ACDE349602D1202528044B9A791980F1[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

ACDE349602D1202528044B9A791980F1.zip
Size

49KB
MD5

f6ce67ea3b7919a63e0c8f3bd028d2d2
SHA1

300c15cfcaa5f75866eeb88673ba26053571cfc5
SHA256

b54137a0d65c0b9d28a4546d40d3dc82cef11bfda78ee4f13b915a7ee4b21e98
SHA512

3ae080c0aaa13a0c38f8a8721a45b338d61d55a60c3c474149c00c5b0c3e8df3b1b41b14b7abd8421089f3f907800c86f28c6d96c756c08767df957b317ab536
SSDEEP

1536:VqfSGCSAnC2lGTOA06AbBRGe9nGzDQ6WN4q490C:VWz2lw0GGGfx9P

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/dwm.exe/dwm.exe

Files

ACDE349602D1202528044B9A791980F1.zip
.zip

Password: infected
details.json
dwm.exe/dwm.exe
.exe windows x64

da9d0579a13085ac96d862c4786dfaa7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

api-ms-win-crt-runtime-l1-1-0

_invoke_watson
_initterm_e
_c_exit
_register_thread_local_exe_atexit_callback
_initterm

api-ms-win-crt-private-l1-1-0

_o__errno
_o__exit
_o__get_wide_winmain_command_line
_o__initialize_onexit_table
_o__initialize_wide_environment
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_exe
_o__set_app_type
_o__set_fmode
_o__set_new_mode
memmove
_o__wcsicmp
_o__wtof
_o_exit
_o_free
_o_malloc
_o_terminate
__C_specific_handler
__CxxFrameHandler3
__current_exception
__current_exception_context
_CxxThrowException
_o__configure_wide_argv
_o__configthreadlocale
_o___p__commode
_o__cexit
_o__callnewh
_o___stdio_common_vswprintf
_o__crt_atexit
_o___std_exception_destroy
_o___std_exception_copy
memcmp
memcpy

api-ms-win-crt-string-l1-1-0

memset

api-ms-win-core-windowserrorreporting-l1-1-0

WerSetFlags

api-ms-win-core-windowserrorreporting-l1-1-3

WerSetMaxProcessHoldMilliseconds

api-ms-win-core-windowserrorreporting-l1-1-1

WerRegisterCustomMetadata
WerUnregisterCustomMetadata

api-ms-win-eventlog-legacy-l1-1-0

ReportEventW
RegisterEventSourceW
DeregisterEventSource

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
GetModuleHandleExW
GetModuleHandleExA
GetModuleHandleW
GetModuleFileNameA

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
OutputDebugStringW
DebugBreak

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
GetCurrentProcessId
TerminateThread
GetStartupInfoW
OpenProcessToken
ProcessIdToSessionId
GetCurrentThread
ExitProcess
GetCurrentProcess
TerminateProcess
SetPriorityClass

api-ms-win-core-errorhandling-l1-1-0

SetLastError
GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RaiseException
SetErrorMode

api-ms-win-core-synch-l1-1-0

ReleaseSRWLockExclusive
CreateSemaphoreExW
CreateMutexExW
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
AcquireSRWLockShared
InitializeCriticalSectionEx
ReleaseSRWLockShared
ReleaseMutex
AcquireSRWLockExclusive
WaitForSingleObjectEx
TryAcquireSRWLockExclusive
OpenSemaphoreW
ReleaseSemaphore
WaitForSingleObject
CreateEventW

api-ms-win-core-heap-l1-1-0

HeapFree
HeapAlloc
GetProcessHeap
HeapSetInformation

api-ms-win-core-winrt-error-l1-1-0

RoOriginateError

api-ms-win-core-com-l1-1-0

CoTaskMemAlloc

api-ms-win-core-threadpool-l1-2-0

CreateThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer

api-ms-win-security-base-l1-1-0

CheckTokenMembership
AdjustTokenPrivileges

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegQueryValueExW
RegGetValueW
RegSetValueExW
RegOpenKeyExW

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateStringReference

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureStackBackTrace
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-version-l1-1-1

GetFileVersionInfoSizeW
GetFileVersionInfoW

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer
EventSetInformation
EventRegister
EventUnregister

api-ms-win-core-version-l1-1-0

VerQueryValueW

rpcrt4

UuidCreate
RpcStringFreeW
UuidToStringW

api-ms-win-core-memory-l1-1-0

CreateFileMappingW
UnmapViewOfFile
MapViewOfFile

api-ms-win-core-util-l1-1-0

Beep

api-ms-win-core-psapi-l1-1-0

QueryFullProcessImageNameW

api-ms-win-composition-redirection-l1-1-0

DwmInitializePort

api-ms-win-composition-windowmanager-l1-1-0

ord101

api-ms-win-dx-d3dkmt-l1-1-0

D3DKMTCheckVidPnExclusiveOwnership
D3DKMTSetProcessSchedulingPriorityClass
D3DKMTEscape

api-ms-win-dx-d3dkmt-l1-1-1

D3DKMTOpenAdapterFromLuid

api-ms-win-rtcore-ntuser-private-l1-1-0

RegisterSessionPort

api-ms-win-rtcore-ntuser-private-l1-1-2

DwmKernelStartup

api-ms-win-rtcore-ntuser-window-l1-1-0

GetMessageW
RegisterClassExW
DefWindowProcW
PostMessageW
DestroyWindow
TranslateMessage
DispatchMessageW
PostQuitMessage
CreateWindowExW

win32u

NtDesktopCaptureBits

ntdll

RtlPublishWnfStateData
RtlSubscribeWnfStateChangeNotification
RtlUnsubscribeWnfStateChangeNotification
NtAlpcSendWaitReceivePort
RtlNtStatusToDosError
DbgPrompt
NtSetInformationProcess
RtlFreeSid
RtlAllocateAndInitializeSid
EtwEventRegister
EtwEventWriteTransfer
RtlGetDeviceFamilyInfoEnum
NtQueryInformationProcess
NtQuerySystemInformation
DbgPrintEx

dxgi

DXGIDeclareAdapterRemovalSupport

coremessaging

CoreUICreate

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

dwmcore

MilCompositionEngine_Initialize

msvcp_win

?_Raise_handler@std@@3P6AXAEBVexception@stdext@@@ZEA
?_Xlength_error@std@@YAXPEBD@Z
_Query_perf_counter
_Query_perf_frequency

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-errorhandling-l1-1-3

TerminateProcessOnMemoryExhaustion

api-ms-win-core-errorhandling-l1-1-2

RaiseFailFastException

Sections

.text
Size: 60KB - Virtual size: 57KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 4KB - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 328B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

da9d0579a13085ac96d862c4786dfaa7

Headers

DLL Characteristics

File Characteristics

Imports

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-core-windowserrorreporting-l1-1-0

api-ms-win-core-windowserrorreporting-l1-1-3

api-ms-win-core-windowserrorreporting-l1-1-1

api-ms-win-eventlog-legacy-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-winrt-error-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-version-l1-1-1

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-version-l1-1-0

rpcrt4

api-ms-win-core-memory-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-psapi-l1-1-0

api-ms-win-composition-redirection-l1-1-0

api-ms-win-composition-windowmanager-l1-1-0

api-ms-win-dx-d3dkmt-l1-1-0

api-ms-win-dx-d3dkmt-l1-1-1

api-ms-win-rtcore-ntuser-private-l1-1-0

api-ms-win-rtcore-ntuser-private-l1-1-2

api-ms-win-rtcore-ntuser-window-l1-1-0

win32u

ntdll

dxgi

coremessaging

api-ms-win-core-apiquery-l1-1-0

dwmcore

msvcp_win

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

api-ms-win-core-errorhandling-l1-1-3

api-ms-win-core-errorhandling-l1-1-2

Sections

.text Size: 60KB - Virtual size: 57KB

.rdata Size: 28KB - Virtual size: 24KB

.data Size: 4KB - Virtual size: 17KB

.pdata Size: 8KB - Virtual size: 4KB

.didat Size: 4KB - Virtual size: 176B

.rsrc Size: 8KB - Virtual size: 7KB

.reloc Size: 4KB - Virtual size: 328B

.text
Size: 60KB - Virtual size: 57KB

.rdata
Size: 28KB - Virtual size: 24KB

.data
Size: 4KB - Virtual size: 17KB

.pdata
Size: 8KB - Virtual size: 4KB

.didat
Size: 4KB - Virtual size: 176B

.rsrc
Size: 8KB - Virtual size: 7KB

.reloc
Size: 4KB - Virtual size: 328B