19874f86324a1a81d08d905c18e55e1231b71bd839541b32dde8d35917174fd2[.]exe[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

19874f86324a1a81d08d905c18e55e1231b71bd839541b32dde8d35917174fd2.exe.zip
Size

45KB
MD5

7cc8940d85489cbf2319051c21131a46
SHA1

2bf7f9fcb10044863cbcaffad84476514800834e
SHA256

978734134a7888729cee07fc222cc6beb4c4aac6ac79ba584b4cc1267d1c47b0
SHA512

1277fb0e71141e08a4049f429fb51f1288eab593b8106559bf8298f5be83497dad8e861f598b9c8138218b61086ad6a4cafeca208d60204319b5d45acd18961c
SSDEEP

768:i7a67j0Rl532b3Dos5DdGuSmOwNOXB3tG8LSgViE55FOfYY8HBS/D/VFF3cxU:ia6ERlw3ss5DdQmOwwFhTVhD1NEhFZ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/19874f86324a1a81d08d905c18e55e1231b71bd839541b32dde8d35917174fd2.exe

Files

19874f86324a1a81d08d905c18e55e1231b71bd839541b32dde8d35917174fd2.exe.zip
.zip

Password: infected
19874f86324a1a81d08d905c18e55e1231b71bd839541b32dde8d35917174fd2.exe
.exe windows:5 windows x86 arch:x86

b588953ab6b46fffb3de335064b0c5a4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

DeleteFileA
WriteProcessMemory
CloseHandle
GetModuleFileNameA
LoadLibraryA
VirtualAllocEx
CopyFileA
GetProcAddress
Sleep
VirtualFreeEx
OpenProcess
CreateRemoteThread
WaitForSingleObject
GetCurrentProcess
FreeLibrary
GetNativeSystemInfo
CreateFileW
HeapSize
WriteConsoleW
GetLastError
HeapFree
HeapAlloc
GetCommandLineA
HeapSetInformation
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
DecodePointer
TlsFree
GetModuleHandleW
SetLastError
GetCurrentThreadId
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
HeapCreate
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameW
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LCMapStringW
MultiByteToWideChar
GetStringTypeW
LeaveCriticalSection
EnterCriticalSection
SetFilePointer
GetConsoleCP
GetConsoleMode
LoadLibraryW
RtlUnwind
IsProcessorFeaturePresent
HeapReAlloc
SetStdHandle
FlushFileBuffers

advapi32

OpenServiceA
AdjustTokenPrivileges
OpenSCManagerA
SetServiceStatus
CryptGenRandom
QueryServiceStatus
CryptAcquireContextA
LookupPrivilegeValueA
StartServiceA
CryptReleaseContext
CreateServiceA
RegisterServiceCtrlHandlerA
DeleteService
StartServiceCtrlDispatcherA
OpenProcessToken
CloseServiceHandle

netapi32

NetShareEnum
NetApiBufferFree

Sections

.text
Size: 41KB - Virtual size: 41KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

b588953ab6b46fffb3de335064b0c5a4

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

netapi32

Sections

.text Size: 41KB - Virtual size: 41KB

.rdata Size: 10KB - Virtual size: 10KB

.data Size: 3KB - Virtual size: 11KB

.rsrc Size: 26KB - Virtual size: 26KB

.reloc Size: 4KB - Virtual size: 3KB

.text
Size: 41KB - Virtual size: 41KB

.rdata
Size: 10KB - Virtual size: 10KB

.data
Size: 3KB - Virtual size: 11KB

.rsrc
Size: 26KB - Virtual size: 26KB

.reloc
Size: 4KB - Virtual size: 3KB