5360880a00a11ef09a25a672f3d9e1ade135bca582c74a1b8f853b9837dc29c5[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

5360880a00a11ef09a25a672f3d9e1ade135bca582c74a1b8f853b9837dc29c5.zip
Size

1.8MB
MD5

5b3f070cf00fe58e519a949ce106bde8
SHA1

13c1ae58d31c530c60ebe72eb69b90753ada27e3
SHA256

7bb648b746a691132e9714ce9917b64286219827c991e9396fc198b88c6e1216
SHA512

6ee9d3f5d11555b631c3fd6bce02fc4cb1bf64a1ffc3b005d4a5f1730113a2fae69b3ea277dd8fea91cf133049f46a47769f41d3621300916f2ebb0435079706
SSDEEP

49152:XdBP5pL6ZBZ47PeDueWMqZfisfg2sopO0O:rLiDuecftY2lpO0O

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack002/5360880a00a11ef09a25a672f3d9e1ade135bca582c74a1b8f853b9837dc29c5

Files

5360880a00a11ef09a25a672f3d9e1ade135bca582c74a1b8f853b9837dc29c5.zip
.zip

Password: infected
5360880a00a11ef09a25a672f3d9e1ade135bca582c74a1b8f853b9837dc29c5.zip
.zip

Password: infected
5360880a00a11ef09a25a672f3d9e1ade135bca582c74a1b8f853b9837dc29c5
.exe windows x86

Password: infected

a152a887c62352e5d0ee2b309c926dda

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

NtQuerySystemInformation
NtDeviceIoControlFile
RtlNtStatusToDosError
RtlCaptureContext
NtCancelIoFileEx

kernel32

DeviceIoControl
CreateFileW
GetSystemInfo
GetSystemTimes
SleepConditionVariableSRW
lstrlenW
GetProcessTimes
OpenProcess
FlushFileBuffers
GetTickCount
QueryPerformanceCounter
MapViewOfFile
CreateFileMappingW
FormatMessageA
GetSystemTime
FreeLibrary
SystemTimeToFileTime
GetProcessHeap
GetFileSize
LockFileEx
LocalFree
UnlockFile
HeapDestroy
HeapCompact
HeapAlloc
LoadLibraryW
HeapReAlloc
DeleteFileW
DeleteFileA
WaitForSingleObjectEx
LoadLibraryA
CreateFileA
GetVolumeInformationW
OutputDebugStringW
GetFileAttributesExW
GetFileAttributesA
GetLastError
GetDiskFreeSpaceA
FormatMessageW
GetTempPathA
MultiByteToWideChar
HeapSize
HeapValidate
UnmapViewOfFile
GetFileAttributesW
WaitForSingleObject
CreateMutexW
GetTempPathW
UnlockFileEx
SetEndOfFile
GetFullPathNameA
SetFilePointer
LockFile
OutputDebugStringA
GetDiskFreeSpaceW
GetFullPathNameW
HeapFree
HeapCreate
AreFileApisANSI
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
GetCurrentThreadId
GetProcessIoCounters
GetSystemTimeAsFileTime
GetLogicalDrives
GlobalMemoryStatusEx
GetTickCount64
FlushViewOfFile
GetDiskFreeSpaceExW
GetProcAddress
GetModuleHandleA
Sleep
WriteFile
ReadFile
CancelIoEx
SetFileCompletionNotificationModes
GetQueuedCompletionStatusEx
CreateIoCompletionPort
PostQueuedCompletionStatus
GetCurrentProcessId
SetHandleInformation
ReleaseSRWLockExclusive
TryAcquireSRWLockExclusive
AcquireSRWLockExclusive
GetDriveTypeW
DuplicateHandle
TlsFree
InitOnceComplete
GetCurrentProcess
TlsAlloc
TlsSetValue
TlsGetValue
CloseHandle
UnhandledExceptionFilter
InitOnceBeginInitialize
AcquireSRWLockShared
ReleaseSRWLockShared
CreateThread
QueryPerformanceFrequency
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetTimeZoneInformation
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
WriteConsoleW
ReleaseMutex
FindClose
AddVectoredExceptionHandler
SetThreadStackGuarantee
SwitchToThread
GetCurrentThread
SetLastError
GetCurrentDirectoryW
GetEnvironmentVariableW
WideCharToMultiByte
SetFileInformationByHandle
SetFilePointerEx
CreateDirectoryW
GetStdHandle
TerminateProcess
WakeAllConditionVariable
WakeConditionVariable
CreateMutexA
FindNextFileW
GetFileInformationByHandle
GetFileInformationByHandleEx
FindFirstFileW
GetFinalPathNameByHandleW
CopyFileExW
GetConsoleMode
GetModuleHandleW
ExitProcess

advapi32

RegQueryValueExA
RegQueryValueExW
SystemFunction036
RegCloseKey
RegOpenKeyExW

crypt32

CertAddCertificateContextToStore
CertDuplicateStore
CertEnumCertificatesInStore
CertCloseStore
CertVerifyCertificateChainPolicy
CertGetCertificateChain
CertOpenStore
CertFreeCertificateContext
CertDuplicateCertificateChain
CertFreeCertificateChain
CryptUnprotectData
CertDuplicateCertificateContext

ws2_32

WSAIoctl
setsockopt
WSASend
WSARecv
recv
shutdown
getsockopt
getpeername
ioctlsocket
bind
WSASocketW
closesocket
WSAGetLastError
WSAGetOverlappedResult
WSAStartup
WSACleanup
freeaddrinfo
getaddrinfo

ole32

CoInitializeSecurity
CoInitializeEx
CoTaskMemFree
CoUninitialize
CoSetProxyBlanket
CoCreateInstance

oleaut32

SysAllocString
VariantClear
SysFreeString

pdh

PdhAddCounterW
PdhCollectQueryData
PdhCloseQuery
PdhLookupPerfNameByIndexW
PdhGetFormattedCounterValue
PdhRemoveCounter
PdhOpenQueryA

powrprof

CallNtPowerInformation

psapi

GetPerformanceInfo
EnumProcessModulesEx
GetModuleFileNameExW

iphlpapi

GetIfTable2
FreeMibTable
GetIfEntry2

netapi32

NetUserGetLocalGroups
NetApiBufferFree
NetQueryDisplayInformation

shell32

SHGetKnownFolderPath

bcrypt

BCryptGenRandom

secur32

InitializeSecurityContextW
FreeCredentialsHandle
EncryptMessage
DecryptMessage
DeleteSecurityContext
ApplyControlToken
AcceptSecurityContext
FreeContextBuffer
QueryContextAttributesW
AcquireCredentialsHandleA

vcruntime140

_except_handler4_common
memmove
memset
memcmp
strrchr
__CxxFrameHandler3
__current_exception_context
__current_exception
memcpy

api-ms-win-crt-heap-l1-1-0

_msize
_set_new_mode
free
malloc
realloc

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-string-l1-1-0

strncmp
strlen
strcspn

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table
_crt_atexit
_controlfp_s
exit
_register_onexit_function
_c_exit
_cexit
__p___argv
__p___argc
terminate
_beginthreadex
_endthreadex
_register_thread_local_exe_atexit_callback
_seh_filter_exe
_set_app_type
_configure_narrow_argv
_initialize_narrow_environment
_get_initial_narrow_environment
_initterm
_exit
_initterm_e

api-ms-win-crt-math-l1-1-0

_libm_sse2_log_precise
__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode
_set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 2.7MB - Virtual size: 2.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 743KB - Virtual size: 742KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 22KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 101KB - Virtual size: 101KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

Password: infected

a152a887c62352e5d0ee2b309c926dda

Headers

DLL Characteristics

File Characteristics

Imports

ntdll

kernel32

advapi32

crypt32

ws2_32

ole32

oleaut32

pdh

powrprof

psapi

iphlpapi

netapi32

shell32

bcrypt

secur32

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 2.7MB - Virtual size: 2.7MB

.rdata Size: 743KB - Virtual size: 742KB

.data Size: 22KB - Virtual size: 24KB

.reloc Size: 101KB - Virtual size: 101KB

.text
Size: 2.7MB - Virtual size: 2.7MB

.rdata
Size: 743KB - Virtual size: 742KB

.data
Size: 22KB - Virtual size: 24KB

.reloc
Size: 101KB - Virtual size: 101KB