malware[.]zip | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

malware.zip
Size

543KB
MD5

8b671990370ae2ea726a11fbac957ab0
SHA1

f0eb18cdb3868f2c84344e8d001a87e236dfcab1
SHA256

0408b22c6c030c95f94ab4f2cb49706dfaa66f58531d39396cf3c72d01bd0008
SHA512

2dd268a2af1127776512ff9cbf46ee019033e5892131dc615095b016602a28911c7dae8bef1ab2e91ec6efa4add22849cc5a69b609c872a53ada59f860a9fb31
SSDEEP

12288:uSzcHCACMCC3g1JGhxYpD8ZLk6j10oBsUhsmQ0/yznKYLz:uSzgXCMCCuGhxIqP50oBsUSmLyjl

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/dfrgui.exe
unpack001/sxshared.dll

Files

malware.zip
.zip

Password: infected
dfrgui.exe
.exe windows:6 windows x86

04d8ee76d0a182663f0fc26de23d4858

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
RegisterTraceGuidsW
UnregisterTraceGuids
RegCloseKey
ConvertStringSecurityDescriptorToSecurityDescriptorW
CloseTrace
RegCreateKeyExW
OpenProcessToken
TraceMessage
ControlTraceW
EnableTrace
StartTraceW
CheckTokenMembership
GetTokenInformation
CreateWellKnownSid
RegOpenKeyExW
RegQueryValueExW
DuplicateToken

kernel32

GetLocaleInfoW
FormatMessageW
LoadLibraryW
GetProcAddress
FreeLibrary
CreateThread
Sleep
GetLocalTime
GetCalendarInfoW
GetModuleHandleW
LoadLibraryExW
GetVolumePathNameW
ExpandEnvironmentStringsW
MoveFileExW
CreateFileW
DeviceIoControl
FindFirstFileW
FindNextFileW
FindClose
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
GetStartupInfoA
InterlockedCompareExchange
InterlockedExchange
GetVolumeInformationW
GetDriveTypeW
CreateEventW
DeleteCriticalSection
SetEvent
InitializeCriticalSection
GetVolumeNameForVolumeMountPointW
GetDateFormatW
GetTimeFormatW
GetCurrentProcess
EnterCriticalSection
LeaveCriticalSection
SystemTimeToFileTime
FileTimeToSystemTime
WaitForSingleObject
InterlockedPopEntrySList
InitializeSListHead
RtlCaptureStackBackTrace
InterlockedPushEntrySList
InterlockedDecrement
InterlockedIncrement
CloseHandle
SetLastError
GetProcessHeap
HeapSetInformation
SetErrorMode
GetCommandLineW
RegisterApplicationRestart
GetFileAttributesW
DeleteFileW
CreateDirectoryW
GetLastError
LocalFree

gdi32

CreateCompatibleDC
SetLayout
SelectObject
DeleteDC
DeleteObject
GdiFlush
CreateDIBSection
SetTextColor
SetBkColor
ExtTextOutW
CreateFontIndirectW
GetDeviceCaps

user32

SetWindowTextW
EnumWindows
GetWindowTextW
GetDlgItemTextW
SetDlgItemTextW
SendMessageTimeoutW
RegisterWindowMessageW
DestroyWindow
SystemParametersInfoW
ReleaseDC
GetDC
SendMessageW
DialogBoxParamW
SetForegroundWindow
MessageBoxW
MoveWindow
GetWindowRect
GetClientRect
ClientToScreen
GetSystemMetrics
DestroyIcon
EndPaint
GetSysColor
MapWindowPoints
GetDlgItem
BeginPaint
SetFocus
SetWindowLongW
GetWindowLongW
ShowWindow
EndDialog
EnableWindow
PostMessageW
SetWindowPos
LoadImageW
LoadStringW
CheckDlgButton
IsDlgButtonChecked
InflateRect
DrawFrameControl
OffsetRect
SetTimer
GetSysColorBrush
KillTimer
GetDesktopWindow
ChangeWindowMessageFilter

msvcrt

memset
memmove
wcstok
_wtol
??2@YAPAXI@Z
_purecall
_vscwprintf
memcpy
__getmainargs
_cexit
_exit
_XcptFilter
_ismbblead
exit
_acmdln
_initterm
_amsg_exit
__setusermatherr
__p__commode
__p__fmode
__set_app_type
?terminate@@YAXXZ
_except_handler4_common
_controlfp
_wcsicmp
??3@YAXPAX@Z
iswspace
_vsnwprintf
wcschr

shell32

CommandLineToArgvW
ShellExecuteExW
SHGetFileInfoW
SHGetStockIconInfo

ole32

CoCreateInstance
CoInitializeSecurity
CoInitializeEx
CoUninitialize
CoTaskMemAlloc
CoTaskMemFree
CoDisconnectObject

oleaut32

VariantInit
VariantTimeToSystemTime
SysFreeString
SysStringLen
SystemTimeToVariantTime
SysAllocString
VariantClear

comctl32

ImageList_Add
ImageList_AddMasked
ImageList_ReplaceIcon
ImageList_Create
ord345
InitCommonControlsEx
ord344
ImageList_Destroy

ntdll

RtlAllocateHeap
RtlFreeHeap
WinSqmAddToStream
EtwTraceMessage
RtlGetLastNtStatus

virtdisk

GetStorageDependencyInformation

sxshared

SxTracerDebuggerBreak
SxTracerGetThreadContextRetail
SxTracerShouldTrackFailure

Sections

.text
Size: 97KB - Virtual size: 96KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 463KB - Virtual size: 462KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dfrgui.exe.config
.xml
gz7io9.tmp
sxshared.dll
.dll regsvr32 windows:4 windows x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
GetLastFailureAsHRESULT
HRESULTFromNTSTATUS
SxTracerDebuggerBreak
SxTracerGetThreadContextDebug
SxTracerGetThreadContextRetail
SxTracerShouldTrackFailure
Win32FromHRESULT
Win32FromNTSTATUS

Sections

.text
Size: 118KB - Virtual size: 118KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.sdata
Size: 1024B - Virtual size: 548B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 676B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 44B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

04d8ee76d0a182663f0fc26de23d4858

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

gdi32

user32

msvcrt

shell32

ole32

oleaut32

comctl32

ntdll

virtdisk

sxshared

Sections

.text Size: 97KB - Virtual size: 96KB

.data Size: 5KB - Virtual size: 5KB

.rsrc Size: 463KB - Virtual size: 462KB

.reloc Size: 7KB - Virtual size: 6KB

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

File Characteristics

Imports

mscoree

Exports

Exports

Sections

.text Size: 118KB - Virtual size: 118KB

.sdata Size: 1024B - Virtual size: 548B

.rsrc Size: 1024B - Virtual size: 676B

.reloc Size: 512B - Virtual size: 44B

.text
Size: 97KB - Virtual size: 96KB

.data
Size: 5KB - Virtual size: 5KB

.rsrc
Size: 463KB - Virtual size: 462KB

.reloc
Size: 7KB - Virtual size: 6KB

.text
Size: 118KB - Virtual size: 118KB

.sdata
Size: 1024B - Virtual size: 548B

.rsrc
Size: 1024B - Virtual size: 676B

.reloc
Size: 512B - Virtual size: 44B