11268376503[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

11268376503.zip
Size

309KB
MD5

048792e1045c93c77846190803cfdd04
SHA1

f67d0fcc83539abd257961d1137a86597235ef96
SHA256

13f585922516d364d03a8a8407929fe00bc6cc8a51a32d27e999d34114b5c453
SHA512

f7dff527438044d46cc3f8b9f40ebb80a656f4df83633e538df64da09f898400151b0d1f3a6551c7383408dbc359b8079196100937e86022d17a55a2d3bcba0d
SSDEEP

6144:oZrZySTbQyzP4lD2fUfCBg5a/daOvjpkQeqs7bMUlgNaVojiJnQMKvLzQmfYhb:CpbQySD2f1B65Ov5sfxlgN80i9QLvo5

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/fbc92a5053079e4d4776867f6cb1a854c676d1ece81c3ed33f563350ea619efe

Files

11268376503.zip
.zip

Password: infected
fbc92a5053079e4d4776867f6cb1a854c676d1ece81c3ed33f563350ea619efe
.exe windows x64

Password: infected

c4e9ea639702b9542c3ea62d13e7f13d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

GetConsoleOutputCP
FlushFileBuffers
HeapSize
LCMapStringW
GetProcessHeap
HeapAlloc
ReleaseSRWLockExclusive
CompareStringW
SwitchToThread
GetStringTypeW
GetFileType
SetStdHandle
WaitForSingleObject
AcquireSRWLockExclusive
SetEnvironmentVariableW
FreeEnvironmentStringsW
SetThreadStackGuarantee
WakeAllConditionVariable
SleepConditionVariableSRW
WakeConditionVariable
GetSystemInfo
AddVectoredExceptionHandler
SwitchToFiber
CreateFiber
ConvertThreadToFiber
GetModuleHandleA
GetProcAddress
TryEnterCriticalSection
LeaveCriticalSection
GetStdHandle
GetConsoleMode
WriteFile
WriteConsoleW
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
GetCurrentProcess
ReleaseMutex
SetLastError
GetEnvironmentVariableW
RtlLookupFunctionEntry
GetModuleHandleW
FormatMessageW
GetCommandLineW
VirtualProtect
GetFullPathNameW
CreateFileW
InitializeCriticalSection
EnterCriticalSection
GetEnvironmentStringsW
WideCharToMultiByte
MultiByteToWideChar
SetHandleInformation
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
QueryPerformanceCounter
QueryPerformanceFrequency
GetCurrentDirectoryW
GetCurrentThread
RtlCaptureContext
AcquireSRWLockShared
ReleaseSRWLockShared
CreateThread
GetDriveTypeW
GetVolumeInformationW
DeviceIoControl
GetDiskFreeSpaceExW
GetProcessTimes
FindClose
LocalFree
GetProcessIoCounters
OpenProcess
ReadProcessMemory
GetCommandLineA
GetModuleHandleExW
TerminateProcess
GetSystemTimeAsFileTime
GetTickCount64
GetLastError
GlobalMemoryStatusEx
ExitProcess
RtlPcToFileHeader
MoveFileExW
SetFilePointerEx
GetUserDefaultLCID
LoadLibraryExW
GetLogicalDrives
FreeLibrary
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
RaiseException
EncodePointer
RtlUnwindEx
IsProcessorFeaturePresent
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcessId
IsDebuggerPresent
RtlVirtualUnwind
CloseHandle
InitializeSListHead
GetCurrentThreadId
HeapFree
GetModuleFileNameW
HeapReAlloc

pdh

PdhOpenQueryA
PdhCloseQuery
PdhRemoveCounter
PdhGetFormattedCounterValue
PdhLookupPerfNameByIndexW
PdhAddCounterW
PdhCollectQueryData

shell32

ShellExecuteW
CommandLineToArgvW

snmpapi

SnmpUtilMemAlloc

crypt32

CertGetCertificateChain
CertDuplicateStore
CertCloseStore
CertVerifyCertificateChainPolicy
CertEnumCertificatesInStore
CertAddCertificateContextToStore
CertDuplicateCertificateContext
CertDuplicateCertificateChain
CertFreeCertificateContext
CertOpenStore
CertFreeCertificateChain

secur32

EncryptMessage
AcquireCredentialsHandleA
DecryptMessage
FreeCredentialsHandle
FreeContextBuffer
DeleteSecurityContext
AcceptSecurityContext
InitializeSecurityContextW
QueryContextAttributesW

ws2_32

WSAGetLastError
getaddrinfo
connect
ioctlsocket
WSAStartup
freeaddrinfo
WSACleanup
WSASocketW
getsockopt
setsockopt
getpeername
send
closesocket
recv
select
getsockname

advapi32

RegQueryValueExA
SystemFunction036

bcrypt

BCryptGenRandom

ntdll

RtlGetVersion
NtQuerySystemInformation
NtQueryInformationProcess

ole32

CoUninitialize
CoCreateInstance
CoInitializeSecurity
CoInitializeEx
CoSetProxyBlanket

powrprof

CallNtPowerInformation

iphlpapi

FreeMibTable
GetIfEntry2
GetIfTable2

netapi32

NetApiBufferFree
NetUserGetLocalGroups
NetQueryDisplayInformation

oleaut32

VariantClear
SysAllocString
SysFreeString

psapi

EnumProcessModulesEx
GetModuleFileNameExW

Sections

.text
Size: 396KB - Virtual size: 395KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 143KB - Virtual size: 142KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 67KB - Virtual size: 66KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

c4e9ea639702b9542c3ea62d13e7f13d

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

pdh

shell32

snmpapi

crypt32

secur32

ws2_32

advapi32

bcrypt

ntdll

ole32

powrprof

iphlpapi

netapi32

oleaut32

psapi

Sections

.text Size: 396KB - Virtual size: 395KB

.rdata Size: 143KB - Virtual size: 142KB

.data Size: 3KB - Virtual size: 7KB

.pdata Size: 14KB - Virtual size: 14KB

_RDATA Size: 512B - Virtual size: 244B

.rsrc Size: 67KB - Virtual size: 66KB

.reloc Size: 4KB - Virtual size: 4KB

.text
Size: 396KB - Virtual size: 395KB

.rdata
Size: 143KB - Virtual size: 142KB

.data
Size: 3KB - Virtual size: 7KB

.pdata
Size: 14KB - Virtual size: 14KB

_RDATA
Size: 512B - Virtual size: 244B

.rsrc
Size: 67KB - Virtual size: 66KB

.reloc
Size: 4KB - Virtual size: 4KB