FinalHE[.]zip | Triage

Resubmissions

16/10/2023, 13:56

231016-q846bagb3z 3

16/10/2023, 13:56

231016-q8m7sshh46 3

Sharing

Copy URL Twitter E-mail

General

Target

FinalHE.zip
Size

9.3MB
MD5

8e942b2e65b23735f9de3746de6cf839
SHA1

88d4144f4053880b70b96cfbecf36b5875de0d29
SHA256

6f0546be4caefab17136618b05026d1d5c32fefab9e88075dcf77ab1705b96c0
SHA512

e45685c1318c545a21121ab473ad48863c026948662939faedcfeb6103c841280005aff285996bd9341851b50e7890e5b326d42a2f50d1ab95fc64a6f2d76838
SSDEEP

196608:8sUEJCNcCUbJAhbLYjwNHaUi+kfDZdeHxqG:8VEfdbubLYyHaU7qD8xqG

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/FinalHE.exe

Files

FinalHE.zip
.zip

Password: infected
FinalHE.exe
.exe windows:6 windows x86

Password: infected

18c277e0460ebb8b186ef85e63882ff4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

PathFindFileNameA

wtsapi32

WTSFreeMemory
WTSQuerySessionInformationW

uxtheme

GetThemePartSize
GetThemeColor
GetThemeInt
GetThemeEnumValue
GetThemeMargins
GetThemePropertyOrigin
GetThemeTransitionDuration
CloseThemeData
ord47
GetThemeBackgroundRegion
IsThemeBackgroundPartiallyTransparent
GetThemeBool
SetWindowTheme
IsThemeActive
IsAppThemed
GetCurrentThemeName
OpenThemeData

dwmapi

DwmEnableBlurBehindWindow
DwmGetWindowAttribute
DwmIsCompositionEnabled
DwmSetWindowAttribute

gdi32

DeleteObject
GetRegionData
SelectClipRgn
SelectObject
CreateDIBSection
GdiFlush
BitBlt
DeleteDC
SetLayout
GetDeviceCaps
CreateCompatibleBitmap
CreateDCW
CreateBitmap
ChoosePixelFormat
SetPixelFormat
DescribePixelFormat
GetPixelFormat
SwapBuffers
GetBitmapBits
GetObjectW
CreateFontIndirectW
EnumFontFamiliesExW
GetFontData
GetStockObject
AddFontResourceExW
RemoveFontResourceExW
AddFontMemResourceEx
RemoveFontMemResourceEx
GetTextMetricsW
GetTextFaceW
GetCharABCWidthsW
GetCharABCWidthsFloatW
GetGlyphOutlineW
GetOutlineTextMetricsW
GetTextExtentPoint32W
GetCharABCWidthsI
SetBkMode
SetGraphicsMode
SetTextColor
SetTextAlign
SetWorldTransform
ExtTextOutW
GetDIBits
CreateRectRgn
CreateCompatibleDC
CombineRgn
OffsetRgn

oleaut32

SysAllocString
SysFreeString
SafeArrayPutElement
SafeArrayCreateVector

imm32

ImmGetVirtualKey
ImmGetDefaultIMEWnd
ImmGetContext
ImmReleaseContext
ImmAssociateContext
ImmAssociateContextEx
ImmGetCompositionStringW
ImmGetOpenStatus
ImmNotifyIME
ImmSetCompositionWindow
ImmSetCandidateWindow

iphlpapi

ConvertInterfaceLuidToIndex
ConvertInterfaceNameToLuidW
ConvertInterfaceIndexToLuid
ConvertInterfaceLuidToGuid
GetAdaptersAddresses
ConvertInterfaceLuidToNameW

userenv

GetUserProfileDirectoryW

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

netapi32

NetApiBufferFree
NetShareEnum

ws2_32

recv
recvfrom
select
send
sendto
setsockopt
closesocket
bind
WSACleanup
WSAGetLastError
getsockname
WSASetLastError
WSASocketW
getsockopt
inet_addr
listen
ntohs
gethostbyaddr
gethostbyname
getservbyport
getservbyname
ntohl
getaddrinfo
WSASendTo
getnameinfo
getpeername
WSAAccept
WSAConnect
WSAHtonl
WSAIoctl
WSAAsyncSelect
htons
htonl
ioctlsocket
inet_ntoa
WSANtohl
WSANtohs
connect
accept
__WSAFDIsSet
WSAStartup
socket
freeaddrinfo
WSARecv
WSARecvFrom
WSASend
gethostname

advapi32

OpenSCManagerW
BuildTrusteeWithSidW
GetNamedSecurityInfoW
GetEffectiveRightsFromAclW
LookupAccountSidW
MapGenericMask
GetLengthSid
FreeSid
DuplicateToken
CopySid
AllocateAndInitializeSid
AccessCheck
OpenProcessToken
RegSetValueExW
RegQueryInfoKeyW
RegFlushKey
RegEnumValueW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegQueryValueExW
SystemFunction036
GetTokenInformation
GetSidSubAuthorityCount
GetSidSubAuthority
RegOpenKeyExW
RegNotifyChangeKeyValue
OpenServiceA
RegCloseKey
CloseServiceHandle

kernel32

UnhandledExceptionFilter
GetCPInfo
GetStringTypeW
LCMapStringEx
DecodePointer
EncodePointer
InitializeCriticalSectionEx
RaiseException
VirtualFree
VirtualAlloc
GetUserGeoID
GetGeoInfoW
GetTimeZoneInformation
GetExitCodeProcess
GetModuleHandleExW
FindNextChangeNotification
FindFirstChangeNotificationW
FindCloseChangeNotification
LCMapStringW
CompareStringW
WideCharToMultiByte
RegisterWaitForSingleObject
UnregisterWaitEx
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
SetFilePointerEx
SetEndOfFile
GetFileType
FlushFileBuffers
GetFileInformationByHandleEx
SystemTimeToFileTime
FileTimeToSystemTime
TzSpecificLocalTimeToSystemTime
MoveFileExW
MoveFileW
CopyFileW
SetErrorMode
GetVolumePathNamesForVolumeNameW
GetTempPathW
SetFileTime
RemoveDirectoryW
GetLogicalDrives
GetFileInformationByHandle
GetFileAttributesW
FindFirstFileW
DeleteFileW
GetCurrentDirectoryW
SetCurrentDirectoryW
GetModuleFileNameW
GetStartupInfoW
GetTickCount64
GetFileAttributesExW
GetUserPreferredUILanguages
GetUserDefaultLCID
GetCurrencyFormatW
GetTimeFormatW
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
IsDebuggerPresent
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwind
SetLastError
LoadLibraryExW
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
ExitThread
FreeLibraryAndExitThread
GetCommandLineA
SetFileAttributesW
SetStdHandle
ReadConsoleW
HeapFree
HeapAlloc
IsValidLocale
EnumSystemLocalesW
HeapReAlloc
IsValidCodePage
GetOEMCP
SetEnvironmentVariableW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
HeapSize
CreateThread
CloseHandle
Sleep
TerminateProcess
OpenProcess
lstrcmpA
lstrcmpiA
K32GetModuleFileNameExA
GetDiskFreeSpaceExW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
FindClose
FindFirstFileExW
FindNextFileW
GetFullPathNameW
GetStdHandle
CreateDirectoryW
CreateFileW
GetFileSizeEx
ReadFile
WriteFile
GetLastError
MultiByteToWideChar
GetConsoleOutputCP
GetConsoleMode
WriteConsoleW
SetConsoleOutputCP
GetCurrentThreadId
TlsGetValue
TryEnterCriticalSection
TlsAlloc
TlsSetValue
TlsFree
SetEvent
WaitForSingleObject
SleepEx
CreateEventW
ResetEvent
WaitForMultipleObjects
VerSetConditionMask
QueryPerformanceCounter
QueryPerformanceFrequency
ReleaseSemaphore
GetCurrentProcess
GetCurrentProcessId
TerminateThread
GetVersionExA
FreeLibrary
GetProcAddress
LoadLibraryA
GetProcessAffinityMask
SetThreadAffinityMask
FormatMessageA
CreateSemaphoreA
VerifyVersionInfoA
GetOverlappedResult
CreateFileA
DeviceIoControl
CancelIo
DuplicateHandle
ReleaseMutex
CreateMutexW
GetCurrentThread
GetModuleHandleA
GetModuleFileNameA
GetSystemDirectoryA
GetACP
lstrcmpW
GetModuleHandleW
LocalFree
FormatMessageW
WTSGetActiveConsoleSessionId
ExpandEnvironmentStringsW
CreateProcessW
CheckRemoteDebuggerPresent
GlobalAlloc
GlobalUnlock
GlobalLock
GetLocaleInfoW
LoadLibraryW
GlobalSize
GetUserDefaultLangID
GetVolumeInformationW
GetLongPathNameW
GetDriveTypeW
GetConsoleWindow
ExitProcess
LocalAlloc
GlobalFree
SetHandleInformation
CompareStringEx
GetCommandLineW
OutputDebugStringW
IsProcessorFeaturePresent
SetThreadPriority
GetThreadPriority
ResumeThread
GetSystemInfo
WaitForSingleObjectEx
GetSystemTime
GetLocalTime
GetSystemDirectoryW
GetDateFormatW

ole32

OleInitialize
OleUninitialize
CoUninitialize
CoInitializeEx
CoInitialize
RevokeDragDrop
OleGetClipboard
OleFlushClipboard
OleIsCurrentClipboard
CoCreateInstance
DoDragDrop
CoTaskMemFree
ReleaseStgMedium
CoGetMalloc
CoCreateGuid
RegisterDragDrop
CoLockObjectExternal
OleSetClipboard
StringFromGUID2

shell32

SHGetKnownFolderPath
CommandLineToArgvW
Shell_NotifyIconGetRect
SHBrowseForFolderW
SHGetKnownFolderIDList
SHGetPathFromIDListW
SHGetMalloc
SHCreateItemFromParsingName
SHCreateItemFromIDList
ShellExecuteW
ord727
SHGetStockIconInfo
SHGetFileInfoW
Shell_NotifyIconW

user32

TrackMouseEvent
GetClipboardFormatNameW
GetCursorInfo
GetIconInfo
CreateIconIndirect
CreateCursor
LoadCursorW
GetCursor
SetCursorPos
EnumDisplayDevicesW
RegisterClassW
TrackPopupMenuEx
MapVirtualKeyW
ToUnicode
ToAscii
GetKeyboardState
GetAsyncKeyState
IsZoomed
PeekMessageW
FindWindowA
SetCaretPos
GetTouchInputInfo
CloseTouchInputHandle
ShowCaret
HideCaret
DestroyCaret
CreateCaret
IsWindowEnabled
RegisterWindowMessageW
GetKeyboardLayout
RegisterClipboardFormatW
ChangeClipboardChain
SetClipboardViewer
IsHungAppWindow
LoadIconW
EnumDisplayMonitors
GetMonitorInfoW
MonitorFromWindow
SetMenuItemInfoW
GetMenuItemInfoW
TrackPopupMenu
RemoveMenu
ModifyMenuW
GetWindowTextW
RealGetWindowClassW
ChangeWindowMessageFilterEx
MessageBoxW
DrawIconEx
TranslateMessage
DispatchMessageW
GetQueueStatus
MsgWaitForMultipleObjectsEx
SetTimer
KillTimer
CharNextExA
RegisterDeviceNotificationW
UnregisterDeviceNotification
GetMessageExtraInfo
GetKeyState
PostMessageA
EnumWindows
GetClassNameA
GetWindowThreadProcessId
GetSystemMetrics
SystemParametersInfoW
DefWindowProcW
DestroyWindow
GetDC
ReleaseDC
GetSysColor
GetDesktopWindow
GetDoubleClickTime
IsWindow
MessageBeep
GetCaretBlinkTime
UpdateLayeredWindowIndirect
SendMessageW
PostMessageW
AttachThreadInput
CreateWindowExW
IsChild
ShowWindow
UpdateLayeredWindow
SetLayeredWindowAttributes
FlashWindowEx
MoveWindow
SetWindowPos
GetWindowPlacement
SetWindowPlacement
IsWindowVisible
IsIconic
SetFocus
RegisterTouchWindow
UnregisterTouchWindow
IsTouchWindow
GetCapture
SetCapture
ReleaseCapture
GetMenu
GetSystemMenu
EnableMenuItem
GetForegroundWindow
SetForegroundWindow
BeginPaint
EndPaint
GetUpdateRect
SetWindowRgn
InvalidateRect
SetWindowTextW
GetClientRect
GetWindowRect
AdjustWindowRectEx
SetCursor
ClientToScreen
ScreenToClient
GetWindowLongW
SetWindowLongW
GetParent
SetParent
GetWindow
DestroyCursor
DestroyIcon
MonitorFromPoint
GetAncestor
GetKeyboardLayoutList
RegisterPowerSettingNotification
UnregisterPowerSettingNotification
UnregisterClassW
GetClassInfoW
RegisterClassExW
GetFocus
GetCursorPos
WindowFromPoint
ChildWindowFromPointEx
GetSysColorBrush
LoadImageW
SetMenu
DrawMenuBar
CreateMenu
CreatePopupMenu
DestroyMenu
InsertMenuW
AppendMenuW

winmm

timeSetEvent
PlaySoundW
timeKillEvent

Sections

.text
Size: 8.4MB - Virtual size: 8.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6.4MB - Virtual size: 6.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 320KB - Virtual size: 374KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.qtmetad
Size: 1024B - Virtual size: 770B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.qtmimed
Size: 315KB - Virtual size: 315KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 280KB - Virtual size: 279KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

18c277e0460ebb8b186ef85e63882ff4

Headers

DLL Characteristics

File Characteristics

Imports

shlwapi

wtsapi32

uxtheme

dwmapi

gdi32

oleaut32

imm32

iphlpapi

userenv

version

netapi32

ws2_32

advapi32

kernel32

ole32

shell32

user32

winmm

Sections

.text Size: 8.4MB - Virtual size: 8.4MB

.rdata Size: 6.4MB - Virtual size: 6.4MB

.data Size: 320KB - Virtual size: 374KB

.qtmetad Size: 1024B - Virtual size: 770B

.qtmimed Size: 315KB - Virtual size: 315KB

.rsrc Size: 33KB - Virtual size: 33KB

.reloc Size: 280KB - Virtual size: 279KB

.text
Size: 8.4MB - Virtual size: 8.4MB

.rdata
Size: 6.4MB - Virtual size: 6.4MB

.data
Size: 320KB - Virtual size: 374KB

.qtmetad
Size: 1024B - Virtual size: 770B

.qtmimed
Size: 315KB - Virtual size: 315KB

.rsrc
Size: 33KB - Virtual size: 33KB

.reloc
Size: 280KB - Virtual size: 279KB