11836180422[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

11836180422.zip
Size

12.6MB
MD5

65ab5e7b5137c441acae8baa07573cd2
SHA1

7f18d05b25f38ec701ae8c66e75012ce25468270
SHA256

6f347f6cd51b60e3441f30690d10934a212251d4afd8fc597164e0a895f946a8
SHA512

0677c4d0a00417f0cf3581f49befff8c3b10e72b21147846fbf42ac5e6c3b01103bb4fc3a32fc59ad0a8c613c4b47fa1a91fffe71f9eb2104d8271403359505e
SSDEEP

196608:C1peV2qmLStpxQXSP8blN/m4TQ52TCvFEF2L4LvmJcOX9hG0Tfns/nvx/OH:CLeVPj6XSkZN05duQQv49LT/sB/OH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/339b9a836d23ac4c92c2cfeb8db6d859f13b194d2119ebfc6f2eb62c4e887a72

Files

11836180422.zip
.zip

Password: infected
339b9a836d23ac4c92c2cfeb8db6d859f13b194d2119ebfc6f2eb62c4e887a72
.dll windows:5 windows x86

22fb261e144eab3d4e0b242b7a8e571f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

setupapi

SetupDiGetDeviceInterfaceDetailW
SetupDiEnumDeviceInterfaces
SetupDiGetClassDevsW
SetupDiEnumDeviceInfo
SetupDiGetDeviceInstanceIdW
SetupDiGetDeviceRegistryPropertyW
SetupDiDestroyDeviceInfoList

iphlpapi

GetAdaptersInfo

libeay32

ord67
ord1882
ord490
ord400
ord497
ord2081
ord493
ord484
ord2206

zlib1

deflate
deflateInit2_
deflateEnd
crc32

kernel32

EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
LoadLibraryA
FlushFileBuffers
SetStdHandle
InitializeCriticalSection
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetConsoleMode
MapViewOfFile
UnmapViewOfFile
FreeLibrary
LoadLibraryW
IsValidCodePage
CreateFileW
GetLastError
SetLastError
GetProcAddress
CreateFileMappingA
LocalAlloc
CloseHandle
OpenFileMappingA
LocalFree
GetFullPathNameW
CreateMutexW
FindFirstFileW
SetFilePointer
SetEndOfFile
CreateProcessW
CreateDirectoryW
WaitForSingleObject
GetModuleHandleW
WriteFile
WideCharToMultiByte
GetStringTypeA
TerminateProcess
ReadFile
GetModuleFileNameW
MultiByteToWideChar
GetStartupInfoW
GetTempPathW
FindClose
RemoveDirectoryW
FindNextFileW
GetFileAttributesExW
ReleaseMutex
DeleteFileW
ResumeThread
GetSystemWindowsDirectoryW
DeviceIoControl
SetErrorMode
SetUnhandledExceptionFilter
GetCurrentProcess
InterlockedExchange
GetLocalTime
GetCurrentThreadId
GetCurrentProcessId
SystemTimeToFileTime
GetLogicalDriveStringsW
GlobalMemoryStatusEx
GetSystemInfo
GetDiskFreeSpaceExW
GetSystemTime
FileTimeToDosDateTime
CreateFileA
GetFileAttributesA
GetFileSizeEx
FindFirstFileA
FindNextFileA
GetFileTime
FileTimeToLocalFileTime
GetConsoleCP
GetStartupInfoA
GetStringTypeW
GetLocaleInfoW
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetDriveTypeA
CompareStringA
CompareStringW
SetEnvironmentVariableA
Sleep
GetFileType
SetHandleCount
HeapSize
LCMapStringW
LCMapStringA
GetOEMCP
GetACP
GetCPInfo
GetCurrentDirectoryA
GetModuleFileNameA
GetStdHandle
ExitProcess
HeapCreate
HeapDestroy
HeapReAlloc
VirtualAlloc
VirtualFree
UnhandledExceptionFilter
IsDebuggerPresent
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitThread
CreateThread
FileTimeToSystemTime
GetDriveTypeW
GetTimeZoneInformation
GetCommandLineA
IsValidLocale
GetProcessHeap
EnterCriticalSection
LeaveCriticalSection
RtlUnwind
GetModuleHandleA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
InterlockedDecrement
RaiseException
DeleteCriticalSection
GetVersionExW
GetVersionExA

user32

wsprintfW

advapi32

SetSecurityDescriptorDacl
RegSetValueExW
RegFlushKey
RegCreateKeyExW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
FreeSid
AllocateAndInitializeSid
InitializeSecurityDescriptor

shell32

ShellExecuteW

ole32

CoCreateGuid
CoInitialize

dbghelp

MiniDumpWriteDump

ws2_32

WSACleanup
WSAStartup
inet_ntoa
gethostname
gethostbyname

Exports

Exports

jnzBindDistinctID
jnzBuildHttpData
jnzCLTCommit
jnzCLTCreate
jnzCLTCreate2
jnzCLTFree
jnzCLTSensorWriteBoolProperties
jnzCLTSensorWriteEvent
jnzCLTSensorWriteFloatProperties
jnzCLTSensorWriteIntProperties
jnzCLTSensorWriteListProperties
jnzCLTSensorWriteStringProperties
jnzCLTWriteData
jnzCLTWriteInt
jnzCreate
jnzCreate2
jnzDataFree
jnzDecryptData
jnzEnableCrashReport
jnzEnableSandbox
jnzEncryptData
jnzFree
jnzInitSSLRand
jnzMid
jnzMidEx
jnzMidInfo
jnzMidValid
jnzOpenUrl
jnzSetAppInfo
jnzSetApplyKey
jnzSetDumpTimeStmp
jnzSetHostInfo
jnzSetMidVersion
jnzSetNetProtocol
jnzSetPriCcertificate
jnzSetPubCertificate
jnzSetSensorDistinctID
jnzSetSensorHostInfo
jnzSetSensorProperty
jnzSetSensorUrl
jnzSetURLVersion

Sections

.text
Size: 292KB - Virtual size: 292KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 56KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.jnz40
Size: 4.3MB - Virtual size: 4.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.jnz41
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.jnz42
Size: 8.3MB - Virtual size: 8.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 932B - Virtual size: 932B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.l1
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

Password: infected

22fb261e144eab3d4e0b242b7a8e571f

Headers

File Characteristics

Imports

version

setupapi

iphlpapi

libeay32

zlib1

kernel32

user32

advapi32

shell32

ole32

dbghelp

ws2_32

Exports

Exports

Sections

.text Size: 292KB - Virtual size: 292KB

.rdata Size: 56KB - Virtual size: 56KB

.data Size: 20KB - Virtual size: 20KB

.jnz40 Size: 4.3MB - Virtual size: 4.3MB

.jnz41 Size: 4KB - Virtual size: 4KB

.jnz42 Size: 8.3MB - Virtual size: 8.3MB

.reloc Size: 4KB - Virtual size: 4KB

.rsrc Size: 932B - Virtual size: 932B

.l1 Size: 8KB - Virtual size: 8KB

.text
Size: 292KB - Virtual size: 292KB

.rdata
Size: 56KB - Virtual size: 56KB

.data
Size: 20KB - Virtual size: 20KB

.jnz40
Size: 4.3MB - Virtual size: 4.3MB

.jnz41
Size: 4KB - Virtual size: 4KB

.jnz42
Size: 8.3MB - Virtual size: 8.3MB

.reloc
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 932B - Virtual size: 932B

.l1
Size: 8KB - Virtual size: 8KB