6a6fdd834af9c79c5ffc5e6b51700030259aeae535f8626df84b07b7d2cee067[.]zip

Sharing

Copy URL

Twitter E-mail

General

Target

6a6fdd834af9c79c5ffc5e6b51700030259aeae535f8626df84b07b7d2cee067.zip
Size

14KB
MD5

eea6138905204c7fdfe9c59eb40f399b
SHA1

d8d55d9aa027f3633803e3452e44d01c8af770f8
SHA256

26f627a5b04d6e880762369bee197abcb9ce9ea3445b35bd18c4d677acd1b4ee
SHA512

9bf05bb5d094107da9cec0d27399bb830bd5ac47bbc9521ed4d72f8cbe9f9c43e9f702f7c2d5c0b1eda1ee47ed59454d574617e87b9df82f57f63a9a2d0a6cce
SSDEEP

384:iP0CaAm3sh52WFTevIKN+S43y94TQKLFAlYtZrFVA561:/Am36t2IKoS4i94TQKLuKtZhVA561

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/6a6fdd834af9c79c5ffc5e6b51700030259aeae535f8626df84b07b7d2cee067

Files

6a6fdd834af9c79c5ffc5e6b51700030259aeae535f8626df84b07b7d2cee067.zip
.zip

Password: infected
6a6fdd834af9c79c5ffc5e6b51700030259aeae535f8626df84b07b7d2cee067
.exe windows x64

8af12edd150a1168dc2b3c264d8f5383

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

TraceMessage
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
UnregisterTraceGuids
CryptAcquireContextW
CryptGenRandom
CryptReleaseContext
RegDeleteKeyValueW
RegSetKeyValueW
OpenProcessToken
AdjustTokenPrivileges
InitializeSecurityDescriptor
GetTokenInformation
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
InitializeAcl
SetSecurityDescriptorDacl
EventUnregister
QueryServiceStatus
CloseServiceHandle
OpenSCManagerW
CreateWellKnownSid
StartServiceW
OpenServiceW

kernel32

UnmapViewOfFile
WaitForMultipleObjects
WaitForSingleObject
GetCurrentProcess
LocalAlloc
LocalFree
SetProcessMitigationPolicy
HeapSetInformation
GetCommandLineW
SetEvent
CreateEventW
GetLastError
FreeLibrary
GetProcAddress
GetModuleHandleExA
CloseHandle
OpenProcess
QueryFullProcessImageNameW
CreateFileMappingW
MapViewOfFile
DelayLoadFailureHook
ResolveDelayLoadedAPI
GetCurrentProcessId
OpenEventW
DuplicateHandle
ProcessIdToSessionId

msvcrt

_wcsicmp
_vsnwprintf
_XcptFilter
_amsg_exit
?terminate@@YAXXZ
_onexit
__dllonexit
_unlock
_lock
_commode
_fmode
_wcmdln
__C_specific_handler
_initterm
__setusermatherr
_cexit
_exit
exit
__set_app_type
__wgetmainargs
memset

ntdll

EtwEventRegister
EtwEventUnregister

api-ms-win-core-com-l1-1-0

CoInitializeSecurity
CoSetProxyBlanket
CoInitializeEx
CoTaskMemFree
StringFromCLSID
CoUninitialize

oleaut32

SysAllocStringByteLen
SysFreeString

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
TerminateProcess
GetStartupInfoW

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

rpcrt4

RpcStringBindingComposeW
NdrClientCall3
RpcBindingFree
RpcStringFreeW
RpcBindingFromStringBindingW
I_RpcExceptionFilter
RpcBindingSetAuthInfoExW

winsta

WinStationGetAllProcesses
WinStationFreeGAPMemory

api-ms-win-core-path-l1-1-0

PathCchCombine

Sections

.text
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 540B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 40B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 192B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

8af12edd150a1168dc2b3c264d8f5383

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

msvcrt

ntdll

api-ms-win-core-com-l1-1-0

oleaut32

api-ms-win-core-synch-l1-2-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

rpcrt4

winsta

api-ms-win-core-path-l1-1-0

Sections

.text Size: 15KB - Virtual size: 15KB

.rdata Size: 12KB - Virtual size: 11KB

.data Size: 512B - Virtual size: 11KB

.pdata Size: 1024B - Virtual size: 540B

.didat Size: 512B - Virtual size: 40B

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 512B - Virtual size: 192B

.text
Size: 15KB - Virtual size: 15KB

.rdata
Size: 12KB - Virtual size: 11KB

.data
Size: 512B - Virtual size: 11KB

.pdata
Size: 1024B - Virtual size: 540B

.didat
Size: 512B - Virtual size: 40B

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 512B - Virtual size: 192B