11419959645[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

11419959645.zip
Size

165KB
MD5

d52ba02c8f04e5d3bc0111f5bfef0b53
SHA1

b76ba0ecab1ccbbfaa74f22f65e89d084b8f31e7
SHA256

d4966761cf347fbe36d704dd8a14a4af19a8c8534752e37d4b04725432010631
SHA512

f884e3ae5b073a5f71d4e13f6786764e86eb9e46590f6772ccc8c80262eb16e50eaf412289621c03507d4b4280bf3d0c56d0bec40969d5c145cd76c8b8f94b31
SSDEEP

3072:rdkpraPvVWK9qJqsYw8JTtn3lfsYkPsemQdW5aIh+PSFVo6yJMOQ9xBPd/sxwq5J:+YFNDjh3lfH8LmQdW5aCtcQ9xBPd/s6s

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/7d703330401a1872c0d7c74199afdaff6d11bf7aa65d49e53732ed66220c18ba

Files

11419959645.zip
.zip

Password: infected
7d703330401a1872c0d7c74199afdaff6d11bf7aa65d49e53732ed66220c18ba
.dll windows x86

ccf5c5cddaa36f4d958dcf6f161f061f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

InitializeSRWLock
SwitchToThread
Sleep
CreateEventA
lstrlenA
UnmapViewOfFile
FindResourceExW
FindResourceW
LoadResource
SetEvent
WideCharToMultiByte
SizeofResource
ResetEvent
LockResource
CreateFileA
GetFileSize
MapViewOfFileEx
MultiByteToWideChar
GetProcAddress
CreateFileMappingA
GetModuleHandleA
GetTickCount
IsBadReadPtr
GetProcessHeap
LoadLibraryA
GetCurrentProcess
GetFileAttributesA
GetModuleFileNameW
FindFirstFileA
RemoveDirectoryA
FindClose
GetModuleFileNameA
FindNextFileA
DeleteFileA
SetPriorityClass
OpenProcess
CreateMutexA
ExitProcess
FreeLibrary
SetUnhandledExceptionFilter
Process32First
WriteFile
GetDriveTypeA
TerminateProcess
lstrcatA
InterlockedExchange
lstrcmpiA
Process32Next
GlobalMemoryStatusEx
GetSystemInfo
CreateToolhelp32Snapshot
OutputDebugStringA
GetDiskFreeSpaceExA
lstrcpyA
GetCurrentThread
GetEnvironmentVariableA
SetThreadPriority
GetShortPathNameA
SetFileAttributesA
GetVersionExA
ResumeThread
SetFilePointer
QueryDosDeviceA
TerminateThread
GetLogicalDriveStringsA
CreateThread
MapViewOfFile
ReadFile
VirtualAlloc
CreateFileW
WaitForSingleObject
GetModuleHandleW
DecodePointer
LocalFree
SetEnvironmentVariableA
CompareStringW
WriteConsoleW
FlushFileBuffers
QueryPerformanceCounter
GetEnvironmentStringsW
GetCurrentProcessId
GetCurrentThreadId
SetLastError
GetLastError
DeleteCriticalSection
AcquireSRWLockShared
EnterCriticalSection
ReleaseSRWLockShared
HeapCreate
LeaveCriticalSection
HeapDestroy
InitializeCriticalSectionAndSpinCount
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InterlockedCompareExchange
HeapFree
InterlockedDecrement
InterlockedIncrement
HeapAlloc
CloseHandle
SetErrorMode
EncodePointer
FreeEnvironmentStringsW
RtlUnwind
GetTimeZoneInformation
GetStringTypeW
LCMapStringW
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetFileType
HeapReAlloc
GetSystemTimeAsFileTime
ExitThread
VirtualProtect
GetConsoleMode
GetConsoleCP
SetStdHandle
HeapSize
LoadLibraryW
GetStartupInfoW
SetHandleCount
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GetStdHandle
RaiseException
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
GetCommandLineA
VirtualQuery
CreateProcessA

user32

GetThreadDesktop
OpenInputDesktop
CloseDesktop
SetThreadDesktop
MsgWaitForMultipleObjects
TranslateMessage
PeekMessageA
DispatchMessageA
wsprintfA
OpenWindowStationA
SetProcessWindowStation
GetUserObjectInformationA

advapi32

CloseEventLog
OpenEventLogA
ClearEventLogA
RegQueryValueA
RegCloseKey
RegOpenKeyA
RegOpenKeyExA
RegQueryValueExA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken

shell32

ShellExecuteA
ShellExecuteExA
SHGetSpecialFolderPathA

ole32

CoInitialize
CoCreateGuid
CoUninitialize
CoCreateInstance

oleaut32

VariantInit
VariantClear
SysAllocString
SysFreeString

shlwapi

PathStripPathA
StrChrA

ws2_32

setsockopt
freeaddrinfo
WSASetLastError
WSAStringToAddressA
shutdown
send
htons
ntohs
WSAGetLastError
htonl
closesocket
ntohl
WSAIoctl
getsockname
gethostname
inet_addr
WSACloseEvent
connect
WSAStartup
WSAEnumNetworkEvents
WSAEventSelect
WSACleanup
recv
bind
socket
WSACreateEvent
WSAResetEvent
WSAWaitForMultipleEvents
inet_ntop
getaddrinfo

iphlpapi

GetIfTable

psapi

GetProcessImageFileNameA

wininet

InternetOpenUrlA
InternetCloseHandle
InternetOpenA

Sections

.text
Size: 201KB - Virtual size: 201KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 65KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

ccf5c5cddaa36f4d958dcf6f161f061f

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

ws2_32

iphlpapi

psapi

wininet

Sections

.text Size: 201KB - Virtual size: 201KB

.rdata Size: 65KB - Virtual size: 65KB

.data Size: 8KB - Virtual size: 16KB

.rsrc Size: 512B - Virtual size: 436B

.reloc Size: 18KB - Virtual size: 18KB

.text
Size: 201KB - Virtual size: 201KB

.rdata
Size: 65KB - Virtual size: 65KB

.data
Size: 8KB - Virtual size: 16KB

.rsrc
Size: 512B - Virtual size: 436B

.reloc
Size: 18KB - Virtual size: 18KB