package[.]zip | Triage

Sharing

Copy URL Twitter E-mail

General

Target

package.zip
Size

531KB
MD5

235f3e4d2d52f83e65f686a2c9eb58f6
SHA1

ce80ad57b365c532d40aa0f0e93bb30aac8a89e2
SHA256

13e8ac8dc71f6def3cf78f3f9df717c685783d73d81c13587a838d97469e5a41
SHA512

5dea3f96b5123e6ec4ee7393ef2629a076fb5ccc29e71f7ccc61116aff4cc28c78c40c7089881d8a1dc707c21f437c97b4857fecc97f22417f1af485ee58e98b
SSDEEP

6144:OeZdRXmH6stnFsqYbNoyA5/1N+XtMaZFy8SZJcaEyCu76VhAHekhWosV6rj2Pwmu:DbRouqYTtm8wZCDh8ehop2xfERHtX

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/aaedf.trg.exe
unpack001/npptools.dll

Files

package.zip
.zip
aaedf.trg.exe
.exe windows:5 windows x86 arch:x86

43a0b5c08b9c6cfc6914e52cd1070a36

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

mfc42

ord823
ord825

msvcrt

malloc
_controlfp
??1type_info@@UAE@XZ
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
_XcptFilter
_exit
strncpy
strchr
wcscpy
wcslen
wcschr
wcstombs
exit
free
_EH_prolog
__CxxFrameHandler

advapi32

RegOpenKeyA
AddAce
RegQueryValueExW
GetAce
RegSetValueExW
RegDeleteKeyA
RegCreateKeyA
MakeSelfRelativeSD
RegOpenKeyExA
RegQueryValueExA
RegCreateKeyExA
GetSecurityDescriptorLength
RegSetValueExA
RegCloseKey
GetSecurityDescriptorSacl
GetSecurityDescriptorDacl
GetSecurityDescriptorOwner
GetSecurityDescriptorGroup
MakeAbsoluteSD
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
EqualSid
DeleteAce
LookupAccountNameA
OpenProcessToken
GetTokenInformation
RegOpenKeyExW
AddAccessAllowedAce
GetAclInformation
AddAccessDeniedAce
InitializeAcl
GetLengthSid

kernel32

GetLastError
CloseHandle
WaitForSingleObject
CreateEventA
lstrcmpiA
GetModuleFileNameA
lstrlenA
lstrcatA
lstrcpyA
CreateMutexA
GetTempPathW
GetComputerNameA
SetLastError
GetCurrentProcess
SetEvent
HeapAlloc
GetProcessHeap
GetModuleHandleA
GetStartupInfoA

user32

wsprintfA

netapi32

NetShareCheck

npptools

GetStringFromBlob
SetDwordInBlob
FindOneOf
recursiveDeleteKey
SetStringInBlob
UnMarshalBlob
GetNPPBlobTable
RaiseNMEvent
MarshalBlob
CreateNPPInterface
DestroyBlob
DuplicateBlob

ole32

CoRegisterClassObject
CoInitializeSecurity
CoInitializeEx
StringFromGUID2
CoQueryClientBlanket
CoUninitialize

Exports

Exports

_DllMain@12

Sections

.text
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 592B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
info.txt
npptools.dll
.dll windows:4 windows x86 arch:x86

418cacac2b6a85f1b6dcacf68cfe5edf

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
UnhandledExceptionFilter
IsBadCodePtr
IsValidLocale
IsValidCodePage
GetLocaleInfoA
GetStartupInfoA
GetUserDefaultLCID
SetStdHandle
SetConsoleCtrlHandler
GetLocaleInfoW
CompareStringA
CompareStringW
SetEnvironmentVariableA
GetFileType
GetProfileStringA
InterlockedExchange
GetSystemDirectoryA
MoveFileExA
LocalLock
LocalUnlock
GetStdHandle
SetHandleCount
SetUnhandledExceptionFilter
HeapCreate
HeapDestroy
GetVersionExA
GetEnvironmentVariableA
IsBadWritePtr
VirtualAlloc
VirtualFree
FatalAppExitA
HeapSize
GetACP
GetLocalTime
GetSystemTime
GetTimeZoneInformation
ExitThread
CreateThread
TerminateProcess
GetCommandLineA
RaiseException
GetDriveTypeA
FindNextFileA
HeapFree
HeapAlloc
HeapReAlloc
RtlUnwind
GetTickCount
SetErrorMode
CopyFileA
SetFileAttributesA
SystemTimeToFileTime
LocalFileTimeToFileTime
GetFileSize
GetStringTypeExA
GetVolumeInformationA
FindFirstFileA
FindClose
DeleteFileA
MoveFileA
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
CreateFileA
GetCurrentProcess
DuplicateHandle
GetCurrentDirectoryA
lstrlenW
SizeofResource
GetOEMCP
GetCPInfo
GetProcessVersion
GlobalFlags
TlsGetValue
LocalReAlloc
TlsSetValue
EnterCriticalSection
LeaveCriticalSection
TlsFree
GlobalHandle
DeleteCriticalSection
TlsAlloc
InitializeCriticalSection
LocalAlloc
MulDiv
GetLastError
GetDiskFreeSpaceA
GetFileTime
SetFileTime
GetFullPathNameA
GetTempFileNameA
GetFileAttributesA
FileTimeToLocalFileTime
FileTimeToSystemTime
WritePrivateProfileStringA
GetPrivateProfileStringA
GetPrivateProfileIntA
CreateEventA
SuspendThread
SetThreadPriority
ResumeThread
SetEvent
WaitForSingleObject
CloseHandle
GetCurrentThread
GlobalSize
FormatMessageA
LocalFree
GlobalReAlloc
GlobalAlloc
lstrcmpA
MultiByteToWideChar
WideCharToMultiByte
InterlockedDecrement
InterlockedIncrement
GlobalFree
FindResourceA
LoadResource
LockResource
GetCurrentThreadId
lstrcmpiA
GlobalFindAtomA
GlobalDeleteAtom
lstrcatA
lstrcpyA
GlobalLock
lstrcpynA
GlobalUnlock
GlobalGetAtomNameA
GlobalAddAtomA
GetVersion
ExitProcess
GetModuleHandleA
Sleep
GetShortPathNameA
lstrlenA
GetThreadLocale
GetProcessHeap
IsBadReadPtr
SetLastError
LoadLibraryA
GetProcAddress
FreeLibrary
EnumSystemLocalesA
GetModuleFileNameA

user32

MapWindowPoints
GetSysColor
DispatchMessageA
AdjustWindowRectEx
ScreenToClient
DeferWindowPos
BeginDeferWindowPos
EndDeferWindowPos
ScrollWindow
GetScrollInfo
SetScrollInfo
ShowScrollBar
GetScrollRange
SetScrollRange
GetScrollPos
SetScrollPos
GetTopWindow
MessageBoxA
IsChild
RegisterClassA
TrackPopupMenu
SetWindowPlacement
GetWindowTextLengthA
GetWindowTextA
DestroyWindow
CreateWindowExA
SetWindowsHookExA
CallNextHookEx
GetClassLongA
SetPropA
UnhookWindowsHookEx
GetPropA
CallWindowProcA
RemovePropA
DefWindowProcA
GetMessageTime
GetMessagePos
GetForegroundWindow
SetForegroundWindow
OffsetRect
IntersectRect
SystemParametersInfoA
GetWindowPlacement
GetWindowRect
SendDlgItemMessageA
GetLastActivePopup
BringWindowToTop
IsWindowVisible
IsIconic
GetFocus
ScrollWindowEx
GetDlgItem
InvalidateRect
SetWindowLongA
wsprintfA
GetKeyState
SetWindowPos
GetDlgCtrlID
GetMenuItemCount
GetSubMenu
GetMenuItemID
UnpackDDElParam
ReuseDDElParam
EnableWindow
HideCaret
ShowCaret
SetDlgItemTextA
DrawFocusRect
DefDlgProcA
IsWindowUnicode
SendMessageA
UpdateWindow
CopyRect
LoadBitmapA
SetActiveWindow
WinHelpA
SetMenu
GetMenu
LoadIconA
GetClassInfoA
LoadMenuA
DestroyMenu
SetFocus
GetParent
GetActiveWindow
ShowWindow
GetWindowLongA
IsWindow
GetDesktopWindow
CheckDlgButton
CheckRadioButton
GetDlgItemInt
GetDlgItemTextA
GetSystemMetrics
SetDlgItemInt
GetWindow
IsWindowEnabled
SetCursor
PeekMessageA
PostMessageA
GetCapture
ReleaseCapture
TranslateAcceleratorA
LoadAcceleratorsA
SetRectEmpty
GetClientRect
RegisterWindowMessageA
IsDialogMessageA
SetWindowTextA
MoveWindow
GetNextDlgTabItem
EnableMenuItem
CheckMenuItem
SetMenuItemBitmaps
ModifyMenuA
GetMenuState
GetMenuCheckMarkDimensions
IsZoomed
ReleaseDC
GetDC
PtInRect
SetParent
IsRectEmpty
AppendMenuA
DeleteMenu
GetSystemMenu
CreateDialogIndirectParamA
EndDialog
CharToOemA
OemToCharA
wvsprintfA
PostQuitMessage
ShowOwnedPopups
GetCursorPos
ValidateRect
TranslateMessage
GetMessageA
SetWindowContextHelpId
PostThreadMessageA
ExcludeUpdateRgn
IsDlgButtonChecked
RegisterClipboardFormatA
RemoveMenu
GetTabbedTextExtentA
FindWindowA
CharUpperA
MessageBeep
GetNextDlgGroupItem
CopyAcceleratorTableA
CharNextA
DestroyIcon
GetMenuStringA
InsertMenuA
GetDialogBaseUnits
LockWindowUpdate
GetDCEx
InvertRect
SetCapture
InflateRect
WindowFromPoint
KillTimer
SetTimer
LoadStringA
GetSysColorBrush
GetClassNameA
GrayStringA
DrawTextA
TabbedTextOutA
MapDialogRect
BeginPaint
GetWindowDC
ClientToScreen
FillRect
SetRect
LoadCursorA
EqualRect
DestroyCursor
EndPaint

gdi32

GetViewportOrgEx
AbortDoc
EndDoc
EndPage
StartPage
StartDocA
SetAbortProc
CreateDCA
SaveDC
RestoreDC
SelectPalette
SetBkMode
SetPolyFillMode
SetROP2
SetStretchBltMode
SetMapMode
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowOrgEx
OffsetWindowOrgEx
SetWindowExtEx
ScaleWindowExtEx
SelectClipRgn
ExcludeClipRect
IntersectClipRect
OffsetClipRgn
MoveToEx
LineTo
SetTextAlign
SetTextJustification
SetTextCharacterExtra
SetMapperFlags
GetCurrentPositionEx
ArcTo
SetArcDirection
PolyDraw
CreatePen
SetColorAdjustment
PolyBezierTo
GetClipRgn
CreateRectRgn
SelectClipPath
ExtSelectClipRgn
PlayMetaFileRecord
GetObjectType
EnumMetaFile
PlayMetaFile
GetViewportExtEx
GetWindowExtEx
ExtCreatePen
CreateSolidBrush
CreateHatchBrush
CreatePatternBrush
CreateDIBPatternBrushPt
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
CreateFontIndirectA
BitBlt
SetRectRgn
CombineRgn
GetTextColor
GetBkColor
LPtoDP
GetNearestColor
GetStretchBltMode
GetPolyFillMode
GetTextAlign
GetBkMode
GetROP2
GetTextFaceA
GetWindowOrgEx
CopyMetaFileA
Rectangle
GetStockObject
GetDeviceCaps
CreateRectRgnIndirect
PatBlt
CreateFontA
GetCharWidthA
DeleteObject
CreateCompatibleBitmap
StretchDIBits
DeleteDC
GetTextMetricsA
SelectObject
GetTextExtentPoint32A
CreateBitmap
SetBkColor
SetTextColor
GetClipBox
GetDCOrgEx
StretchBlt
DPtoLP
GetMapMode
CreateCompatibleDC
PolylineTo
CreateDIBitmap
GetTextExtentPointA
GetObjectA

comdlg32

GetSaveFileNameA
GetFileTitleA
GetOpenFileNameA
PageSetupDlgA
CommDlgExtendedError
PrintDlgA

winspool.drv

OpenPrinterA
DocumentPropertiesA
ClosePrinter

advapi32

GetFileSecurityA
RegCloseKey
RegEnumKeyA
RegOpenKeyA
RegDeleteKeyA
RegCreateKeyExA
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
RegSetValueA
RegCreateKeyA
RegQueryValueA
SetFileSecurityA
RegDeleteValueA

shell32

ExtractIconA
DragAcceptFiles
DragQueryFileA
DragFinish
SHGetFileInfoA

comctl32

ord17
ord13
ord14
ImageList_Destroy
ImageList_Create
ImageList_LoadImageA
ImageList_Merge
ImageList_Read
ImageList_Write

oledlg

ord8

ole32

OleRun
ReleaseStgMedium
CoTreatAsClass
StringFromCLSID
ReadClassStg
ReadFmtUserTypeStg
OleRegGetUserType
WriteClassStg
WriteFmtUserTypeStg
SetConvertStg
CoDisconnectObject
OleDuplicateData
CoTaskMemAlloc
CoTaskMemFree
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoGetClassObject
CoCreateInstance
CLSIDFromString
CLSIDFromProgID
OleInitialize
OleUninitialize
CoFreeUnusedLibraries
CoRegisterMessageFilter
CoRegisterClassObject
CoRevokeClassObject
OleSetClipboard
OleFlushClipboard
OleIsCurrentClipboard
CreateStreamOnHGlobal
CreateBindCtx

olepro32

ord253

oleaut32

SafeArrayUnaccessData
SysFreeString
SafeArrayAccessData
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayGetElemsize
SafeArrayGetDim
SafeArrayCreate
VariantClear
SafeArrayRedim
VariantCopy
SysAllocString
SysAllocStringByteLen
VariantChangeType
SysStringByteLen
VarCyFromStr
VarBstrFromCy
VarDateFromStr
VarBstrFromDate
SafeArrayCopy
SafeArrayAllocData
SafeArrayAllocDescriptor
SafeArrayGetElement
SafeArrayPtrOfIndex
SafeArrayPutElement
SafeArrayLock
SafeArrayUnlock
SafeArrayDestroy
SafeArrayDestroyData
SafeArrayDestroyDescriptor
VariantTimeToSystemTime
SysReAllocStringLen
SysStringLen
SysAllocStringLen
LoadTypeLi

odbc32

ord4
ord48
ord49
ord20
ord17
ord59
ord8
ord44
ord19
ord46
ord12
ord68
ord43
ord41
ord2
ord1
ord23
ord50
ord45
ord51
ord15
ord9
ord14
ord3
ord11
ord18
ord13
ord61
ord16
ord5
ord10
ord72

Exports

Exports

ChangeAppIDAccessACL
ChangeAppIDLaunchACL
ClearEventData
CreateBlob
CreateNPPInterface
DestroyBlob
DestroyNPPBlobTable
DuplicateBlob
FilterNPPBlob
FindOneOf
FindUnknownBlobCategories
FindUnknownBlobTags
GetBoolFromBlob
GetClassIDFromBlob
GetDwordFromBlob
GetMacAddressFromBlob
GetNPPAddressFilterFromBlob
GetNPPBlobFromUI
GetNPPBlobTable
GetNPPEtypeSapFilter
GetNPPMacTypeAsNumber
GetNPPPatternFilterFromBlob
GetNPPTriggerFromBlob
GetNetworkInfoFromBlob
GetStringFromBlob
GetStringsFromBlob
IsRemoteNPP
LockBlob
MarshalBlob
MergeBlob
RaiseNMEvent
ReadBlobFromFile
RegCreateBlobKey
RegOpenBlobKey
ReleaseEventSystem
RemoveFromBlob
SelectNPPBlobFromTable
SendEvent
SetBoolInBlob
SetClassIDInBlob
SetDwordInBlob
SetMacAddressInBlob
SetNPPAddressFilterInBlob
SetNPPEtypeSapFilter
SetNPPPatternFilterInBlob
SetNPPTriggerInBlob
SetNetworkInfoInBlob
SetStringInBlob
SubkeyExists
UnMarshalBlob
UnlockBlob
WriteBlobToFile
WriteCrackedBlobToFile
recursiveDeleteKey
setKeyAndValue

Sections

.text
Size: 800KB - Virtual size: 797KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 136KB - Virtual size: 134KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 40KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 468KB - Virtual size: 466KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 56KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

43a0b5c08b9c6cfc6914e52cd1070a36

Headers

DLL Characteristics

File Characteristics

Imports

mfc42

msvcrt

advapi32

kernel32

user32

netapi32

npptools

ole32

Exports

Exports

Sections

.text Size: 14KB - Virtual size: 14KB

.data Size: 1024B - Virtual size: 592B

.rsrc Size: 1KB - Virtual size: 1KB

418cacac2b6a85f1b6dcacf68cfe5edf

Headers

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

oledlg

ole32

olepro32

oleaut32

odbc32

Exports

Exports

Sections

.text Size: 800KB - Virtual size: 797KB

.rdata Size: 136KB - Virtual size: 134KB

.data Size: 40KB - Virtual size: 57KB

.idata Size: 20KB - Virtual size: 16KB

.rsrc Size: 468KB - Virtual size: 466KB

.reloc Size: 56KB - Virtual size: 52KB

.text
Size: 14KB - Virtual size: 14KB

.data
Size: 1024B - Virtual size: 592B

.rsrc
Size: 1KB - Virtual size: 1KB

.text
Size: 800KB - Virtual size: 797KB

.rdata
Size: 136KB - Virtual size: 134KB

.data
Size: 40KB - Virtual size: 57KB

.idata
Size: 20KB - Virtual size: 16KB

.rsrc
Size: 468KB - Virtual size: 466KB

.reloc
Size: 56KB - Virtual size: 52KB