65f3162d46b247a9b79ace4c19e6ad81c5aa00a2229a6557f377f9ced697df01[.]zip

Resubmissions

18/05/2023, 11:13

230518-nbkz3aae67 10

18/05/2023, 11:10

230518-m9sl5ahe4w 10

Sharing

Copy URL Twitter E-mail

General

Target

65f3162d46b247a9b79ace4c19e6ad81c5aa00a2229a6557f377f9ced697df01.zip
Size

80KB
MD5

cd398b04ca12a63a8912a8779397cd72
SHA1

10e1e1e40a9a0cf2f72d85fbe5259eb1cd345d3f
SHA256

1b21d198073feb27ea7e9e5582492e507882d0700e09df68d0f80d4cdfa3823b
SHA512

ef4c0dc8416a3c745094f66fbe480a01df760f41c34bcee8836903d78d45abb6ddfbf2d40528bf021e34d49c744acfb5a31377ec91cd41e6a27bd90b96892d87
SSDEEP

1536:ywBlwRleg/TT7fo0oT/avAPWOXjmNpMWYdWiiHaSBjTSEjZLymSvajg4:zBHg/TXoT2APlXiNpABi1ZSik4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/65f3162d46b247a9b79ace4c19e6ad81c5aa00a2229a6557f377f9ced697df01.exe

Files

65f3162d46b247a9b79ace4c19e6ad81c5aa00a2229a6557f377f9ced697df01.zip
.zip

Password: infected
65f3162d46b247a9b79ace4c19e6ad81c5aa00a2229a6557f377f9ced697df01.exe
.exe windows x86

3f3196be03f57bb3aff9424932885030

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetDefaultCommConfigW
HeapAlloc
GetConsoleAliasA
GetEnvironmentStringsW
SetConsoleScreenBufferSize
AddConsoleAliasW
SizeofResource
FindNextVolumeW
SetConsoleCursorPosition
WriteConsoleW
GetModuleFileNameW
LCMapStringA
SetLastError
GetProcAddress
VirtualAlloc
BeginUpdateResourceW
GetFirmwareEnvironmentVariableW
GetAtomNameA
LoadLibraryA
LocalAlloc
GetModuleFileNameA
EraseTape
lstrcpyW
SetProcessAffinityMask
CreateFileW
ReadFile
EncodePointer
DecodePointer
GetCommandLineA
HeapSetInformation
GetStartupInfoW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
GetCurrentProcess
IsProcessorFeaturePresent
EnterCriticalSection
LeaveCriticalSection
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
GetModuleHandleW
ExitProcess
WriteFile
HeapCreate
Sleep
HeapSize
RtlUnwind
GetLastError
SetFilePointer
HeapFree
CloseHandle
FreeEnvironmentStringsW
WideCharToMultiByte
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
GetCurrentThreadId
InterlockedDecrement
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
RaiseException
GetConsoleCP
GetConsoleMode
LoadLibraryW
HeapReAlloc
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
CreateFileA
SetStdHandle
FlushFileBuffers
MultiByteToWideChar
LCMapStringW
GetStringTypeW
SetEndOfFile
GetProcessHeap

user32

GetCursorPos

gdi32

GetCharWidth32A

advapi32

CloseEventLog

Sections

.text
Size: 77KB - Virtual size: 76KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gudo
Size: 1024B - Virtual size: 626B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

Password: infected

3f3196be03f57bb3aff9424932885030

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

Sections

.text Size: 77KB - Virtual size: 76KB

.rdata Size: 19KB - Virtual size: 18KB

.data Size: 6KB - Virtual size: 36KB

.gudo Size: 1024B - Virtual size: 626B

.rsrc Size: 26KB - Virtual size: 26KB

.text
Size: 77KB - Virtual size: 76KB

.rdata
Size: 19KB - Virtual size: 18KB

.data
Size: 6KB - Virtual size: 36KB

.gudo
Size: 1024B - Virtual size: 626B

.rsrc
Size: 26KB - Virtual size: 26KB