activate[.]7z | Triage

Sharing

Copy URL Twitter E-mail

General

Target

activate.7z
Size

5.5MB
MD5

2ec476752dff483c9d58454bfe8af5ee
SHA1

62e17ace6788421ce87a10afef3f5626b8546389
SHA256

24f4c40c37f3be71b1435d345a4dea4d4f10e99c741382f080e261c0ac013e12
SHA512

65c7ee025ea6105e4ddc673520bfc33878904e633accb88de2eb7a45053a341d80dd64eef6ed9c46e5559f3ee2e9063add10713028248bd75ccab0db70b0494d
SSDEEP

98304:D8jvnbNKjLVnSxJt50y6sNNmJA+xLxHT4GZ2bGMHNWg09scA8OFvljt6BQOEQ:I7JKUJ41sD+5hUGZ2bGMHNU9sBZ4SOEQ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/activate.exe

Files

activate.7z
.7z
activate.exe
.exe windows:6 windows x86 arch:x86

2abe533e25a4d6517447ccb30bcf5468

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateToolhelp32Snapshot
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
GetModuleHandleA
LoadLibraryA
GetProcAddress

Sections

.text
Size: - Virtual size: 3.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 1.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

[0]
Size: 688.3MB - Virtual size: 688.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.&6f
Size: - Virtual size: 2.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.5{K
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.\zM
Size: 5.5MB - Virtual size: 5.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 8KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ