13799937684[.]zip

Sharing

Copy URL

Twitter E-mail

General

Target

13799937684.zip
Size

85KB
MD5

97877b1419184a5a802ae68de4d3873a
SHA1

8b788edb6d680ccbb53e743e9e6ecf789c5024ee
SHA256

1acba9d66e3167c54274b64378834ee6798b37b2ff4066dbec1aa63698c163c5
SHA512

0b6260c049a5a39b8c8c203303c4c9af7cde4314322c3a5c41a94f75489f6b3cff80cf1cba739365da60a6742a98fa4abff4bf7210df2ca646b7cad996606e8e
SSDEEP

1536:pr3PW7Q78avEoFPn7M1Z9F4ILZYn1Bx8IOEO+hx5Qqm7lbL2d9Y34EpY8h94:pbPkavEoFPo9+9y3Ef4qmRbWYIEpZh94

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/b78b162232ed3eb495de8fc553e32cf93098ca9bca17ee791956555b5042b72c

Files

13799937684.zip
.zip

Password: infected
b78b162232ed3eb495de8fc553e32cf93098ca9bca17ee791956555b5042b72c
.exe windows:6 windows x86 arch:x86

39e7fc9a91b0346ea2bd83d322490d1b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ReadFile
GetLastError
CreateFileA
WriteFile
DeleteFileW
GetModuleHandleW
CreateDirectoryW
GetModuleFileNameW
CompareStringOrdinal
CreateMutexW
GetFileAttributesW
GetCurrentDirectoryW
SetCurrentDirectoryW
CopyFileW
SetHandleInformation
CreatePipe
PeekNamedPipe
CreateProcessW
GetExitCodeProcess
DecodePointer
GetFileSize
GetConsoleMode
GetConsoleCP
FlushFileBuffers
HeapSize
SetFilePointerEx
GetProcessHeap
GetStringTypeW
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
MultiByteToWideChar
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
CreateFileW
FindClose
GetTempPathW
FindFirstFileW
GlobalUnlock
lstrcmpW
GlobalLock
GlobalAlloc
Sleep
IsWow64Process
lstrcmpiW
WideCharToMultiByte
GetComputerNameW
CloseHandle
Process32FirstW
Process32NextW
CreateToolhelp32Snapshot
GetVersionExW
GetCurrentProcess
FindFirstFileExW
HeapReAlloc
LCMapStringW
GetFileType
WriteConsoleW
HeapAlloc
HeapFree
ExitProcess
GetStdHandle
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
CreateThread
RaiseException
LoadLibraryExW
GetProcAddress
FreeLibrary
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlUnwind
SetLastError
EncodePointer

user32

UnhookWindowsHookEx
GetForegroundWindow
GetWindowTextA
DispatchMessageW
CallNextHookEx
GetKeyState
SetWindowsHookExW
MessageBoxW
ReleaseDC
GetDC
PostQuitMessage
OpenClipboard
CloseClipboard
GetClipboardSequenceNumber
SetClipboardData
EmptyClipboard
GetSystemMetrics
TranslateMessage
GetMessageW
GetClipboardData
IsClipboardFormatAvailable

gdi32

CreateCompatibleBitmap
SelectObject
CreateCompatibleDC
DeleteObject
BitBlt

advapi32

RegSetKeyValueW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
CryptAcquireContextW
AllocateAndInitializeSid
CryptCreateHash
CryptHashData
CryptDestroyHash
FreeSid
CheckTokenMembership
CryptGetHashParam
CryptReleaseContext

shell32

ShellExecuteExW
SHGetKnownFolderPath

ole32

CoInitializeEx
CoUninitialize
CoTaskMemFree

shlwapi

PathFindFileNameW
PathFindFileNameA

urlmon

URLDownloadToFileW

winhttp

WinHttpSetTimeouts
WinHttpSendRequest
WinHttpWriteData
WinHttpCloseHandle
WinHttpConnect
WinHttpQueryDataAvailable
WinHttpOpenRequest
WinHttpReadData
WinHttpAddRequestHeaders
WinHttpOpen
WinHttpReceiveResponse

gdiplus

GdipSaveImageToFile
GdipGetImageEncodersSize
GdipFree
GdipDisposeImage
GdipCreateBitmapFromHBITMAP
GdipAlloc
GdipCloneImage
GdipGetImageEncoders
GdiplusShutdown
GdiplusStartup

Sections

.text
Size: 109KB - Virtual size: 108KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 38KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

39e7fc9a91b0346ea2bd83d322490d1b

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

shlwapi

urlmon

winhttp

gdiplus

Sections

.text Size: 109KB - Virtual size: 108KB

.rdata Size: 38KB - Virtual size: 37KB

.data Size: 2KB - Virtual size: 6KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 6KB - Virtual size: 6KB

.text
Size: 109KB - Virtual size: 108KB

.rdata
Size: 38KB - Virtual size: 37KB

.data
Size: 2KB - Virtual size: 6KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 6KB - Virtual size: 6KB