149979213411fcac20f7cbc1a26e1521b80073aff05d4c0f967046ef5f23b13a[.]zip

General

Target

149979213411fcac20f7cbc1a26e1521b80073aff05d4c0f967046ef5f23b13a.zip
Size

18KB
MD5

e366fda31628c5d9da83cfcdb7ac9fc4
SHA1

b0d01827d1fd9bd70ed3c60205e95baba728515b
SHA256

043bc5f8da479077084c4ec75e5c1182254366d135373059906bb6fed0bf5148
SHA512

e530b458bd94eeffa5aa8a2f8a27c7d6c1562c7ae8c955172ee3fd1e2ff88b2cfb94bebf10d56c3aa912b83f69fb2ff9d965c45706bc7050dd9837db1926358d
SSDEEP

384:8TtfqvaMmPDFwQBoZc4WY2ikhwIJiSIa5g9JzNwVMScl0RaUK9Qrcm:0ACVLqtZBWJKm35g91AsSPKKJ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/149979213411fcac20f7cbc1a26e1521b80073aff05d4c0f967046ef5f23b13a

Files

149979213411fcac20f7cbc1a26e1521b80073aff05d4c0f967046ef5f23b13a.zip
.zip

Password: infected
149979213411fcac20f7cbc1a26e1521b80073aff05d4c0f967046ef5f23b13a
.exe windows:4 windows x86 arch:x86

Password: infected

b48d4f95b75d3b29bfe6a5d6b20bb1d0

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

DeleteFileA
CopyFileA
lstrcatA
GetTickCount
GetLocalTime
lstrcpyA
GetComputerNameA
GetLocaleInfoA
MultiByteToWideChar
CreateProcessA
FreeLibrary
GetProcAddress
LoadLibraryA
_lclose
_lopen
GetSystemDirectoryA
WideCharToMultiByte
GetModuleFileNameA
lstrlenA
CloseHandle
Sleep
FlushFileBuffers
LCMapStringW
LCMapStringA
SetStdHandle
GetOEMCP
GetACP
GetCPInfo
InterlockedIncrement
InterlockedDecrement
SetFilePointer
GetStringTypeW
GetStringTypeA
GetLastError
CreateThread
GetCurrentThreadId
TlsSetValue
ExitThread
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
HeapFree
TlsAlloc
SetLastError
TlsGetValue
HeapAlloc
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
RtlUnwind
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
DeleteCriticalSection
HeapDestroy
HeapCreate
VirtualFree
WriteFile
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
VirtualAlloc
HeapReAlloc

advapi32

RegCreateKeyExA
RegSetValueExA
RegCloseKey
GetUserNameA

ws2_32

gethostname
gethostbyname
send
socket
htons
inet_addr
ioctlsocket
connect
select
closesocket
WSAStartup
WSACleanup
inet_ntoa

mpr

WNetAddConnection2A
WNetCancelConnection2A

netapi32

NetApiBufferFree
NetUserEnum
NetScheduleJobAdd
NetRemoteTOD

Sections

.text
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

b48d4f95b75d3b29bfe6a5d6b20bb1d0

Headers

File Characteristics

Imports

kernel32

advapi32

ws2_32

mpr

netapi32

Sections

.text Size: 24KB - Virtual size: 23KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 12KB - Virtual size: 12KB

.text
Size: 24KB - Virtual size: 23KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 12KB - Virtual size: 12KB