69937d0390e6cecd775282abc8e514bac0770fcab6c912db1c7501883f8bbfc0[.]exe[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

69937d0390e6cecd775282abc8e514bac0770fcab6c912db1c7501883f8bbfc0.exe.zip
Size

3.0MB
MD5

48c25eb26b233c9678d620e66c179f9c
SHA1

ceb720dbf989ca2b31f72f83e3c9c40b53230768
SHA256

dc7d72b6e1010f3f0f42f9a6bbf956f2a7f56cc5ec53cad06f03ed698fd9a92e
SHA512

dab2eb669b7221fb1291fa199a094b884738d2b5c1c85bfcc46c4c26b2b5ed61748bfd12f1ce2d006c49673f8d060165c62ab1162e9a9d7851a7b1a1a0c64d9d
SSDEEP

49152:C9XC7mdVUQoRvnOOpP61wXQoyxe7IwiDyxUmuuUbg+/H/blJlP7bWBjIEJz9ULmK:EhhEd61meD5muuIg4H/tP7iyIzD1Ja

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/69937d0390e6cecd775282abc8e514bac0770fcab6c912db1c7501883f8bbfc0.exe

Files

69937d0390e6cecd775282abc8e514bac0770fcab6c912db1c7501883f8bbfc0.exe.zip
.zip

Password: infected
69937d0390e6cecd775282abc8e514bac0770fcab6c912db1c7501883f8bbfc0.exe
.exe windows:5 windows x64

cfd25bb8b565beae8243cdfa604fadc6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
GetProcAddress

powerdatarecoverycore

??1KMemoryPool@@UEAA@XZ

ikernel

klog_log

qt5core

?qrand@@YAHXZ

qt5gui

??1QPen@@QEAA@XZ

qt5widgets

??1QMenu@@UEAA@XZ

qt5network

??1QSslError@@QEAA@XZ

user32

GetDC

gdi32

DeleteDC

advapi32

RegCloseKey

shell32

ord155

ole32

OleRun

oleaut32

VariantClear

msvcr120

rand

msvcp120

?_BADOFF@std@@3_JB

propsys

PSGetPropertyKeyFromName

mpr

WNetCloseEnum

libeay32

ord340

libcurl

curl_easy_init

Sections

.MPRESS1
Size: 2.9MB - Virtual size: 6.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.MPRESS2
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 182KB - Virtual size: 181KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

Password: infected

cfd25bb8b565beae8243cdfa604fadc6

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

powerdatarecoverycore

ikernel

qt5core

qt5gui

qt5widgets

qt5network

user32

gdi32

advapi32

shell32

ole32

oleaut32

msvcr120

msvcp120

propsys

mpr

libeay32

libcurl

Sections

.MPRESS1 Size: 2.9MB - Virtual size: 6.6MB

.MPRESS2 Size: 4KB - Virtual size: 3KB

.rsrc Size: 182KB - Virtual size: 181KB

.MPRESS1
Size: 2.9MB - Virtual size: 6.6MB

.MPRESS2
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 182KB - Virtual size: 181KB