ad1417ba9e765856d608177c1f0830b032bc4f2878f14b1d11980846b89e04de[.]zip

Resubmissions

05/10/2023, 09:15

231005-k77bdsbh42 3

05/10/2023, 09:05

231005-k2m1kahh8s 3

Sharing

Copy URL Twitter E-mail

General

Target

ad1417ba9e765856d608177c1f0830b032bc4f2878f14b1d11980846b89e04de.zip
Size

1.2MB
MD5

0092d7a4ec7bb1fb9ac9131130140bcc
SHA1

16671d32940219fc12b8ced3b3e21b3082573b4c
SHA256

617e072af91ab139903639f24860653ca74dcb781dd3aae2bbca2800aa261506
SHA512

a8ed4793c640afae91f9513780850e27a3ef0acd397de242586df49ff3c17405e4e5c3840acb534bf5ca86df1ff9a4d7cee9e373f82e6d8451ab048f36089b02
SSDEEP

24576:2dTCTwJCpsvCHVD1p69kKNSOy5RYFBLZovivaO0Jd:2ZewJCKKHVD149kgSOyUFBi40Jd

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/ad1417ba9e765856d608177c1f0830b032bc4f2878f14b1d11980846b89e04de.exe

Files

ad1417ba9e765856d608177c1f0830b032bc4f2878f14b1d11980846b89e04de.zip
.zip

Password: infected
ad1417ba9e765856d608177c1f0830b032bc4f2878f14b1d11980846b89e04de.exe
.exe windows:5 windows x86

Password: infected

ef1c7a48d9044aa991779608a9efd584

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetTempFileNameW
lstrlenA
ReadProcessMemory
WideCharToMultiByte
SetErrorMode
ReleaseSemaphore
CreateSemaphoreW
HeapSetInformation
FindResourceExW
OpenProcess
ExitProcess
GetCurrentDirectoryW
GetSystemDirectoryW
SetCurrentDirectoryW
GetCurrentProcess
GetCommandLineW
GetTempPathW
MultiByteToWideChar
FreeLibrary
LoadLibraryExW
lstrcmpiW
InterlockedDecrement
InterlockedIncrement
lstrlenW
OutputDebugStringA
GetModuleFileNameW
SetLastError
GetExitCodeProcess
FindResourceW
LoadResource
LockResource
SizeofResource
RaiseException
GetVersion
GetFileAttributesW
LoadLibraryW
GetModuleHandleA
LoadLibraryA
InitializeCriticalSection
GetCurrentProcessId
CreateNamedPipeW
LocalFree
ResetEvent
CreateThread
CreateEventW
DeleteCriticalSection
GetModuleHandleW
GetProcAddress
WriteFile
ConnectNamedPipe
ReadFile
DisconnectNamedPipe
SetEvent
WaitForSingleObject
CloseHandle
CreateMutexW
CallNamedPipeW
GetLastError
WaitNamedPipeW
CreateFileW
GetVersionExW
LeaveCriticalSection
EnterCriticalSection
SetEnvironmentVariableA
CompareStringW
CompareStringA
SetEndOfFile
GetDriveTypeA
GetCurrentDirectoryA
CreateFileA
GetLocaleInfoW
GetStringTypeA
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetDateFormatA
GetTimeFormatA
FlushFileBuffers
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetTimeZoneInformation
GetStartupInfoA
SetHandleCount
FreeEnvironmentStringsW
IsValidCodePage
LocalAlloc
InterlockedCompareExchange
InterlockedExchange
SignalObjectAndWait
TerminateProcess
GetTickCount
SetInformationJobObject
TerminateJobObject
GetQueuedCompletionStatus
DuplicateHandle
GetCurrentThreadId
CreateIoCompletionPort
PostQueuedCompletionStatus
ResumeThread
WriteProcessMemory
MapViewOfFile
CreateFileMappingW
GetThreadContext
AssignProcessToJobObject
GetStartupInfoW
UnregisterWaitEx
RegisterWaitForSingleObject
CreateJobObjectW
VirtualFreeEx
VirtualAllocEx
VirtualProtectEx
SearchPathW
ExpandEnvironmentStringsW
QueryInformationJobObject
HeapAlloc
GetProcessHeap
VirtualProtect
CreateProcessW
OpenEventW
DebugBreak
VirtualQuery
SuspendThread
WaitForMultipleObjects
VirtualQueryEx
GetLongPathNameW
QueryDosDeviceW
InterlockedExchangeAdd
SetUnhandledExceptionFilter
DeleteFileW
SetFilePointer
ReleaseMutex
Sleep
IsDebuggerPresent
GetStdHandle
CreateToolhelp32Snapshot
GetSystemInfo
Process32NextW
Process32FirstW
GetProcessId
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
QueryPerformanceCounter
TlsGetValue
TlsFree
TlsSetValue
TlsAlloc
GlobalUnlock
GlobalLock
GlobalSize
GlobalAddAtomW
GetFileType
GetExitCodeThread
GetWindowsDirectoryW
MoveFileExW
QueueUserWorkItem
GlobalAlloc
GlobalFree
VerifyVersionInfoW
VerSetConditionMask
lstrcmpiA
GetEnvironmentStringsW
SetEnvironmentVariableW
GetEnvironmentVariableW
CreateDirectoryExW
RtlUnwind
HeapFree
UnhandledExceptionFilter
VirtualAlloc
HeapReAlloc
GetConsoleCP
GetConsoleMode
SetStdHandle
GetFullPathNameW
LCMapStringA
LCMapStringW
GetCPInfo
GetStringTypeW
HeapCreate
HeapDestroy
VirtualFree
GetModuleFileNameA
HeapSize
GetACP
GetOEMCP

user32

SetActiveWindow
CloseWindow
GetClipboardFormatNameA
GetClipboardData
ReleaseDC
GetDC
OpenClipboard
CloseClipboard
EmptyClipboard
SetClipboardData
IsClipboardFormatAvailable
EnumClipboardFormats
CountClipboardFormats
GetClipboardFormatNameW
GetClipboardSequenceNumber
GetClipboardOwner
GetPriorityClipboardFormat
GetOpenClipboardWindow
ChangeClipboardChain
GetClipboardViewer
SetClipboardViewer
RegisterClipboardFormatW
RegisterClipboardFormatA
LoadCursorW
LoadIconW
SendDlgItemMessageW
FindWindowExW
EnumThreadWindows
SetWindowPos
GetParent
DdeClientTransaction
EnumChildWindows
GetWindowInfo
SetWindowTextW
IsWindowEnabled
EnableWindow
RegisterClassW
GetAsyncKeyState
UnregisterClassW
MsgWaitForMultipleObjectsEx
WaitMessage
GetQueueStatus
PostQuitMessage
CallMsgFilterW
KillTimer
GetClassNameW
SetWindowLongW
GetUserObjectInformationW
GetWindowThreadProcessId
GetGUIThreadInfo
SendMessageW
DialogBoxParamW
CharNextW
GetDlgItem
EndDialog
IsWindow
EnumWindows
DestroyWindow
PostMessageW
SetParent
GetFocus
GetActiveWindow
RegisterWindowMessageW
RegisterClassExW
CreateWindowExW
SetTimer
GetDesktopWindow
CloseWindowStation
CloseDesktop
CreateWindowStationW
AllowSetForegroundWindow
BringWindowToTop
GetWindowLongW
GetThreadDesktop
SetProcessWindowStation
CreateDesktopW
GetProcessWindowStation
PeekMessageW
MsgWaitForMultipleObjects
TranslateMessage
DispatchMessageW
DdeDisconnect
DdeConnect
DdeCreateDataHandle
DdeAddData
DdeGetData
DdeInitializeW
DdeUninitialize
DdeFreeStringHandle
DdeCreateStringHandleW
DdeNameService
FindWindowA
RegisterWindowMessageA
ShowWindow
FindWindowW
DefWindowProcW
MessageBoxW
UserHandleGrantAccess

advapi32

CryptHashData
RegCloseKey
CreateProcessAsUserW
CreateRestrictedToken
DuplicateTokenEx
DuplicateToken
LookupPrivilegeValueW
CopySid
CreateWellKnownSid
GetSecurityInfo
SetEntriesInAclW
ConvertSidToStringSidW
CheckTokenMembership
CryptGetProvParam
CryptSetProvParam
CryptGenRandom
CryptDecrypt
CryptSignHashA
CryptSignHashW
CryptGetHashParam
CryptAcquireContextA
CryptAcquireContextW
CryptImportKey
CryptGetUserKey
CryptCreateHash
CryptReleaseContext
CryptDestroyKey
CryptDestroyHash
RegOpenKeyExW
CryptGenKey
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegDeleteKeyW
RegDisablePredefinedCache
RevertToSelf
SetSecurityInfo
GetSecurityDescriptorSacl
SetTokenInformation
GetLengthSid
ConvertStringSidToSidW
SetThreadToken
RegOpenKeyExA
GetTokenInformation
OpenProcessToken
EqualSid
RegQueryValueExA
RegCreateKeyW
RegOpenKeyW
RegQueryValueW
RegEnumKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
RegQueryValueExW

shell32

ord43
SHGetSpecialFolderPathW
ShellExecuteExW
SHGetFolderPathW
ShellExecuteW
SHCreateDirectoryExW
SHGetPathFromIDListW
SHBrowseForFolderW
FindExecutableW
SHGetFileInfoW
CommandLineToArgvW

ole32

CoInitialize
StringFromCLSID
CreateStreamOnHGlobal
CoMarshalInterface
GetHGlobalFromStream
CLSIDFromString
CoRevokeClassObject
CoRegisterClassObject
CoTaskMemAlloc
CoTaskMemRealloc
CoCreateInstance
CoTaskMemFree
CoUninitialize
CoResumeClassObjects
CoInitializeEx
CLSIDFromProgID
CoUnmarshalInterface
ReleaseStgMedium

oleaut32

SysAllocStringByteLen
SafeArrayRedim
VariantCopyInd
VariantClear
LoadTypeLi
LoadRegTypeLi
SysAllocString
SafeArrayPutElement
VariantCopy
SafeArrayCopy
VariantInit
VarBstrCmp
SafeArrayGetVartype
SafeArrayDestroy
SafeArrayCreate
SysStringByteLen
SysAllocStringLen
SafeArrayLock
SafeArrayUnlock
SafeArrayGetUBound
SysStringLen
VarUI4FromStr
SysFreeString
SafeArrayGetLBound

mapi32

ord19

shlwapi

AssocQueryStringW
PathFileExistsW
PathIsDirectoryW
PathAppendW
PathIsRelativeW
PathFindExtensionW
PathAddBackslashW
UrlCanonicalizeW
PathCreateFromUrlW
UrlIsW
PathIsURLW
PathFindFileNameW
PathRemoveFileSpecW

winmm

timeGetTime
timeBeginPeriod
timeEndPeriod

secur32

FreeContextBuffer
FreeCredentialsHandle
InitializeSecurityContextA
DeleteSecurityContext
AcquireCredentialsHandleA

gdi32

GetStockObject
GetEnhMetaFileHeader
GetCurrentObject
GetRgnBox
CreateRectRgn
CombineRgn
CreateEnhMetaFileW
SetPolyFillMode
GetObjectType
CloseEnhMetaFile
CreateCompatibleBitmap
SetDIBits
GetObjectW
GetDIBits
GetEnhMetaFileBits
PlayEnhMetaFile
DeleteEnhMetaFile
SelectObject
GetFontData
CreateScalableFontResourceW
RemoveFontResourceW
DeleteObject
CreateFontIndirectW
GetClipBox
CreateDCW
GetTextColor
GetTextAlign
GetBkMode
GetStretchBltMode
GetPolyFillMode
GetMiterLimit
AddFontResourceW
DeleteDC
ExtEscape
Escape
ResetDCW
EndDoc
EndPage
StartPage
AbortDoc
StartDocW
GetDeviceCaps
SetEnhMetaFileBits
CreateDCA
CreateICW

winspool.drv

ClosePrinter
DeviceCapabilitiesW
DeviceCapabilitiesA
DeletePrinterDataW
DeletePrinterDataA
SetPrinterW
GetPrinterDriverA
GetPrinterDriverW
DocumentPropertiesW
GetPrinterW
EnumPrintersA
OpenPrinterW
EnumPrintersW
OpenPrinterA

Sections

.text
Size: 706KB - Virtual size: 708KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 203KB - Virtual size: 204KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 27KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 300KB - Virtual size: 300KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 35KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

ef1c7a48d9044aa991779608a9efd584

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

mapi32

shlwapi

winmm

secur32

gdi32

winspool.drv

Sections

.text Size: 706KB - Virtual size: 708KB

.rdata Size: 203KB - Virtual size: 204KB

.data Size: 27KB - Virtual size: 28KB

.rsrc Size: 300KB - Virtual size: 300KB

.reloc Size: 35KB - Virtual size: 45KB

.text
Size: 706KB - Virtual size: 708KB

.rdata
Size: 203KB - Virtual size: 204KB

.data
Size: 27KB - Virtual size: 28KB

.rsrc
Size: 300KB - Virtual size: 300KB

.reloc
Size: 35KB - Virtual size: 45KB