14395781509[.]zip

Sharing

Copy URL

Twitter E-mail

General

Target

14395781509.zip
Size

497KB
MD5

ebfdd3900672c4c1ca1cfa27e0b54473
SHA1

d2545521d0da64524b69c91a74d9ef1802693c73
SHA256

6811f5c21227d7bf41df3b384c905bbaceae6c3cd9e8c96d0aebef6c382bb550
SHA512

298bc8a5daf98969da0f00778af4f4b6a75e0cecf0d219037988f490e6138c2e3377cc95bde50c8d26149f628fd1194911eb7e0692264f311d838969b706b508
SSDEEP

12288:IIAT4xJUjVNtEH5NLcUmftHX2sRbpEWrjk:U8JUZbEjLchtFtqWA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/a7504addd9879ff171030b24a35c7454a39a997021a6056f4d58314529e07268

Files

14395781509.zip
.zip

Password: infected
a7504addd9879ff171030b24a35c7454a39a997021a6056f4d58314529e07268
.dll windows:5 windows x64 arch:x64

3deb0ec3489831c68610df64d6264fcb

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

advapi32

FreeSid
AllocateAndInitializeSid
LookupAccountSidW
OpenThreadToken
CredUnmarshalCredentialW
SetThreadToken
RevertToSelf
RegQueryInfoKeyW
RegConnectRegistryW
EqualSid
GetLengthSid
RegisterEventSourceW
ReportEventW
DeregisterEventSource
CryptHashData
CryptDestroyHash
CryptCreateHash
CryptAcquireContextW
CryptGetHashParam
GetTokenInformation
OpenProcessToken
RegSetValueExW
RegOpenKeyW
RegEnumKeyExW
CloseServiceHandle
QueryServiceStatus
QueryServiceConfigW
OpenServiceW
OpenSCManagerW
GetTraceLoggerHandle
RegisterTraceGuidsW
SystemFunction006
RegNotifyChangeKeyValue
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegQueryValueExW
TraceEvent
CredFree
SystemFunction007

cryptdll

MD5Update
CDLocateCheckSum
CDGenerateRandomBits
CDLocateCSystem
CDBuildIntegrityVect
MD5Final
CDFindCommonCSystemWithKey
MD5Init

kernel32

lstrlenW
DelayLoadFailureHook
__C_specific_handler
DeleteTimerQueueTimer
CreateTimerQueueTimer
CompareStringA
lstrcmpiA
GetSystemDefaultLCID
lstrlenA
GetCurrentThread
WaitForSingleObject
DeleteCriticalSection
OpenFileMappingW
GetModuleFileNameA
GetSystemInfo
GetProfileStringA
CreateFileMappingW
GetLocalTime
EnterCriticalSection
VirtualAlloc
CreateFileW
LeaveCriticalSection
LoadLibraryW
InitializeCriticalSection
WriteFile
MapViewOfFileEx
UnmapViewOfFile
CreateFileA
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetACP
WideCharToMultiByte
UnregisterWait
RegisterWaitForSingleObjectEx
SetEvent
OpenEventW
FreeLibrary
GetProcAddress
LoadLibraryA
GetComputerNameW
GetComputerNameExW
Sleep
GetLastError
MultiByteToWideChar
lstrcpyW
GetModuleFileNameW
GetModuleHandleW
FormatMessageW
DebugBreak
OutputDebugStringA
IsDebuggerPresent
ExpandEnvironmentStringsW
GetEnvironmentVariableW
CreateEventW
DisableThreadLibraryCalls
LocalAlloc
GetCurrentProcessId
LocalFree
lstrcmpW
CloseHandle
GetSystemTimeAsFileTime

msasn1

ASN1BERDecZeroCharString
ASN1BEREncS32
ASN1BEREncEndOfContents
ASN1BEREncSX
ASN1BEREncOctetString
ASN1DecSetError
ASN1BERDecEndOfContents
ASN1charstring_free
ASN1BERDecCharString
ASN1Free
ASN1BEREncU32
ASN1BEREncBool
ASN1BEREncExplicitTag
ASN1BERDecBool
ASN1BERDecOpenType2
ASN1BEREncBitString
ASN1bitstring_free
ASN1BERDecBitString
ASN1DecAlloc
ASN1BERDecOctetString
ASN1BERDecPeekTag
ASN1BERDecS32Val
ASN1ztcharstring_free
ASN1BERDecU32Val
ASN1BERDecSXVal
ASN1octetstring_free
ASN1BEREncOpenType
ASN1BERDecSkip
ASN1BEREncObjectIdentifier
ASN1BERDecGeneralizedTime
ASN1BERDecObjectIdentifier
ASN1objectidentifier_free
ASN1CEREncGeneralizedTime
ASN1BERDecNotEndOfContents
ASN1BERDecExplicitTag
ASN1BEREncCharString
ASN1_CreateModule
ASN1_CloseDecoder
ASN1intx_free
ASN1_CreateEncoder
ASN1_FreeEncoded
ASN1_Decode
ASN1_FreeDecoded
ASN1_CreateDecoder
ASN1_CloseEncoder
ASN1intx_setuint32
ASN1_Encode
ASN1intx2int32
ASN1intx2uint32
ASN1intxisuint32

msvcrt

_resetstkoflw
memset
_ultoa
qsort
wcstoul
wcsspn
memcmp
memcpy
_wcsnicmp
strrchr
_vsnprintf
_strcmpi
_snprintf
strchr
_snwprintf
_strnicmp
malloc
free
_initterm
_wcsicmp
sscanf
sprintf
_stricmp
wcsrchr
swprintf

ntdll

RtlConvertSharedToExclusive
RtlCompareMemory
NtSetSecurityObject
RtlSetDaclSecurityDescriptor
RtlCreateSecurityDescriptor
RtlAddAccessAllowedAce
RtlCreateAcl
RtlEqualSid
RtlLengthSid
NtOpenProcessToken
NtQueryInformationToken
RtlDeleteResource
RtlInitializeResource
NtClose
RtlAcquireResourceExclusive
NtOpenThreadToken
RtlDeleteCriticalSection
RtlReleaseResource
RtlAcquireResourceShared
RtlFreeUnicodeString
RtlInitUnicodeString
RtlCreateTimerQueue
RtlCreateTimer
RtlDeregisterWait
RtlRegisterWait
NtQuerySystemInformation
RtlIntegerToUnicodeString
RtlInitializeCriticalSection
RtlEraseUnicodeString
RtlRunDecodeUnicodeString
RtlAnsiStringToUnicodeString
RtlEqualUnicodeString
RtlLeaveCriticalSection
NtAllocateLocallyUniqueId
RtlUpcaseUnicodeString
NtCreateEvent
NtOpenEvent
NtWaitForSingleObject
RtlSystemTimeToLocalTime
RtlDowncaseUnicodeString
VerSetConditionMask
RtlVerifyVersionInfo
NtQuerySystemTime
RtlInitializeSid
RtlSubAuthoritySid
RtlCopySid
RtlCopyUnicodeString
RtlPrefixUnicodeString
RtlEqualDomainName
RtlInitAnsiString
RtlUnicodeStringToAnsiString
RtlFreeAnsiString
RtlAllocateAndInitializeSid
RtlFreeSid
RtlAppendUnicodeStringToString
RtlLengthRequiredSid
RtlValidSid
RtlTimeFieldsToTime
RtlTimeToTimeFields
RtlSubAuthorityCountSid
RtlDeleteTimerQueueEx
RtlGetElementGenericTable
RtlDeleteElementGenericTable
RtlInitializeGenericTable
RtlInsertElementGenericTable
RtlNtStatusToDosError
RtlUniform
RtlOemStringToUnicodeString
DbgPrint
RtlFreeHeap
RtlAllocateHeap
RtlImageNtHeader
RtlEnterCriticalSection
NtDuplicateObject
RtlCompareUnicodeString
RtlInsertElementGenericTableAvl
RtlInitializeGenericTableAvl
RtlLookupElementGenericTableAvl
NtOpenProcess
RtlCopyLuid
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlDeleteTimerQueue

secur32

CredMarshalTargetInfo
CredUnmarshalTargetInfo
LsaGetLogonSessionData
LsaFreeReturnBuffer
FreeContextBuffer

user32

wsprintfW
CharLowerBuffW

Exports

Exports

CfGetPlatformInfo
KerbDomainChangeCallback
KerbFree
TfGetPlatformInfo
OfGetPlatformIn
WfGetPlatformIn
SpInitialize
VfGetPlatformI
SpLsaModeInitialize
SpUserModeInitialize

Sections

.text
Size: 591KB - Virtual size: 590KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 23KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 70KB - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 191KB - Virtual size: 191KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 832B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

3deb0ec3489831c68610df64d6264fcb

Headers

File Characteristics

Imports

advapi32

cryptdll

kernel32

msasn1

msvcrt

ntdll

secur32

user32

Exports

Exports

Sections

.text Size: 591KB - Virtual size: 590KB

.data Size: 23KB - Virtual size: 24KB

.pdata Size: 70KB - Virtual size: 70KB

.rsrc Size: 191KB - Virtual size: 191KB

.reloc Size: 1024B - Virtual size: 832B

.text
Size: 591KB - Virtual size: 590KB

.data
Size: 23KB - Virtual size: 24KB

.pdata
Size: 70KB - Virtual size: 70KB

.rsrc
Size: 191KB - Virtual size: 191KB

.reloc
Size: 1024B - Virtual size: 832B