tester[.]7z | Triage

Sharing

Copy URL Twitter E-mail

General

Target

tester.7z
Size

134KB
MD5

afadb17f53fef6c11a567f266b308f7f
SHA1

e8b199dc73ba2c9e9ebe0e9b3c58c3fab2a05f34
SHA256

473945c17be8d315270500768fa94e061a8a947e8f34a6734cbc2e7cb4127d65
SHA512

f70dab51e21148f59e5d6536e5fcb0bbeca9eada9012c2cdc11c81e1b7280c94a67d29036aea19cf13256b8453d38e86e8b175b0c526e730f46ca2e7afec8b9f
SSDEEP

3072:yhQ7ZIdHnHTjUpx3aD6Dw7tuHy4A6qI2nt+KLuNMfI:yuudHzjUpfWkSL/4QQMfI

Score

3^/10

pdf link

Malware Config

Signatures

One or more HTTP URLs in PDF identified
Detects presence of HTTP links in PDF files.
pdf link

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack002/DANFE353790299485523/DANFE353790299485523.exe

Files

tester.7z
.7z

Password: insanepassword123@
DANFE353790299485523.iso
.iso

Password: insanepassword123@
DANFE353790299485523.pdf.lnk
.lnk
DANFE353790299485523/DANFE353790299485523.exe
.exe windows x64

Password: insanepassword123@

272245e2988e1e430500b852c4fb5e18

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

_setmode
exit
iswxdigit
time
srand
_wtol
fflush
wcsstr
iswalpha
wcstoul
_errno
printf
rand
fprintf
wcsncmp
_pipe
_commode
_lock
wcsrchr
realloc
towlower
_initterm
__setusermatherr
setlocale
_wcsupr
iswdigit
_ultoa
_cexit
_unlock
_exit
__dllonexit
_wcsicmp
iswspace
wcschr
fgets
??_V@YAXPEAX@Z
_pclose
ferror
_onexit
__CxxFrameHandler3
_open_osfhandle
_close
feof
_dup
_wpopen
_wcsnicmp
?terminate@@YAXXZ
memset
wcstol
_get_osfhandle
_dup2
_getch
towupper
memcmp
_setjmp
wcsspn
_fmode
qsort
__set_app_type
_tell
_wcslwr
longjmp
_local_unwind
_purecall
__C_specific_handler
??3@YAXPEAX@Z
memcpy_s
free
calloc
__getmainargs
_XcptFilter
_amsg_exit
??1type_info@@UEAA@XZ
memmove
memcpy
_CxxThrowException
_vsnwprintf
swscanf
__iob_func
malloc
_callnewh
??0exception@@QEAA@AEBQEBD@Z
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBV0@@Z
??1exception@@UEAA@XZ
?what@exception@@UEBAPEBDXZ
wcscmp

ntdll

RtlLookupFunctionEntry
RtlCaptureContext
NtOpenProcessToken
NtQueryInformationToken
NtClose
NtOpenThreadToken
RtlFreeHeap
NtFsControlFile
RtlDosPathNameToNtPathName_U
RtlVirtualUnwind
RtlFreeUnicodeString
RtlReleaseRelativeName
NtOpenFile
RtlDosPathNameToRelativeNtPathName_U_WithStatus
NtSetInformationFile
NtQueryVolumeInformationFile
NtSetInformationProcess
NtQueryInformationProcess
RtlNtStatusToDosError
NtCancelSynchronousIoFile
RtlCreateUnicodeStringFromAsciiz
RtlFindLeastSignificantBit

api-ms-win-core-kernel32-legacy-l1-1-0

CopyFileW
GetConsoleWindow

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW
GetModuleFileNameA
LoadLibraryExW
GetProcAddress
GetModuleFileNameW
GetModuleHandleExW

api-ms-win-core-synch-l1-1-0

CreateSemaphoreExW
InitializeCriticalSection
WaitForSingleObject
ReleaseSemaphore
TryAcquireSRWLockExclusive
WaitForSingleObjectEx
ReleaseMutex
ReleaseSRWLockShared
AcquireSRWLockShared
LeaveCriticalSection
CreateMutexExW
EnterCriticalSection
ReleaseSRWLockExclusive
OpenSemaphoreW

api-ms-win-core-heap-l1-1-0

HeapFree
HeapAlloc
GetProcessHeap
HeapSetInformation
HeapReAlloc
HeapSize

api-ms-win-core-errorhandling-l1-1-0

SetLastError
UnhandledExceptionFilter
GetLastError
SetErrorMode
SetUnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-0

InitializeProcThreadAttributeList
GetCurrentThreadId
UpdateProcThreadAttribute
DeleteProcThreadAttributeList
GetStartupInfoW
CreateProcessAsUserW
OpenThread
CreateProcessW
ResumeThread
TerminateProcess
GetExitCodeProcess
GetCurrentProcess
GetCurrentProcessId

api-ms-win-core-localization-l1-2-0

GetThreadLocale
SetThreadLocale
FormatMessageW
GetLocaleInfoW
GetCPInfo
GetACP
GetUserDefaultLCID

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
DebugBreak
IsDebuggerPresent

api-ms-win-core-handle-l1-1-0

DuplicateHandle
CloseHandle

api-ms-win-core-memory-l1-1-0

VirtualAlloc
VirtualQuery
VirtualFree
ReadProcessMemory

api-ms-win-core-console-l1-1-0

ReadConsoleW
SetConsoleCtrlHandler
SetConsoleMode
WriteConsoleW
GetConsoleMode
GetConsoleOutputCP

api-ms-win-core-file-l1-1-0

CreateFileW
FlushFileBuffers
GetFileAttributesExW
GetDriveTypeW
FindClose
FindNextFileW
CreateDirectoryW
GetVolumeInformationW
SetFileAttributesW
SetEndOfFile
SetFilePointerEx
WriteFile
DeleteFileW
SetFileTime
GetVolumePathNameW
SetFilePointer
ReadFile
GetFileAttributesW
GetFileType
RemoveDirectoryW
FindFirstFileExW
CompareFileTime
GetFullPathNameW
GetDiskFreeSpaceExW
FileTimeToLocalFileTime
GetFileSize
FindFirstFileW

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
MultiByteToWideChar

api-ms-win-core-processenvironment-l1-1-0

GetCommandLineW
GetEnvironmentStringsW
ExpandEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SearchPathW
SetCurrentDirectoryW
GetCurrentDirectoryW
GetEnvironmentVariableW
SetEnvironmentStringsW
GetStdHandle

api-ms-win-core-console-l2-1-0

SetConsoleCursorPosition
GetConsoleScreenBufferInfo
ScrollConsoleScreenBufferW
FillConsoleOutputAttribute
FillConsoleOutputCharacterW
FlushConsoleInputBuffer
SetConsoleTextAttribute

api-ms-win-security-base-l1-1-0

GetFileSecurityW
RevertToSelf
GetSecurityDescriptorOwner

api-ms-win-core-sysinfo-l1-1-0

GetSystemTime
SetLocalTime
GetSystemTimeAsFileTime
GetTickCount
GetWindowsDirectoryW
GetLocalTime
GetVersion

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime
FileTimeToSystemTime

api-ms-win-core-datetime-l1-1-0

GetDateFormatW
GetTimeFormatW

api-ms-win-core-systemtopology-l1-1-0

GetNumaNodeProcessorMaskEx
GetNumaHighestNodeNumber

api-ms-win-core-console-l2-2-0

SetConsoleTitleW
GetConsoleTitleW

api-ms-win-core-processenvironment-l1-2-0

NeedCurrentDirectoryForExePathW

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegEnumKeyExW
RegDeleteKeyExW
RegDeleteValueW
RegQueryValueExW

api-ms-win-core-file-l2-1-0

MoveFileExW
CreateSymbolicLinkW
CreateHardLinkW
MoveFileWithProgressW
GetFileInformationByHandleEx

api-ms-win-core-heap-l2-1-0

GlobalAlloc
GlobalFree
LocalFree

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-core-winrt-l1-1-0

RoInitialize
RoUninitialize

api-ms-win-core-processtopology-l1-1-0

GetThreadGroupAffinity

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpW
lstrcmpiW

api-ms-win-core-processtopology-obsolete-l1-1-0

SetProcessAffinityMask

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Sections

.text
Size: 185KB - Virtual size: 184KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 41KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 110KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 144B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 776B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
DANFE353790299485523/DANFE353790299485523.pdf
.pdf
Password: insanepassword123@
- http://NF-ewww.nfe.fazenda.gov.br/portal
- http://www.webdanfe.com.br

Sharing

General

Malware Config

Signatures

Files

Password: insanepassword123@

Password: insanepassword123@

Password: insanepassword123@

272245e2988e1e430500b852c4fb5e18

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

ntdll

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-console-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-console-l2-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-datetime-l1-1-0

api-ms-win-core-systemtopology-l1-1-0

api-ms-win-core-console-l2-2-0

api-ms-win-core-processenvironment-l1-2-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-file-l2-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-io-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-processtopology-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-processtopology-obsolete-l1-1-0

api-ms-win-core-apiquery-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Sections

.text Size: 185KB - Virtual size: 184KB

.rdata Size: 41KB - Virtual size: 41KB

.data Size: 512B - Virtual size: 110KB

.pdata Size: 9KB - Virtual size: 8KB

.didat Size: 512B - Virtual size: 144B

.rsrc Size: 33KB - Virtual size: 33KB

.reloc Size: 1024B - Virtual size: 776B

Password: insanepassword123@

.text
Size: 185KB - Virtual size: 184KB

.rdata
Size: 41KB - Virtual size: 41KB

.data
Size: 512B - Virtual size: 110KB

.pdata
Size: 9KB - Virtual size: 8KB

.didat
Size: 512B - Virtual size: 144B

.rsrc
Size: 33KB - Virtual size: 33KB

.reloc
Size: 1024B - Virtual size: 776B