AVM[.]zip | Triage

Sharing

Copy URL Twitter E-mail

General

Target

AVM.zip
Size

16.9MB
MD5

eb2c1d8bf70d258484f327f2d77bc653
SHA1

fa5ed793525ac2b341ab923edaf4e3668b3fa64e
SHA256

fd106ec27644d321a4630db07bd27ccd131324cae9b8c91241b08eb3b4c94a02
SHA512

740ea279e6285760d7bf0c472f9f974e3acbb27caad46256d29e9001fe6f19e0deb0d970e7b1347d7f07755c19f6dab4eca63a09464fa20ae94e4a9be3c7a43e
SSDEEP

393216:ZiI4bsZxlHxwNw+sG92HizeT0pImKDzgkI1EDYeh/X:MpbmHEv924eIpImKDzPI1Er

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/AVM.exe

Files

AVM.zip
.zip
AVM.exe
.exe windows:6 windows x64 arch:x64

8ea8e7b9632f90c14391f38dbdfae513

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_43

D3DCompile

normaliz

IdnToAscii

kernel32

CreatePipe
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

GetForegroundWindow

gdi32

CreateRoundRectRgn

advapi32

CryptReleaseContext

shell32

ShellExecuteA

ole32

CoUninitialize

msvcp140

?good@ios_base@std@@QEBA_NXZ

shlwapi

StrStrIA

ntdll

RtlInitUnicodeString

iphlpapi

GetAdaptersInfo

wininet

InternetCloseHandle

ws2_32

htonl

urlmon

URLDownloadToFileA

imm32

ImmReleaseContext

dwmapi

DwmExtendFrameIntoClientArea

wldap32

ord301

crypt32

CryptDecodeObjectEx

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

setupapi

CM_Get_Device_IDW

bcrypt

BCryptGenRandom

vcruntime140

__std_exception_copy

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo_noreturn

api-ms-win-crt-heap-l1-1-0

_callnewh

api-ms-win-crt-stdio-l1-1-0

fclose

api-ms-win-crt-filesystem-l1-1-0

_unlink

api-ms-win-crt-utility-l1-1-0

rand

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-string-l1-1-0

_strdup

api-ms-win-crt-math-l1-1-0

powf

api-ms-win-crt-convert-l1-1-0

strtoul

api-ms-win-crt-time-l1-1-0

strftime

api-ms-win-crt-multibyte-l1-1-0

_mbscmp

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: - Virtual size: 40.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 2.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 3.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.cypher1
Size: - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.cypher0
Size: - Virtual size: 156KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vlizer
Size: - Virtual size: 2.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.cypher2
Size: - Virtual size: 8.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.cypher3
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.cypher4
Size: 18.4MB - Virtual size: 18.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 284B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8ea8e7b9632f90c14391f38dbdfae513

Headers

DLL Characteristics

File Characteristics

Imports

d3d11

d3dcompiler_43

normaliz

kernel32

user32

gdi32

advapi32

shell32

ole32

msvcp140

shlwapi

ntdll

iphlpapi

wininet

ws2_32

urlmon

imm32

dwmapi

wldap32

crypt32

d3dx11_43

setupapi

bcrypt

vcruntime140

vcruntime140_1

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-multibyte-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: - Virtual size: 40.3MB

.rdata Size: - Virtual size: 2.5MB

.data Size: - Virtual size: 3.2MB

.pdata Size: - Virtual size: 73KB

.cypher1 Size: - Virtual size: 30KB

.cypher0 Size: - Virtual size: 156KB

.vlizer Size: - Virtual size: 2.1MB

.cypher2 Size: - Virtual size: 8.3MB

.cypher3 Size: 6KB - Virtual size: 5KB

.cypher4 Size: 18.4MB - Virtual size: 18.4MB

.reloc Size: 512B - Virtual size: 284B

.rsrc Size: 31KB - Virtual size: 30KB

.text
Size: - Virtual size: 40.3MB

.rdata
Size: - Virtual size: 2.5MB

.data
Size: - Virtual size: 3.2MB

.pdata
Size: - Virtual size: 73KB

.cypher1
Size: - Virtual size: 30KB

.cypher0
Size: - Virtual size: 156KB

.vlizer
Size: - Virtual size: 2.1MB

.cypher2
Size: - Virtual size: 8.3MB

.cypher3
Size: 6KB - Virtual size: 5KB

.cypher4
Size: 18.4MB - Virtual size: 18.4MB

.reloc
Size: 512B - Virtual size: 284B

.rsrc
Size: 31KB - Virtual size: 30KB