10610438586[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

10610438586.zip
Size

3.0MB
MD5

359425b8564b18edf998005e0c22c44f
SHA1

d4e0f8df7a43294db2cd905e87c14506db51df1b
SHA256

03891a7f1d14d96ea2b7c332f05310fd11f622a4ed8cb454fd97636374f529ac
SHA512

7776c3aaff7009a57a91ec8a84428e33a8649e921457cc6c28eb39c5b84611ab03f8af4cbd07f3c0df5662f625286fe9846c7215f6ae97d768991a685cf4d5e8
SSDEEP

49152:PpMiS36XUaaG+W6ctbpWLZSa3TPf5Kh/56j0mYZPJgYXOqGAq89pIHrKuKAvxyRO:PgyIGSQiSCNKhkj0muetqG4XILDK+LTF

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/62bbcaa1cbb5cd9d16d645132a7ac57ec3eef1f6e15fc79f5ff2158023ae7d1c

Files

10610438586.zip
.zip

Password: infected
62bbcaa1cbb5cd9d16d645132a7ac57ec3eef1f6e15fc79f5ff2158023ae7d1c
.exe windows x86

Password: infected

19e0a34398ad53fb4358b2153705f6e6

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

rasapi32

RasHangUpA

kernel32

SetCurrentDirectoryA

user32

GetCursorPos

gdi32

SetMapMode

winmm

waveOutRestart

winspool.drv

DocumentPropertiesA

advapi32

RegCreateKeyExA

shell32

ShellExecuteA

ole32

CLSIDFromString

oleaut32

UnRegisterTypeLi

comctl32

ImageList_Destroy

ws2_32

inet_ntoa

wininet

HttpQueryInfoA

comdlg32

GetSaveFileNameA

msvcrt

strncpy

iphlpapi

GetInterfaceInfo

psapi

GetMappedFileNameW

Sections

.text
Size: 2.2MB - Virtual size: 3.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.sedata
Size: 976KB - Virtual size: 976KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 72KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.sedata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

19e0a34398ad53fb4358b2153705f6e6

Headers

File Characteristics

Imports

rasapi32

kernel32

user32

gdi32

winmm

winspool.drv

advapi32

shell32

ole32

oleaut32

comctl32

ws2_32

wininet

comdlg32

msvcrt

iphlpapi

psapi

Sections

.text Size: 2.2MB - Virtual size: 3.9MB

.sedata Size: 976KB - Virtual size: 976KB

.idata Size: 4KB - Virtual size: 4KB

.rsrc Size: 72KB - Virtual size: 72KB

.sedata Size: 4KB - Virtual size: 4KB

.text
Size: 2.2MB - Virtual size: 3.9MB

.sedata
Size: 976KB - Virtual size: 976KB

.idata
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 72KB - Virtual size: 72KB

.sedata
Size: 4KB - Virtual size: 4KB