ets2v1485727tr[.]zip | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ets2v1485727tr.zip
Size

2.9MB
MD5

ffd57492c5db6836edf1ca505cd7ed6b
SHA1

1eebc81d0fc356cca1b9e2cd7b969cb9e924aa64
SHA256

a7f35709a9d47f1530f6f9c4d7df55924093197c0a8930d40fffef37ff91eb9b
SHA512

be2ce505771e3f4b60ff96dce57d4ab98d737e76c87d9449543bd8c2103ff29f6d65a0643f5ec455e0e8544e524656a671d38156912230e0b9108a309c5f03c6
SSDEEP

49152:E8sH6ceOgsimDInGs1ivSu5LGr6WECN4sxsS656o9T34qa:Ez4ScnGpvSu5LG+WE1WsS656QTna

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack002/ets2v148572+7tr.exe

Files

ets2v1485727tr.zip
.zip
ets2v1485727tr.zip
.zip
ets2v148572+7tr.exe
.exe windows:6 windows x64 arch:x64

1734ea0a584c9857d44f3001af4838d5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
GetProcAddress

winmm

PlaySoundW

winspool.drv

ClosePrinter

comdlg32

FindTextW

comctl32

ImageList_Add

shell32

ShellExecuteW

user32

GetDC

version

VerQueryValueW

oleaut32

VariantInit

advapi32

RegLoadKeyW

msvcrt

memcpy

ole32

IsEqualGUID

gdi32

Pie

Exports

Exports

__dbk_fcall_wrapper
dbkFCallWrapperAddr

Sections

.MPRESS1
Size: 2.7MB - Virtual size: 8.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.MPRESS2
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 327KB - Virtual size: 327KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
iNvIcTUs oRCuS.nfo
ets2v1485727tr.zip.txt
megagames.com.txt