961b1a6a707722ebd4632d0ca3ea6b3b7f42143bc8ae946f99d8c1ac1b91c490[.]zip

General

Target

961b1a6a707722ebd4632d0ca3ea6b3b7f42143bc8ae946f99d8c1ac1b91c490.zip
Size

13KB
MD5

7a03de7a903c6616b45ba1f36fb85a9e
SHA1

6a11bbec0f371e5e015653f12251047ed1888125
SHA256

61ae81efb5b96218e145b1f356a1610a095afad832ab2309c1aff55dc1bae22d
SHA512

9fb3ace5e2959c6813294db711e74cb287a1982762501ba12b424ec2bc0d35a4cd889eda5bf44efbc90267f1262aa64ac2b3dd0fb8627c007e9a846756f42e92
SSDEEP

192:kQkFhws1OoQuiEhjzSMXLDBnvYEKZs7wrKriBZxHReYvM1F4YyzCS99C5ma+dZp3:kx1cyBnvwZs7kKrkdk16Y2L9amG4Sorr

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/961b1a6a707722ebd4632d0ca3ea6b3b7f42143bc8ae946f99d8c1ac1b91c490.exe

Files

961b1a6a707722ebd4632d0ca3ea6b3b7f42143bc8ae946f99d8c1ac1b91c490.zip
.zip

Password: infected
961b1a6a707722ebd4632d0ca3ea6b3b7f42143bc8ae946f99d8c1ac1b91c490.exe
.dll windows x64

Password: infected

c1d1febbe45a60da209c85a2f3720ca0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

CreateRemoteThread
GetLastError
WriteProcessMemory
Sleep
WriteFile
CloseHandle
lstrcpyA
lstrlenA
CreateThread
CreateProcessA
GetTempPathA
GetTempFileNameA
CreateFileA
GetComputerNameExA
GetVersionExA
CreateToolhelp32Snapshot
Process32First
Process32Next
GetCurrentProcessId
OpenProcess
VirtualAllocEx
VirtualAlloc
LocalFree
LocalSize
LocalAlloc
GetModuleHandleA
GetProcAddress

user32

wsprintfA

advapi32

CryptDecrypt
CryptImportKey
CryptDestroyKey
CryptReleaseContext
CryptAcquireContextA
GetUserNameA
SystemFunction036
CryptEncrypt

ws2_32

closesocket
connect
htons
inet_addr
inet_ntoa
recv
select
send
socket
gethostbyname
WSAStartup
WSACleanup

Exports

Exports

WvZKjcSFVKCybuIrIIuBkuXpmvirz

Sections

.text
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 336B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 264B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

c1d1febbe45a60da209c85a2f3720ca0

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

ws2_32

Exports

Exports

Sections

.text Size: 6KB - Virtual size: 6KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 512B - Virtual size: 336B

.pdata Size: 512B - Virtual size: 264B

.rsrc Size: 512B - Virtual size: 480B

.text
Size: 6KB - Virtual size: 6KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 512B - Virtual size: 336B

.pdata
Size: 512B - Virtual size: 264B

.rsrc
Size: 512B - Virtual size: 480B