0ad39d35ba9dcff65fe51329677acc9e8fe2f08e9e48e15361a132bd79d5acdc[.]zip

Sharing

Copy URL

Twitter E-mail

General

Target

0ad39d35ba9dcff65fe51329677acc9e8fe2f08e9e48e15361a132bd79d5acdc.zip
Size

37KB
MD5

b60f13f6b0f277eb41c3370b12d92686
SHA1

735ed86ac4264f3d7171bff75aa83962d83ecf48
SHA256

2cf5fda1ee71f1d053956abb86e57038f697bc507587a082b2430758fe955564
SHA512

40aed9d23a57649804a42474efe14033c42988dc61378d8aebbd0ca3a1f2186e0c0e20d1334c9dbc376136c712fcc90a084bac3dad9b542c200ef72954d2f618
SSDEEP

768:4igxRWsGZn92iBpaW8ggEPeJuZB1+QLLT+vQwSCa2DlAld8+dsROQUVdmsG:/KO2iTaxDCVZBwAH+vgCa2Clds8mP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/0ad39d35ba9dcff65fe51329677acc9e8fe2f08e9e48e15361a132bd79d5acdc.exe

Files

0ad39d35ba9dcff65fe51329677acc9e8fe2f08e9e48e15361a132bd79d5acdc.zip
.zip

Password: infected
0ad39d35ba9dcff65fe51329677acc9e8fe2f08e9e48e15361a132bd79d5acdc.exe
.exe windows x86

Password: infected

0db234c8cab614966240dd6a46dbf425

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCommandLineW
ExitProcess
AllocConsole
SetErrorMode
GetModuleFileNameW
GetLastError
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
DecodePointer
EncodePointer
GetStartupInfoW
HeapSetInformation
InterlockedCompareExchange
Sleep
InterlockedExchange

user32

GetKeyboardLayout
GetWindowTextW
MapVirtualKeyExW
GetKeyNameTextW
GetForegroundWindow
GetAsyncKeyState
GetMessageW

shell32

CommandLineToArgvW
SHGetFolderPathW

pocofoundation

?create@Logger@Poco@@SAAAV12@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PAVChannel@2@H@Z
??0FileInputStream@Poco@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@H@Z
??0PatternFormatter@Poco@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
??1PatternFormatter@Poco@@UAE@XZ
?format@PatternFormatter@Poco@@UAEXABVMessage@2@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?setProperty@PatternFormatter@Poco@@UAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0@Z
?getProperty@PatternFormatter@Poco@@UBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV34@@Z
??0FormattingChannel@Poco@@QAE@PAVFormatter@1@@Z
?setChannel@FormattingChannel@Poco@@QAEXPAVChannel@2@@Z
?log@FormattingChannel@Poco@@UAEXABVMessage@2@@Z
?setProperty@FormattingChannel@Poco@@UAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0@Z
?open@FormattingChannel@Poco@@UAEXXZ
?close@FormattingChannel@Poco@@UAEXXZ
??1FormattingChannel@Poco@@MAE@XZ
??0ConsoleChannel@Poco@@QAE@XZ
?log@ConsoleChannel@Poco@@UAEXABVMessage@2@@Z
??1ConsoleChannel@Poco@@MAE@XZ
?setFileName@Path@Poco@@QAEAAV12@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?parent@Path@Poco@@QBE?AV12@XZ
??0Timestamp@Poco@@QAE@XZ
??0FileOutputStream@Poco@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@H@Z
?close@FileIOS@Poco@@QAEXXZ
?current@Thread@Poco@@SAPAV12@XZ
??0Thread@Poco@@QAE@XZ
??1Thread@Poco@@QAE@XZ
?get@Logger@Poco@@SAAAV12@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?setProperty@NullChannel@Poco@@UAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0@Z
??1Path@Poco@@QAE@XZ
?toString@Path@Poco@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?makeDirectory@Path@Poco@@QAEAAV12@XZ
?displayText@Exception@Poco@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?toUTF8@UnicodeConverter@Poco@@SAXABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z
?elapsed@Timestamp@Poco@@QBE_JXZ
?information@Logger@Poco@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?format@DateTimeFormatter@Poco@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABVTimestamp@2@ABV34@H@Z
??0Timestamp@Poco@@QAE@_J@Z
??1Timestamp@Poco@@QAE@XZ
?update@Timestamp@Poco@@QAEXXZ
??_DMemoryInputStream@Poco@@QAEXXZ
??0LogicException@Poco@@QAE@ABV01@@Z
??0Exception@Poco@@QAE@ABV01@@Z
??0MemoryInputStream@Poco@@QAE@PBD_J@Z
??0NullPointerException@Poco@@QAE@ABV01@@Z
??0NullPointerException@Poco@@QAE@H@Z
??1NullPointerException@Poco@@UAE@XZ
?lock@Mutex@Poco@@QAEXXZ
?unlock@Mutex@Poco@@QAEXXZ
?isRunning@Thread@Poco@@QBE_NXZ
??0Runnable@Poco@@QAE@XZ
??1Runnable@Poco@@UAE@XZ
?toUTF8@UnicodeConverter@Poco@@SAXPB_WAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?toUTF8@UnicodeConverter@Poco@@SAXPB_WHAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?log@NullChannel@Poco@@UAEXABVMessage@2@@Z
??1NullChannel@Poco@@UAE@XZ
??0NullChannel@Poco@@QAE@XZ
?exists@File@Poco@@QBE_NXZ
??4File@Poco@@QAEAAV01@ABV01@@Z
??1File@Poco@@UAE@XZ
??0File@Poco@@QAE@XZ
??0File@Poco@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
??0File@Poco@@QAE@ABVPath@1@@Z
??0File@Poco@@QAE@ABV01@@Z
?copyToString@StreamCopier@Poco@@SA_JAAV?$basic_istream@DU?$char_traits@D@std@@@std@@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@I@Z
?getProperty@Channel@Poco@@UBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV34@@Z
?setProperty@Channel@Poco@@UAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0@Z
?close@Channel@Poco@@UAEXXZ
?open@Channel@Poco@@UAEXXZ
??_DFileInputStream@Poco@@QAEXXZ
??_DFileOutputStream@Poco@@QAEXXZ
??8File@Poco@@QBE_NABV01@@Z
?what@Exception@Poco@@UBEPBDXZ
??1Exception@Poco@@UAE@XZ
??0Exception@Poco@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@H@Z
??0Exception@Poco@@IAE@H@Z
??1NamedMutex@Poco@@QAE@XZ
??0NamedMutex@Poco@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?getSize@File@Poco@@QBE_KXZ
?tryLock@NamedMutex@Poco@@QAE_NXZ
?unlock@NamedMutex@Poco@@QAEXXZ
?lock@FastMutex@Poco@@QAEXXZ
?unlock@FastMutex@Poco@@QAEXXZ
?tryWait@Event@Poco@@QAE_NJ@Z
??0Condition@Poco@@QAE@XZ
??1Condition@Poco@@QAE@XZ
?broadcast@Condition@Poco@@QAEXXZ
?enqueue@Condition@Poco@@IAEXAAVEvent@2@@Z
?dequeue@Condition@Poco@@IAEXAAVEvent@2@@Z
??0Event@Poco@@QAE@_N@Z
??0Path@Poco@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?join@Thread@Poco@@QAEXXZ
?start@Thread@Poco@@QAEXAAVRunnable@2@@Z
??1Mutex@Poco@@QAE@XZ
??0Mutex@Poco@@QAE@XZ
??1Event@Poco@@QAE@XZ

msvcp100

?pbackfail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHH@Z
?seekoff@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE?AV?$fpos@H@2@_JHH@Z
?seekpos@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE?AV?$fpos@H@2@V32@H@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_J@Z
??_7?$basic_istream@DU?$char_traits@D@std@@@std@@6B@
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z
?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?_BADOFF@std@@3_JB
??_7?$basic_ostream@DU?$char_traits@D@std@@@std@@6B@
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?uncaught_exception@std@@YA_NXZ
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z

msvcr100

memcpy
__CxxFrameHandler3
_CxxThrowException
_controlfp_s
_invoke_watson
_except_handler4_common
?_type_info_dtor_internal_method@type_info@@QAEXXZ
?terminate@@YAXXZ
_crt_debugger_hook
?_name_internal_method@type_info@@QBEPBDPAU__type_info_node@@@Z
_onexit
_lock
__dllonexit
_unlock
__set_app_type
_fmode
_commode
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_acmdln
exit
_ismbblead
_XcptFilter
_exit
_cexit
__getmainargs
_amsg_exit
??_V@YAXPAX@Z
__RTtypeid
freopen_s
__iob_func
_purecall
getchar
??2@YAPAXI@Z
??3@YAXPAX@Z
memmove
??0exception@std@@QAE@ABV01@@Z
??0exception@std@@QAE@ABQBD@Z
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
memset

pocoxml

?release@DOMObject@XML@Poco@@QBEXXZ
??0DOMParser@XML@Poco@@QAE@PAVNamePool@12@@Z
??1DOMParser@XML@Poco@@QAE@XZ
?parse@DOMParser@XML@Poco@@QAEPAVDocument@23@PAVInputSource@23@@Z
?getAttribute@Element@XML@Poco@@QBEABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV45@@Z
??1InputSource@XML@Poco@@QAE@XZ
??0InputSource@XML@Poco@@QAE@AAV?$basic_istream@DU?$char_traits@D@std@@@std@@@Z
?documentElement@Document@XML@Poco@@QBEPAVElement@23@XZ

Sections

.text
Size: 49KB - Virtual size: 48KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

0db234c8cab614966240dd6a46dbf425

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

shell32

pocofoundation

msvcp100

msvcr100

pocoxml

Sections

.text Size: 49KB - Virtual size: 48KB

.rdata Size: 25KB - Virtual size: 25KB

.data Size: 2KB - Virtual size: 3KB

.rsrc Size: 512B - Virtual size: 436B

.reloc Size: 9KB - Virtual size: 9KB

.text
Size: 49KB - Virtual size: 48KB

.rdata
Size: 25KB - Virtual size: 25KB

.data
Size: 2KB - Virtual size: 3KB

.rsrc
Size: 512B - Virtual size: 436B

.reloc
Size: 9KB - Virtual size: 9KB