10476719204[.]zip | Triage

Sharing

Copy URL Twitter E-mail

General

Target

10476719204.zip
Size

8KB
MD5

08108fde98b1f8f00d33bfe189dbd041
SHA1

9adefeb353c32e0ce17355760dd5644672cf61c2
SHA256

6592602c8d78678db650ab66a891e61d599724d4994d290c8dd8979b34ea8773
SHA512

24915f69142a1ff822051def20a16b939eb9e23a3394e2acfbbf8c541907a7dd583108b4990df0a684156b91d3ff15e786421e23dec368a36973283fb5ba09e0
SSDEEP

192:fXyQ/IBeEaqvGSuXFLs7LQ/3ZTh/pcQxrpZLvt:fTQsEa3HXFLsg/Zd/pZxHR

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/ec3adc8f8bc36d34903a9f5e089ee4b4f31b2461395d7bd0012a929accdf2091

Files

10476719204.zip
.zip

Password: infected
ec3adc8f8bc36d34903a9f5e089ee4b4f31b2461395d7bd0012a929accdf2091
.dll windows x64

37af5cd8fc35f39f0815827f7b80b304

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

CreateMutexA
WaitForSingleObject
ReleaseMutex
Sleep
GetLastError
SetEvent
lstrcpyA
CloseHandle
CreateThread
ResetEvent
GetCurrentProcessId
GetComputerNameExA
DeleteCriticalSection
VirtualFree
VirtualAlloc
WaitForMultipleObjects
GetQueuedCompletionStatus
PostQueuedCompletionStatus
CreateIoCompletionPort
HeapFree
EnterCriticalSection
HeapReAlloc
InitializeCriticalSection
LeaveCriticalSection
HeapAlloc
HeapDestroy
HeapCreate
lstrlenA
CreateEventA

user32

wsprintfA

advapi32

GetUserNameA
SystemFunction036

ws2_32

inet_addr
select
gethostbyname
closesocket
socket
inet_ntoa
recv
htons
WSACleanup
WSAStartup
send
connect

iphlpapi

GetAdaptersInfo

Exports

Exports

nuyqDowzvzgGHAQM

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 856B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 360B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ