi

ntdll

kernel32

Sections

.text Size: 60KB - Virtual size: 59KB

.rdata Size: 12KB - Virtual size: 8KB

.data Size: 4KB - Virtual size: 12KB

.bss Size: 16KB - Virtual size: 16KB

.rsrc Size: 4KB - Virtual size: 448B

.text
Size: 60KB - Virtual size: 59KB

.rdata
Size: 12KB - Virtual size: 8KB

.data
Size: 4KB - Virtual size: 12KB

.bss
Size: 16KB - Virtual size: 16KB

.rsrc
Size: 4KB - Virtual size: 448B