General
-
Target
ScreenScrew.zip
-
Size
104KB
-
MD5
b79554fbb0dc8dfc2382b39b5dd3a6ea
-
SHA1
c92e557a8c1f756108d80d7af2d2bf8c8ca0c3e5
-
SHA256
ab7d15cf7d327924602b5cd6e6ad43306573ca14198a00d8b5cf3a5ed532f8c4
-
SHA512
cd88011fc6e0c6377362a0563caf8e0494d622ff74202dc4fdae88f4ccc62727d01523e8e0a430db49b895a793f7cdc718ae96640a7fc839ee94b789f6ccfbb6
-
SSDEEP
1536:Ulpzmewsjvu3942vDql6i5GdQglF9t9F6puRNnbDTVxSm4J2JawtirdQ5ux3Pn+4:UHmeFjpGdQgJ1R95x9j81rdQoxf+4
Malware Config
Signatures
-
Processes:
resource yara_rule static1/unpack001/[email protected] aspack_v212_v242
Files
-
ScreenScrew.zip.zip .ps1
Password: mysubsarethebest
-
[email protected].exe windows x86
Password: mysubsarethebest
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
CODE Size: 84KB - Virtual size: 192KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
DATA Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 3KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 14KB - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.aspack Size: 6KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.adata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE