1e0215f67fb7b02bc44f33bf6a5b884c3061cbeb38e0150b559635458951fa53[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

1e0215f67fb7b02bc44f33bf6a5b884c3061cbeb38e0150b559635458951fa53.zip
Size

286KB
MD5

c6dddc00c8f078b8f95356b199ef9835
SHA1

18a11e6babab492fc7e2de46ec05ac9eadc6802d
SHA256

f060346636a7bd24d76a309af93f27100ca04c3eb8211198445a23566bbce802
SHA512

26d7f9fab5ae911a3ca197fe486c144879541bcd15180e1f7d0ffd07ad39eadf39efccbc995427ffc8d5453b8c940faa40ffd2aacd3e5c1f331b548c482c6a97
SSDEEP

6144:C40lzCojDsOYA0RsbdA9hChISzJuaJZCqBlWu9Xvo+jtmuR7+Grv86:sbs5VSbdAmhIkJuaKkf1g4tmA7Px

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/1e0215f67fb7b02bc44f33bf6a5b884c3061cbeb38e0150b559635458951fa53.exe

Files

1e0215f67fb7b02bc44f33bf6a5b884c3061cbeb38e0150b559635458951fa53.zip
.zip

Password: infected
1e0215f67fb7b02bc44f33bf6a5b884c3061cbeb38e0150b559635458951fa53.exe
.exe windows:4 windows x86 arch:x86

Password: infected

cd46b7aed718803156f54c0576fe8371

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

RtlUnwind
HeapFree
GetStartupInfoA
GetCommandLineA
ExitProcess
RaiseException
HeapAlloc
TerminateProcess
HeapSize
HeapReAlloc
GetACP
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
UnhandledExceptionFilter
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
SetUnhandledExceptionFilter
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
IsBadReadPtr
IsBadCodePtr
SetStdHandle
FlushFileBuffers
SetFilePointer
ReadFile
InterlockedExchange
SetErrorMode
WritePrivateProfileStringA
GetOEMCP
GetCPInfo
GetProcessVersion
GlobalFlags
TlsGetValue
LocalReAlloc
TlsSetValue
EnterCriticalSection
GlobalReAlloc
LeaveCriticalSection
TlsFree
GlobalHandle
DeleteCriticalSection
TlsAlloc
InitializeCriticalSection
LocalAlloc
GetLastError
LocalFree
GlobalFree
GetModuleFileNameA
GlobalAlloc
lstrcmpA
GetCurrentThread
MultiByteToWideChar
WideCharToMultiByte
InterlockedIncrement
InterlockedDecrement
GlobalLock
GlobalUnlock
MulDiv
SetLastError
FindResourceA
LoadResource
LockResource
GetCurrentThreadId
GlobalGetAtomNameA
lstrcmpiA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
GetModuleHandleA
WriteFile
CloseHandle
WinExec
lstrcpyA
GetWindowsDirectoryA
LoadLibraryA
FreeLibrary
lstrcatA
GetVersion
LoadLibraryExW
LoadLibraryExA
GetProcAddress
SizeofResource
GetCurrentProcess
lstrcpynA
lstrlenA
FreeEnvironmentStringsA
Sleep

user32

UpdateWindow
PostMessageA
IsDialogMessageA
SetWindowTextA
ShowWindow
IsWindowEnabled
GetNextDlgTabItem
EnableMenuItem
CheckMenuItem
SetMenuItemBitmaps
ModifyMenuA
GetMenuState
LoadBitmapA
GetMenuCheckMarkDimensions
TabbedTextOutA
DrawTextA
GrayStringA
LoadStringA
PostQuitMessage
ValidateRect
TranslateMessage
GetMessageA
CreateDialogIndirectParamA
EndDialog
GetClassNameA
GetSysColorBrush
DestroyMenu
SendDlgItemMessageA
MapWindowPoints
DispatchMessageA
GetFocus
SetActiveWindow
SetFocus
AdjustWindowRectEx
IsWindowVisible
GetTopWindow
MessageBoxA
WinHelpA
wsprintfA
GetClassInfoA
RegisterClassA
GetMenu
GetMenuItemCount
GetSubMenu
GetMenuItemID
GetDlgItem
GetWindowTextLengthA
GetWindowTextA
GetDlgCtrlID
GetKeyState
DefWindowProcA
DestroyWindow
CreateWindowExA
SetWindowsHookExA
GetClassLongA
SetPropA
UnhookWindowsHookEx
GetPropA
CallWindowProcA
RemovePropA
GetMessageTime
GetLastActivePopup
GetForegroundWindow
SetForegroundWindow
GetWindow
SetWindowPos
RegisterWindowMessageA
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetSystemMetrics
LoadCursorA
CopyIcon
GetDC
ReleaseDC
IsWindow
GetMessagePos
PtInRect
SetTimer
MessageBeep
SetWindowLongA
KillTimer
GetSystemMenu
LoadIconA
EnableWindow
FillRect
GetWindowRect
GetClientRect
SetCursor
GetWindowLongA
DrawStateA
CopyRect
FrameRect
InflateRect
GetSysColor
OffsetRect
DrawFocusRect
PeekMessageA
SendMessageA
GetCursorPos
ScreenToClient
GetActiveWindow
GetParent
GetCapture
SetCapture
ClientToScreen
WindowFromPoint
ReleaseCapture
InvalidateRect
GetIconInfo
RedrawWindow
LoadImageA
DestroyCursor
CallNextHookEx
UnregisterClassA

gdi32

SetBkMode
SetMapMode
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
MoveToEx
LineTo
SetBkColor
SaveDC
GetDeviceCaps
CreatePen
CreateSolidBrush
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
RestoreDC
SetTextColor
DeleteDC
GetObjectA
GetStockObject
BitBlt
GetClipBox
SetStretchBltMode
SetDIBitsToDevice
GetTextExtentPoint32A
CreateFontIndirectA
DeleteObject
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
CreateBitmap

comdlg32

GetOpenFileNameA
GetSaveFileNameA

winspool.drv

OpenPrinterA
DocumentPropertiesA
ClosePrinter

advapi32

RegSetValueExA
RegCreateKeyExA
RegOpenKeyExA
RegQueryValueA
RegCloseKey

shell32

ShellExecuteA
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetMalloc

comctl32

ord17

Sections

.text
Size: 120KB - Virtual size: 118KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 232KB - Virtual size: 228KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

cd46b7aed718803156f54c0576fe8371

Headers

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

Sections

.text Size: 120KB - Virtual size: 118KB

.rdata Size: 32KB - Virtual size: 28KB

.data Size: 8KB - Virtual size: 21KB

.rsrc Size: 232KB - Virtual size: 228KB

.text
Size: 120KB - Virtual size: 118KB

.rdata
Size: 32KB - Virtual size: 28KB

.data
Size: 8KB - Virtual size: 21KB

.rsrc
Size: 232KB - Virtual size: 228KB