AER-sam[.]zip | Triage

Sharing

Copy URL Twitter E-mail

General

Target

AER-sam.zip
Size

225KB
MD5

21f3f1e319537808dcab0e701b2d0537
SHA1

8203480145a38bf14cf81058455abeb76233d524
SHA256

6d3dd21f200e591ef67af2c22ce986f8f29ed3a5acac4ef125664ee7230e34f0
SHA512

1603237c8b89631839023bb94a236f385bb12190cc78b25e79fb64d8e057c2cf43e6293efe52edbbe4a2ad6f639eb6a348fbbdccee4c64bf931b13bfa07710c3
SSDEEP

6144:RbTOKKpBTznQQZxMtP422TuqTYWfHPlDdL:9teNPZy42WLYadhL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/6c321d51e03f703cafa3fb12d2a5130744aef6dd90c60aceb2572758e3ce2441

Files

AER-sam.zip
.zip

Password: infected
6c321d51e03f703cafa3fb12d2a5130744aef6dd90c60aceb2572758e3ce2441
.exe windows:6 windows x64

d1884757532ce7b0014241f40262c929

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

TraceMessage
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
UnregisterTraceGuids
TraceEvent
RegSetValueExW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegCreateKeyExW

kernel32

GetTickCount
QueryPerformanceCounter
GetModuleHandleW
SetUnhandledExceptionFilter
GetStartupInfoW
GetVersionExA
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
DeleteCriticalSection
InitializeCriticalSection
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
OutputDebugStringA
CreateMutexW
lstrlenA
MultiByteToWideChar
ReleaseMutex
GetVersionExW
GetSystemDefaultUILanguage
Sleep
CloseHandle
WriteFile
lstrlenW
CreateFileW
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
EnterCriticalSection
LeaveCriticalSection
RegisterApplicationRestart
HeapSetInformation
DeleteFileW
GetTempPathW
FreeLibrary
WideCharToMultiByte
GetProcAddress
LoadLibraryW
ExpandEnvironmentStringsW
RaiseException
GlobalDeleteAtom
GlobalAddAtomW
GetLastError
GetCurrentThreadId
SetLastError

gdi32

CreateCompatibleBitmap
CreatePen
CreateRectRgnIndirect
CreateRectRgn
CombineRgn
GetStockObject
Rectangle
SelectObject
GetDeviceCaps
DeleteObject
SetTextColor
SetBkMode
GetLayout
GetClipRgn
SelectClipRgn
GetObjectW
CreatePolygonRgn
OffsetRgn
FillRgn
PatBlt
CreateCompatibleDC
DeleteDC
CreateDIBSection
BitBlt
SetLayout
CreateSolidBrush

user32

MapWindowPoints
GetMonitorInfoW
CopyRect
UnregisterClassA
DeferWindowPos
BeginDeferWindowPos
SetCursor
GetIconInfo
GetWindowTextW
CallWindowProcW
DrawIconEx
OffsetRect
GetWindowRgnBox
UnregisterHotKey
GetWindowLongW
GetForegroundWindow
DestroyMenu
CheckMenuRadioItem
GetSystemMetrics
IsWindowVisible
ShowWindow
ReleaseDC
LoadCursorW
RegisterClassW
GetWindowLongPtrW
SetWindowLongPtrW
BeginPaint
LoadMenuW
SetCapture
ReleaseCapture
UnionRect
InvalidateRect
GetPropW
SetPropW
IntersectRect
EnumDisplayMonitors
IsIconic
PtInRect
GetWindow
LogicalToPhysicalPoint
SetRect
CloseClipboard
OpenClipboard
EmptyClipboard
SetClipboardData
GetClassNameW
GetParent
LoadAcceleratorsW
GetWindowRect
TranslateAcceleratorW
LoadStringW
CreateWindowExW
AdjustWindowRect
RegisterHotKey
DestroyWindow
MonitorFromWindow
EndDeferWindowPos
LoadIconW
GetSubMenu
LoadImageW
SetClassLongPtrW
SetWindowTextW
IsZoomed
DialogBoxParamW
CheckDlgButton
IsDlgButtonChecked
GetClientRect
DrawFocusRect
DrawTextW
GetProcessDefaultLayout
TrackPopupMenuEx
SetScrollInfo
GetScrollInfo
SetFocus
DefWindowProcW
PostMessageW
GetMessageW
TranslateMessage
DispatchMessageW
EndPaint
AdjustWindowRectEx
InflateRect
FillRect
SendMessageW
EndDialog
GetDlgItem
GetDC
SetForegroundWindow
OpenIcon
FindWindowW
MessageBoxW
GetSysColor
SetWindowPos
GetWindowDC
GetDesktopWindow
PostQuitMessage
SystemParametersInfoW

msvcrt

__CxxFrameHandler3
??3@YAXPEAX@Z
??_V@YAXPEAX@Z
free
_vsnwprintf
??_U@YAPEAX_K@Z
??2@YAPEAX_K@Z
_wcsicmp
memcpy_s
wcscspn
wcsspn
memmove_s
malloc
_resetstkoflw
strstr
_vscwprintf
_onexit
_lock
__dllonexit
_unlock
??1type_info@@UEAA@XZ
_errno
realloc
?terminate@@YAXXZ
__set_app_type
_fmode
_commode
__setusermatherr
_amsg_exit
_initterm
_acmdln
exit
_cexit
_ismbblead
_exit
_XcptFilter
__getmainargs
memset
__C_specific_handler
vswprintf_s
_CxxThrowException

ntdll

WinSqmIncrementDWORD
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
EtwTraceMessage
WinSqmIsOptedIn

gdiplus

GdipSaveImageToStream
GdipMeasureString
GdipSetStringFormatFlags
GdipSetStringFormatLineAlign
GdipSetStringFormatAlign
GdipCreateStringFormat
GdipCreateFontFromLogfontW
GdipDeleteStringFormat
GdipDeleteFont
GdipDrawString
GdipFillRectangle
GdipCreateLineBrushFromRect
GdipGetImageEncodersSize
GdipCreateBitmapFromScan0
GdipCreateBitmapFromHBITMAP
GdipCloneImage
GdipDisposeImage
GdipSaveImageToFile
GdipFillEllipseI
GdipSetSmoothingMode
GdiplusStartup
GdiplusShutdown
GdipDeleteGraphics
GdipFillRectangleI
GdipCloneBrush
GdipDeleteBrush
GdipCreateSolidFill
GdipCreateFromHDC
GdipFree
GdipAlloc
GdipGetImageEncoders

comctl32

ImageList_Create
ImageList_Add
ord380
ImageList_Destroy
ord345
InitCommonControlsEx

shlwapi

UrlCreateFromPathW
PathFindExtensionW
StrStrA
PathIsURLW
StrChrW
ord487
PathFindFileNameW
ord158
SHRegGetUSValueW
PathRemoveExtensionW

shell32

ShellAboutW
ord75
SHCreateItemInKnownFolder

ole32

CoTaskMemFree
StringFromCLSID
CoInitialize
CoCreateInstance
CreateStreamOnHGlobal
CoCreateGuid
CoUninitialize

oleaut32

SafeArrayGetElement
SafeArrayGetUBound
VarBstrCat
SysAllocStringLen
SysStringLen
SysAllocString
VariantClear
VariantInit
SysFreeString
SafeArrayPutElement

uxtheme

GetThemeSysFont
GetThemeSysColor

oleacc

AccessibleObjectFromWindow

slc

SLGetWindowsInformationDWORD

msdrm

DRMIsWindowProtected

Sections

.text
Size: 165KB - Virtual size: 165KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 245KB - Virtual size: 248KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

d1884757532ce7b0014241f40262c929

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

gdi32

user32

msvcrt

ntdll

gdiplus

comctl32

shlwapi

shell32

ole32

oleaut32

uxtheme

oleacc

slc

msdrm

Sections

.text Size: 165KB - Virtual size: 165KB

.data Size: 1024B - Virtual size: 11KB

.pdata Size: 5KB - Virtual size: 4KB

.rsrc Size: 245KB - Virtual size: 248KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 165KB - Virtual size: 165KB

.data
Size: 1024B - Virtual size: 11KB

.pdata
Size: 5KB - Virtual size: 4KB

.rsrc
Size: 245KB - Virtual size: 248KB

.reloc
Size: 1KB - Virtual size: 1KB