General
-
Target
876860a923754e2d2f6b1514d98f4914271e8cf60d3f95cf1f983e91baffa32b.zip
-
Size
28KB
-
MD5
6da8bd0f189175f1931983a3e68b82a8
-
SHA1
fb62b911c9e8d794b31cf93771f77ed8c7cbb2ef
-
SHA256
ca6fea4f07cd185f9fbef2c160fad13623a2e62f3d59bdb6e13505d0988c5c56
-
SHA512
e813fbce88059ff59e322e1ca662571f37e2efe893430385005d97a45b278399ab7e2f48fdc906efbc4dce2d0a016f995e5bacc45b2f5079fb89682bae9b1378
-
SSDEEP
768:AwVaOAI+FUsW46DFzfY+K5AKYT49zmV/NwG911uoj+:zAz2O6F0CAz4/Nh911uU+
Malware Config
Extracted
gozi
7709
checklist.skype.com
62.173.141.252
31.41.44.33
109.248.11.112
-
base_path
/drew/
-
build
250255
-
exe_type
loader
-
extension
.jlk
-
server_id
50
Signatures
-
Gozi family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/876860a923754e2d2f6b1514d98f4914271e8cf60d3f95cf1f983e91baffa32b
Files
-
876860a923754e2d2f6b1514d98f4914271e8cf60d3f95cf1f983e91baffa32b.zip.zip
Password: infected
-
876860a923754e2d2f6b1514d98f4914271e8cf60d3f95cf1f983e91baffa32b.dll windows:5 windows x86
Password: infected
ef075d26b728b78a932306e24062e80c
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
ntdll
ZwQueryInformationToken
ZwOpenProcess
ZwClose
ZwOpenProcessToken
_snwprintf
memcpy
strcpy
sprintf
mbstowcs
_snprintf
wcstombs
memset
_aulldiv
_allmul
_aullrem
RtlUnwind
NtQueryVirtualMemory
kernel32
RaiseException
LocalAlloc
HeapAlloc
InterlockedIncrement
InterlockedDecrement
HeapFree
SetEvent
GetTickCount
GetSystemTimeAsFileTime
Sleep
HeapDestroy
HeapCreate
SwitchToThread
lstrlenA
SetWaitableTimer
Process32First
WaitForSingleObject
SleepEx
CreateEventA
lstrlenW
GetLastError
GetProcAddress
Process32Next
WaitForMultipleObjects
GetModuleHandleA
CreateToolhelp32Snapshot
CloseHandle
CreateWaitableTimerA
lstrcpyA
ResetEvent
lstrcmpW
GetVersionExA
LoadLibraryA
FreeLibrary
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
lstrcmpA
CreateFileMappingW
MapViewOfFile
InterlockedExchange
ExpandEnvironmentStringsW
ExpandEnvironmentStringsA
QueryPerformanceFrequency
OpenProcess
GetVersion
GetCurrentProcessId
lstrcatA
QueryPerformanceCounter
GetComputerNameW
WideCharToMultiByte
GetComputerNameExA
oleaut32
SysAllocString
SafeArrayDestroy
SafeArrayCreate
SysFreeString
Sections
.text Size: 30KB - Virtual size: 29KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1000B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ