10436363210[.]zip | Triage

Sharing

Copy URL Twitter E-mail

General

Target

10436363210.zip
Size

385KB
MD5

943b298cb093fe588897abd862f87bc5
SHA1

1d23aad942bfc2c70c7ef41179ba1455a8e5a378
SHA256

b395bbdc2a7a36f71609d2a5e378c0cbf02ef49903a3442f31173d05766a8e46
SHA512

cacad2033fa6073e0b8a478444a4816011f7f7eb463fef2e8a4348e89e23bfe9ed1f2a5f17375c36f07ae9264036e262b9a65e036c65846a423aee0bae357cde
SSDEEP

12288:Uj05WOwvDmvtoLh70tbaisl0+Em7kP0mOSfLCh65tgUd+:75W9DStcAtd60Yk6UB7gJ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/1235eb2b4775ffc52ad059a03f622036b518154346563133f399b174cf515294

Files

10436363210.zip
.zip

Password: infected
1235eb2b4775ffc52ad059a03f622036b518154346563133f399b174cf515294
.exe windows x86

216df81b1ef7bc2aa8ec52bbeef137c9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

PathAppendW

activeds

ord9
ord15

kernel32

CreateProcessW
GetSystemTime
lstrlenW
LocalFree

advapi32

CheckTokenMembership
CreateWellKnownSid

ole32

CoCreateInstance
CoSetProxyBlanket

Sections

.text
Size: 896KB - Virtual size: 895KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 62KB - Virtual size: 96KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 512B - Virtual size: 470B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ