17bf10e4dd21565658610824afa990f2f474c39a396510701425ef740343fdbd[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
17bf10e4dd21565658610824afa990f2f474c39a396510701425ef740343fdbd.zip
Size 77KB
Sample231001-ra5vmabd4s
SHA256 9e1d9504f01849014affc783aa1a47989897016e9c676b027ff23a803a37447d
MD5 50001871c875a0663982badcf303f8ad
SHA1 de63341b256bdd708f8d15f86a918ad23c5ebd40
SHA512 68174564ce5cae33f9521593cb9fb6a1bed060f37b42cb89b0608837d5e6d96b84e1853562bd277f326bf9fb5c9c21d5d53394460644ff66e34adca95176e52b
SSDEEP 1536:gEqvLBZ04hjObWBpa+9/STbWOTDv6GBn7GVUC0z33jknzlaMyP:gBLQ4kegPbfDSu0UC0zHjkzljk
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/17bf10e4dd21565658610824afa990f2f474c39a396510701425ef740343fdbd

File Explorer

17bf10e4dd21565658610824afa990f2f474c39a396510701425ef740343fdbd.zip

.zip 77KB
17bf10e4dd21565658610824afa990f2f474c39a396510701425ef740343fdbd

.exe 138KB

17bf10e4dd21565658610824afa990f2f474c39a396510701425ef740343fdbd.zip

SHA256 9e1d9504f01849014affc783aa1a47989897016e9c676b027ff23a803a37447d
MD5 50001871c875a0663982badcf303f8ad
SHA1 de63341b256bdd708f8d15f86a918ad23c5ebd40
SHA512 68174564ce5cae33f9521593cb9fb6a1bed060f37b42cb89b0608837d5e6d96b84e1853562bd277f326bf9fb5c9c21d5d53394460644ff66e34adca95176e52b
SSDEEP 1536:gEqvLBZ04hjObWBpa+9/STbWOTDv6GBn7GVUC0z33jknzlaMyP:gBLQ4kegPbfDSu0UC0zHjkzljk
MD5 SHA1 SHA512 SSDEEP

Password

infected

17bf10e4dd21565658610824afa990f2f474c39a396510701425ef740343fdbd

IMPHASH ca33a8184e94a42bd80f3c63b367c41f
SHA256 17bf10e4dd21565658610824afa990f2f474c39a396510701425ef740343fdbd
MD5 254df705ae1572e5bb33fdf9bdd38bb6
SHA1 3d40b40f626cae4d3499e72288cfdfe409df72ac
SHA512 60ba12b65eca7387733707eb27a39c076e9a0d3945555638262030b3bd32e8dd1d584ec59bcce26d96ef217f08a06c582289914229c19ad857ddde789474bf17
SSDEEP 3072:MbvdlTga8za7/aApO6fCR6kMgoXpOpo7KqXd4ljqEJSfMKRuF2f0xsxT626f/GAo:MDppOabdUj1J+MKRaKPLAm3zRd
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

28283

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetCommandLineW lstrlenW lstrcpyW lstrcmpiW EnterCriticalSection WriteFile GetModuleFileNameW LeaveCriticalSection InitializeCriticalSection SetFilePointer CreateFileW lstrcatW CloseHandle GetLocalTime DeleteCriticalSection SetPriorityClass GetCurrentProcess Wow64DisableWow64FsRedirection TerminateProcess CreateMutexW WaitForSingleObject ReleaseMutex OpenProcess Wow64RevertWow64FsRedirection GetLastError GetProcAddress ExitProcess GetModuleHandleW ReadFile GetLogicalDrives FindFirstFileW GetFileSizeEx FindNextFileW WaitForMultipleObjects SetThreadPriority GetQueuedCompletionStatus lstrlenA FindClose PostQueuedCompletionStatus SetFileAttributesW Sleep GetCurrentThread GetSystemInfo LoadLibraryW CreateThread MoveFileExW GetCurrentProcessId CreateIoCompletionPort GetDriveTypeW GetConsoleWindow HeapFree HeapSize HeapAlloc GetProcessHeap DecodePointer GetConsoleMode GetConsoleOutputCP FlushFileBuffers HeapReAlloc SetFilePointerEx LCMapStringW CompareStringW WriteConsoleW UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwind SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW EncodePointer RaiseException GetStdHandle GetModuleHandleExW GetCommandLineA GetFileType FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetStringTypeW

user32

wsprintfW ShowWindow wsprintfA

shell32

ShellExecuteW CommandLineToArgvW SHEmptyRecycleBinW

rstrtmgr

RmRegisterResources RmStartSession RmEndSession RmGetList

shlwapi

wvnsprintfW PathFindExtensionW PathRemoveFileSpecW