3d8a3a50bea9cb76347fb4e10a406ba60a7ccd6e591326ca656d393282d1a3a4[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

3d8a3a50bea9cb76347fb4e10a406ba60a7ccd6e591326ca656d393282d1a3a4.zip
Size

308KB
MD5

d87abb5738517e67aa1dcfdca4dd0e1f
SHA1

527669081faa9361eb9008ad9a08381ddfbdd3c2
SHA256

c2c9aa21e4f812559469d4b56c0cb30ee0c4358451c86995596e8e29ec0f1ca5
SHA512

5cd90b4d3657c41c59d12bec02da7e27f54d89580e899fd99c246d6d14d548761185a1241a171e83eb6b83be945a6d3e4f25a8a31f67bfac03f55cd68e1444c8
SSDEEP

6144:SD+oaaSwoTrljl1OhESkyBHtEgwtOLOIeL+zwAo6qp7BYX/B/yPCWW0XiUXujs5G:0+drlDOxklH4Oyz/ovxSZyPXNXmjsI

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/3d8a3a50bea9cb76347fb4e10a406ba60a7ccd6e591326ca656d393282d1a3a4.exe

Files

3d8a3a50bea9cb76347fb4e10a406ba60a7ccd6e591326ca656d393282d1a3a4.zip
.zip

Password: infected
3d8a3a50bea9cb76347fb4e10a406ba60a7ccd6e591326ca656d393282d1a3a4.exe
.exe windows x86

Password: infected

a9b8f84ed7e3b395834ca51370b2661f

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

wsock32

bind
setsockopt
socket
gethostname
WSASetLastError
WSAStartup
htons
send
getsockopt
connect
gethostbyaddr
inet_ntoa
htonl
sendto
select
recv
WSAGetLastError
WSACleanup
closesocket
gethostbyname

ssleay32

ord183
ord96
ord48
ord8
ord172
ord12
ord75
ord87
ord43
ord108
ord78

kernel32

TlsGetValue
lstrcpynA
GlobalFlags
WritePrivateProfileStringA
GetCurrentDirectoryA
GetLastError
GetProcessVersion
GetThreadLocale
GetCPInfo
GetOEMCP
SetErrorMode
DuplicateHandle
CreateFileA
ReadFile
WriteFile
SetFilePointer
FlushFileBuffers
LockFile
UnlockFile
SetEndOfFile
DeleteFileA
FindClose
FindFirstFileA
GetVolumeInformationA
GetFullPathNameA
FileTimeToSystemTime
FileTimeToLocalFileTime
GetFileAttributesA
GetFileSize
GetFileTime
RtlUnwind
GetTimeZoneInformation
GetSystemTime
GetLocalTime
GetFileType
GetSystemTimeAsFileTime
HeapFree
GetDriveTypeA
LocalReAlloc
RemoveDirectoryA
GetStartupInfoA
GetCommandLineA
ExitProcess
TerminateProcess
HeapAlloc
RaiseException
HeapReAlloc
HeapSize
GetACP
SetStdHandle
SetHandleCount
GetStdHandle
LCMapStringA
LCMapStringW
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetUnhandledExceptionFilter
GetStringTypeA
GetStringTypeW
IsBadReadPtr
IsBadCodePtr
CompareStringA
CompareStringW
SetEnvironmentVariableA
TlsSetValue
EnterCriticalSection
GlobalReAlloc
LeaveCriticalSection
TlsFree
GlobalHandle
DeleteCriticalSection
TlsAlloc
InitializeCriticalSection
GetTickCount
FormatMessageA
WideCharToMultiByte
InterlockedIncrement
InterlockedDecrement
GetProfileStringA
CreateThread
MoveFileA
SetCurrentDirectoryA
GetModuleFileNameA
GlobalFree
GlobalAlloc
LocalSize
MulDiv
SetLastError
LoadLibraryA
FreeLibrary
GetVersion
lstrcatA
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalUnlock
GlobalLock
GlobalDeleteAtom
lstrcmpA
lstrcmpiA
GetCurrentThread
GetCurrentThreadId
GetWindowsDirectoryA
MultiByteToWideChar
CreateDirectoryA
GetModuleHandleA
GetProcAddress
GetCurrentProcess
GetVersionExA
lstrcpyA
CreateProcessA
lstrlenA
GetExitCodeThread
GetExitCodeProcess
TerminateThread
CloseHandle
LocalAlloc
LocalFree
FindResourceA
LoadResource
SizeofResource
LockResource
Sleep
FindNextFileA

user32

BeginPaint
EndPaint
TabbedTextOutA
DrawTextA
GrayStringA
WindowFromPoint
DestroyMenu
RegisterClipboardFormatA
GetClassNameA
PtInRect
GetSysColorBrush
LoadStringA
CharNextA
CopyAcceleratorTableA
SetRect
GetNextDlgGroupItem
MessageBeep
PostThreadMessageA
InvalidateRect
CharUpperA
InflateRect
GetTopWindow
IsChild
GetCapture
WinHelpA
wsprintfA
GetClassInfoA
RegisterClassA
GetMenuItemCount
GetSubMenu
GetMenuItemID
GetWindowTextLengthA
GetWindowTextA
GetDlgCtrlID
DefWindowProcA
CreateWindowExA
GetClassLongA
SetPropA
GetPropA
GetWindowDC
RemovePropA
GetMessageTime
GetMessagePos
SetForegroundWindow
SetWindowLongA
RegisterWindowMessageA
OffsetRect
IntersectRect
SystemParametersInfoA
GetWindowPlacement
MapDialogRect
SetWindowPos
GetWindow
SetWindowContextHelpId
EndDialog
SetActiveWindow
IsWindow
CreateDialogIndirectParamA
DestroyWindow
SetMenuItemBitmaps
CheckMenuItem
EnableMenuItem
GetFocus
GetNextDlgTabItem
GetMessageA
GetActiveWindow
ValidateRect
IsWindowVisible
GetCursorPos
GetParent
GetLastActivePopup
IsWindowEnabled
GetWindowLongA
PostQuitMessage
ShowWindow
DestroyIcon
SetTimer
AppendMenuA
RemoveMenu
CallNextHookEx
LoadIconA
LoadBitmapA
GetWindowRect
GetForegroundWindow
MessageBoxA
GetKeyState
TranslateMessage
DispatchMessageA
PeekMessageA
GetDlgItem
EnableWindow
LoadCursorA
SetCursor
GetMenuState
GetMenu
DrawMenuBar
ModifyMenuA
PostMessageA
SetWindowsHookExA
UnhookWindowsHookEx
IsIconic
GetClientRect
DrawIcon
ScreenToClient
SendMessageA
GetSystemMetrics
LoadImageA
GetDesktopWindow
CopyRect
ReleaseDC
GetDC
ClientToScreen
MoveWindow
SetWindowTextA
IsDialogMessageA
IsDlgButtonChecked
SetDlgItemTextA
SetDlgItemInt
GetDlgItemTextA
DrawFocusRect
GetDlgItemInt
CheckRadioButton
CheckDlgButton
UpdateWindow
SendDlgItemMessageA
MapWindowPoints
GetSysColor
SetFocus
AdjustWindowRectEx
CallWindowProcA
IsWindowUnicode
DefDlgProcA
ExcludeUpdateRgn
ShowCaret
HideCaret
UnregisterClassA
GetMenuCheckMarkDimensions

gdi32

RestoreDC
SelectObject
GetStockObject
SetBkMode
SetMapMode
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
SaveDC
IntersectClipRect
GetDeviceCaps
GetViewportExtEx
GetWindowExtEx
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
GetTextColor
GetBkColor
DPtoLP
LPtoDP
GetMapMode
PatBlt
DeleteDC
GetObjectA
SetBkColor
SetTextColor
GetClipBox
CreateBitmap
DeleteObject
GetTextExtentPointA
BitBlt
CreateCompatibleDC
CreateDIBitmap
CreateSolidBrush

comdlg32

GetFileTitleA

winspool.drv

ClosePrinter
DocumentPropertiesA
OpenPrinterA

advapi32

RegDeleteKeyA
RegDeleteValueA
RegOpenKeyExA
RegCloseKey
RegCreateKeyExA
RegQueryValueExA
RegSetValueExA

shell32

SHGetSpecialFolderPathA
SHGetMalloc
SHGetPathFromIDListA
SHGetSpecialFolderLocation
ShellExecuteA

comctl32

ord17

oledlg

ord8

ole32

CLSIDFromProgID
CoGetClassObject
CLSIDFromString
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
CoTaskMemFree
CoTaskMemAlloc
OleInitialize
OleUninitialize
StgOpenStorageOnILockBytes
CoFreeUnusedLibraries
CoRegisterMessageFilter
CoRevokeClassObject
OleIsCurrentClipboard
OleFlushClipboard
CoCreateInstance

olepro32

ord253

oleaut32

SysAllocStringByteLen
SysAllocString
VariantChangeType
VariantCopy
SysStringLen
VariantTimeToSystemTime
VariantClear
SysAllocStringLen
SysFreeString

Sections

.text
Size: 236KB - Virtual size: 235KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 60KB - Virtual size: 96KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 244KB - Virtual size: 241KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

a9b8f84ed7e3b395834ca51370b2661f

Headers

File Characteristics

Imports

wsock32

ssleay32

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

oledlg

ole32

olepro32

oleaut32

Sections

.text Size: 236KB - Virtual size: 235KB

.rdata Size: 40KB - Virtual size: 39KB

.data Size: 60KB - Virtual size: 96KB

.rsrc Size: 244KB - Virtual size: 241KB

.text
Size: 236KB - Virtual size: 235KB

.rdata
Size: 40KB - Virtual size: 39KB

.data
Size: 60KB - Virtual size: 96KB

.rsrc
Size: 244KB - Virtual size: 241KB