11674579399[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

11674579399.zip
Size

311KB
MD5

7c18db47e1be39c348a6acb5f4c85b26
SHA1

8a365bf4d72b6fecf56a14cb0fe904c903790e94
SHA256

11e6220013700b6310c60ecd44e3c1dcb966364a8b1fd2d9670074190841a8be
SHA512

7f6cc0f078f5daa6f134a468ab06506fc95c4f68bbe3d7ed84f1cf8eca28f1ee7f3798d8f00316376e1b49fc2cb1bbabe7ce9ee708567e48328a34bc85adc762
SSDEEP

6144:aJbxTddOepgUHIucVwcxqcHoK/XJu0Fo0VqEbzFhTysGXK7CI7n4xWtw/bpP:m1WOkxnHo0Juz4Rhmit4xYG

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/c28708e707789379dfba91aee9cecb18ac3bf11ffd678ed2b97cfd88b80adbc5

Files

11674579399.zip
.zip

Password: infected
c28708e707789379dfba91aee9cecb18ac3bf11ffd678ed2b97cfd88b80adbc5
.dll windows x86

Password: infected

b7fa5d0a561f82b8d27459b3b4a585bc

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscms

GetStandardColorSpaceProfileW

gdi32

GetTextExtentExPointI
GetSystemPaletteEntries
GetViewportOrgEx
GetRegionData
GetDeviceGammaRamp
GetViewportExtEx
GetWindowExtEx

oleaut32

LoadTypeLibEx

winspool.drv

GetPrinterW
FindFirstPrinterChangeNotification

shlwapi

GetMenuPosFromID

kernel32

GetBinaryTypeW
GetModuleFileNameW
GetCurrentThreadId
GetStringTypeW
GetTempPathA
GetConsoleCursorInfo
GetConsoleTitleW
DeleteVolumeMountPointW
GetSystemTimeAsFileTime
GetThreadContext
GetCurrentDirectoryA
GetDiskFreeSpaceExW
GetCommTimeouts
GetComputerNameW
DeleteFileA
GetFileType
DefineDosDeviceA
GetProcessWorkingSetSize
GetFileAttributesExW
DeactivateActCtx
GetThreadTimes
WriteProfileStringA
GetVersion
FindFirstFileExA

secur32

EnumerateSecurityPackagesW
GetUserNameExA
GetUserNameExW
InitializeSecurityContextA

ole32

GetConvertStg

msvcrt

memset
strcmp

urlmon

GetClassFileOrMime

user32

GetWindowTextA
EnumWindowStationsA
GetMessageTime
GetMenuDefaultItem
LoadMenuW
DefWindowProcW
GetKeyState
GetClassInfoExA
DestroyCursor
DestroyMenu
GetMessageA

wininet

FindNextUrlCacheGroup

version

GetFileVersionInfoSizeA

advapi32

RegOpenKeyA
GetCurrentHwProfileA
GetUserNameW
GetCurrentHwProfileW

Sections

.text
Size: 92KB - Virtual size: 88KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 260KB - Virtual size: 256KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 108KB - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

b7fa5d0a561f82b8d27459b3b4a585bc

Headers

DLL Characteristics

File Characteristics

Imports

mscms

gdi32

oleaut32

winspool.drv

shlwapi

kernel32

secur32

ole32

msvcrt

urlmon

user32

wininet

version

advapi32

Sections

.text Size: 92KB - Virtual size: 88KB

.rdata Size: 260KB - Virtual size: 256KB

.data Size: 16KB - Virtual size: 24KB

.idata Size: 4KB - Virtual size: 3KB

.reloc Size: 108KB - Virtual size: 107KB

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 8KB - Virtual size: 7KB

.text
Size: 92KB - Virtual size: 88KB

.rdata
Size: 260KB - Virtual size: 256KB

.data
Size: 16KB - Virtual size: 24KB

.idata
Size: 4KB - Virtual size: 3KB

.reloc
Size: 108KB - Virtual size: 107KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 8KB - Virtual size: 7KB