batman1[.]zip | Triage™

General

Target
batman1.zip
Size 216KB
Sample231208-m8mdqaba46
SHA256 19614f57ed86b1305c8e00443ee49f751a62b19df9f1a72f326d939b0fd69e66
MD5 b86406aa385d641e99a64c1d4e0dc762
SHA1 d971b22f4ad60d4cc0bf301e933076df31c84bd0
SHA512 a1fd42444910c308527f6bf4e030d4df54241cb9108bbcb1724225183f8e645b28f48c0609e87bbc870452a352c2b1978d7edc6c18239413c4ce2529a2f8a8d3
SSDEEP 3072:jmMgUvmeeVemDanCmC627kNRrQayPqmi+QvSsg0uvt+8RdGkU66gr7ZxJq0izUXH:jmMgjeQarfIcSs0pRdlU6zdq0GUXryyJ
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/batman1.exe

File Explorer

batman1.zip

.zip 216KB
batman1.exe

.exe 323KB

batman1.zip

SHA256 19614f57ed86b1305c8e00443ee49f751a62b19df9f1a72f326d939b0fd69e66
MD5 b86406aa385d641e99a64c1d4e0dc762
SHA1 d971b22f4ad60d4cc0bf301e933076df31c84bd0
SHA512 a1fd42444910c308527f6bf4e030d4df54241cb9108bbcb1724225183f8e645b28f48c0609e87bbc870452a352c2b1978d7edc6c18239413c4ce2529a2f8a8d3
SSDEEP 3072:jmMgUvmeeVemDanCmC627kNRrQayPqmi+QvSsg0uvt+8RdGkU66gr7ZxJq0izUXH:jmMgjeQarfIcSs0pRdlU6zdq0GUXryyJ
MD5 SHA1 SHA512 SSDEEP

Password

infected

batman1.exe

IMPHASH d01c1de5b3809b46e3c55481ecafaf4f
SHA256 a947c216ea52ce23457b3babb1e1eb6275cabe2150d3995553e4de4b8c3d97f4
MD5 afdf2fbc0756ed304d1a33083a5f2b0f
SHA1 f3a25627f925390097a64a84ef34c952fe8af036
SHA512 1c49e53b21c6cebc7a070667aaf05bc89e1a434270208fb61e54c8d74b8f4f3c70c021567d65e1ae024b16bdddb6f89989434075b9a422f2582d82c861b6ccf1
SSDEEP 6144:vG9T0nIO6C3XwbT5QOIJSeEY7EkvBeC1G:HIO6TTeO8Sw7Ekv8C
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

1

Major OS version

5

Entry point

27480

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetConsoleTextAttribute GetConsoleAliasA SetConsoleScreenBufferSize FlushViewOfFile _lclose GetProcessPriorityBoost GetModuleHandleW GetTickCount GetWindowsDirectoryA GetPriorityClass GetVolumePathNameW OpenProcess EnumSystemCodePagesA GetAtomNameW EnumResourceLanguagesA MultiByteToWideChar DisconnectNamedPipe FindFirstFileExA GetLastError GetLongPathNameA ClearCommError SetVolumeLabelW SetFileApisToOEM ProcessIdToSessionId LocalAlloc IsWow64Process SetConsoleOutputCP SetProcessWorkingSetSize GetCommMask GetDefaultCommConfigA FindFirstVolumeMountPointA VirtualProtect EnumDateFormatsW FatalAppExitA SetCalendarInfoA FindAtomW FindNextVolumeA lstrcpyW WriteConsoleW LoadLibraryW HeapAlloc BuildCommDCBAndTimeoutsA lstrlenA WriteConsoleOutputCharacterW PeekConsoleInputW GetVolumeNameForVolumeMountPointA InterlockedIncrement InterlockedDecrement EncodePointer DecodePointer Sleep InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection HeapFree GetCommandLineW HeapSetInformation GetStartupInfoW RaiseException RtlUnwind WideCharToMultiByte LCMapStringW GetCPInfo TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent HeapCreate SetHandleCount GetStdHandle InitializeCriticalSectionAndSpinCount GetFileType SetFilePointer CloseHandle GetProcAddress ExitProcess WriteFile GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError GetCurrentThreadId QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetLocaleInfoW HeapSize GetACP GetOEMCP IsValidCodePage GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale GetStringTypeW HeapReAlloc SetStdHandle GetConsoleCP GetConsoleMode FlushFileBuffers CreateFileW

user32

GetCaretPos

advapi32

RevertToSelf EnumServicesStatusW BackupEventLogA RegQueryMultipleValuesW QueryServiceLockStatusW

Sharing