2b2f4945244472a57bce76055101bab1996c538ad2c6bcea5fe6c11733f23d69[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

2b2f4945244472a57bce76055101bab1996c538ad2c6bcea5fe6c11733f23d69.zip
Size

22KB
MD5

e9d2722ed00775927f3f67da0187f537
SHA1

9e59122f9813e88904f42692da260ed0f8970c76
SHA256

a7794148e41bdf99788034ecbcb8bca391b9768de64f2db4209ca09e251a5daf
SHA512

742fa25c4861cca468b531e9f738b3610c2d577e1f4d1f987865c4d3c7d24ea2b3e6c91eb857a84ce022490a99bce648e6425ad00b55333c2a27a4368588d003
SSDEEP

384:/UnaluEQMDvFnlsvd18hKgTeEKgpJOfTRfBktZGWJt+w7j1xgZjBzbXD+qwahQuX:MnaluEOcQgnKgpJObTktZ2w75xcjB3DP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/2b2f4945244472a57bce76055101bab1996c538ad2c6bcea5fe6c11733f23d69.exe

Files

2b2f4945244472a57bce76055101bab1996c538ad2c6bcea5fe6c11733f23d69.zip
.zip

Password: infected
2b2f4945244472a57bce76055101bab1996c538ad2c6bcea5fe6c11733f23d69.exe
.exe windows x86

Password: infected

b79142f1df6c12c1bc1cb268b4f995de

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

WriteConsoleW
SetFilePointerEx
SetStdHandle
GetConsoleMode
GetConsoleCP
FlushFileBuffers
LCMapStringEx
HeapSize
GetStringTypeW
WideCharToMultiByte
HeapReAlloc
HeapAlloc
RtlUnwind
LoadLibraryW
OutputDebugStringW
IsDebuggerPresent
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
Sleep
HeapFree
LeaveCriticalSection
EnterCriticalSection
GetModuleHandleW
TerminateProcess
GetCurrentProcess
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
SetUnhandledExceptionFilter
UnhandledExceptionFilter
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetTickCount64
EnumResourceTypesW
lstrlenW
VirtualAlloc
ExitProcess
ReadFile
LoadLibraryExW
CreateFileW
GetSystemTimeAsFileTime
GetCommandLineW
GetLastError
SetLastError
InterlockedIncrement
InterlockedDecrement
GetCurrentThreadId
IsProcessorFeaturePresent
EncodePointer
DecodePointer
GetModuleHandleExW
GetProcAddress
MultiByteToWideChar
GetStdHandle
WriteFile
GetModuleFileNameW
GetProcessHeap
GetFileType
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
InitOnceExecuteOnce
GetStartupInfoW
QueryPerformanceCounter
CloseHandle

rtm

RtmGetRouteAge
RtmDeregisterClient
MgmGetNextMfe

loadperf

LoadPerfCounterTextStringsA
UnloadPerfCounterTextStringsA

rtutils

TracePrintfA
TraceVprintfExW
TracePrintfW
RouterLogRegisterW
RouterLogEventStringW
TraceDumpExW

odbc32

ord11
ord262
ord107
ord41

mapi32

ord160
ord193
ord126
ord121
ord156
ord192
ord52

setupapi

SetupDiClassGuidsFromNameA
SetupDecompressOrCopyFileA
SetupFindFirstLineA
SetupDiGetClassDevsW

user32

GetMessageW
TranslateMessage
DispatchMessageW
SetWindowPos
UpdateWindow
BeginPaint
EndPaint
GetClientRect
MessageBoxW
LoadCursorW
CreateWindowExW
DefWindowProcW
PostQuitMessage
RegisterClassExW
ShowWindow

gdi32

SetTextColor
SelectObject
GetTextExtentPoint32W
DeleteObject
CreateFontW
TextOutW

Sections

.text
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

b79142f1df6c12c1bc1cb268b4f995de

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

rtm

loadperf

rtutils

odbc32

mapi32

setupapi

user32

gdi32

Sections

.text Size: 25KB - Virtual size: 25KB

.rdata Size: 10KB - Virtual size: 9KB

.data Size: 4KB - Virtual size: 11KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 3KB - Virtual size: 3KB

.text
Size: 25KB - Virtual size: 25KB

.rdata
Size: 10KB - Virtual size: 9KB

.data
Size: 4KB - Virtual size: 11KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 3KB - Virtual size: 3KB