activate[.]rar | Triage

Sharing

General

Target

activate.rar
Size

5.4MB
MD5

15e1843a99c3060c150a67919b396690
SHA1

24ec742fdb6c010e9cc349413fc44d05eb555bb7
SHA256

dc86ca0c7cf5e45c196ef2707aa90550b20e3b860dc48e42ffde78c06792fea3
SHA512

2ce651e63ea5ccf01f5763ed52e9837955cf290e91b840b595ab4d2148ce4ff71cf57446a5c2d22f1c269874227ec05299cf28075057ce4d29370769b9258cc3
SSDEEP

98304:OsXhHc4vlsBky4cNirKhZgOYF6gHKQtJ/wjwrWqdIWXpXfTlhVx2:Osl8k1cN2K7YF6gN00aGIIlQ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/activate.exe

Files

activate.rar
.rar
activate.exe
.exe windows:6 windows x86 arch:x86

2abe533e25a4d6517447ccb30bcf5468

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateToolhelp32Snapshot
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
GetModuleHandleA
LoadLibraryA
GetProcAddress

Sections

.text
Size: - Virtual size: 3.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 1.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

[0]
Size: 688.3MB - Virtual size: 688.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.&6f
Size: - Virtual size: 2.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.5{K
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.\zM
Size: 5.5MB - Virtual size: 5.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 8KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ