11696286759[.]zip | Triage™

General

Target
11696286759.zip
Size 311KB
Sample230901-sa8rysff29
SHA256 0b0a251719cc3c7f1a7cc1ce8b62f7b40b7747af08bcb9dc3ce95ccc94bd78b7
MD5 1306e68fa29a931472301f1c6732f45c
SHA1 e939bf34f4a608c8953fbbf83d7da533e32e9f5e
SHA512 aa94b6114da0ee852752e6fb997c50e7df81d0355c72162a421f836508b9eec1d42a792eea36b1275be54a5f07031e48b4aa0f94da82586ace8b3cd0e921b0be
SSDEEP 6144:0IALLDfRYIUceI9eFiKGU1IeHNjeBmHwl9bf46wOx2G6uCEXv/tOj:0RLvfRYueuKGmbjnHwlVw6wOxJ6uCM4
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/826e3f4fa6ac406d4143c9031704d1f1ae474740c59769deaf7c3bd0886f7828

File Explorer

11696286759.zip

.zip 311KB
826e3f4fa6ac406d4143c9031704d1f1ae474740c59769deaf7c3bd0886f7828

.dll 496KB

11696286759.zip

SHA256 0b0a251719cc3c7f1a7cc1ce8b62f7b40b7747af08bcb9dc3ce95ccc94bd78b7
MD5 1306e68fa29a931472301f1c6732f45c
SHA1 e939bf34f4a608c8953fbbf83d7da533e32e9f5e
SHA512 aa94b6114da0ee852752e6fb997c50e7df81d0355c72162a421f836508b9eec1d42a792eea36b1275be54a5f07031e48b4aa0f94da82586ace8b3cd0e921b0be
SSDEEP 6144:0IALLDfRYIUceI9eFiKGU1IeHNjeBmHwl9bf46wOx2G6uCEXv/tOj:0RLvfRYueuKGmbjnHwlVw6wOxJ6uCM4
MD5 SHA1 SHA512 SSDEEP

Password

infected

826e3f4fa6ac406d4143c9031704d1f1ae474740c59769deaf7c3bd0886f7828

IMPHASH f84800c8c63f43928b6ea707548ac3f3
SHA256 826e3f4fa6ac406d4143c9031704d1f1ae474740c59769deaf7c3bd0886f7828
MD5 20be9f99443471337677b822d64f3597
SHA1 cc60eb639199b675faadfa858d4b4d5fbe40620f
SHA512 73c9fa7da507cb561c264aadf8a2767472b8f80d453c1bef023dffd640be5a50494befe3d53de7fee40b03116c041ace074edfe1326749bd6b4f96f593f93123
SSDEEP 6144:v1IBXjS6D3sj/6L+Roit85Ckwmu+rPJJpevpNsN3nqblYXMg:udnD8D0+R32wP+rpcNEqb1g
MD5 SHA1 SHA512 SSDEEP

windows x86

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

4131

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

DefineDosDeviceA GetProcessWorkingSetSize GetFileAttributesExW DeactivateActCtx GetThreadTimes WriteProfileStringA GetFileType FindFirstFileExA GetCurrentThreadId GetModuleFileNameW GetBinaryTypeW DeleteFileA GetComputerNameW GetCommTimeouts GetDiskFreeSpaceExW GetStringTypeW GetCurrentDirectoryA GetThreadContext GetSystemTimeAsFileTime DeleteVolumeMountPointW GetConsoleTitleW GetConsoleCursorInfo GetTempPathA GetVersion

gdi32

GetViewportOrgEx GetSystemPaletteEntries GetWindowExtEx GetTextExtentExPointI GetRegionData GetDeviceGammaRamp GetViewportExtEx

winspool.drv

FindFirstPrinterChangeNotification GetPrinterW

user32

GetWindowTextA EnumWindowStationsA GetMessageTime GetMenuDefaultItem GetClassInfoExA GetKeyState LoadMenuW DefWindowProcW GetMessageA DestroyMenu DestroyCursor

oleaut32

LoadTypeLibEx

mscms

GetStandardColorSpaceProfileW

advapi32

GetCurrentHwProfileA GetUserNameW RegOpenKeyA GetCurrentHwProfileW

msvcrt

memset strcmp

urlmon

GetClassFileOrMime

version

GetFileVersionInfoSizeA

secur32

GetUserNameExW InitializeSecurityContextA GetUserNameExA EnumerateSecurityPackagesW

ole32

GetConvertStg

shlwapi

GetMenuPosFromID

wininet

FindNextUrlCacheGroup

Name

.text

Size

92KB

Virtual Size

89KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

260KB

Virtual Size

256KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

16KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

108KB

Virtual Size

107KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

8KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

11696286759.zip

826e3f4fa6ac406d4143c9031704d1f1ae474740c59769deaf7c3bd0886f7828

kernel32

gdi32

winspool.drv

user32

oleaut32

mscms

advapi32

msvcrt

urlmon

version

secur32

ole32

shlwapi

wininet