3adbce7867fe496ea696873ed08e3dc0-sample[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

3adbce7867fe496ea696873ed08e3dc0-sample.zip
Size

44.6MB
MD5

d28b2ccbd095d19df9e26ce3531fa1d4
SHA1

a22e97ca74406b7acf4bac85b934afff66da9a23
SHA256

fd4012423e3042d4d04ba1ace98005a4085b2b0dd01ac00cf2dd2fa1db445584
SHA512

678f2b2dd0fa8ebaa67a9378f2fdcfa19df758b7c145a85c97a52622678924d100a8f1c6eac9c2eacddd6632d5ea2bcfaf9791cc16baa3a1106c8ee80b911f2f
SSDEEP

786432:hHlQ5NwfQL3G62d8J1CKY7n5pCvrThb/4WlWb2jCK6BmghksfDJrabcptNwSSS:jSwN6CKon2zFb/jMbCCKGBWs0bcdwC

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/liquidsoap.exe

Files

3adbce7867fe496ea696873ed08e3dc0-sample.zip
.zip

Password: infected
liquidsoap.exe
.exe windows x64

Password: infected

79baad9591b9c01db483cd3645518a06

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

ChangeServiceConfig2W
CloseServiceHandle
ControlService
CreateServiceW
CryptAcquireContextA
CryptAcquireContextW
CryptCreateHash
CryptDecrypt
CryptDestroyHash
CryptDestroyKey
CryptEncrypt
CryptGenRandom
CryptGetHashParam
CryptGetProvParam
CryptHashData
CryptImportKey
CryptReleaseContext
CryptSetHashParam
CryptSetProvParam
CryptSignHashA
DeleteService
DeregisterEventSource
GetTokenInformation
GetUserNameW
LookupPrivilegeValueW
OpenProcessToken
OpenSCManagerW
OpenServiceW
QueryServiceStatus
RegCloseKey
RegOpenKeyExA
RegOpenKeyExW
RegQueryValueExA
RegQueryValueExW
RegisterEventSourceW
RegisterServiceCtrlHandlerW
ReportEventW
SetServiceStatus
StartServiceCtrlDispatcherW

bcrypt

BCryptCloseAlgorithmProvider
BCryptGenRandom
BCryptOpenAlgorithmProvider

crypt32

CertAddCertificateContextToStore
CertCloseStore
CertCreateCertificateChainEngine
CertDeleteCertificateFromStore
CertEnumCRLsInStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertFindExtension
CertFreeCertificateChain
CertFreeCertificateChainEngine
CertFreeCertificateContext
CertGetCertificateChain
CertGetCertificateContextProperty
CertGetNameStringA
CertOpenStore
CryptDecodeObjectEx
CryptQueryObject
CryptStringToBinaryA
PFXImportCertStore

gdi32

BitBlt
CombineRgn
CreateCompatibleDC
CreateDIBSection
CreateRectRgn
DeleteDC
DeleteObject
GetDIBColorTable
GetDeviceCaps
GetObjectA
GetStockObject
SelectObject

kernel32

AcquireSRWLockExclusive
AcquireSRWLockShared
AddVectoredExceptionHandler
CancelIoEx
CancelWaitableTimer
CloseHandle
ConvertFiberToThread
ConvertThreadToFiberEx
CreateDirectoryA
CreateDirectoryW
CreateEventA
CreateEventW
CreateFiberEx
CreateFileA
CreateFileMappingA
CreateFileMappingW
CreateFileW
CreateMutexA
CreateMutexW
CreatePipe
CreateProcessW
CreateSemaphoreA
CreateSemaphoreW
CreateThread
CreateWaitableTimerA
DeleteCriticalSection
DeleteFiber
DeleteFileW
DeviceIoControl
DuplicateHandle
EnterCriticalSection
EnumResourceLanguagesA
EnumSystemLocalesA
ExitProcess
ExitThread
ExpandEnvironmentStringsA
FileTimeToSystemTime
FindClose
FindFirstFileA
FindFirstFileW
FindNextFileW
FormatMessageA
FormatMessageW
FreeEnvironmentStringsW
FreeLibrary
GetACP
GetComputerNameA
GetConsoleMode
GetConsoleOutputCP
GetConsoleScreenBufferInfo
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetEnvironmentStringsW
GetEnvironmentVariableA
GetEnvironmentVariableW
GetExitCodeProcess
GetExitCodeThread
GetFileAttributesA
GetFileAttributesExA
GetFileAttributesW
GetFileInformationByHandle
GetFileSize
GetFileSizeEx
GetFileType
GetFinalPathNameByHandleA
GetFinalPathNameByHandleW
GetFullPathNameA
GetFullPathNameW
GetHandleInformation
GetLastError
GetLocaleInfoA
GetLongPathNameA
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleExA
GetModuleHandleExW
GetModuleHandleW
GetPriorityClass
GetProcAddress
GetProcessAffinityMask
GetProcessHeap
GetProcessTimes
GetProcessWorkingSetSize
GetStartupInfoA
GetStartupInfoW
GetStdHandle
GetSystemDirectoryA
GetSystemDirectoryW
GetSystemInfo
GetSystemTime
GetSystemTimeAdjustment
GetSystemTimeAsFileTime
GetTempFileNameW
GetTempPathA
GetTempPathW
GetThreadContext
GetThreadLocale
GetThreadPriority
GetThreadTimes
GetTickCount
GetTickCount64
GetTimeZoneInformation
GetVersion
GetVersionExA
GetVersionExW
GetWindowsDirectoryA
GlobalAlloc
GlobalFree
GlobalMemoryStatus
GlobalMemoryStatusEx
HeapAlloc
HeapFree
HeapReAlloc
InitOnceBeginInitialize
InitOnceComplete
InitializeConditionVariable
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
InitializeSRWLock
IsDBCSLeadByteEx
IsDebuggerPresent
LeaveCriticalSection
LoadLibraryA
LoadLibraryExA
LoadLibraryExW
LoadLibraryW
LocalAlloc
LocalFree
LockFileEx
MapViewOfFile
MoveFileExA
MoveFileExW
MultiByteToWideChar
OpenFileMappingA
OpenProcess
OutputDebugStringA
PeekConsoleInputW
PeekNamedPipe
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ReadConsoleA
ReadConsoleInputW
ReadConsoleW
ReadFile
ReleaseMutex
ReleaseSRWLockExclusive
ReleaseSRWLockShared
ReleaseSemaphore
RemoveVectoredExceptionHandler
ResetEvent
ResumeThread
RtlCaptureContext
RtlLookupFunctionEntry
RtlUnwindEx
RtlVirtualUnwind
SearchPathW
SetConsoleCtrlHandler
SetConsoleMode
SetConsoleOutputCP
SetConsoleTextAttribute
SetCurrentDirectoryW
SetEndOfFile
SetEnvironmentVariableA
SetErrorMode
SetEvent
SetFilePointer
SetFilePointerEx
SetFileTime
SetHandleInformation
SetLastError
SetProcessAffinityMask
SetSystemTime
SetThreadAffinityMask
SetThreadContext
SetThreadPriority
SetUnhandledExceptionFilter
SetWaitableTimer
SignalObjectAndWait
Sleep
SleepConditionVariableSRW
SleepEx
SuspendThread
SwitchToFiber
SystemTimeToFileTime
TerminateProcess
TerminateThread
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
TryEnterCriticalSection
UnlockFileEx
UnmapViewOfFile
VerSetConditionMask
VerifyVersionInfoW
VirtualAlloc
VirtualFree
VirtualLock
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForMultipleObjectsEx
WaitForSingleObject
WaitForSingleObjectEx
WaitNamedPipeW
WakeAllConditionVariable
WakeConditionVariable
WideCharToMultiByte
WriteConsoleW
WriteFile

msvcrt

__C_specific_handler
___lc_codepage_func
___mb_cur_max_func
__iob_func
__lconv_init
__set_app_type
__setusermatherr
__wgetmainargs
__winitenv
_access
_aligned_free
_aligned_malloc
_aligned_realloc
_amsg_exit
_assert
_beginthreadex
_cexit
_close
_commit
_commode
_difftime64
_dup2
_endthreadex
_errno
_exit
_filelengthi64
_fileno
_findclose
_findfirst64
_findnext64
_flushall
_fmode
_fstat64
_ftime64
_fullpath
_get_osfhandle
_getmaxstdio
_gmtime64
_hypot
_initterm
_localtime64
_lock
_locking
_lseeki64
_mbsrchr
_mkdir
_mktime64
_onexit
_open
_open_osfhandle
_putenv_s
_rmdir
_setjmp
_setmaxstdio
_setmode
_snprintf
_snwprintf
_sopen
_stat64
_strdup
_stricmp
_strnicmp
_vsnwprintf
_sys_errlist
_sys_nerr
_time64
_ultoa
_unlink
_unlock
_vscprintf
_vscwprintf
_vsnprintf
_waccess
_wassert
_wchdir
_wchmod
_wcmdln
_wcsicmp
_wcsnicmp
_wexecv
_wexecve
_wexecvp
_wexecvpe
_wfindfirst64
_wfindnext64
_wfopen
_wfullpath
_wgetcwd
_wgetenv
_wmkdir
_wopen
_wputenv
_wremove
_wrename
_wrmdir
_wsopen
_wstat64
_wsystem
_wunlink
abort
acos
asin
atan
atof
atoi
bsearch
calloc
clock
cosh
exit
fclose
feof
ferror
fflush
fgetc
fgetpos
fgets
fgetwc
fopen
fprintf
fputc
fputs
fread
free
frexp
fseek
fsetpos
ftell
fwrite
getc
getchar
getenv
getwc
isalnum
isalpha
iscntrl
isgraph
islower
isprint
ispunct
isspace
isupper
iswctype
isxdigit
localeconv
log10
malloc
mbstowcs
memchr
memcmp
memcpy
memmove
memset
perror
printf
putc
putwc
qsort
raise
rand
realloc
remove
rename
rewind
setlocale
setvbuf
signal
sinh
sprintf
srand
strcat
strchr
strcmp
strcoll
strcpy
strcspn
strerror
strftime
strlen
strncat
strncmp
strncpy
strpbrk
strrchr
strspn
strstr
strtok
strtol
strtoul
strxfrm
swscanf
tan
tanh
tolower
toupper
towlower
towupper
ungetc
ungetwc
vfprintf
wcscat
wcschr
wcscmp
wcscoll
wcscpy
wcsftime
wcslen
wcsncmp
wcsncpy
wcsrchr
wcsstr
wcstol
wcstombs
wcsxfrm
_tzname
_timezone
longjmp
_nextafter
_write
_wcsdup
_unlink
_tzset
_stricmp
_strdup
_setmode
_rmdir
_read
_putenv
_open
_lseek
_isatty
_getpid
_getcwd
_fileno
_fdopen
_dup2
_dup
_close
_chmod
_access

ncrypt

NCryptDecrypt
NCryptDeleteKey
NCryptFreeObject
NCryptGetProperty
NCryptOpenKey
NCryptOpenStorageProvider
NCryptSignHash

ole32

CoCreateInstance
CoGetInterfaceAndReleaseStream
CoGetMalloc
CoInitialize
CoInitializeEx
CoMarshalInterThreadInterfaceInStream
CoTaskMemAlloc
CoTaskMemFree
CoUninitialize
CreateBindCtx
OleLoadFromStream
OleSaveToStream
PropVariantClear

oleaut32

OleCreatePropertyFrame

psapi

EnumProcessModules
GetProcessMemoryInfo

setupapi

SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInterfaces
SetupDiGetClassDevsA
SetupDiGetDeviceInterfaceAlias
SetupDiGetDeviceInterfaceDetailW
SetupDiGetDeviceRegistryPropertyW
SetupDiOpenDeviceInterfaceRegKey

shlwapi

SHCreateStreamOnFileA

user32

AdjustWindowRectEx
BeginPaint
CopyIcon
CreateWindowExA
DefWindowProcA
DestroyCursor
DestroyWindow
DispatchMessageA
DrawIcon
EndPaint
FindWindowA
FindWindowW
FrameRect
GetActiveWindow
GetCapture
GetCaretPos
GetClientRect
GetClipboardOwner
GetClipboardViewer
GetCursorInfo
GetCursorPos
GetDC
GetDesktopWindow
GetFocus
GetIconInfo
GetInputState
GetMessagePos
GetMessageTime
GetOpenClipboardWindow
GetProcessWindowStation
GetSystemMetrics
GetUserObjectInformationW
GetWindowLongPtrA
GetWindowRect
LoadCursorA
MessageBoxW
PeekMessageA
ReleaseDC
SendMessageA
SetWindowLongPtrA
SetWindowRgn
ShowWindow

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

avicap32

capCreateCaptureWindowA
capGetDriverDescriptionA

winmm

timeBeginPeriod
timeEndPeriod
timeGetDevCaps
timeGetTime
waveInAddBuffer
waveInClose
waveInGetDevCapsW
waveInGetErrorTextW
waveInGetNumDevs
waveInMessage
waveInOpen
waveInPrepareHeader
waveInReset
waveInStart
waveInUnprepareHeader
waveOutClose
waveOutGetDevCapsA
waveOutGetDevCapsW
waveOutGetErrorTextA
waveOutGetErrorTextW
waveOutGetID
waveOutGetNumDevs
waveOutGetPosition
waveOutMessage
waveOutOpen
waveOutPause
waveOutPrepareHeader
waveOutReset
waveOutRestart
waveOutUnprepareHeader
waveOutWrite

wldap32

ber_free
ldap_bind_s
ldap_err2string
ldap_first_attribute
ldap_first_entry
ldap_get_dn
ldap_get_values_len
ldap_init
ldap_memfree
ldap_msgfree
ldap_next_attribute
ldap_next_entry
ldap_search_s
ldap_set_option
ldap_simple_bind_s
ldap_sslinit
ldap_unbind_s
ldap_value_free_len

ws2_32

WSACleanup
WSACloseEvent
WSACreateEvent
WSADuplicateSocketW
WSAEnumNetworkEvents
WSAEventSelect
WSAGetLastError
WSAIoctl
WSARecvFrom
WSAResetEvent
WSASendTo
WSASetEvent
WSASetLastError
WSASocketW
WSAStartup
WSAWaitForMultipleEvents
__WSAFDIsSet
accept
bind
closesocket
connect
freeaddrinfo
getaddrinfo
gethostbyaddr
gethostbyname
gethostname
getnameinfo
getpeername
getprotobyname
getprotobynumber
getservbyname
getservbyport
getsockname
getsockopt
htonl
htons
inet_addr
inet_ntoa
inet_ntop
inet_pton
ioctlsocket
listen
ntohl
ntohs
recv
recvfrom
select
send
sendto
setsockopt
shutdown
socket

Sections

.text
Size: 39.9MB - Virtual size: 39.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rotext
Size: 117KB - Virtual size: 117KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 5.2MB - Virtual size: 5.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.exptbl
Size: 4.1MB - Virtual size: 4.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.imptbl
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rodata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 11.3MB - Virtual size: 11.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

/4
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 952KB - Virtual size: 952KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 8.6MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 120B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 942KB - Virtual size: 941KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/14
Size: 72KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/29
Size: 12.6MB - Virtual size: 12.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/41
Size: 903KB - Virtual size: 902KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/55
Size: 4.1MB - Virtual size: 4.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/67
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/80
Size: 123KB - Virtual size: 122KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/91
Size: 12.0MB - Virtual size: 12.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/102
Size: 8.9MB - Virtual size: 8.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/115
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

79baad9591b9c01db483cd3645518a06

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

bcrypt

crypt32

gdi32

kernel32

msvcrt

ncrypt

ole32

oleaut32

psapi

setupapi

shlwapi

user32

version

avicap32

winmm

wldap32

ws2_32

Sections

.text Size: 39.9MB - Virtual size: 39.9MB

.rotext Size: 117KB - Virtual size: 117KB

.data Size: 5.2MB - Virtual size: 5.2MB

.exptbl Size: 4.1MB - Virtual size: 4.1MB

.imptbl Size: 1KB - Virtual size: 1KB

.rodata Size: 16KB - Virtual size: 15KB

.rdata Size: 11.3MB - Virtual size: 11.3MB

/4 Size: 7KB - Virtual size: 6KB

.pdata Size: 952KB - Virtual size: 952KB

.xdata Size: 1.1MB - Virtual size: 1.1MB

.bss Size: - Virtual size: 8.6MB

.idata Size: 26KB - Virtual size: 26KB

.CRT Size: 512B - Virtual size: 120B

.tls Size: 512B - Virtual size: 16B

.reloc Size: 942KB - Virtual size: 941KB

/14 Size: 72KB - Virtual size: 72KB

/29 Size: 12.6MB - Virtual size: 12.6MB

/41 Size: 903KB - Virtual size: 902KB

/55 Size: 4.1MB - Virtual size: 4.1MB

/67 Size: 1.2MB - Virtual size: 1.2MB

/80 Size: 123KB - Virtual size: 122KB

/91 Size: 12.0MB - Virtual size: 12.0MB

/102 Size: 8.9MB - Virtual size: 8.9MB

/115 Size: 1.3MB - Virtual size: 1.3MB

.text
Size: 39.9MB - Virtual size: 39.9MB

.rotext
Size: 117KB - Virtual size: 117KB

.data
Size: 5.2MB - Virtual size: 5.2MB

.exptbl
Size: 4.1MB - Virtual size: 4.1MB

.imptbl
Size: 1KB - Virtual size: 1KB

.rodata
Size: 16KB - Virtual size: 15KB

.rdata
Size: 11.3MB - Virtual size: 11.3MB

/4
Size: 7KB - Virtual size: 6KB

.pdata
Size: 952KB - Virtual size: 952KB

.xdata
Size: 1.1MB - Virtual size: 1.1MB

.bss
Size: - Virtual size: 8.6MB

.idata
Size: 26KB - Virtual size: 26KB

.CRT
Size: 512B - Virtual size: 120B

.tls
Size: 512B - Virtual size: 16B

.reloc
Size: 942KB - Virtual size: 941KB

/14
Size: 72KB - Virtual size: 72KB

/29
Size: 12.6MB - Virtual size: 12.6MB

/41
Size: 903KB - Virtual size: 902KB

/55
Size: 4.1MB - Virtual size: 4.1MB

/67
Size: 1.2MB - Virtual size: 1.2MB

/80
Size: 123KB - Virtual size: 122KB

/91
Size: 12.0MB - Virtual size: 12.0MB

/102
Size: 8.9MB - Virtual size: 8.9MB

/115
Size: 1.3MB - Virtual size: 1.3MB