10590255136[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

10590255136.zip
Size

419KB
MD5

0265ae8aefb459623a59eb84149957a8
SHA1

5254ef1d5840eb4290905373d5265e5fb8a98419
SHA256

82904a05f3519c723e59e04cbccbaeeebdad97ee7568fd0b00acbd29bd3be746
SHA512

52d4a7eea9adce8bcb0c17824dff4c62273c7e975e510a70201c4fe3924463b91f40c17b33c3a23d044150fd1c07c9db06d66925c495f4343a41e479763e411b
SSDEEP

12288:WMqtYAw+az2eruJPrpqEfVFnKm8TdG4EUqJcJvgvNMmKgQESQNs:32ToWp/Fnko4ETJcJvGNMmzSt

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/bc3078e8716f155aee2678e08cad48ceb6991572552fe82debc79df26de8c3af

Files

10590255136.zip
.zip

Password: infected
bc3078e8716f155aee2678e08cad48ceb6991572552fe82debc79df26de8c3af
.dll windows x86

95f272985140953ddcae67c7c99de31e

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

GetLastError
GlobalFree
VirtualProtect
lstrcmpiA
LoadLibraryA
GlobalAlloc
IsBadWritePtr
ExitProcess
InitializeCriticalSection
GetCurrentProcessId
GetTickCount
ResumeThread
SuspendThread
Sleep
CloseHandle
GetExitCodeThread
EnterCriticalSection
LeaveCriticalSection
GetCurrentProcess
GetVersion
GetCurrentThreadId
SetConsoleCtrlHandler
CreateFileA
CreateFileW
GetFileInformationByHandle
GetFileSize
LockFile
LockFileEx
OpenFile
ReadFile
ReadFileEx
SetEndOfFile
SetFilePointer
UnlockFile
UnlockFileEx
WriteFile
WriteFileEx
_hread
GetModuleFileNameA
CreateThread
_lcreat
_llseek
_lopen
_lread
_lwrite
FindFirstFileA
FindFirstFileW
FindNextFileA
FindNextFileW
LoadLibraryW
LoadLibraryExA
LoadLibraryExW
FreeLibrary
CreateFileMappingA
CreateFileMappingW
OpenFileMappingA
OpenFileMappingW
SetLastError
IsBadReadPtr
CreateEventA
WaitForSingleObject
SetEvent
GetOverlappedResult
VirtualAlloc
VirtualFree
WideCharToMultiByte
GetFileType
DeleteFileA
DeleteFileW
GetFullPathNameA
DeviceIoControl
GetTempPathA
GetWindowsDirectoryA
GetCommandLineA
GetPriorityClass
SetPriorityClass
GetThreadPriority
SetThreadPriority
GetCurrentThread
DuplicateHandle
GetLocalTime
GetModuleHandleA
GetProcAddress
_hwrite
_lclose
lstrcpyA
GetEnvironmentVariableA
UnmapViewOfFile
ReleaseMutex
FlushViewOfFile
LocalAlloc
lstrcmpA
CreateMutexA
lstrlenA
LocalFree
FormatMessageA
GetVersionExA
MapViewOfFile
MultiByteToWideChar

user32

CallNextHookEx
SetWindowsHookExA
GetActiveWindow
MessageBoxA
wsprintfA
LoadStringA

msvcrt

sscanf
fprintf
fopen
_getpid
strcat
ctime
strncat
vfprintf
strrchr
strchr
vsprintf
toupper
_getcwd
strtol
strtok
_setmbcp
setlocale
mbtowc
mbstowcs
wctomb
wcstombs
_mbsinc
iswctype
towupper
strncpy
fclose
time
wcstoul
wcsncat
wcscat
wcsrchr
wcschr
wcsncmp
wcscmp
wcsncpy
wcscpy
wcscspn
wcsspn
wcsstr
wcslen
wcstok
wcsftime
mblen
_isctype
fgets
strstr
memmove
fputc
fputs
_iob
strlen
memcpy
atol
memset
malloc
getenv
atoi
free
strcmp
fgetwc
fgetws
wcstol
sprintf
strcpy

advapi32

RegQueryValueExA
RegOpenKeyExA
RegCloseKey
InitializeSecurityDescriptor
RegOpenKeyA
SetSecurityDescriptorDacl
GetUserNameA

wsock32

closesocket
getsockname
bind
WSAGetLastError
getpeername
recv
send
connect
gethostname

Exports

Exports

clear_incrust_screen
get_distance_treuil
get_ident
get_ident_cam
get_incrust_col_count
get_incrust_row_count
get_pente
get_rotation
get_site
init_incrust_screen
initcom
set_incrust_color
set_incrust_off
set_incrust_on
teste_reception
write_string_to_incrust

Sections

0000001
Size: 336KB - Virtual size: 336KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

0000002
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

0000003
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

0000004
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

0000005
Size: 512B - Virtual size: 479B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

0000006
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

0000008
Size: 50KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

0000009
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

0000010
Size: 66KB - Virtual size: 66KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

0000011
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

95f272985140953ddcae67c7c99de31e

Headers

File Characteristics

Imports

kernel32

user32

msvcrt

advapi32

wsock32

Exports

Exports

Sections

0000001 Size: 336KB - Virtual size: 336KB

0000002 Size: 4KB - Virtual size: 4KB

0000003 Size: - Virtual size: 4KB

0000004 Size: 8KB - Virtual size: 8KB

0000005 Size: 512B - Virtual size: 479B

0000006 Size: 22KB - Virtual size: 22KB

.rsrc Size: 22KB - Virtual size: 22KB

0000008 Size: 50KB - Virtual size: 52KB

0000009 Size: 4KB - Virtual size: 4KB

0000010 Size: 66KB - Virtual size: 66KB

0000011 Size: 4KB - Virtual size: 3KB

0000001
Size: 336KB - Virtual size: 336KB

0000002
Size: 4KB - Virtual size: 4KB

0000003
Size: - Virtual size: 4KB

0000004
Size: 8KB - Virtual size: 8KB

0000005
Size: 512B - Virtual size: 479B

0000006
Size: 22KB - Virtual size: 22KB

.rsrc
Size: 22KB - Virtual size: 22KB

0000008
Size: 50KB - Virtual size: 52KB

0000009
Size: 4KB - Virtual size: 4KB

0000010
Size: 66KB - Virtual size: 66KB

0000011
Size: 4KB - Virtual size: 3KB