11197289790[.]zip | Triage

Resubmissions

18/07/2023, 08:56

230718-kwhtnahc44 3

18/07/2023, 08:53

230718-ktnl5ahc36 3

Sharing

Copy URL Twitter E-mail

General

Target

11197289790.zip
Size

3.0MB
MD5

3e570a8bdb6ad0c019cb2707871d4660
SHA1

cc2610a62b678d8c670eb263ddca2080152bd73e
SHA256

ea24f11f85469fed8cd94ddbf9d8c4001bdeb976ddcf3e31c92707cacda6d3bf
SHA512

f29bf42e7e2a6145f72dae23d9389153250d834ea1bf66c6f6419215ba59551f447f0a9cd8a59f1d9429571b867ed170074e71e80bafcbaf0cbb053903a05493
SSDEEP

49152:BrbbFpNmqR0o79c35A9VJMPrYzUXEV93yaF4S32tyF9ZMkaAVABk7gJ:BrR9RcpUMP0zUXEz9F4S9ZMkpb7gJ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/3a6a09944c820b418a6a4ca57de88131746f9c3438b036f06cff257ac7f380b2

Files

11197289790.zip
.zip

Password: infected
3a6a09944c820b418a6a4ca57de88131746f9c3438b036f06cff257ac7f380b2
.dll windows x86

Password: infected

e82dd51b077167be63c004bed23d0c1e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Sleep

Exports

Exports

DtrcytvJinm
DxerctSxrctvy
EexrctDrctvy

Sections

.text
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 104B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ