4a2ad49c934f9ae6ca6b5d0c7cc34f5e12d349640012fa8cf8eb7e2d3acd6c9f[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

4a2ad49c934f9ae6ca6b5d0c7cc34f5e12d349640012fa8cf8eb7e2d3acd6c9f.zip
Size

307KB
MD5

6a305fe69007aaeaf5774d110f66d628
SHA1

b369c137f60850c11c7679bb0338c6c8c1d1990d
SHA256

231c5967818c9c1a2afa5cb8a4905d951553b058f37bc713487fd8c38eee362c
SHA512

eaa4b20a81fed6221c6576e208e6458c25310e3fc698db9054dfe0e6caf34343fd0c2fa51f8658f69b6ba36033f55e4569fd1ad44fe816daf05486c186db9d67
SSDEEP

6144:k6zJyH5VreiHaRN7pQAywMMbVArfBqVCiWouLEsKL6h+dKCi2:v1YRei6RRplnMMSQUi5sKL6h+d42

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/4a2ad49c934f9ae6ca6b5d0c7cc34f5e12d349640012fa8cf8eb7e2d3acd6c9f.exe

Files

4a2ad49c934f9ae6ca6b5d0c7cc34f5e12d349640012fa8cf8eb7e2d3acd6c9f.zip
.zip

Password: infected
4a2ad49c934f9ae6ca6b5d0c7cc34f5e12d349640012fa8cf8eb7e2d3acd6c9f.exe
.exe windows x86

Password: infected

ae80b4ecb14ba8e602aaba0e2180c87d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

crypt32

CryptBinaryToStringA
CryptImportPublicKeyInfo
CryptStringToBinaryA
CryptDecodeObjectEx

wininet

InternetCloseHandle
InternetConnectA
HttpOpenRequestA
InternetReadFile
InternetCrackUrlA
InternetOpenA
HttpSendRequestA

shlwapi

PathRemoveExtensionW
StrCmpNIA
StrToIntA
StrChrA
StrToInt64ExA
StrSpnA
PathFindFileNameW
StrStrIA
StrCmpNW
StrChrIA
StrCpyNW
PathMatchSpecW
StrCmpNIW
StrPBrkA
PathCombineW
PathSkipRootW
StrStrIW
PathUnquoteSpacesW
StrChrW

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeA
VerQueryValueA
GetFileVersionInfoSizeW
GetFileVersionInfoA

mpr

WNetOpenEnumW
WNetCloseEnum
WNetEnumResourceW

imagehlp

CheckSumMappedFile

ws2_32

htons
sendto
socket
WSAStartup
inet_ntoa
inet_addr
htonl
shutdown
closesocket
gethostbyname

kernel32

WaitForSingleObject
SetEvent
OutputDebugStringW
SetFileTime
WriteFile
InitializeCriticalSection
Sleep
LeaveCriticalSection
GetTimeFormatW
GetFileAttributesW
FileTimeToSystemTime
ReadFile
GetFileSizeEx
MoveFileW
EnterCriticalSection
CreateEventW
SizeofResource
GetFileTime
DeleteCriticalSection
CloseHandle
FileTimeToLocalFileTime
lstrcpyW
CreateThread
LoadResource
FindResourceW
FreeResource
LocalFree
ExitProcess
lstrcpynA
MultiByteToWideChar
GetTempFileNameW
GetFileSize
MapViewOfFile
UnmapViewOfFile
FreeLibrary
CreateProcessW
LoadLibraryExW
LoadLibraryW
CopyFileW
ReadProcessMemory
GetSystemWow64DirectoryW
lstrcpynW
TerminateProcess
FlushInstructionCache
SetFilePointerEx
GetTempPathW
VirtualAllocEx
CreateFileMappingW
OpenEventW
WinExec
GetWindowsDirectoryW
DeleteFileW
WriteProcessMemory
ResumeThread
FindFirstFileW
GetModuleFileNameW
FindClose
SetFileAttributesW
WideCharToMultiByte
CreateMutexW
GetCurrentProcess
GetCurrentThreadId
SetFilePointer
SetThreadPriority
WaitForMultipleObjects
SetCurrentDirectoryW
OutputDebugStringA
SetProcessShutdownParameters
GetFileAttributesA
lstrlenA
SearchPathW
lstrcpyA
GetEnvironmentVariableW
IsBadWritePtr
TlsAlloc
GetVersionExW
lstrcmpiA
GetTickCount
GetModuleFileNameA
GetDateFormatW
GetProcAddress
lstrlenW
lstrcatW
MulDiv
GetSystemDirectoryW
CreateToolhelp32Snapshot
LockResource
SetErrorMode
GetSystemWindowsDirectoryW
GetModuleHandleW
GetVolumeInformationW
GetLastError
OpenMutexW
VirtualProtect
GetNativeSystemInfo
GetDriveTypeW
GetLogicalDrives
VirtualFree
VirtualAlloc
GetModuleHandleA
QueryDosDeviceW
FindNextFileW
HeapReAlloc
HeapAlloc
HeapFree
HeapCreate
HeapValidate
SetLastError
GetProcessHeaps
HeapSetInformation
GetCurrentProcessId
GetComputerNameA
lstrcmpiW
ExpandEnvironmentStringsW
CreateDirectoryW
Process32NextW
GetSystemInfo
OpenProcess
GetCurrentThread
IsBadStringPtrA
GetHandleInformation
IsBadCodePtr
IsBadStringPtrW
RtlUnwind
CreateFileW
FlushFileBuffers
Process32FirstW
IsBadReadPtr

advapi32

RegOpenKeyExW
RegCloseKey
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetKernelObjectSecurity
LookupPrivilegeValueW
CreateWellKnownSid
CheckTokenMembership
FreeSid
AllocateAndInitializeSid
DuplicateToken
GetTokenInformation
OpenProcessToken
ConvertSidToStringSidW
GetLengthSid
RegSetValueExW
RegFlushKey
RegOpenKeyW
AdjustTokenPrivileges
RegCreateKeyExW
RegEnumValueW
RegEnumKeyW
CryptDestroyKey
CryptAcquireContextW
CryptGetKeyParam
RegDeleteValueW
CryptEncrypt
RegQueryValueExW

user32

wsprintfW
DispatchMessageW
DefWindowProcW
RegisterClassW
CreateWindowExW
PeekMessageW
TranslateMessage
wsprintfA
CharLowerBuffA
GetSystemMetrics
GetKeyboardLayoutList
ReleaseDC
SystemParametersInfoW
GetDC
DrawTextA
FillRect
GetLastInputInfo
RegisterClassExW
UnregisterClassW
GetForegroundWindow

ole32

CoCreateInstance
CoInitializeSecurity
CoInitialize
CoInitializeEx
CoUninitialize

shell32

ShellExecuteW
ShellExecuteExW
SHGetFolderPathW
SHChangeNotify

ntdll

ZwOpenSection
RtlFreeUnicodeString
NtDeleteFile
isspace
RtlDosPathNameToNtPathName_U
memmove
ZwOpenProcess
ZwClose
ZwOpenDirectoryObject
ZwQuerySystemInformation
_chkstk
ZwQueryInformationProcess
_allmul
memcpy
_alldiv
memset
_aulldvrm
NtQueryVirtualMemory

oleaut32

SysAllocString
SysFreeString

gdi32

SetTextColor
DeleteDC
GetDeviceCaps
GetDIBits
SetBkColor
SetPixel
DeleteObject
SelectObject
CreateCompatibleDC
CreateCompatibleBitmap
CreateFontW
GetObjectW
GetStockObject

netapi32

NetUserEnum
NetUserGetInfo
NetApiBufferFree

Sections

.text
Size: 64KB - Virtual size: 63KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 32KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

ae80b4ecb14ba8e602aaba0e2180c87d

Headers

DLL Characteristics

File Characteristics

Imports

crypt32

wininet

shlwapi

version

mpr

imagehlp

ws2_32

kernel32

advapi32

user32

ole32

shell32

ntdll

oleaut32

gdi32

netapi32

Sections

.text Size: 64KB - Virtual size: 63KB

.rdata Size: 16KB - Virtual size: 14KB

.data Size: 12KB - Virtual size: 10KB

.rsrc Size: 32KB - Virtual size: 30KB

.text
Size: 64KB - Virtual size: 63KB

.rdata
Size: 16KB - Virtual size: 14KB

.data
Size: 12KB - Virtual size: 10KB

.rsrc
Size: 32KB - Virtual size: 30KB