9799476494[.]zip | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
9799476494.zip
Size 416KB
Sample230330-ppdzcacf43
SHA256 a7f960482e2b729b34054bb18a8635b1b41f0be9b23266cb6b323a2a1b5e271f
MD5 37c307b8314be9dee23a52a722b5beea
SHA1 f4fa1e9faaf88108c701022883e1a49bfc0b7659
SHA512 c70e5c7c92e18fa70c665c598568cfae7a57a91f06de8c8536ef102b12f8f416c97b70f7d2ba0711c5b9b938f076e77e717440889bdf410779fdec820549e0d4
SSDEEP 12288:IbHEz8qv3q2gSqk59wK1MjXrj29p6wxrP:DzotSqrXf29EwF
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

9799476494.zip

.zip 416KB
99f82c9a80fc6556f28e50e2889d59325e8169dc3742bf34121dc85207c6d965

.exe 889KB

9799476494.zip

SHA256 a7f960482e2b729b34054bb18a8635b1b41f0be9b23266cb6b323a2a1b5e271f
MD5 37c307b8314be9dee23a52a722b5beea
SHA1 f4fa1e9faaf88108c701022883e1a49bfc0b7659
SHA512 c70e5c7c92e18fa70c665c598568cfae7a57a91f06de8c8536ef102b12f8f416c97b70f7d2ba0711c5b9b938f076e77e717440889bdf410779fdec820549e0d4
SSDEEP 12288:IbHEz8qv3q2gSqk59wK1MjXrj29p6wxrP:DzotSqrXf29EwF
MD5 SHA1 SHA512 SSDEEP

Password

infected

99f82c9a80fc6556f28e50e2889d59325e8169dc3742bf34121dc85207c6d965

IMPHASH 1586e698e06818b73054f32427ed664a
SHA256 99f82c9a80fc6556f28e50e2889d59325e8169dc3742bf34121dc85207c6d965
MD5 d0b2d98b0c4380a4246e6d3f1d9a6da5
SHA1 418427d3f7a773666b6905d80f02a0087cd4409f
SHA512 061db40321abf16353925d259b869598763a10e781f96ff745603ef3ee60cdc049664150d7446809fa695e7f6d0e888f22978edc05851e38a72a49b09f95e5b7
SSDEEP 24576:X5nc7yYs6kQ2WxeisU09E3b6E/IwU5jjpDWPy:XZ6YWxG9E3b6Nz5jjpDMy
MD5 SHA1 SHA512 SSDEEP

windows x86

Password

infected

Minor OS version

Major OS version

Entry point

466604

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

FindVolumeClose GetVolumeInformationW GetVolumePathNamesForVolumeNameW CreateFileW WriteFile CloseHandle GetFileSizeEx ReadFile WaitForSingleObject CreateThread MoveFileW TerminateProcess OpenProcess lstrcmpiW QueryFullProcessImageNameW K32EnumProcesses HeapAlloc HeapFree GetProcessHeap Sleep FindNextVolumeW CopyFileW SetLastError QueryPerformanceCounter QueryPerformanceFrequency SetEndOfFile WriteConsoleW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FindFirstFileExW GetTimeZoneInformation HeapSize FindFirstVolumeW lstrcmpW GetModuleFileNameW GetTickCount CreateProcessA OpenMutexW CreateMutexW GetLastError GetTempPathW GetFileAttributesW FindNextFileW FindFirstFileW GetComputerNameExW FindClose HeapReAlloc GetFileAttributesExW CreateProcessW GetExitCodeProcess ReadConsoleW SetFilePointerEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW WaitForSingleObjectEx GetCurrentThreadId GetExitCodeThread GetNativeSystemInfo InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx TryEnterCriticalSection DeleteCriticalSection WideCharToMultiByte MultiByteToWideChar GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress LocalFree EncodePointer DecodePointer LCMapStringEx GetLocaleInfoEx GetStringTypeW CompareStringEx GetCPInfo InitializeCriticalSectionAndSpinCount SetEvent ResetEvent CreateEventW InitializeSListHead IsProcessorFeaturePresent IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW GetCurrentProcess GetCurrentProcessId RaiseException RtlUnwind InterlockedPushEntrySList TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW ExitThread FreeLibraryAndExitThread GetStdHandle GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW

user32

CharLowerW

shell32

SHChangeNotify

ole32

CoSetProxyBlanket CoCreateInstance CoInitializeSecurity CoInitializeEx

oleaut32

SysAllocStringLen SysAllocString SysFreeString VariantInit

advapi32

CryptGenRandom CryptReleaseContext CryptAcquireContextA QueryServiceStatusEx OpenServiceW OpenSCManagerW EnumServicesStatusW EnumDependentServicesW ControlService CloseServiceHandle ChangeServiceConfigW RegSetValueExW RegCreateKeyExW

wldap32

ord72 ord41 ord26 ord145 ord191 ord135 ord206 ord88 ord224 ord13 ord27 ord14 ord140