VOD-SCRPTS-WorkInk-Installer_891842[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

VOD-SCRPTS-WorkInk-Installer_891842.zip
Size

17.5MB
MD5

55a77476a26dc8346cfd8b74a0e72d7b
SHA1

6cee0aba1d1c2f2530ea930e0834fd5807202997
SHA256

b49baf870630dbed5f14430911fd829269ae0cad8b8351095c2c22be45227724
SHA512

2da18efc7fa55cc6539b177acbb3276fdfb35bdbde4f01f71502ca8495df611905af56cabd091f08ba7104297ec1b4707aaee7f6af0af0700223abc4b0482fd4
SSDEEP

393216:ltk2DbYoZdF3JRgwcZpmGR51c34vUi4FHfUgqBqY378fbbZQWASJ3RSMTY/:ltk2DUszkwQpmWNvx4FH8gKL78fbbZ9O

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Install_01025.exe

Files

VOD-SCRPTS-WorkInk-Installer_891842.zip
.zip
Install_01025.exe
.exe windows x86

c61f65a7af6939836e7bbe4a515158f8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

PathCombineW
PathFileExistsW

kernel32

AcquireSRWLockExclusive
SetFileAttributesW
GetVersionExA
LeaveCriticalSection
FindFirstFileExW
GetFileSizeEx
lstrlenW
FreeLibrary
ResetEvent
GetSystemDirectoryW
GetModuleHandleW
VirtualFree
GetModuleFileNameW
EnterCriticalSection
FormatMessageW
HeapReAlloc
GetProcessAffinityMask
GetCurrentProcessId
TlsSetValue
GetFileInformationByHandle
GetFileAttributesA
SetFileAttributesA
TlsGetValue
CompareStringW
WaitForSingleObject
VerSetConditionMask
RaiseException
lstrlenA
SetUnhandledExceptionFilter
CreateDirectoryW
VirtualAlloc
GetDateFormatW
SleepEx
WriteConsoleW
SetEvent
GetLastError
GetCommandLineA
VerifyVersionInfoW
EnumSystemLocalesW
TlsAlloc
FindNextFileW
ReleaseSRWLockExclusive
DeleteFileW
GetProcAddress
GetFileType
InitializeCriticalSectionEx
EncodePointer
GetTimeFormatW
IsProcessorFeaturePresent
DeleteFileA
SetEnvironmentVariableW
GetFullPathNameW
HeapAlloc
IsDebuggerPresent
FormatMessageA
GetFileSize
TerminateProcess
GetFileAttributesExW
LoadLibraryW
IsValidLocale
lstrcatA
LCMapStringEx
InitializeSListHead
MoveFileExW
CreateFileW
CreateDirectoryA
GetEnvironmentStringsW
GetDriveTypeW
GetStringTypeW
LoadLibraryA
InitializeCriticalSection
LoadLibraryExW
CreateSemaphoreA
GetTempPathW
GetModuleHandleExW
SetFilePointer
FindClose
ReleaseSemaphore
GetCurrentDirectoryA
LCMapStringW
GetSystemInfo
GetConsoleOutputCP
GetLocaleInfoW
PeekNamedPipe
GetStartupInfoW
GetTimeZoneInformation
UnhandledExceptionFilter
HeapFree
RtlUnwind
TlsFree
CloseHandle
RemoveDirectoryA
GetCommandLineW
FlushFileBuffers
MultiByteToWideChar
WideCharToMultiByte
WaitForMultipleObjects
RemoveDirectoryW
QueryPerformanceFrequency
GetEnvironmentVariableA
GetSystemTimeAsFileTime
AreFileApisANSI
GetStdHandle
InitializeCriticalSectionAndSpinCount
FreeLibraryAndExitThread
LocalFree
WaitForSingleObjectEx
HeapSize
ReadConsoleW
GetProcessHeap
GetCurrentThread
GetTickCount64
SetStdHandle
GetCurrentThreadId
SetFileTime
Sleep
FindFirstFileA
FileTimeToSystemTime
GetTempPathA
CreateEventA
GetUserDefaultLCID
ReadFile
GetModuleHandleA
GlobalMemoryStatus
QueryPerformanceCounter
ExitProcess
SetFilePointerEx
GetConsoleMode
GetCurrentDirectoryW
SetEndOfFile
SetLastError
GetACP
GetFileAttributesW
SystemTimeToTzSpecificLocalTime
lstrcatW
FreeEnvironmentStringsW
WriteFile
DeleteCriticalSection
GetModuleFileNameA
IsValidCodePage
CreateThread
GetOEMCP
CreateFileA
GetSystemWow64DirectoryW
GetCurrentProcess
DecodePointer
GetCPInfo
FindFirstFileW
ExitThread
GetTickCount
FindNextFileA

user32

MessageBoxW
GetWindowLongA
SetWindowTextW
SetWindowTextA
SetWindowLongA
MessageBoxA
LoadIconA
ShowWindow
LoadStringW
LoadStringA
DialogBoxParamA
PostMessageA
CharUpperW
SetTimer
DestroyWindow
SendMessageA
DialogBoxParamW
EndDialog
KillTimer
CharUpperA
GetDlgItem
wsprintfA

shell32

SHGetSpecialFolderPathW

oleaut32

VariantClear
SysAllocStringLen
SysStringLen

bcrypt

BCryptGenRandom

advapi32

CryptAcquireContextW
CryptDestroyKey
CryptDestroyHash
CryptHashData
CryptEncrypt
RegCreateKeyExW
CryptCreateHash
CryptImportKey
CryptGetHashParam
RegOpenKeyExW
RegCloseKey
RegSetValueExW
CryptReleaseContext

ole32

CoInitialize
CoUninitialize
CoCreateInstance

crypt32

CertCloseStore
CertOpenStore
CertFindCertificateInStore
PFXImportCertStore
CryptQueryObject
CertGetCertificateChain
CertFreeCertificateContext
CertGetNameStringW
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CertFreeCertificateChain
CertEnumCertificatesInStore
CertAddCertificateContextToStore
CryptDecodeObjectEx
CryptStringToBinaryW
CertFindExtension

wldap32

ord147
ord133
ord301
ord79
ord142
ord46
ord145
ord219
ord167
ord14
ord216
ord73
ord208
ord41
ord117
ord26
ord27
ord127

ws2_32

recvfrom
sendto
ioctlsocket
gethostname
WSACloseEvent
bind
send
freeaddrinfo
WSAEventSelect
WSAResetEvent
WSAEnumNetworkEvents
WSAIoctl
WSAWaitForMultipleEvents
closesocket
WSAGetLastError
recv
WSACreateEvent
connect
getpeername
getsockname
getsockopt
htons
ntohs
setsockopt
socket
WSASetLastError
getaddrinfo
WSAStartup
WSACleanup
__WSAFDIsSet
select
accept
htonl
listen

Sections

.text
Size: 6.0MB - Virtual size: 6.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 212KB - Virtual size: 212KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 71KB - Virtual size: 71KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c61f65a7af6939836e7bbe4a515158f8

Headers

DLL Characteristics

File Characteristics

Imports

shlwapi

kernel32

user32

shell32

oleaut32

bcrypt

advapi32

ole32

crypt32

wldap32

ws2_32

Sections

.text Size: 6.0MB - Virtual size: 6.0MB

.rdata Size: 212KB - Virtual size: 212KB

.data Size: 6KB - Virtual size: 18KB

.rsrc Size: 3KB - Virtual size: 3KB

.reloc Size: 71KB - Virtual size: 71KB

.text
Size: 6.0MB - Virtual size: 6.0MB

.rdata
Size: 212KB - Virtual size: 212KB

.data
Size: 6KB - Virtual size: 18KB

.rsrc
Size: 3KB - Virtual size: 3KB

.reloc
Size: 71KB - Virtual size: 71KB