sample (1)[.]zip | Triage

Sharing

General

Target

sample (1).zip
Size

117KB
MD5

b508a277f3a03dc1d75cd2211b604589
SHA1

26bed9699112d4d9edce04cd0e3f09638733475d
SHA256

1836f1a909119113853c1253e2808057b8699d6831c27c86b9933a86acf7775c
SHA512

699d32bcba2c75596c3291be6f7507c227950db321b59246273e4bbd35fec0d32908b636df5c1ad7467fdb42345b2b76edae2c8687e6176da2501a94da92f6f8
SSDEEP

3072:ILUBn1i65sL6AuDXgI8cpvcK4Kd30kSPTbIiAgleOggEOqUi6al:GswcsL0EK4g0kSQiBleRgEhHl

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack002/Revil.bin

Files

sample (1).zip
.zip

Password: infected
Revil.bin.zip
.zip

Password: infected
Revil.bin
.exe windows x86

95c9dbd11f21d2c0fa6c3dccccbdebb5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCommandLineA
ExitProcess
LoadLibraryA
GetProcAddress
GetCurrentProcessId
GetModuleHandleA

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 534B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

enc
Size: 115KB - Virtual size: 115KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ