11118115491[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

11118115491.zip
Size

13.7MB
MD5

74255c2587a6f5c81534ec98fab6f437
SHA1

0a16866d8f0653a513a29b1a05335d0f5c2ba8e6
SHA256

13aa92667cd812767ef37f63232ac4d644bc7317eea448ef67c3ca06dcd879b9
SHA512

6a466442c756bd9d81553d6d93213faef500feb57288e030889da2084d86265437959a8dd17c6b883d670dbb12571c6d8d02ee5b18620fbb4e59793424457b7e
SSDEEP

393216:mq1mvUTys3tnWVYJ2RJ6JL9kWGxCO4cSzY:N1NTLJZkR1Wm6RY

Score

1^/10

Malware Config

Signatures

Files

11118115491.zip
.zip

Password: infected
39aa275b4b26b42007724c078307ecf8c9fa5c9d4d71b4aaa52f99e75bcde9aa
.exe windows x86

71af4d9b45e89ae99030e4f74e33d069

Code Sign

22:ad:4c:85:d3:6a:fb:51:bf:00:06:d1:a4:34:d2:d7
Certificate

Issuer

CN=中国人寿股份有限公司深圳分公司

Not Before

13/09/2022, 02:50

Not After

31/12/2039, 23:59

Subject

CN=中国人寿股份有限公司深圳分公司

6e:26:ee:f3:6c:94:21:16:7e:54:bd:a9:72:a2:28:ca:e6:c4:fc:8a
Signer

Actual PE Digest

6e:26:ee:f3:6c:94:21:16:7e:54:bd:a9:72:a2:28:ca:e6:c4:fc:8a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

WriteFile

msvcrt

vfprintf

Sections

.text
Size: - Virtual size: 4.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 2.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: - Virtual size: 3.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 199KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: - Virtual size: 345B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: - Virtual size: 52B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: - Virtual size: 186KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 4.6MB - Virtual size: 4.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 996B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 496B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
cc53d8dd15312f1f766df97ee2ec8c9bfa84e39e0ce52e3d2aa5400a7f37fb11
.exe windows x86

71af4d9b45e89ae99030e4f74e33d069

Code Sign

22:ad:4c:85:d3:6a:fb:51:bf:00:06:d1:a4:34:d2:d7
Certificate

Issuer

CN=中国人寿股份有限公司深圳分公司

Not Before

13/09/2022, 02:50

Not After

31/12/2039, 23:59

Subject

CN=中国人寿股份有限公司深圳分公司

0d:0d:f2:9a:b5:00:a6:8a:37:ed:98:a9:0e:10:a4:6e:93:8b:46:b2
Signer

Actual PE Digest

0d:0d:f2:9a:b5:00:a6:8a:37:ed:98:a9:0e:10:a4:6e:93:8b:46:b2

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

WriteFile

msvcrt

vfprintf

Sections

.text
Size: - Virtual size: 4.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 2.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: - Virtual size: 3.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 199KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: - Virtual size: 345B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: - Virtual size: 52B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: - Virtual size: 185KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 4.7MB - Virtual size: 4.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 996B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 496B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
f750d47f7007d087dfae643372e0c8fe91612d28c54e7ad60227d510da6269f4
.exe windows x86

71af4d9b45e89ae99030e4f74e33d069

Code Sign

22:ad:4c:85:d3:6a:fb:51:bf:00:06:d1:a4:34:d2:d7
Certificate

Issuer

CN=中国人寿股份有限公司深圳分公司

Not Before

13/09/2022, 02:50

Not After

31/12/2039, 23:59

Subject

CN=中国人寿股份有限公司深圳分公司

ec:72:b7:ef:99:24:19:53:ab:f6:c7:b5:b2:33:4c:f2:b5:91:40:b4
Signer

Actual PE Digest

ec:72:b7:ef:99:24:19:53:ab:f6:c7:b5:b2:33:4c:f2:b5:91:40:b4

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

WriteFile

msvcrt

vfprintf

Sections

.text
Size: - Virtual size: 4.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 2.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: - Virtual size: 3.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 199KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: - Virtual size: 345B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: - Virtual size: 52B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: - Virtual size: 186KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 4.7MB - Virtual size: 4.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 996B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 496B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

71af4d9b45e89ae99030e4f74e33d069

Code Sign

22:ad:4c:85:d3:6a:fb:51:bf:00:06:d1:a4:34:d2:d7Certificate

6e:26:ee:f3:6c:94:21:16:7e:54:bd:a9:72:a2:28:ca:e6:c4:fc:8aSigner

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msvcrt

Sections

.text Size: - Virtual size: 4.7MB

.data Size: - Virtual size: 2.3MB

.rdata Size: - Virtual size: 3.7MB

.bss Size: - Virtual size: 199KB

.edata Size: - Virtual size: 345B

.idata Size: - Virtual size: 4KB

.CRT Size: - Virtual size: 52B

.tls Size: 512B - Virtual size: 512B

.text Size: - Virtual size: 186KB

.data Size: - Virtual size: 17KB

.text Size: 4.6MB - Virtual size: 4.6MB

.data Size: 1024B - Virtual size: 996B

.reloc Size: 1KB - Virtual size: 1KB

.rsrc Size: 512B - Virtual size: 496B

71af4d9b45e89ae99030e4f74e33d069

Code Sign

22:ad:4c:85:d3:6a:fb:51:bf:00:06:d1:a4:34:d2:d7Certificate

0d:0d:f2:9a:b5:00:a6:8a:37:ed:98:a9:0e:10:a4:6e:93:8b:46:b2Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msvcrt

Sections

.text Size: - Virtual size: 4.7MB

.data Size: - Virtual size: 2.3MB

.rdata Size: - Virtual size: 3.8MB

.bss Size: - Virtual size: 199KB

.edata Size: - Virtual size: 345B

.idata Size: - Virtual size: 4KB

.CRT Size: - Virtual size: 52B

.tls Size: 512B - Virtual size: 512B

.text Size: - Virtual size: 185KB

.data Size: - Virtual size: 17KB

.text Size: 4.7MB - Virtual size: 4.7MB

.data Size: 1024B - Virtual size: 996B

.reloc Size: 1KB - Virtual size: 1KB

.rsrc Size: 512B - Virtual size: 496B

71af4d9b45e89ae99030e4f74e33d069

Code Sign

22:ad:4c:85:d3:6a:fb:51:bf:00:06:d1:a4:34:d2:d7Certificate

ec:72:b7:ef:99:24:19:53:ab:f6:c7:b5:b2:33:4c:f2:b5:91:40:b4Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msvcrt

Sections

.text Size: - Virtual size: 4.7MB

.data Size: - Virtual size: 2.3MB

.rdata Size: - Virtual size: 3.8MB

.bss Size: - Virtual size: 199KB

.edata Size: - Virtual size: 345B

.idata Size: - Virtual size: 4KB

.CRT Size: - Virtual size: 52B

.tls Size: 512B - Virtual size: 512B

.text Size: - Virtual size: 186KB

.data Size: - Virtual size: 17KB

.text Size: 4.7MB - Virtual size: 4.7MB

.data Size: 1024B - Virtual size: 996B

.reloc Size: 1KB - Virtual size: 1KB

22:ad:4c:85:d3:6a:fb:51:bf:00:06:d1:a4:34:d2:d7
Certificate

6e:26:ee:f3:6c:94:21:16:7e:54:bd:a9:72:a2:28:ca:e6:c4:fc:8a
Signer

.text
Size: - Virtual size: 4.7MB

.data
Size: - Virtual size: 2.3MB

.rdata
Size: - Virtual size: 3.7MB

.bss
Size: - Virtual size: 199KB

.edata
Size: - Virtual size: 345B

.idata
Size: - Virtual size: 4KB

.CRT
Size: - Virtual size: 52B

.tls
Size: 512B - Virtual size: 512B

.text
Size: - Virtual size: 186KB

.data
Size: - Virtual size: 17KB

.text
Size: 4.6MB - Virtual size: 4.6MB

.data
Size: 1024B - Virtual size: 996B

.reloc
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 512B - Virtual size: 496B

22:ad:4c:85:d3:6a:fb:51:bf:00:06:d1:a4:34:d2:d7
Certificate

0d:0d:f2:9a:b5:00:a6:8a:37:ed:98:a9:0e:10:a4:6e:93:8b:46:b2
Signer

.text
Size: - Virtual size: 4.7MB

.data
Size: - Virtual size: 2.3MB

.rdata
Size: - Virtual size: 3.8MB

.bss
Size: - Virtual size: 199KB

.edata
Size: - Virtual size: 345B

.idata
Size: - Virtual size: 4KB

.CRT
Size: - Virtual size: 52B

.tls
Size: 512B - Virtual size: 512B

.text
Size: - Virtual size: 185KB

.data
Size: - Virtual size: 17KB

.text
Size: 4.7MB - Virtual size: 4.7MB

.data
Size: 1024B - Virtual size: 996B

.reloc
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 512B - Virtual size: 496B

22:ad:4c:85:d3:6a:fb:51:bf:00:06:d1:a4:34:d2:d7
Certificate

ec:72:b7:ef:99:24:19:53:ab:f6:c7:b5:b2:33:4c:f2:b5:91:40:b4
Signer

.text
Size: - Virtual size: 4.7MB

.data
Size: - Virtual size: 2.3MB

.rdata
Size: - Virtual size: 3.8MB

.bss
Size: - Virtual size: 199KB

.edata
Size: - Virtual size: 345B

.idata
Size: - Virtual size: 4KB

.CRT
Size: - Virtual size: 52B

.tls
Size: 512B - Virtual size: 512B

.text
Size: - Virtual size: 186KB

.data
Size: - Virtual size: 17KB

.text
Size: 4.7MB - Virtual size: 4.7MB

.data
Size: 1024B - Virtual size: 996B

.reloc
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 512B - Virtual size: 496B