0b997e8b0d0ff6cc4e6f1919c6c0f3080eaa0d08c8fccdf50f7648bf05cca446[.]zip

Resubmissions

23/06/2023, 08:47

230623-kp51lsde8410

23/06/2023, 08:31

230623-ketjtseg4s10

Sharing

Copy URL Twitter E-mail

General

Target
0b997e8b0d0ff6cc4e6f1919c6c0f3080eaa0d08c8fccdf50f7648bf05cca446.zip
Size 42KB
Sample230623-kp51lsde84
SHA256 90a15609ff6dab9ce8bc433c1fffca8fd5f3f5e8992536eb82e70b898ad2c826
MD5 9d63bc016905a660f5762e1f09b97d98
SHA1 b3c8624e786c5f715fe295cc6918199cdc773e69
SHA512 2506d8ad3f10507ac197fd5bec62207536efb5c3650c4343586b19df1836c73203c4588649bf77b3d4fe2f8587b88a7c5220d06504290a3867df060ee46f9372
SSDEEP 768:GmkM+Up4yhC/8KMEVim1PscQVnuT0BbdBfSDdugPOtVbG//2zWlrA8ATVUVoo:TX+i4yM/3Vwm6ccXBbdBfSpugSVbGH2i
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/0b997e8b0d0ff6cc4e6f1919c6c0f3080eaa0d08c8fccdf50f7648bf05cca446.exe

File Explorer

0b997e8b0d0ff6cc4e6f1919c6c0f3080eaa0d08c8fccdf50f7648bf05cca446.zip

.zip 42KB
0b997e8b0d0ff6cc4e6f1919c6c0f3080eaa0d08c8fccdf50f7648bf05cca446.exe

.exe 58KB

0b997e8b0d0ff6cc4e6f1919c6c0f3080eaa0d08c8fccdf50f7648bf05cca446.zip

SHA256 90a15609ff6dab9ce8bc433c1fffca8fd5f3f5e8992536eb82e70b898ad2c826
MD5 9d63bc016905a660f5762e1f09b97d98
SHA1 b3c8624e786c5f715fe295cc6918199cdc773e69
SHA512 2506d8ad3f10507ac197fd5bec62207536efb5c3650c4343586b19df1836c73203c4588649bf77b3d4fe2f8587b88a7c5220d06504290a3867df060ee46f9372
SSDEEP 768:GmkM+Up4yhC/8KMEVim1PscQVnuT0BbdBfSDdugPOtVbG//2zWlrA8ATVUVoo:TX+i4yM/3Vwm6ccXBbdBfSpugSVbGH2i
MD5 SHA1 SHA512 SSDEEP

Password

infected

0b997e8b0d0ff6cc4e6f1919c6c0f3080eaa0d08c8fccdf50f7648bf05cca446.exe

IMPHASH 851a0ba8fbb71710075bdfe6dcef92eb
SHA256 0b997e8b0d0ff6cc4e6f1919c6c0f3080eaa0d08c8fccdf50f7648bf05cca446
MD5 d458a2f85bc1330f13acccd63d88d015
SHA1 2604402597e41faa97db737fe0fb4166864752ad
SHA512 5e89c3541022d31df8d7d2b15522734649796428ba6842182ab59988d3ea5679e1f8b2903b4e7646785c46c8d41b5e99031a4875a340e9be84362b63797e1c99
SSDEEP 1536:hNeRBl5PT/rx1mzwRMSTdLpJ5mwnf+viID/:hQRrmzwR5JUD/
MD5 SHA1 SHA512 SSDEEP

windows x86

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

12199

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

mpr

WNetEnumResourceW WNetUseConnectionW WNetOpenEnumW WNetCloseEnum

ws2_32

ioctlsocket getpeername ntohl select WSAGetLastError htons recv socket closesocket getsockopt WSAAddressToStringW htonl connect

iphlpapi

GetIpAddrTable

winhttp

WinHttpReceiveResponse WinHttpOpenRequest WinHttpConnect WinHttpCloseHandle WinHttpOpen WinHttpSendRequest

kernel32

FindClose FindNextFileW SystemTimeToFileTime OpenProcess FindFirstFileW MoveFileW GetFileSizeEx SetFilePointerEx SetEndOfFile GetCurrentThreadId GetLocalTime ExitProcess SetFilePointer WaitForSingleObject GetComputerNameW SetEvent GetLogicalDrives GetTickCount Sleep CopyFileW GetFileAttributesW ReadFile CreateFileW MultiByteToWideChar CreateEventW WaitForMultipleObjects CloseHandle SetFileAttributesW CreateThread InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection ResetEvent DeleteCriticalSection AllocConsole WriteFile WideCharToMultiByte WriteConsoleW GetStdHandle CreateMutexW CreateProcessW GetCurrentProcess SetHandleInformation HeapFree GetLocaleInfoW ReadProcessMemory TerminateProcess GetModuleFileNameW FlushFileBuffers OpenMutexW GetLastError GetProcAddress Process32FirstW GetExitCodeThread CreatePipe Process32NextW GetModuleHandleA CreateToolhelp32Snapshot ReleaseMutex GetVersion DeleteFileW GetCurrentProcessId GetVolumeInformationW ExpandEnvironmentStringsW HeapAlloc GetProcessHeap HeapReAlloc QueryPerformanceCounter

user32

GetWindowThreadProcessId GetShellWindow

advapi32

FreeSid LookupPrivilegeValueW OpenProcessToken GetTokenInformation EqualSid RegSetValueExW RegCloseKey AdjustTokenPrivileges RegOpenKeyExW LookupAccountSidW AllocateAndInitializeSid DuplicateTokenEx RegQueryValueExW

shell32

ShellExecuteExW

ole32

CoGetObject CoInitializeEx CoUninitialize