12484026651[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

12484026651.zip
Size

345KB
MD5

42effed741aca27b6f0612f4bba2dec1
SHA1

c594df2a4e83949503483120f133cc3123e4573f
SHA256

378c4567021b067253a030cc3a89dcd16af3a92b32dfba3fb0a6c2dbfa3a81f3
SHA512

e454d4d33cd0d8aee980dff59699a05c395ae2d30c538d563caeaa77ff46fb4f8fb656439e195b6a851de7f7e4c610d53e618651c27c9c06adcbddad6119aa3a
SSDEEP

6144:IaYtEEuEwTHLkalfpp5dSzmYw3nHipnKkiAqCVBSaHFLnjev2rS1A9DN1:P07oTHLkaIUiiyBSaHZev2rS1WX

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/bbdac308d2b15a4724de7919bf8e9ffa713dea60ae3a482417c44c60012a654b

Files

12484026651.zip
.zip

Password: infected
bbdac308d2b15a4724de7919bf8e9ffa713dea60ae3a482417c44c60012a654b
.exe windows:6 windows x86

Password: infected

b4d5733390854900e9a765684837c828

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

dbghelp

ImageNtHeader

mpr

WNetOpenEnumW
WNetCancelConnection2W
WNetAddConnection2W
WNetEnumResourceW
WNetCloseEnum

wtsapi32

WTSEnumerateSessionsW
WTSQueryUserToken
WTSFreeMemory

kernel32

SetStdHandle
GetStdHandle
GetCommandLineW
WriteFile
GetLastError
CreateMutexA
GetCurrentProcessId
GetCurrentThreadId
GetDynamicTimeZoneInformation
WideCharToMultiByte
GetConsoleMode
WriteConsoleA
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
CloseHandle
TerminateProcess
OpenProcess
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetFinalPathNameByHandleW
SetFileAttributesW
GetCurrentProcess
IsValidCodePage
GetProcAddress
LocalFree
GetDriveTypeW
GetCurrentThread
FormatMessageA
ExitThread
GetFileSizeEx
FlushFileBuffers
HeapReAlloc
GetTimeZoneInformation
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
CreateThread
LoadLibraryExW
FreeLibrary
GetTimeFormatW
GetACP
FreeLibraryAndExitThread
GetModuleHandleExW
GetFileType
ReadFile
ReadConsoleW
GetConsoleOutputCP
ExitProcess
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
HeapSize
WriteConsoleW
GetModuleFileNameW
GetCommandLineA
HeapAlloc
HeapFree
GetModuleHandleW
MultiByteToWideChar
QueryPerformanceCounter
WaitForSingleObjectEx
GetExitCodeThread
GetNativeSystemInfo
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
TryEnterCriticalSection
DeleteCriticalSection
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableCS
SleepConditionVariableSRW
TlsFree
GetStringTypeW
CreateFileW
FindClose
FindFirstFileExW
FindNextFileW
GetFileAttributesW
GetFileAttributesExW
SetEndOfFile
SetFileInformationByHandle
SetFilePointerEx
AreFileApisANSI
GetFileInformationByHandleEx
GetSystemTimeAsFileTime
EncodePointer
DecodePointer
CompareStringEx
GetCPInfo
LCMapStringEx
GetLocaleInfoEx
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
CreateEventW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
RaiseException
RtlUnwind
SetLastError
TlsAlloc
TlsGetValue
TlsSetValue
GetDateFormatW

shell32

ShellExecuteW

ole32

CoSetProxyBlanket
CoCreateInstance
CoUninitialize
CoInitializeEx

oleaut32

VariantInit
SysFreeString
SysAllocString

advapi32

LookupPrivilegeValueA
CryptGenRandom
CryptReleaseContext
CryptAcquireContextA
RevertToSelf
DuplicateTokenEx
SetThreadToken
SetNamedSecurityInfoW
SetEntriesInAclW
LookupPrivilegeValueW
FreeSid
AllocateAndInitializeSid
AdjustTokenPrivileges
OpenProcessToken
OpenServiceW
OpenSCManagerW
EnumDependentServicesW
ControlService
CloseServiceHandle

Sections

.text
Size: 551KB - Virtual size: 550KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 121KB - Virtual size: 121KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 17KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

b4d5733390854900e9a765684837c828

Headers

DLL Characteristics

File Characteristics

Imports

dbghelp

mpr

wtsapi32

kernel32

shell32

ole32

oleaut32

advapi32

Sections

.text Size: 551KB - Virtual size: 550KB

.rdata Size: 121KB - Virtual size: 121KB

.data Size: 17KB - Virtual size: 22KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 26KB - Virtual size: 26KB

.text
Size: 551KB - Virtual size: 550KB

.rdata
Size: 121KB - Virtual size: 121KB

.data
Size: 17KB - Virtual size: 22KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 26KB - Virtual size: 26KB