0cf36731f5b8651d53fc651607c3fccac24b631c08dca4493d8e07d2fbff1db3[.]zip

Sharing

Copy URL

Twitter E-mail

General

Target

0cf36731f5b8651d53fc651607c3fccac24b631c08dca4493d8e07d2fbff1db3.zip
Size

66KB
MD5

cb3303dd1a4616b0b63e352aa1b15b8b
SHA1

6958ee2a38f70ab36cc7178d019d85ffc90761e1
SHA256

c37587ff49bdaa6f13cddab42cc9799b21ef27265c7cf60fdca97e68fbb1a542
SHA512

ad2b13045a1f51e2b67a30f6ff520da3a5615019b37ad7bb17c1287e70102df78983ddd660eb54ce7cc034b656a913aca2eabbc05e03802453a178bc49be0966
SSDEEP

1536:cPdYiEO1nNiO68xVNlJ5zkufsA4YKjKxoqFF0QwzTpFzpm:clYx0NiOhwVnYBUtLzpm

Score

1^/10

Malware Config

Signatures

Files

0cf36731f5b8651d53fc651607c3fccac24b631c08dca4493d8e07d2fbff1db3.zip
.zip

Password: infected
0cf36731f5b8651d53fc651607c3fccac24b631c08dca4493d8e07d2fbff1db3.exe
.exe windows x86

384315f4c0ec5ec99da1ceda7e38dcc6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleHandleA
OpenProcess
CreateToolhelp32Snapshot
Sleep
GetLastError
Process32NextW
GetCurrentThread
LoadLibraryA
GlobalAlloc
DeleteFileW
Process32FirstW
GetVersionExW
CloseHandle
CreateThread
HeapAlloc
GetWindowsDirectoryW
GetProcAddress
VirtualAllocEx
LocalFree
GetProcessHeap
FreeLibrary
CreateRemoteThread
VirtualFreeEx
CreateFileW
GetModuleFileNameW
VirtualAlloc
GetCurrentProcess
GetCommandLineW
VirtualFree
SetLastError
HeapFree
GlobalFree
DecodePointer
WriteConsoleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
TerminateProcess
RaiseException
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
RtlUnwind
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
ExitProcess
GetModuleHandleExW
GetStdHandle
WriteFile
MultiByteToWideChar
WideCharToMultiByte
GetACP
LCMapStringW
GetStringTypeW
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
FlushFileBuffers
GetConsoleCP
GetConsoleMode
HeapSize
HeapReAlloc
SetFilePointerEx
WriteProcessMemory

advapi32

SystemFunction036
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenSCManagerW
ImpersonateSelf
OpenProcessToken
EnumServicesStatusW
OpenThreadToken
LookupAccountSidW
GetTokenInformation

shell32

ShellExecuteW
CommandLineToArgvW

Sections

.text
Size: 75KB - Virtual size: 74KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 60KB - Virtual size: 3.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 180B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

384315f4c0ec5ec99da1ceda7e38dcc6

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

shell32

Sections

.text Size: 75KB - Virtual size: 74KB

.rdata Size: 30KB - Virtual size: 29KB

.data Size: 60KB - Virtual size: 3.4MB

.gfids Size: 512B - Virtual size: 180B

.text
Size: 75KB - Virtual size: 74KB

.rdata
Size: 30KB - Virtual size: 29KB

.data
Size: 60KB - Virtual size: 3.4MB

.gfids
Size: 512B - Virtual size: 180B