Static task
static1
Behavioral task
behavioral1
Sample
7095beafff5837070a89407c1bf3c6acf8221ed786e0697f6c578d4c3de0efd6.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
7095beafff5837070a89407c1bf3c6acf8221ed786e0697f6c578d4c3de0efd6.exe
Resource
win10v2004-20230915-en
General
-
Target
11803661090.zip
-
Size
236KB
-
MD5
29ff33d303b62882e1fe846da93d995a
-
SHA1
1c36dfed7f0815850239a71566f3e174fc6e5803
-
SHA256
84c5f5dd114dfb8586a5d3ff3cdf339214909680b8f0bbfa654a0ee0a1662164
-
SHA512
8a865fdb29bbd40006de2df43368e342d024ad6556f0dceba9a923c49c2e58398683693c05d25debc464a1c56b555c808b327e7662e817a5c184fd25fc14fd65
-
SSDEEP
6144:6EuKYQGPkCUkdYpdfG7O/VGCe/P4nwQTPBvOvaBiY39+:6Eu9QsLUQYpdvVYP4nwOobYt+
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/7095beafff5837070a89407c1bf3c6acf8221ed786e0697f6c578d4c3de0efd6
Files
-
11803661090.zip.zip
Password: infected
-
7095beafff5837070a89407c1bf3c6acf8221ed786e0697f6c578d4c3de0efd6.exe windows x64
a5438bd40d42b97abb8c7e584178178a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
advapi32
SystemFunction036
kernel32
CloseHandle
GlobalAlloc
GlobalFree
CreateFileW
GetLastError
DeviceIoControl
GetProcessHeap
HeapAlloc
GetDriveTypeW
FindFirstVolumeW
GetVolumePathNamesForVolumeNameW
SetVolumeMountPointW
FindNextVolumeW
FindVolumeClose
HeapFree
GetSystemDefaultLCID
GetSystemInfo
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
FreeEnvironmentStringsW
ReleaseMutex
FindClose
ReleaseSRWLockShared
AddVectoredExceptionHandler
SetThreadStackGuarantee
GetCurrentThread
Sleep
GetCurrentProcess
RtlCaptureContext
GetProcAddress
RtlLookupFunctionEntry
SetLastError
GetCurrentDirectoryW
GetEnvironmentStringsW
GetEnvironmentVariableW
SetEnvironmentVariableW
GetCommandLineW
SetFilePointerEx
FlushFileBuffers
GetStdHandle
GetCurrentProcessId
WaitForSingleObject
TerminateProcess
QueryPerformanceCounter
TryAcquireSRWLockExclusive
TlsAlloc
HeapReAlloc
AcquireSRWLockShared
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
GetModuleHandleA
FindNextFileW
GetFileInformationByHandle
FindFirstFileW
MoveFileExW
GetModuleHandleW
FormatMessageW
GetModuleFileNameW
ExitProcess
GetFullPathNameW
CreateThread
TlsGetValue
TlsSetValue
GetSystemTimeAsFileTime
GetConsoleMode
WriteConsoleW
GetConsoleOutputCP
HeapSize
LCMapStringW
CompareStringW
GetStringTypeW
GetFileType
SetStdHandle
WideCharToMultiByte
MultiByteToWideChar
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
GetCommandLineA
GetModuleHandleExW
WriteFile
LoadLibraryExW
FreeLibrary
TlsFree
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
EncodePointer
GetCurrentThreadId
InitializeSListHead
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
RtlUnwindEx
RtlPcToFileHeader
RaiseException
mpr
WNetOpenEnumW
WNetCloseEnum
WNetEnumResourceW
Sections
.text Size: 283KB - Virtual size: 282KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 153KB - Virtual size: 152KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ