9820136820[.]zip | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
9820136820.zip
Size 416KB
Sample230330-pppe3scf46
SHA256 e474405d3674b4e7edf64faeaf2991c6cb9f485dd2b3442fcf022eefdf24575d
MD5 663ac316c21991b863c5bf8038b2f82a
SHA1 5f1ac8da3e1357cd1eb608f62a550098d365cf8a
SHA512 64c0593f36499271b37a5e5d5be10bc7ee205c3bcf960f94a34c68e4358e3b28238a404a38f351a20e428fef5afd605a699d7c3217af9a5ee4454d3e8c4e3ad9
SSDEEP 12288:nLK7MPXDrDMmtGajFJpwIPNl0c3F8TEwTEsQlAZyGUJr1:e7M7rDMRwHzl4EwgskAs1
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

9820136820.zip

.zip 416KB
49ec36f03629f5993e496cfee6c5274c5f1db49bde704ef77ffe05fedd60e82b

.exe 889KB

9820136820.zip

SHA256 e474405d3674b4e7edf64faeaf2991c6cb9f485dd2b3442fcf022eefdf24575d
MD5 663ac316c21991b863c5bf8038b2f82a
SHA1 5f1ac8da3e1357cd1eb608f62a550098d365cf8a
SHA512 64c0593f36499271b37a5e5d5be10bc7ee205c3bcf960f94a34c68e4358e3b28238a404a38f351a20e428fef5afd605a699d7c3217af9a5ee4454d3e8c4e3ad9
SSDEEP 12288:nLK7MPXDrDMmtGajFJpwIPNl0c3F8TEwTEsQlAZyGUJr1:e7M7rDMRwHzl4EwgskAs1
MD5 SHA1 SHA512 SSDEEP

Password

infected

49ec36f03629f5993e496cfee6c5274c5f1db49bde704ef77ffe05fedd60e82b

IMPHASH 75375e3a75cb8bc8eddba1a5a3608482
SHA256 49ec36f03629f5993e496cfee6c5274c5f1db49bde704ef77ffe05fedd60e82b
MD5 82abc32f7626be53be02de45d82f1d46
SHA1 7a658531de60a8253973a01758042f2e65aab528
SHA512 cbb93aebe2ee71c04d19f218312e091f9965eb32b88a9ce6b58340174a12df22ca744e92eae1a68550ee366a94d67c6205590822ae0329856432d9b77e8f6b79
SSDEEP 24576:K7cWWvxC1XVB/UfWM0U91nnTqWTdC5WcdI:M1z/U991nnTqAk5WmI
MD5 SHA1 SHA512 SSDEEP

windows x86

Password

infected

Minor OS version

Major OS version

Entry point

466700

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetVolumePathNamesForVolumeNameW CreateFileW WriteFile CloseHandle GetFileSizeEx ReadFile SetFileAttributesW WaitForSingleObject CreateThread MoveFileW TerminateProcess OpenProcess lstrcmpiW QueryFullProcessImageNameW K32EnumProcesses HeapAlloc HeapFree GetProcessHeap Sleep GetComputerNameExW GetVolumeInformationW SetLastError QueryPerformanceCounter QueryPerformanceFrequency SetEndOfFile WriteConsoleW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FindFirstFileExW GetTimeZoneInformation HeapSize FindVolumeClose FindNextVolumeW FindFirstVolumeW lstrcmpW GetModuleFileNameW GetTickCount CreateProcessA OpenMutexW CreateMutexW GetLastError GetTempPathW FindNextFileW FindFirstFileW CopyFileW FindClose HeapReAlloc GetFileAttributesExW CreateProcessW GetExitCodeProcess ReadConsoleW SetFilePointerEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW WaitForSingleObjectEx GetCurrentThreadId GetExitCodeThread GetNativeSystemInfo InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx TryEnterCriticalSection DeleteCriticalSection WideCharToMultiByte MultiByteToWideChar GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress LocalFree EncodePointer DecodePointer LCMapStringEx GetLocaleInfoEx GetStringTypeW CompareStringEx GetCPInfo InitializeCriticalSectionAndSpinCount SetEvent ResetEvent CreateEventW InitializeSListHead IsProcessorFeaturePresent IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW GetCurrentProcess GetCurrentProcessId RaiseException RtlUnwind InterlockedPushEntrySList TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW ExitThread FreeLibraryAndExitThread GetStdHandle GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW

user32

CharLowerW

shell32

SHChangeNotify

ole32

CoSetProxyBlanket CoCreateInstance CoInitializeSecurity CoInitializeEx

oleaut32

SysAllocStringLen SysAllocString SysFreeString VariantInit

advapi32

CryptGenRandom CryptReleaseContext CryptAcquireContextA RegCreateKeyW QueryServiceStatusEx OpenServiceW OpenSCManagerW EnumServicesStatusW EnumDependentServicesW ControlService CloseServiceHandle ChangeServiceConfigW RegSetValueExW RegCreateKeyExW

wldap32

ord72 ord41 ord26 ord145 ord191 ord135 ord206 ord88 ord224 ord13 ord27 ord14 ord140