ba57ca25ebab6389d7f0bd7c81306edc-sample[.]zip | Triage

Resubmissions

15/08/2023, 20:44

230815-zh62nafe4w 7

Sharing

Copy URL Twitter E-mail

General

Target

ba57ca25ebab6389d7f0bd7c81306edc-sample.zip
Size

2KB
MD5

7883e1cbad7652232b6b5fe367851fc5
SHA1

cfabe6daf1e3203347a160a57e03fc95f0f27dee
SHA256

8eac4adaf7397c45b1050f65ca789dea9634469eebdc655aef63f6e7a014b4b7
SHA512

c8155c3d21393e4b879d9d07f9a31408ae4415f2bd77fdca3002687508807af738b5c6e862981352a8d3bca3a17ffff34e6ca575241ca5f6d94cb884f2b31281

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/a99330778a6dc0f2e21e2ef6bca88751

Files

ba57ca25ebab6389d7f0bd7c81306edc-sample.zip
.zip

Password: infected
a99330778a6dc0f2e21e2ef6bca88751
.exe windows x86

Password: infected

cc40fefa3af5cd00cc28dbd874038a4d

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CloseHandle
CreateFileW
DeleteFileW
ExitProcess
GetComputerNameW
GetCurrentDirectoryW
GetFileSize
GetModuleFileNameW
GetTempPathW
GetVersionExW
ReadFile
WriteFile
lstrlenW
lstrcmpW
SleepEx
VirtualAlloc

wininet

HttpOpenRequestW
HttpSendRequestW
InternetOpenW
InternetConnectW
InternetCloseHandle
InternetReadFile

shell32

ShellExecuteW

ntdll

RtlDecompressBuffer
swprintf

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 1009B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ