sample-3613072-8c4056de05d8d152155c27aae4accebb[.]zip | Triage

Sharing

Copy URL Twitter E-mail

General

Target

sample-3613072-8c4056de05d8d152155c27aae4accebb.zip
Size

380KB
MD5

e067a22cc8d1d1f5ab0b8c5f5f6bbba6
SHA1

1837441a0686648644e97309020a71f41e89fc41
SHA256

57d8d2f4ead113149afcbb5acca5002d27214a3bbca5df623fb24928417a5507
SHA512

4667eb5fc46c79eec13c927225dec0eb05fd2006b06b51052ceee1f30169f4cb4c0591d35b0bd04d503ee428de04439f57c61516099ff515b2b78ff0fea90c42
SSDEEP

6144:B4YICVk8BlgpzEuRcnT8uWEirtKTjCJrWQyXAVrGdOg6NocqjOCKHgDOeC:Bu8tscnT8uWrxKTj6SpXAccPCUgDdC

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/autochk.exe

Files

sample-3613072-8c4056de05d8d152155c27aae4accebb.zip
.zip

Password: infected
autochk.exe
.sys windows:4 windows x86 arch:x86

d6d2fdcb9bc59ecbcf8e97f5cc18da42

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

wcscpy
NtQuerySecurityObject
NtReadFile
NtDisplayString
LdrLoadDll
NtAdjustPrivilegesToken
RtlInitUnicodeString
NtCreateKey
NtQueryInformationToken
RtlQueryEnvironmentVariable_U
NtDelayExecution
NtCreateFile
NtSetValueKey
NtOpenProcessToken
NtDeleteFile
NtSetSecurityObject
NtWriteFile
NtClose
NtTerminateProcess
RtlUnwind

Sections

.text
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 104B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ