63bc0424f515ed76125bf3f7d77a47a3da77a9a52d7913a273fa0bd8e5189ef2[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

63bc0424f515ed76125bf3f7d77a47a3da77a9a52d7913a273fa0bd8e5189ef2.zip
Size

1.9MB
MD5

03674c6c48e86e3b3d16df2a70581754
SHA1

ddcc2ee6aa63c189226422e570478d9fde9be00a
SHA256

8bc3d8980fb41788bb3650cc99f052f74dba07f0bea7bcfe1465a494adfee7c5
SHA512

64c9aeec1a2a8f2e4c658c789ee4ec7ca818e8e444920b0c392c923abf91f1279035ffd33d32a2da060bfedf1cc695cd24e76fc9a9ff3d0b3073cf8805e4e338
SSDEEP

49152:ulg+GmJMoDPEezG7p/DEYYpu8dBae9ik0uwm8R:uomJ792p/cpr3J0uw1R

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/63bc0424f515ed76125bf3f7d77a47a3da77a9a52d7913a273fa0bd8e5189ef2.exe

Files

63bc0424f515ed76125bf3f7d77a47a3da77a9a52d7913a273fa0bd8e5189ef2.zip
.zip

Password: infected
63bc0424f515ed76125bf3f7d77a47a3da77a9a52d7913a273fa0bd8e5189ef2.exe
.exe windows x64

Password: infected

867f8d99a619345d9a11a8961527be79

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

oleaut32

SysAllocStringLen
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetUBound
SafeArrayGetLBound
SysFreeString
VariantClear
SafeArrayDestroy

kernel32

GetFileInformationByHandle
GetModuleHandleA
GetCurrentThread
GetStdHandle
GetConsoleMode
WaitForSingleObject
WriteConsoleW
WaitForSingleObjectEx
CreateMutexA
ReleaseMutex
GetEnvironmentVariableW
RtlLookupFunctionEntry
GetModuleHandleW
FormatMessageW
GetTempPathW
GetModuleFileNameW
CreateFileW
GetFileInformationByHandleEx
WakeAllConditionVariable
SetFilePointerEx
FindNextFileW
CreateDirectoryW
FindFirstFileW
FindClose
GetSystemInfo
SetThreadStackGuarantee
AddVectoredExceptionHandler
GlobalAlloc
GetEnvironmentStringsW
FreeEnvironmentStringsW
CompareStringOrdinal
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
GetFileAttributesW
DuplicateHandle
GetCurrentProcessId
CreateNamedPipeW
CreateThread
ReadFileEx
SleepEx
WriteFileEx
MultiByteToWideChar
ExitProcess
QueryPerformanceCounter
QueryPerformanceFrequency
GetSystemTimeAsFileTime
GetCurrentDirectoryW
RtlCaptureContext
AcquireSRWLockShared
CopyFileExW
SleepConditionVariableSRW
SetHandleInformation
WakeConditionVariable
PostQueuedCompletionStatus
WideCharToMultiByte
GlobalSize
GlobalLock
Sleep
ReleaseSRWLockExclusive
SetFileCompletionNotificationModes
CreateIoCompletionPort
TryAcquireSRWLockExclusive
GetFinalPathNameByHandleW
SetLastError
GetQueuedCompletionStatusEx
AcquireSRWLockExclusive
UnhandledExceptionFilter
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
SystemTimeToFileTime
GetTimeZoneInformation
RtlVirtualUnwind
FlushFileBuffers
GetTickCount
MapViewOfFile
CreateFileMappingW
FormatMessageA
GetSystemTime
FreeLibrary
GetFileSize
LockFileEx
LocalFree
UnlockFile
HeapDestroy
HeapCompact
LoadLibraryW
DeleteFileW
DeleteFileA
CreateFileA
FlushViewOfFile
OutputDebugStringW
GetFileAttributesExW
GetFileAttributesA
GetDiskFreeSpaceA
GetTempPathA
HeapSize
HeapValidate
UnmapViewOfFile
CreateMutexW
UnlockFileEx
SetEndOfFile
GetFullPathNameA
SetFilePointer
LockFile
OutputDebugStringA
GetDiskFreeSpaceW
WriteFile
HeapCreate
ReadFile
AreFileApisANSI
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
GetCurrentThreadId
SetUnhandledExceptionFilter
TerminateProcess
SwitchToThread
IsProcessorFeaturePresent
GlobalUnlock
GetLastError
GlobalFree
HeapAlloc
GetProcessHeap
HeapReAlloc
GetCurrentProcess
GetProcAddress
LoadLibraryA
CloseHandle
HeapFree
InitializeSListHead
IsDebuggerPresent
GetFullPathNameW
ReleaseSRWLockShared

bcrypt

BCryptGenRandom

user32

GetMonitorInfoW
EnumDisplaySettingsExW
SetClipboardData
EmptyClipboard
CloseClipboard
GetClipboardData
OpenClipboard
EnumDisplayMonitors

ws2_32

accept
recv
ioctlsocket
socket
setsockopt
send
connect
getaddrinfo
freeaddrinfo
WSAStartup
getsockopt
WSAIoctl
shutdown
closesocket
WSACleanup
WSASocketW
getsockname
WSAGetLastError
getpeername
WSASend
listen
bind

ntdll

NtDeviceIoControlFile
NtCreateFile
NtCancelIoFileEx
RtlNtStatusToDosError

crypt32

CryptUnprotectData
CertDuplicateCertificateContext
CertDuplicateStore
CertFreeCertificateChain
CertGetCertificateChain
CertOpenStore
CertFreeCertificateContext
CertCloseStore
CertAddCertificateContextToStore
CertEnumCertificatesInStore
CertVerifyCertificateChainPolicy
CertDuplicateCertificateChain

secur32

QueryContextAttributesW
FreeContextBuffer
DeleteSecurityContext
EncryptMessage
ApplyControlToken
FreeCredentialsHandle
AcceptSecurityContext
InitializeSecurityContextW
AcquireCredentialsHandleA
DecryptMessage

advapi32

RegQueryValueExW
RegCloseKey
RegOpenKeyExW
SystemFunction036
RegSetValueExA
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
RegCreateKeyExA

gdi32

GetDeviceCaps
DeleteDC
DeleteObject
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
SetStretchBltMode
StretchBlt
GetDIBits
GetObjectW
CreateDCW

ole32

CoInitializeEx
CoCreateInstance
CoSetProxyBlanket
CoInitializeSecurity

vcruntime140

__C_specific_handler
__CxxFrameHandler3
memmove
memset
memcmp
memcpy
__current_exception
__current_exception_context
strrchr

api-ms-win-crt-string-l1-1-0

strcmp
strcspn
strncmp
strlen

api-ms-win-crt-utility-l1-1-0

_rotl64
qsort

api-ms-win-crt-heap-l1-1-0

_msize
realloc
free
_set_new_mode
malloc

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-math-l1-1-0

log
__setusermatherr
_dclass

api-ms-win-crt-runtime-l1-1-0

_exit
__p___argc
__p___argv
_beginthreadex
_endthreadex
terminate
_get_initial_narrow_environment
exit
_crt_atexit
_initterm_e
_set_app_type
_cexit
_c_exit
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_seh_filter_exe
_initterm
_configure_narrow_argv
_register_thread_local_exe_atexit_callback

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 2.6MB - Virtual size: 2.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 64KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

867f8d99a619345d9a11a8961527be79

Headers

DLL Characteristics

File Characteristics

Imports

oleaut32

kernel32

bcrypt

user32

ws2_32

ntdll

crypt32

secur32

advapi32

gdi32

ole32

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 2.6MB - Virtual size: 2.6MB

.rdata Size: 1.1MB - Virtual size: 1.1MB

.data Size: 24KB - Virtual size: 27KB

.pdata Size: 64KB - Virtual size: 64KB

.reloc Size: 26KB - Virtual size: 26KB

.text
Size: 2.6MB - Virtual size: 2.6MB

.rdata
Size: 1.1MB - Virtual size: 1.1MB

.data
Size: 24KB - Virtual size: 27KB

.pdata
Size: 64KB - Virtual size: 64KB

.reloc
Size: 26KB - Virtual size: 26KB