Gloom-final[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

Gloom-final.zip
Size

870KB
MD5

c6de48610571b039566120e80080e50e
SHA1

ed7afcfe8da3088ae7b4a8a9efe13ebca4ac6c18
SHA256

03fb3fa5dad4a9f23805177cda44de16e05c744e42a20c00359b091e95e9b5e0
SHA512

82c340e2e58b198a39084ed0edde794905c7f137530f63041eafa85fb2001c07fc3d6a230ab3cd15fdbf10592ddbaa25828439d9132b0f364b4964108039a409
SSDEEP

24576:j8l3izpGtNSGXirNL3x2/W7zyFY17I/JDeGv:INQGXir53x///7I/J6G

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Gloom-final.exe

Files

Gloom-final.zip
.zip
Gloom-final.exe
.exe windows:6 windows x64 arch:x64

a4e3eb058f2ee1ec654c71415e058faa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ws2_32

__WSAFDIsSet
htonl
WSAIoctl
setsockopt
freeaddrinfo
getaddrinfo
listen
getsockname
accept
sendto
recvfrom
bind
WSACleanup
WSAStartup
getpeername
WSASetLastError
ntohs
WSAGetLastError
WSAWaitForMultipleEvents
WSASetEvent
WSAResetEvent
WSAEventSelect
WSAEnumNetworkEvents
WSACreateEvent
WSACloseEvent
getsockopt
inet_pton
recv
connect
select
gethostname
inet_ntop
ioctlsocket
socket
closesocket
inet_addr
send
htons

kernel32

FreeLibrary
GetModuleHandleW
LoadLibraryW
GetLastError
GetEnvironmentVariableA
SetLastError
FormatMessageW
Sleep
MoveFileExW
GetStdHandle
GetFileType
ReadFile
PeekNamedPipe
GetSystemDirectoryW
GetCurrentProcessId
WaitForSingleObjectEx
SleepEx
VerSetConditionMask
VerifyVersionInfoW
CreateFileW
GetFileSizeEx
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
QueryPerformanceFrequency
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
GetTickCount
QueryPerformanceCounter
WideCharToMultiByte
MultiByteToWideChar
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
GetACP
IsValidCodePage
GetProcAddress
CloseHandle
Process32FirstW
Process32NextW
GetTempPathA
GetModuleHandleA
WaitForSingleObject
VirtualAlloc
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
OutputDebugStringW
DeleteFileW
HeapSize
WriteConsoleW
WaitForMultipleObjects
GetDiskFreeSpaceExW
GetTimeZoneInformation
SetConsoleCtrlHandler
SetEndOfFile
SetStdHandle
HeapReAlloc
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
HeapAlloc
HeapFree
FlushFileBuffers
GetCurrentThread
GetConsoleOutputCP
ReadConsoleW
GetConsoleMode
WriteFile
GetModuleFileNameW
ExitProcess
SetFilePointerEx
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetDriveTypeW
SetCurrentDirectoryW
GetCurrentDirectoryW
CreateDirectoryW
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
RtlUnwind
GetFileAttributesW
GetFileAttributesExW
GetFileInformationByHandle
GetFinalPathNameByHandleW
GetFullPathNameW
SetFileAttributesW
SetFileInformationByHandle
SetFileTime
GetTempPathW
AreFileApisANSI
DeviceIoControl
CreateDirectoryExW
CopyFileW
CreateHardLinkW
GetFileInformationByHandleEx
CreateSymbolicLinkW
LocalFree
FormatMessageA
GetLocaleInfoEx
GetCurrentThreadId
SwitchToThread
GetExitCodeThread
GetNativeSystemInfo
RtlPcToFileHeader
RaiseException
TryAcquireSRWLockExclusive
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableSRW
LCMapStringEx
EncodePointer
DecodePointer
CompareStringEx
GetCPInfo
InitOnceExecuteOnce
CreateEventExW
CreateSemaphoreExW
FlushProcessWriteBuffers
GetCurrentProcessorNumber
GetSystemTimeAsFileTime
GetTickCount64
FreeLibraryWhenCallbackReturns
CreateThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CreateThreadpoolWait
SetThreadpoolWait
CloseThreadpoolWait
GetStringTypeW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
RtlUnwindEx
InterlockedPushEntrySList
InterlockedFlushSList
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
CreateThread
ExitThread
ResumeThread
FreeLibraryAndExitThread
GetModuleHandleExW

user32

GetDC
MessageBoxA

advapi32

RegOpenKeyExA
CryptReleaseContext
CryptGetHashParam
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptDestroyKey
CryptImportKey
CryptEncrypt
CryptAcquireContextW

bcrypt

BCryptGenRandom

crypt32

CertFindCertificateInStore
PFXImportCertStore
CertCloseStore
CertOpenStore
CertFreeCertificateContext
CryptStringToBinaryW
CryptDecodeObjectEx
CertAddCertificateContextToStore
CertFindExtension
CertGetNameStringW
CryptQueryObject
CertCreateCertificateChainEngine
CertFreeCertificateChainEngine
CertGetCertificateChain
CertEnumCertificatesInStore
CertFreeCertificateChain

Sections

.text
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 254KB - Virtual size: 254KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 21KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 81KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

memcpy_
Size: 512B - Virtual size: 264B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

_RDATA
Size: 512B - Virtual size: 500B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a4e3eb058f2ee1ec654c71415e058faa

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

kernel32

user32

advapi32

bcrypt

crypt32

Sections

.text Size: 1.5MB - Virtual size: 1.5MB

.rdata Size: 254KB - Virtual size: 254KB

.data Size: 21KB - Virtual size: 32KB

.pdata Size: 81KB - Virtual size: 80KB

memcpy_ Size: 512B - Virtual size: 264B

_RDATA Size: 512B - Virtual size: 500B

.reloc Size: 6KB - Virtual size: 6KB

.text
Size: 1.5MB - Virtual size: 1.5MB

.rdata
Size: 254KB - Virtual size: 254KB

.data
Size: 21KB - Virtual size: 32KB

.pdata
Size: 81KB - Virtual size: 80KB

memcpy_
Size: 512B - Virtual size: 264B

_RDATA
Size: 512B - Virtual size: 500B

.reloc
Size: 6KB - Virtual size: 6KB