nxI0r1Fjsh5exjjes8bZEy[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

nxI0r1Fjsh5exjjes8bZEy.zip
Size

5.8MB
MD5

f9505cb193ce65b65c327f9529407f0b
SHA1

9310b1d63de32140a6904b95443e40daef5406f3
SHA256

9a2ebf90fe2059969401a95fba2bf699befa39bd4bb950a94936305f25976803
SHA512

efb46c34078b504dcc4612800171fcaf2a11eda9ca413c730141f3ee9e9b22b3a1f17fc25d46b50c511d83b33725767fa69cb22683f675657df2d20a89eb1b6b
SSDEEP

98304:a3WX+PMMFvSUQIs2uokanABZBjPJOTmCEaEqljN4bLCFPHE863:TX+ESvSUQFpougTmCJEwjkOJ+3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/yaRjoMx.dll_

Files

nxI0r1Fjsh5exjjes8bZEy.zip
.zip

Password: unzip-me
manifest.json
metadata.json
quarantine-acquire-file.zk7rzrsMUK7iSIqMyZMCsC.xml
.xml
script.xml
.xml
sysinfo-issues.A3Irpc7sWU04pE4633Qd3e.xml
.xml
sysinfo.PHleYRV4PCbdMjgJBBmEX4.xml
.xml
yaRjoMx.dll_
.dll windows x86

Password: unzip-me

a6f3987344dd4ced19b95fa0bbb9a0d1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryExW
GetCPInfo
GetOEMCP
IsValidCodePage
GetConsoleMode
GetConsoleCP
WriteFile
GetModuleHandleW
TlsSetValue
TlsAlloc
TerminateProcess
Sleep
SetStdHandle
WriteConsoleW
GetStringTypeW
OutputDebugStringW
FlushFileBuffers
CreateFileW
TlsFree
GetThreadTimes
HeapSize
GetStartupInfoW
GetACP
GetEnvironmentVariableA
GetModuleFileNameW
InitializeCriticalSectionAndSpinCount
GetModuleHandleExW
QueryPerformanceCounter
GetSystemDefaultLangID
TlsGetValue
LCMapStringW
GetLastError
CreateProcessA
LeaveCriticalSection
GetCommandLineA
GetTickCount
GetEnvironmentStringsW
GetCurrentProcess
SetEndOfFile
SetFilePointerEx
EncodePointer
DecodePointer
HeapReAlloc
GetCurrentThreadId
RaiseException
RtlUnwind
IsProcessorFeaturePresent
IsDebuggerPresent
ExitProcess
GetProcAddress
MultiByteToWideChar
WideCharToMultiByte
EnterCriticalSection
HeapFree
HeapAlloc
GetProcessHeap
SetLastError
GetStdHandle
GetFileType
DeleteCriticalSection
GetModuleFileNameA
GetCurrentProcessId
GetSystemTimeAsFileTime
FreeEnvironmentStringsW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
CloseHandle

user32

GetMessageA
SetWindowRgn
GetWindowRect
MapDialogRect
IsIconic
GetClientRect
GetQueueStatus
IsDialogMessageW
OffsetRect
SetWindowLongA
CreateWindowExA
SetScrollPos
RemoveMenu
EnableWindow
EndDeferWindowPos
DrawFrameControl
CheckMenuItem
TranslateMDISysAccel
HideCaret
ScreenToClient
SetKeyboardState
SendMessageA
UnionRect
DefWindowProcA
CheckDlgButton
ShowWindow
CheckRadioButton
SystemParametersInfoA
SetWindowTextA
SetScrollInfo

gdi32

PolyPolygon
TranslateCharsetInfo
Arc
CreateDCA
SelectObject
GetCharWidthA
StretchDIBits
GetDIBColorTable
SetStretchBltMode
GetNearestPaletteIndex
CreatePen
CreateICA
RoundRect
GetObjectA
GetStockObject
CreateEnhMetaFileW
GetBitmapBits
PatBlt
GetCharWidthW
SetTextColor
GetCharacterPlacementW
GetRgnBox
GetTextMetricsA
RestoreDC
GetPaletteEntries

advapi32

SetSecurityDescriptorOwner
AllocateAndInitializeSid
RegDeleteValueA
RegEnumKeyA

Sections

.text
Size: 526KB - Virtual size: 525KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

heftyou
Size: 1024B - Virtual size: 784B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

kgeeq
Size: 512B - Virtual size: 220B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

emmulth
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

duxyq
Size: 5.6MB - Virtual size: 5.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: unzip-me

Password: unzip-me

a6f3987344dd4ced19b95fa0bbb9a0d1

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

Sections

.text Size: 526KB - Virtual size: 525KB

.data Size: 5KB - Virtual size: 12KB

.idata Size: 3KB - Virtual size: 3KB

heftyou Size: 1024B - Virtual size: 784B

kgeeq Size: 512B - Virtual size: 220B

emmulth Size: 512B - Virtual size: 32B

duxyq Size: 5.6MB - Virtual size: 5.6MB

.reloc Size: 10KB - Virtual size: 10KB

.text
Size: 526KB - Virtual size: 525KB

.data
Size: 5KB - Virtual size: 12KB

.idata
Size: 3KB - Virtual size: 3KB

heftyou
Size: 1024B - Virtual size: 784B

kgeeq
Size: 512B - Virtual size: 220B

emmulth
Size: 512B - Virtual size: 32B

duxyq
Size: 5.6MB - Virtual size: 5.6MB

.reloc
Size: 10KB - Virtual size: 10KB