d2836cbcc2f103c079eb15c5bce0ae62bde57f70bc3f9f268654a564dec8ed8f[.]zip

Sharing

Copy URL

Twitter E-mail

General

Target

d2836cbcc2f103c079eb15c5bce0ae62bde57f70bc3f9f268654a564dec8ed8f.zip
Size

7KB
MD5

6a670dd94d94b24a4951dbb546668406
SHA1

891252b3b2925d52ddd969bd58b86af9ead15526
SHA256

48c0663ebe0499bdf954489b065c48c4568e4a58c4b6b90167c5d68ff0d4ab07
SHA512

a25ca5df78d6fe62a92a669ca674fb2f788d847c7b3260698f3e025ef6d29bc1416f414a15667efb313f41cdadf52f6d0165d9402ab1846080f53a6e5d1048a2
SSDEEP

192:30X6LliqvVPSZWkgLopCDVvHCdFP+6iG3FvfUl:30X6LcqdPKgLop64FG61vfUl

Score

1^/10

Malware Config

Signatures

Files

d2836cbcc2f103c079eb15c5bce0ae62bde57f70bc3f9f268654a564dec8ed8f.zip
.zip

Password: infected
d2836cbcc2f103c079eb15c5bce0ae62bde57f70bc3f9f268654a564dec8ed8f.exe
.exe windows x86

Password: infected

745d7f50636fb2b25f5ec7f180ef6ab7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

StrStrW

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

advapi32

CryptEncrypt
CryptHashData
CloseEventLog
RegSetValueExW
RegCloseKey
ClearEventLogW
CryptAcquireContextW
OpenEventLogW
CryptDeriveKey
CryptReleaseContext
RegDisableReflectionKey
CryptCreateHash
RegOpenKeyExW
CryptDestroyKey
CryptDestroyHash

wtsapi32

WTSDisconnectSession
WTSEnumerateSessionsW
WTSFreeMemory
WTSQuerySessionInformationW
WTSLogoffSession

mpr

WNetEnumResourceW
WNetOpenEnumW
WNetCloseEnum

kernel32

GetFileTime
GetFileAttributesW
ExpandEnvironmentStringsW
CreateThread
GetVolumeInformationW
SetFileAttributesW
GetCurrentProcessId
DeleteFileW
CloseHandle
FindNextFileW
UpdateResourceW
lstrcatW
WTSGetActiveConsoleSessionId
GetSystemDefaultLangID
ExitProcess
GetFileSize
CreateMutexW
FindFirstFileW
SetFilePointer
FreeResource
lstrlenA
GetDriveTypeW
SetEndOfFile
FindResourceW
LoadResource
CreateProcessW
EndUpdateResourceW
GetLogicalDriveStringsW
GlobalLock
WaitForSingleObject
GetModuleHandleW
GetTickCount
VirtualFree
SetFileTime
WriteFile
GlobalAlloc
Sleep
CopyFileW
SizeofResource
WaitForMultipleObjects
ReadFile
GetModuleFileNameW
CreateFileW
ExitThread
lstrcmpW
MultiByteToWideChar
lstrlenW
GlobalUnlock
GetLastError
GetProcAddress
VirtualAlloc
BeginUpdateResourceW
MoveFileW
GetSystemDefaultLocaleName
GlobalFree
FindClose
ProcessIdToSessionId
LockResource
GetCurrentThreadId

user32

CloseClipboard
GetMessageW
PostQuitMessage
LoadCursorW
wsprintfW
DispatchMessageW
DefWindowProcW
SetWindowTextW
SetClipboardData
GetSystemMetrics
MessageBoxW
OpenClipboard
CreateWindowExW
ShowWindow
EmptyClipboard
GetWindowTextW
GetWindowLongW
LoadIconW
RegisterClassExW
TranslateMessage

gdi32

CreateSolidBrush

shell32

CommandLineToArgvW

Sections

.text
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

745d7f50636fb2b25f5ec7f180ef6ab7

Headers

DLL Characteristics

File Characteristics

Imports

shlwapi

version

advapi32

wtsapi32

mpr

kernel32

user32

gdi32

shell32

Sections

.text Size: 6KB - Virtual size: 5KB

.rdata Size: 5KB - Virtual size: 4KB

.data Size: 512B - Virtual size: 5KB

.rsrc Size: 5KB - Virtual size: 4KB

.text
Size: 6KB - Virtual size: 5KB

.rdata
Size: 5KB - Virtual size: 4KB

.data
Size: 512B - Virtual size: 5KB

.rsrc
Size: 5KB - Virtual size: 4KB