MDE_File_Sample_63d577f88a5070da6061ad1e6ab3e3fca31c0e59c86d6f590fcee94d34a761d7[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

MDE_File_Sample_63d577f88a5070da6061ad1e6ab3e3fca31c0e59c86d6f590fcee94d34a761d7.zip
Size

8.2MB
MD5

fc63fb40f89ce512b7d3ce9737dd3f2b
SHA1

6e5edffdd2fe6e5b7b40dc37f357c867939a8fa5
SHA256

4fe406ad6320e0481d18bf96a3a7657f870ef2deb9bd9167f6399c65bb696519
SHA512

dfc211e4edb3533d3f3887e0d1e140f7ea1375e57c9f7211e3a583037c6210d29d0a5049b91931a8e2e3b859f38cf62d10ba7d9e5990dbaea76c1f246bf5c76e
SSDEEP

196608:UBwr7+tWIcschs4ymbHixsP37f2c/5wPCKNuMLmy5jvd3Esy4:Uir7ojcQmbYsTT/+6K8MLmyLdR

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/_nzpxha9_P.ia.a1

Files

MDE_File_Sample_63d577f88a5070da6061ad1e6ab3e3fca31c0e59c86d6f590fcee94d34a761d7.zip
.zip

Password: infected
_nzpxha9_P.ia.a1
.dll windows:5 windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

B080723_N
TMethodImplementationIntercept
__dbk_fcall_wrapper
dbkFCallWrapperAddr

Sections

Size: 2.8MB - Virtual size: 8.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: 12KB - Virtual size: 26KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: 61KB - Virtual size: 175KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 63KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 1KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 2KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 512B - Virtual size: 69B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 262KB - Virtual size: 717KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Size: 2.9MB - Virtual size: 65.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.edata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

YES
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 58KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

YES
Size: - Virtual size: 5.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.boot
Size: 2.4MB - Virtual size: 2.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Headers

DLL Characteristics

File Characteristics

Exports

Exports

Sections

Size: 2.8MB - Virtual size: 8.8MB

Size: 12KB - Virtual size: 26KB

Size: 61KB - Virtual size: 175KB

.bss Size: - Virtual size: 63KB

Size: 1KB - Virtual size: 22KB

Size: 2KB - Virtual size: 8KB

Size: 512B - Virtual size: 176B

Size: 512B - Virtual size: 69B

Size: 262KB - Virtual size: 717KB

Size: 2.9MB - Virtual size: 65.9MB

.edata Size: 512B - Virtual size: 4KB

YES Size: 16KB - Virtual size: 16KB

.idata Size: 1KB - Virtual size: 4KB

.rsrc Size: 58KB - Virtual size: 58KB

YES Size: - Virtual size: 5.3MB

.boot Size: 2.4MB - Virtual size: 2.4MB

.bss
Size: - Virtual size: 63KB

.edata
Size: 512B - Virtual size: 4KB

YES
Size: 16KB - Virtual size: 16KB

.idata
Size: 1KB - Virtual size: 4KB

.rsrc
Size: 58KB - Virtual size: 58KB

YES
Size: - Virtual size: 5.3MB

.boot
Size: 2.4MB - Virtual size: 2.4MB