9802953895[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

9802953895.zip
Size

1.8MB
MD5

1fd89a69776d2e8d743f05cd28b1203d
SHA1

0013feb0e2f81aca1a74a6400afb246791d2eb7b
SHA256

f480011dfc722bd6aea491ae1c9ab62dec073b00a544c661848ed4b2bc98f093
SHA512

66d183453671e76b7a49cc59949fd0ed3685f6cc60e61be79486dadc381a35bda38dc763f3114fa66bc9ccdb1723bc4f16fa4ee9f388e55cee772e5406f753ed
SSDEEP

49152:5g6iqxufM6XsZC2D5FX8sUPNe9vW3X8sHtA02gVR:5gGxEMhCoJ8PNEuX8sHtbNVR

Score

1^/10

Malware Config

Signatures

Files

9802953895.zip
.zip

Password: infected
2016f2e0e206823eab06ef55dd36d15e882fb4b7d241c2148617781a36c20e84
.dll windows x64

Password: infected

8b2be6e82e1a2f5b6a6ac4ed9979b98b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

CloseHandle
CreateEventA
CreateSemaphoreA
DeleteCriticalSection
DisableThreadLibraryCalls
EnterCriticalSection
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetLastError
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GetProcessAffinityMask
GetSystemInfo
GetSystemTimeAsFileTime
GetTickCount
GetVersionExA
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryW
OutputDebugStringA
OutputDebugStringW
QueryPerformanceCounter
ReleaseSemaphore
ResetEvent
RtlAddFunctionTable
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetEvent
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
WaitForSingleObject

msvcrt

_close
_open
_read
_write
__dllonexit
__iob_func
__setusermatherr
_amsg_exit
_beginthreadex
_errno
_exit
_initterm
_lock
_lseeki64
_onexit
_unlock
_vsnprintf
_vsnwprintf
_wopen
abort
acos
asin
atan
calloc
ceil
clock
cosh
floor
fprintf
fputs
free
frexp
fwrite
islower
isspace
isupper
localeconv
log10
malloc
memchr
memcmp
memcpy
memmove
memset
qsort
raise
realloc
signal
sinh
sprintf
sscanf
strcat
strchr
strcmp
strcpy
strerror
strlen
strncmp
strspn
strtok
strtol
tan
tanh
toupper
vfprintf
wcstombs

user32

MessageBoxA

Exports

Exports

FF264UpdateRefFrameSliceLong
FFGetMBNumber
FFH264BuildPicParams
FFH264CheckCompatibility
FFH264DecodeBuffer
FFH264IsRefFrameInUse
FFH264SetCurrentPicture
FFH264SetDxvaSliceLong
FFH264UpdateRefFramesList
FFIsSkipped
FFVC1UpdatePictureParam
GetCPUCount
GetFFMpegPictureType
av_free
av_h264_decode_frame
av_init_packet
av_log_get_callback
av_log_get_level
av_log_set_callback
av_log_set_level
av_mallocz
av_packet_new_side_data
av_parser_close
av_parser_init
av_parser_parse2
av_set_cpu_flags_mask
av_vc1_decode_frame
avcodec_alloc_context3
avcodec_alloc_frame
avcodec_close
avcodec_decode_audio3
avcodec_decode_audio4
avcodec_decode_video2
avcodec_default_get_buffer
avcodec_default_reget_buffer
avcodec_default_release_buffer
avcodec_encode_audio
avcodec_encode_audio2
avcodec_encode_video
avcodec_find_decoder
avcodec_find_encoder
avcodec_flush_buffers
avcodec_get_current_idct
avcodec_get_encoder_info
avcodec_h264_search_recovery_point
avcodec_open2
avcodec_register_all
ff_simple_idct_mmx
getVersion
gradfunFilter
gradfunInit
pp_free_context
pp_get_context
pp_postprocess
sws_freeContext
sws_freeFilter
sws_freeVec
sws_getCachedContext
sws_getCoefficients
sws_getConstVec
sws_getDefaultFilter
sws_getGaussianVec
sws_normalizeVec
sws_scale
sws_setColorspaceDetails
yadif_filter
yadif_init
yadif_uninit

Sections

.text
Size: 2.9MB - Virtual size: 2.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 83KB - Virtual size: 82KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 672KB - Virtual size: 672KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rodata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 59KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 65KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 4.5MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 80B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

8b2be6e82e1a2f5b6a6ac4ed9979b98b

Headers

File Characteristics

Imports

kernel32

msvcrt

user32

Exports

Exports

Sections

.text Size: 2.9MB - Virtual size: 2.9MB

.data Size: 83KB - Virtual size: 82KB

.rdata Size: 672KB - Virtual size: 672KB

.rodata Size: 5KB - Virtual size: 4KB

.pdata Size: 59KB - Virtual size: 58KB

.xdata Size: 65KB - Virtual size: 65KB

.bss Size: - Virtual size: 4.5MB

.edata Size: 2KB - Virtual size: 1KB

.idata Size: 4KB - Virtual size: 3KB

.CRT Size: 512B - Virtual size: 88B

.tls Size: 512B - Virtual size: 80B

.reloc Size: 10KB - Virtual size: 9KB

.text
Size: 2.9MB - Virtual size: 2.9MB

.data
Size: 83KB - Virtual size: 82KB

.rdata
Size: 672KB - Virtual size: 672KB

.rodata
Size: 5KB - Virtual size: 4KB

.pdata
Size: 59KB - Virtual size: 58KB

.xdata
Size: 65KB - Virtual size: 65KB

.bss
Size: - Virtual size: 4.5MB

.edata
Size: 2KB - Virtual size: 1KB

.idata
Size: 4KB - Virtual size: 3KB

.CRT
Size: 512B - Virtual size: 88B

.tls
Size: 512B - Virtual size: 80B

.reloc
Size: 10KB - Virtual size: 9KB