5hzkjlg864[.]zip | Triage™

General

Target
5hzkjlg864.zip
Size 620KB
Sample230913-tpps3aga96
SHA256 df5305461ba047695b80cf13da306677737724bf2e45b249bba0a5d0d7d57b15
MD5 8ddd8a831a271d295704f99d4c0ded6e
SHA1 a6dcbc1219de4a1192e9f7e29c0eb409dffbb74c
SHA512 91896469ae7007bf2d2720bd0321e9c102af195e98a2ca590b4580b559e15563d85e449b6d367481a171badee593303d428394b8412de4e6621d8dd0007dcc6e
SSDEEP 12288:ZhQhrFSUWEKlbahCdGxaxVpu790D9hfQbZo2L/9u2tnmhxBgG9f3/:ZhQ5FWvbL6ar60D9hco2LFFmh5Vv
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/5hzkjlg864.dll

File Explorer

5hzkjlg864.zip

.zip 620KB
5hzkjlg864.dll

.dll 1.1MB

5hzkjlg864.zip

SHA256 df5305461ba047695b80cf13da306677737724bf2e45b249bba0a5d0d7d57b15
MD5 8ddd8a831a271d295704f99d4c0ded6e
SHA1 a6dcbc1219de4a1192e9f7e29c0eb409dffbb74c
SHA512 91896469ae7007bf2d2720bd0321e9c102af195e98a2ca590b4580b559e15563d85e449b6d367481a171badee593303d428394b8412de4e6621d8dd0007dcc6e
SSDEEP 12288:ZhQhrFSUWEKlbahCdGxaxVpu790D9hfQbZo2L/9u2tnmhxBgG9f3/:ZhQ5FWvbL6ar60D9hco2LFFmh5Vv
MD5 SHA1 SHA512 SSDEEP

Password

infected

5hzkjlg864.dll

IMPHASH 660e4ba65070c42e55f04efddf5f7d78
SHA256 35105efb993284937212530ebf3625f532dfb9b00b73409c266ad380d0665b4f
MD5 946ff48f5b0f50a5501979347e8a411f
SHA1 407e18f76b337fe146b100c2a330ab7b5844c6ed
SHA512 d06328b0c92cd6237758d27060ab8a2b9b230454f194bb434c39945a5670b6ea8505109a6c3ea739758c5f26c0dbc400d1e1620695d812d687bd25fce54eba8e
SSDEEP 24576:bQAzTZH7ALVi4S8lvHV40phqqOCx/ZDAwPM:1zTZHE5rt9
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

16092

Magic Number

523

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

kernel32

EnterCriticalSection LeaveCriticalSection InitializeCriticalSection CloseHandle GetLastError GetCurrentActCtx HeapCreate TryEnterCriticalSection CreateThread OpenThread FindFirstFileA FindNextFileA FindClose WaitForSingleObject GetStdHandle WaitForMultipleObjects GetCurrentThread CreateFileMappingA VirtualAlloc DuplicateHandle QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW RtlUnwindEx InterlockedFlushSList SetLastError DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW GetCurrentProcess ExitProcess TerminateProcess GetModuleHandleExW GetModuleFileNameA MultiByteToWideChar WideCharToMultiByte HeapFree HeapAlloc LCMapStringW FindFirstFileExA IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap GetFileType GetStringTypeW HeapReAlloc HeapSize SetStdHandle RaiseException WriteFile FlushFileBuffers GetConsoleCP GetConsoleMode SetFilePointerEx WriteConsoleW CreateFileW

Name

.text

Size

58KB

Virtual Size

58KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

262KB

Virtual Size

262KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

762KB

Virtual Size

767KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

512B

Virtual Size

148B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

5hzkjlg864.zip

5hzkjlg864.dll

kernel32