10473686937[.]zip | Triage

Sharing

Copy URL Twitter E-mail

General

Target

10473686937.zip
Size

94KB
MD5

b02d4d419f0f655c14cf537892164a07
SHA1

09eef4edc9a0bdfb17b38cbe01be8d598fb52eb5
SHA256

ff3abe94cb75617f38ecd3f20b6eb86fb25c4d065d5ef0eb0de20d93814d7e29
SHA512

cab2a04b27a03e7ea2ae1af262219fd1313568302138ab26200fd9c18ec94950c9a7e5262350539470985bbe252de71d35d2c2aff6ebf542a0dd13004d998076
SSDEEP

1536:lAlOeQTxrJ+qIpUxmQ2IKEyaZFwZTy6/Bnjk+yfyg6oDDWfq5YsV8uFldxxt:qoe2r4qImxd2BEyaMM6/VjpyH6oPWqYk

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/b15225b62ab21063e1397fb9da4da92a5902d0f806842dc8eee33664f047abfc

Files

10473686937.zip
.zip

Password: infected
b15225b62ab21063e1397fb9da4da92a5902d0f806842dc8eee33664f047abfc
.exe windows x86

b5688d14696c0efcb4bfb3c1231064a0

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm60

MethCallEngine
ord518
ord626
ord598
ord520
ord525
EVENT_SINK_AddRef
ord528
ord529
ord560
DllFunctionCall
EVENT_SINK_Release
ord600
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord711
ord531
ord716
ProcCallEngine
ord537
ord645
ord648
ord681
ord576
ord578
ord100
ord579
ord610
ord616
ord617
ord619
ord542
ord545
ord580

Sections

.text
Size: 72KB - Virtual size: 70KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 64KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ