Malware[.]zip | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Malware.zip
Size

184KB
MD5

976592ce561cca63be99af9ce5a2a7e4
SHA1

7226b5dabda476852eb07c9f22b07cabfea71a2c
SHA256

53442ebc4d2571dbd2f04dd2c919c9aa6789a9a279cc2c5f76e2266e1fd41577
SHA512

1b2adb62068b1e5e805c0e6be7de9840b02c16bfafc9c46ef514fa327065d6fc21b094c4b888d5d031175949d2fc0a4401b0bdb2506fd06895c124615f736fcf
SSDEEP

3072:TD4WKJ3rIvLsJRhg/ojsYXlKNcFN3t55gR8Z5Q6FgQuYC4bLkIYbZ9VA:f4VMLahgMXl1N3t55gR8/Q6x3/kIMZ9y

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/d.dll

Files

Malware.zip
.zip
RunDLL-1.bat
d.dll
.dll windows x64

a56f115ee5ef2625bd949acaeec66b76

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

kernel32

GetModuleHandleA

Exports

Exports

tPOptions2int
tigestTypes2int
tistributionPointReasonFlags2int
tastOptions2int
tDCFastFlags2int
tDCOptions2int
teyUsage2int
tAMFlags2int
ticketFlags2int
t_gcc_deregister_frame
t_gcc_register_frame
tasn1_bmember_isset_bit
tasn1_bmember_put_bit
tasn1_copy
tasn1_copy_top
tasn1_decode
tasn1_decode_top
tasn1_encode
tasn1_free
tasn1_free_top
tasn1_length
tasn1_sizeofType
tder_gmtime
tder_timegm
theim_der_set_sort
theim_fix_dce
theim_len_int
theim_len_int64
theim_len_unsigned
theim_len_unsigned64
theim_time2generalizedtime
tdd_AuthorizationData
tdd_CRLDistributionPoints
tdd_DigestAlgorithmIdentifiers
tdd_ETYPE_INFO
tdd_ETYPE_INFO2
tdd_Extensions
tdd_GeneralNames
tdd_METHOD_DATA
tdd_Principals
tsn1_APOptions_units
tsn1_DigestTypes_units
tsn1_DistributionPointReasonFlags_units
tsn1_FastOptions_units
tsn1_KDCFastFlags_units
tsn1_KDCOptions_units
tsn1_KeyUsage_units
tsn1_SAMFlags_units
tsn1_TicketFlags_units
tsn1_fuzzer_done
tsn1_fuzzer_method
tsn1_fuzzer_next
tsn1_fuzzer_reset
tsn1_oid_id_Userid
tsn1_oid_id_aes_128_cbc
tsn1_oid_id_aes_192_cbc
tsn1_oid_id_aes_256_cbc
tsn1_oid_id_apple_system_id
tsn1_oid_id_at_commonName
tsn1_oid_id_at_countryName
tsn1_oid_id_at_description
tsn1_oid_id_at_generationQualifier
tsn1_oid_id_at_givenName
tsn1_oid_id_at_initials
tsn1_oid_id_at_localityName
tsn1_oid_id_at_name
tsn1_oid_id_at_organizationName
tsn1_oid_id_at_organizationalUnitName
tsn1_oid_id_at_pseudonym
tsn1_oid_id_at_serialNumber
tsn1_oid_id_at_stateOrProvinceName
tsn1_oid_id_at_streetAddress
tsn1_oid_id_at_surname
tsn1_oid_id_at_title
tsn1_oid_id_dhpublicnumber
tsn1_oid_id_domainComponent
tsn1_oid_id_dsa
tsn1_oid_id_dsa_with_sha1
tsn1_oid_id_ecDH
tsn1_oid_id_ecMQV
tsn1_oid_id_ecPublicKey
tsn1_oid_id_ec_group_secp160r1
tsn1_oid_id_ec_group_secp160r2
tsn1_oid_id_ec_group_secp224r1
tsn1_oid_id_ec_group_secp256r1
tsn1_oid_id_ec_group_secp384r1
tsn1_oid_id_ec_group_secp521r1
tsn1_oid_id_ecdsa_with_SHA1
tsn1_oid_id_ecdsa_with_SHA224
tsn1_oid_id_ecdsa_with_SHA256
tsn1_oid_id_ecdsa_with_SHA384
tsn1_oid_id_ecdsa_with_SHA512
tsn1_oid_id_heim_rsa_pkcs1_x509
tsn1_oid_id_ms_cert_enroll_domaincontroller
tsn1_oid_id_ms_client_authentication
tsn1_oid_id_netscape
tsn1_oid_id_netscape_cert_comment
tsn1_oid_id_nistAlgorithm
tsn1_oid_id_nist_aes_algs
tsn1_oid_id_nist_sha_algs
tsn1_oid_id_pbeWithSHAAnd128BitRC2_CBC
tsn1_oid_id_pbeWithSHAAnd128BitRC4
tsn1_oid_id_pbeWithSHAAnd2_KeyTripleDES_CBC
tsn1_oid_id_pbeWithSHAAnd3_KeyTripleDES_CBC
tsn1_oid_id_pbeWithSHAAnd40BitRC4
tsn1_oid_id_pbewithSHAAnd40BitRC2_CBC
tsn1_oid_id_pkauthdata
tsn1_oid_id_pkcs12_bagtypes
tsn1_oid_id_pkcs12_certBag
tsn1_oid_id_pkcs12_crlBag
tsn1_oid_id_pkcs12_keyBag
tsn1_oid_id_pkcs12_pkcs8ShroudedKeyBag
tsn1_oid_id_pkcs12_safeContentsBag
tsn1_oid_id_pkcs12_secretBag
tsn1_oid_id_pkcs1_md2WithRSAEncryption
tsn1_oid_id_pkcs1_md5WithRSAEncryption
tsn1_oid_id_pkcs1_rsaEncryption
tsn1_oid_id_pkcs1_sha1WithRSAEncryption
tsn1_oid_id_pkcs1_sha256WithRSAEncryption
tsn1_oid_id_pkcs1_sha384WithRSAEncryption
tsn1_oid_id_pkcs1_sha512WithRSAEncryption
tsn1_oid_id_pkcs2_md2
tsn1_oid_id_pkcs2_md4
tsn1_oid_id_pkcs2_md5
tsn1_oid_id_pkcs3_des_ede3_cbc
tsn1_oid_id_pkcs3_rc2_cbc
tsn1_oid_id_pkcs3_rc4
tsn1_oid_id_pkcs7
tsn1_oid_id_pkcs7_data
tsn1_oid_id_pkcs7_digestedData
tsn1_oid_id_pkcs7_encryptedData
tsn1_oid_id_pkcs7_envelopedData
tsn1_oid_id_pkcs7_signedAndEnvelopedData
tsn1_oid_id_pkcs7_signedData
tsn1_oid_id_pkcs9_contentType
tsn1_oid_id_pkcs9_countersignature
tsn1_oid_id_pkcs9_emailAddress
tsn1_oid_id_pkcs9_messageDigest
tsn1_oid_id_pkcs9_signingTime
tsn1_oid_id_pkcs_1
tsn1_oid_id_pkcs_12
tsn1_oid_id_pkcs_12PbeIds
tsn1_oid_id_pkcs_2
tsn1_oid_id_pkcs_3
tsn1_oid_id_pkcs_9
tsn1_oid_id_pkcs_9_at_certTypes
tsn1_oid_id_pkcs_9_at_certTypes_x509
tsn1_oid_id_pkcs_9_at_friendlyName
tsn1_oid_id_pkcs_9_at_localKeyId
tsn1_oid_id_pkdhkeydata
tsn1_oid_id_pkekuoid
tsn1_oid_id_pkinit
tsn1_oid_id_pkinit_kdf
tsn1_oid_id_pkinit_kdf_ah_sha1
tsn1_oid_id_pkinit_kdf_ah_sha256
tsn1_oid_id_pkinit_kdf_ah_sha512
tsn1_oid_id_pkinit_ms_eku
tsn1_oid_id_pkinit_ms_san
tsn1_oid_id_pkinit_san
tsn1_oid_id_pkix
tsn1_oid_id_pkix_kp
tsn1_oid_id_pkix_kp_OCSPSigning
tsn1_oid_id_pkix_kp_clientAuth
tsn1_oid_id_pkix_kp_emailProtection
tsn1_oid_id_pkix_kp_serverAuth
tsn1_oid_id_pkix_kp_timeStamping
tsn1_oid_id_pkix_on
tsn1_oid_id_pkix_on_dnsSRV
tsn1_oid_id_pkix_on_xmppAddr
tsn1_oid_id_pkix_pe
tsn1_oid_id_pkix_pe_authorityInfoAccess
tsn1_oid_id_pkix_pe_proxyCertInfo
tsn1_oid_id_pkix_ppl
tsn1_oid_id_pkix_ppl_anyLanguage
tsn1_oid_id_pkix_ppl_independent
tsn1_oid_id_pkix_ppl_inheritAll
tsn1_oid_id_pkkdcekuoid
tsn1_oid_id_pkrkeydata
tsn1_oid_id_rsa_digestAlgorithm
tsn1_oid_id_rsa_digest_md2
tsn1_oid_id_rsa_digest_md4
tsn1_oid_id_rsa_digest_md5
tsn1_oid_id_rsadsi_des_ede3_cbc
tsn1_oid_id_rsadsi_encalg
tsn1_oid_id_rsadsi_rc2_cbc
tsn1_oid_id_secsig_sha_1
tsn1_oid_id_secsig_sha_1WithRSAEncryption
tsn1_oid_id_sha224
tsn1_oid_id_sha256
tsn1_oid_id_sha384
tsn1_oid_id_sha512
tsn1_oid_id_uspkicommon_card_id
tsn1_oid_id_uspkicommon_piv_interim
tsn1_oid_id_x509_ce
tsn1_oid_id_x509_ce_authorityKeyIdentifier
tsn1_oid_id_x509_ce_basicConstraints
tsn1_oid_id_x509_ce_cRLDistributionPoints
tsn1_oid_id_x509_ce_cRLNumber
tsn1_oid_id_x509_ce_cRLReason
tsn1_oid_id_x509_ce_certificateIssuer
tsn1_oid_id_x509_ce_certificatePolicies
tsn1_oid_id_x509_ce_deltaCRLIndicator
tsn1_oid_id_x509_ce_extKeyUsage
tsn1_oid_id_x509_ce_freshestCRL
tsn1_oid_id_x509_ce_holdInstructionCode
tsn1_oid_id_x509_ce_inhibitAnyPolicy
tsn1_oid_id_x509_ce_invalidityDate
tsn1_oid_id_x509_ce_issuerAltName
tsn1_oid_id_x509_ce_issuingDistributionPoint
tsn1_oid_id_x509_ce_keyUsage
tsn1_oid_id_x509_ce_nameConstraints
tsn1_oid_id_x509_ce_policyConstraints
tsn1_oid_id_x509_ce_policyMappings
tsn1_oid_id_x509_ce_privateKeyUsagePeriod
tsn1_oid_id_x509_ce_subjectAltName
tsn1_oid_id_x509_ce_subjectDirectoryAttributes
tsn1_oid_id_x509_ce_subjectKeyIdentifier
tsn1_oid_id_x520_at
tsn1_oid_id_x9_57
tsn1_template_prim
topy_AD_AND_OR
topy_AD_IF_RELEVANT
topy_AD_INITIAL_VERIFIED_CAS
topy_AD_KDCIssued
topy_AD_LoginAlias
topy_AD_MANDATORY_FOR_KDC
topy_APOptions
topy_AP_REP
topy_AP_REQ
topy_AS_REP
topy_AS_REQ
topy_AUTHDATA_TYPE
topy_AccessDescription
topy_AlgorithmIdentifier
topy_Attribute
topy_AttributeType
topy_AttributeTypeAndValue
topy_AttributeValue
topy_AuthPack
topy_AuthPack_Win2k
topy_Authenticator
topy_AuthorityInfoAccessSyntax
topy_AuthorityKeyIdentifier
topy_AuthorizationData
topy_AuthorizationDataElement
topy_BaseDistance
topy_BasicConstraints
topy_CKSUMTYPE
topy_CMSAttributes
topy_CMSCBCParameter
topy_CMSEncryptedData
topy_CMSIdentifier
topy_CMSRC2CBCParameter
topy_CMSVersion
topy_CRLCertificateList
topy_CRLDistributionPoints
topy_CRLReason
topy_Certificate
topy_CertificateList
topy_CertificateRevocationLists
topy_CertificateSerialNumber
topy_CertificateSet
topy_Certificates
topy_ChangePasswdDataMS
topy_Checksum
topy_ContentEncryptionAlgorithmIdentifier
topy_ContentInfo
topy_ContentType
topy_DHNonce
topy_DHParameter
topy_DHPublicKey
topy_DHRepInfo
topy_DSAParams
topy_DSAPublicKey
topy_DSASigValue
topy_DigestAlgorithmIdentifier
topy_DigestAlgorithmIdentifiers
topy_DigestError
topy_DigestInfo
topy_DigestInit
topy_DigestInitReply
topy_DigestREP
topy_DigestREQ
topy_DigestRepInner
topy_DigestReqInner
topy_DigestRequest
topy_DigestResponse
topy_DigestTypes
topy_DirectoryString
topy_DistributionPoint
topy_DistributionPointName
topy_DistributionPointReasonFlags
topy_DomainParameters
topy_ECDSA_Sig_Value
topy_ECParameters
topy_ECPoint
topy_ENCTYPE
topy_ETYPE_INFO
topy_ETYPE_INFO2
topy_ETYPE_INFO2_ENTRY
topy_ETYPE_INFO_ENTRY
topy_EncAPRepPart
topy_EncASRepPart
topy_EncKDCRepPart
topy_EncKrbCredPart
topy_EncKrbPrivPart
topy_EncTGSRepPart
topy_EncTicketPart
topy_EncapsulatedContentInfo
topy_EncryptedContent
topy_EncryptedContentInfo
topy_EncryptedData
topy_EncryptedKey
topy_EncryptionKey
topy_EnvelopedData
topy_EtypeList
topy_ExtKeyUsage
topy_Extension
topy_Extensions
topy_ExternalPrincipalIdentifier
topy_ExternalPrincipalIdentifiers
topy_FastOptions
topy_GeneralName
topy_GeneralNames
topy_GeneralSubtree
topy_GeneralSubtrees
topy_HostAddress
topy_HostAddresses
topy_IssuerAndSerialNumber
topy_KDCDHKeyInfo
topy_KDCDHKeyInfo_Win2k
topy_KDCFastCookie
topy_KDCFastFlags
topy_KDCFastState
topy_KDCOptions
topy_KDC_PROXY_MESSAGE
topy_KDC_REP
topy_KDC_REQ
topy_KDC_REQ_BODY
topy_KDFAlgorithmId
topy_KERB_ARMOR_SERVICE_REPLY
topy_KERB_CRED
topy_KERB_TGS_REP_IN
topy_KERB_TGS_REP_OUT
topy_KERB_TGS_REQ_IN
topy_KERB_TGS_REQ_OUT
topy_KERB_TIMES
topy_KRB5PrincipalName
topy_KRB5SignedPath
topy_KRB5SignedPathData
topy_KRB_CRED
topy_KRB_ERROR
topy_KRB_PRIV
topy_KRB_SAFE
topy_KRB_SAFE_BODY
topy_KX509_ERROR_CODE
topy_KerberosString
topy_KerberosTime
topy_KeyEncryptionAlgorithmIdentifier
topy_KeyIdentifier
topy_KeyTransRecipientInfo
topy_KeyUsage
topy_KrbCredInfo
topy_KrbFastArmor
topy_KrbFastArmoredRep
topy_KrbFastArmoredReq
topy_KrbFastFinished
topy_KrbFastReq
topy_KrbFastResponse
topy_Kx509Request
topy_Kx509Response
topy_LR_TYPE
topy_LastReq
topy_MESSAGE_TYPE
topy_METHOD_DATA
topy_MS_UPN_SAN
topy_MessageDigest
topy_NAME_TYPE
topy_NTLMInit
topy_NTLMInitReply
topy_NTLMReply
topy_NTLMRequest
topy_NTLMRequest2
topy_NTLMResponse
topy_Name
topy_NameConstraints
topy_OriginatorInfo
topy_OtherName
topy_PADATA_TYPE
topy_PA_DATA
topy_PA_ENC_SAM_RESPONSE_ENC
topy_PA_ENC_TS_ENC
topy_PA_FX_FAST_REPLY
topy_PA_FX_FAST_REQUEST
topy_PA_PAC_REQUEST
topy_PA_PK_AS_REP
topy_PA_PK_AS_REP_BTMM
topy_PA_PK_AS_REP_Win2k
topy_PA_PK_AS_REQ
topy_PA_PK_AS_REQ_Win2k
topy_PA_S4U2Self
topy_PA_SAM_CHALLENGE_2
topy_PA_SAM_CHALLENGE_2_BODY
topy_PA_SAM_REDIRECT
topy_PA_SAM_RESPONSE_2
topy_PA_SAM_TYPE
topy_PA_SERVER_REFERRAL_DATA
topy_PA_ServerReferralData
topy_PA_SvrReferralData
topy_PKAuthenticator
topy_PKAuthenticator_Win2k
topy_PKCS12_Attribute
topy_PKCS12_Attributes
topy_PKCS12_AuthenticatedSafe
topy_PKCS12_CertBag
topy_PKCS12_MacData
topy_PKCS12_OctetString
topy_PKCS12_PBEParams
topy_PKCS12_PFX
topy_PKCS12_SafeBag
topy_PKCS12_SafeContents
topy_PKCS8Attributes
topy_PKCS8EncryptedData
topy_PKCS8EncryptedPrivateKeyInfo
topy_PKCS8PrivateKey
topy_PKCS8PrivateKeyAlgorithmIdentifier
topy_PKCS8PrivateKeyInfo
topy_PKCS9_BMPString
topy_PKCS9_friendlyName
topy_PKIXXmppAddr
topy_PROV_SRV_LOCATION
topy_PkinitSP80056AOtherInfo
topy_PkinitSuppPubInfo
topy_Principal
topy_PrincipalName
topy_Principals
topy_ProxyCertInfo
topy_ProxyPolicy
topy_RDNSequence
topy_RSAPrivateKey
topy_RSAPublicKey
topy_Realm
topy_RecipientIdentifier
topy_RecipientInfo
topy_RecipientInfos
topy_RelativeDistinguishedName
topy_ReplyKeyPack
topy_ReplyKeyPack_Win2k
topy_SAMFlags
topy_SignatureAlgorithmIdentifier
topy_SignatureValue
topy_SignedData
topy_SignerIdentifier
topy_SignerInfo
topy_SignerInfos
topy_SubjectKeyIdentifier
topy_SubjectPublicKeyInfo
topy_TBSCRLCertList
topy_TBSCertificate
topy_TD_DH_PARAMETERS
topy_TD_INVALID_CERTIFICATES
topy_TD_TRUSTED_CERTIFIERS
topy_TGS_REP
topy_TGS_REQ
topy_TYPED_DATA
topy_Ticket
topy_TicketFlags
topy_Time
topy_TransitedEncoding
topy_TrustedCA
topy_TrustedCA_Win2k
topy_TypedData
topy_UniqueIdentifier
topy_UnprotectedAttributes
topy_ValidationParms
topy_Validity
topy_Version
topy_heim_any
topy_heim_any_set
topy_krb5int32
topy_krb5uint32
tecode_AD_AND_OR
tecode_AD_IF_RELEVANT
tecode_AD_INITIAL_VERIFIED_CAS
tecode_AD_KDCIssued
tecode_AD_LoginAlias
tecode_AD_MANDATORY_FOR_KDC
tecode_APOptions
tecode_AP_REP
tecode_AP_REQ
tecode_AS_REP
tecode_AS_REQ
tecode_AUTHDATA_TYPE
tecode_AccessDescription
tecode_AlgorithmIdentifier
tecode_Attribute
tecode_AttributeType
tecode_AttributeTypeAndValue
tecode_AttributeValue
tecode_AuthPack

Sections

.text
Size: 398KB - Virtual size: 398KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.buildid
Size: 512B - Virtual size: 53B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 432B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 52KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a56f115ee5ef2625bd949acaeec66b76

Headers

File Characteristics

Imports

kernel32

Exports

Exports

Sections

.text Size: 398KB - Virtual size: 398KB

.data Size: 8KB - Virtual size: 8KB

.rdata Size: 6KB - Virtual size: 6KB

.buildid Size: 512B - Virtual size: 53B

.pdata Size: 18KB - Virtual size: 17KB

.xdata Size: 19KB - Virtual size: 18KB

.bss Size: - Virtual size: 432B

.edata Size: 52KB - Virtual size: 52KB

.idata Size: 1KB - Virtual size: 1KB

.reloc Size: 20KB - Virtual size: 17KB

.text
Size: 398KB - Virtual size: 398KB

.data
Size: 8KB - Virtual size: 8KB

.rdata
Size: 6KB - Virtual size: 6KB

.buildid
Size: 512B - Virtual size: 53B

.pdata
Size: 18KB - Virtual size: 17KB

.xdata
Size: 19KB - Virtual size: 18KB

.bss
Size: - Virtual size: 432B

.edata
Size: 52KB - Virtual size: 52KB

.idata
Size: 1KB - Virtual size: 1KB

.reloc
Size: 20KB - Virtual size: 17KB