460b5c15cf65866c6b9f3e3a6ec653561b88e5c5bfb263e94dfebc7bbf6a0cb2[.]exe[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

460b5c15cf65866c6b9f3e3a6ec653561b88e5c5bfb263e94dfebc7bbf6a0cb2.exe.zip
Size

484KB
MD5

40bcbab806a6307677bd2e590e3079b0
SHA1

55fa7f531944b02bb43b770acc22c94678706327
SHA256

8c7a14c518c1c5b4bd894b8bbfa6238dc5e7509cdc3d3391319cd6979383c19c
SHA512

fd09daaa305aafc16dde9ffc534eeef395a60daabc701b2c9d8524fa53323e2e23ba18b8997667ea9f991be5c63b903c45b327a82c007d67a478c568dd1bd481
SSDEEP

12288:v/vcqsJwX7PNHt4QYbCHmPV9/yvHSP8QbdPu4eQ/L3:vncqJXHYeHmP7CyE65TLT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/460b5c15cf65866c6b9f3e3a6ec653561b88e5c5bfb263e94dfebc7bbf6a0cb2.exe

Files

460b5c15cf65866c6b9f3e3a6ec653561b88e5c5bfb263e94dfebc7bbf6a0cb2.exe.zip
.zip

Password: infected
460b5c15cf65866c6b9f3e3a6ec653561b88e5c5bfb263e94dfebc7bbf6a0cb2.exe
.exe windows:5 windows x64 arch:x64

d0b576aa1597bfc88eef11f7320a63ec

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
GetProcAddress

wsock32

__WSAFDIsSet

version

VerQueryValueW

winmm

timeGetTime

comctl32

ImageList_Remove

mpr

WNetUseConnectionW

wininet

FtpOpenFileW

psapi

GetProcessMemoryInfo

iphlpapi

IcmpSendEcho

userenv

LoadUserProfileW

uxtheme

IsThemeActive

user32

GetDC

gdi32

LineTo

comdlg32

GetSaveFileNameW

advapi32

AddAce

shell32

DragFinish

ole32

CoGetObject

oleaut32

SysStringLen

Sections

.MPRESS1
Size: 468KB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.MPRESS2
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

Password: infected

d0b576aa1597bfc88eef11f7320a63ec

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

wsock32

version

winmm

comctl32

mpr

wininet

psapi

iphlpapi

userenv

uxtheme

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

Sections

.MPRESS1 Size: 468KB - Virtual size: 1.1MB

.MPRESS2 Size: 4KB - Virtual size: 3KB

.rsrc Size: 27KB - Virtual size: 27KB

.MPRESS1
Size: 468KB - Virtual size: 1.1MB

.MPRESS2
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 27KB - Virtual size: 27KB