01a6fbe1a46c19a084d1d1a72bf02ac193eb0e34ea45f0abf2cc3da0e4b57c79[.]exe[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

01a6fbe1a46c19a084d1d1a72bf02ac193eb0e34ea45f0abf2cc3da0e4b57c79.exe.zip
Size

1.3MB
MD5

c41b24e5d3bbf7ea47cc410a6327ea23
SHA1

a519a149b7dae26a584e86d05c55253859039ba1
SHA256

a05033d3047a31612880f5c17baf23366de796ce19c2f5e57fb01819dcf0ed17
SHA512

c04ec2683ae40359ef813da59d457c122c124d4c94d654f0721f1c35355553254de7118da52c308b1f19cc7e2088af1c095b57dc97b06143f6fd4c942ea3eff3
SSDEEP

24576:KSW+g349OwICubP0dU7zIFkhU2yKBUqrR7knjJt0hvrTA9gYpI099bNu81cTMs3d:KcgAdU7akhyqR7OjJ8vrU9gE9uXe3Z5M

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/01a6fbe1a46c19a084d1d1a72bf02ac193eb0e34ea45f0abf2cc3da0e4b57c79.exe

Files

01a6fbe1a46c19a084d1d1a72bf02ac193eb0e34ea45f0abf2cc3da0e4b57c79.exe.zip
.zip

Password: infected
01a6fbe1a46c19a084d1d1a72bf02ac193eb0e34ea45f0abf2cc3da0e4b57c79.exe
.exe windows:4 windows x86 arch:x86

59fe0785aa1d1cd142e7d9a4f67db7f0

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
GetProcAddress

advapi32

IsValidSid

comctl32

ImageList_Add

gdi32

BitBlt

gdiplus

GdipFree

icmp

IcmpSendEcho

imagehlp

MakeSureDirectoryPathExists

iphlpapi

GetAdaptersInfo

msi

MsiEnumProductsW

msvcrt

pow

netapi32

NetUserDel

ole32

CoInitialize

oleaut32

SafeArrayGetDim

setupapi

SetupIterateCabinetW

shell32

IsNetDrive

urlmon

URLDownloadToFileW

user32

GetDC

userenv

GetDefaultUserProfileDirectoryW

wininet

InternetOpenW

winmm

timeBeginPeriod

winspool.drv

SetPrinterW

wsock32

bind

Sections

.MPRESS1
Size: 1.3MB - Virtual size: 4.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.MPRESS2
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

Password: infected

59fe0785aa1d1cd142e7d9a4f67db7f0

Headers

File Characteristics

Imports

kernel32

advapi32

comctl32

gdi32

gdiplus

icmp

imagehlp

iphlpapi

msi

msvcrt

netapi32

ole32

oleaut32

setupapi

shell32

urlmon

user32

userenv

wininet

winmm

winspool.drv

wsock32

Sections

.MPRESS1 Size: 1.3MB - Virtual size: 4.9MB

.MPRESS2 Size: 4KB - Virtual size: 4KB

.rsrc Size: 68KB - Virtual size: 67KB

.MPRESS1
Size: 1.3MB - Virtual size: 4.9MB

.MPRESS2
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 68KB - Virtual size: 67KB