d79d1c50863e99b5d93d3d5f7f6c68a0f7774cd53e329a9cd626123c2d8b4716[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

d79d1c50863e99b5d93d3d5f7f6c68a0f7774cd53e329a9cd626123c2d8b4716.zip
Size

95KB
MD5

3c7034ffe3205048cf3c09f1357cd2e8
SHA1

75fb2923d9f7b873f74a1bcd15866b5e97fd49c8
SHA256

fa5f91b58c77a3834939a1f2584a44b466f988e3bb997198a5a7b1a9859e7af2
SHA512

6a04282bd8ccdc4d590b0713349f71438e5172eb4e5dd027912c29cf34c5491f56f016ff8c92b8565afe2e544f3a5d338b1fee9ef5652dd0dbdb0f40889a1c47
SSDEEP

1536:tqAJFYMwGRaj90Vt47GNP0O5Vn9XxqJVaeucp6iOcsiNn6ZGjxYN4QfhonO1G6CC:t7bwG04t47GNP0eR6JVeg6iOc/V6oYTB

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/d79d1c50863e99b5d93d3d5f7f6c68a0f7774cd53e329a9cd626123c2d8b4716.exe

Files

d79d1c50863e99b5d93d3d5f7f6c68a0f7774cd53e329a9cd626123c2d8b4716.zip
.zip

Password: infected
d79d1c50863e99b5d93d3d5f7f6c68a0f7774cd53e329a9cd626123c2d8b4716.exe
.exe windows:6 windows x86 arch:x86

Password: infected

e5dbf4f8ccc1f4276248f5791017efa9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualAllocEx
GetCommandLineA
FindNextFileA
HeapAlloc
InitializeCriticalSectionAndSpinCount
GlobalGetAtomNameW
DeleteFileW
FindClose
FindFirstFileW
FindNextFileW
GetTempPathW
VirtualAlloc
EnumSystemCodePagesA
SetEndOfFile
CreateFileW
OutputDebugStringW
ReadConsoleW
WriteConsoleW
SetStdHandle
LoadLibraryExW
HeapReAlloc
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetModuleFileNameW
SetFilePointerEx
ReadFile
GetFileType
GetStdHandle
GetConsoleMode
GetConsoleCP
WriteFile
FlushFileBuffers
CloseHandle
GetProcessHeap
IsDebuggerPresent
GetCurrentThreadId
GetOEMCP
GetACP
IsValidCodePage
HeapSize
AreFileApisANSI
GetModuleHandleExW
ExitProcess
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
WideCharToMultiByte
MultiByteToWideChar
GetStringTypeW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
EncodePointer
DecodePointer
GetLastError
HeapFree
RaiseException
RtlUnwind
GetCommandLineW
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
Sleep
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetModuleHandleW
GetProcAddress
IsProcessorFeaturePresent

oleaut32

VarDecFix
CreateStdDispatch
VarCyFromR4
VarFormatFromTokens
VarAdd
VarI2FromBool
VarI1FromStr
SafeArrayCreateVector

rpcrt4

I_RpcTransConnectionReallocPacket
NdrConformantVaryingStructBufferSize
MesIncrementalHandleReset
I_RpcParseSecurity
NdrComplexStructFree
NdrComplexStructMemorySize

wininet

GopherGetLocatorTypeW
InternetGetCertByURL
ShowSecurityInfo
HttpSendRequestExW
FtpPutFileA
InternetTimeFromSystemTime
InternetReadFileExA

ole32

ReleaseStgMedium
HWND_UserUnmarshal
HWND_UserSize
StgCreatePropSetStg
HBRUSH_UserMarshal
CLSIDFromProgID

resutils

ResUtilGetProperties
ResUtilGetPrivateProperties
ResUtilDupParameterBlock
ResUtilEnumPrivateProperties

winmm

GetDriverModuleHandle
mmioAdvance
midiInUnprepareHeader
auxGetNumDevs
waveOutWrite
NotifyCallbackData
auxGetDevCapsW

Sections

.text
Size: 125KB - Virtual size: 124KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 37KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

e5dbf4f8ccc1f4276248f5791017efa9

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

oleaut32

rpcrt4

wininet

ole32

resutils

winmm

Sections

.text Size: 125KB - Virtual size: 124KB

.rdata Size: 37KB - Virtual size: 37KB

.data Size: 15KB - Virtual size: 24KB

.text
Size: 125KB - Virtual size: 124KB

.rdata
Size: 37KB - Virtual size: 37KB

.data
Size: 15KB - Virtual size: 24KB