460b5c15cf65866c6b9f3e3a6ec653561b88e5c5bfb263e94dfebc7bbf6a0cb2[.]exe[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

460b5c15cf65866c6b9f3e3a6ec653561b88e5c5bfb263e94dfebc7bbf6a0cb2.exe.zip
Size

484KB
MD5

f601fa41d7724ee52c624e8b66e7604d
SHA1

e84373279acaa27d090e98dc6a1fe245bd7d33ee
SHA256

cf62b49f627d47a7725901b5054b25c75733c6e2fdad7a6e4877b72bc92b2b9e
SHA512

28b1653aee46550efb9d397c55d4cbe3f793c992ae5ec3a28c9003d2c4594f337616ef7e7afe0bf51d06b12828d8e92f336d06f893a81befc5d907279051b969
SSDEEP

12288:/zT/WwexohDXzAIhbumO2dUhegnkIynp8QlZT2X9MHo3YqCa:/zT/WKXUIhAJhSnp8QlZT0Mbq5

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/460b5c15cf65866c6b9f3e3a6ec653561b88e5c5bfb263e94dfebc7bbf6a0cb2.exe

Files

460b5c15cf65866c6b9f3e3a6ec653561b88e5c5bfb263e94dfebc7bbf6a0cb2.exe.zip
.zip

Password: infected
460b5c15cf65866c6b9f3e3a6ec653561b88e5c5bfb263e94dfebc7bbf6a0cb2.exe
.exe windows:5 windows x64

d0b576aa1597bfc88eef11f7320a63ec

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
GetProcAddress

wsock32

__WSAFDIsSet

version

VerQueryValueW

winmm

timeGetTime

comctl32

ImageList_Remove

mpr

WNetUseConnectionW

wininet

FtpOpenFileW

psapi

GetProcessMemoryInfo

iphlpapi

IcmpSendEcho

userenv

LoadUserProfileW

uxtheme

IsThemeActive

user32

GetDC

gdi32

LineTo

comdlg32

GetSaveFileNameW

advapi32

AddAce

shell32

DragFinish

ole32

CoGetObject

oleaut32

SysStringLen

Sections

.MPRESS1
Size: 468KB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.MPRESS2
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

Password: infected

d0b576aa1597bfc88eef11f7320a63ec

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

wsock32

version

winmm

comctl32

mpr

wininet

psapi

iphlpapi

userenv

uxtheme

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

Sections

.MPRESS1 Size: 468KB - Virtual size: 1.1MB

.MPRESS2 Size: 4KB - Virtual size: 3KB

.rsrc Size: 27KB - Virtual size: 27KB

.MPRESS1
Size: 468KB - Virtual size: 1.1MB

.MPRESS2
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 27KB - Virtual size: 27KB