Win7Recovery.zip
- SHA256 dfbbc4d8e684ccbb14739ab8e6ddc8dde751dc8ce55fd50717d4c0e7353402c4
Password
mysubsarethebest
Static task
static1
1 signatures
windows7-x64
11 signatures
150 seconds
General
- Target Win7Recovery.zip
- Size 401KB
- Sample240302-t6wypsfd77
- SHA256 dfbbc4d8e684ccbb14739ab8e6ddc8dde751dc8ce55fd50717d4c0e7353402c4
- MD5 2877bb68fe0971fd721e426bd7650c4f
- SHA1 d1cc4e0bb506d43f8f94e655ab66468feaaa7836
- SHA512 68066729370b8475bc919404671fc8c63c234616137768ac8c25e504e8014f59d2fbc0ac96647f6cd1af18b8e37662f81b836e17da80dac1e2eca43d80a69363
- SSDEEP 12288:btRz6yVeaiHEgszIc6nuZVKN0euSMFqze0NUx:7zviH1UIcOUolZ+
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/[email protected]
File Explorer
-
Win7Recovery.zip.zip 401KB
-
[email protected].exe 467KB
- IMPHASH 16f918727956e3290e9ef449cc9402d9
- SHA256 2ac0ca4ffda10b1861dd4ae0c2f0131a6400214cb4f5fa33951f3062b784a755
- MD5 ab65e866abc51f841465d19aba35fb14
- SHA1 ec79f1f511a199291b0893bc866a788ceac19f6e
- SHA512 2474905f174635b236e5f6e8f8c497e44435c94edd02ec47d3440c9a216f6840d040e6acc5fe2ec301ada80467f6cf55225d6361c1e7c6c6c7edccb9e7b5a35e
- SSDEEP 12288:JSAEF99H0UO8MDCSP0iUiF1lv54a7cXndlZni:wX9HjOEaUw3cXd
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
mysubsarethebest
Minor OS version
0
Major OS version
5
Entry point
5247
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
advapi32
RegCloseKey
RegSetValueExW
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW
RegQueryValueExA
RegOpenKeyExA
kernel32
InterlockedDecrement
CreateThread
GetCurrentThreadId
lstrlenW
GetModuleFileNameW
HeapReAlloc
WriteFile
CreateFileW
lstrlenA
SetEvent
LocalFree
GetOverlappedResult
ReadFile
LocalAlloc
GetFileSizeEx
MulDiv
FormatMessageW
WaitForSingleObject
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoA
GetCommandLineA
GetVersionExA
ExitProcess
GetProcAddress
LoadLibraryExA
HeapAlloc
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
HeapDestroy
HeapCreate
VirtualFree
LoadLibraryA
GetACP
GetOEMCP
GetCPInfo
VirtualAlloc
RtlUnwind
InterlockedExchange
VirtualQuery
SetFilePointer
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
SetStdHandle
VirtualProtect
GetSystemInfo
GetLocaleInfoA
FlushFileBuffers
InterlockedIncrement
WaitForMultipleObjects
GetLastError
GetModuleHandleA
ResetEvent
HeapFree
GetProcessHeap
CreateEventW
GetStdHandle
CloseHandle
gdi32
GetObjectW
GetDeviceCaps
CreateFontIndirectW
DeleteObject
user32
TranslateMessage
GetMessageW
LoadImageW
GetDC
ReleaseDC
MessageBoxW
SetWindowTextW
ShowWindow
SetDlgItemTextW
SetFocus
SendMessageW
PostThreadMessageW
GetDlgItemTextW
GetDlgItem
GetWindowTextLengthW
EnableWindow
GetWindowLongW
SetWindowLongW
SendDlgItemMessageW
GetParent
PostMessageW
LoadStringW
KillTimer
DispatchMessageW
SetTimer
PostQuitMessage
shell32
SHGetFolderPathW
SHBindToParent
SHGetSpecialFolderPathW
ord155
SHGetPathFromIDListW
SHBrowseForFolderW
ShellExecuteW
ord258
SHSetLocalizedName
comdlg32
GetOpenFileNameW
shlwapi
StrFormatByteSizeW
StrRetToBufW
SHSetValueW
PathFindFileNameW
PathAddExtensionW
PathAppendW
PathRemoveFileSpecW
StrStrIA
PathCombineW
mswsock
AcceptEx
ole32
CoInitialize
CoMarshalInterThreadInterfaceInStream
CoRegisterClassObject
CoRevokeClassObject
CoInitializeEx
CoGetInterfaceAndReleaseStream
CoCreateInstance
CoUninitialize
irprops.cpl
BluetoothAuthenticateDevice
BluetoothEnableDiscovery
BluetoothSelectDevices
BluetoothSelectDevicesFree
BluetoothFindFirstRadio
BluetoothFindRadioClose
BluetoothGetDeviceInfo
Name
.text
Size
14KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
148KB
Virtual Size
148KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
143KB
Virtual Size
143KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
143KB
Virtual Size
143KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
412B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=131, productName=VS2008 build 21022, version=21022,
count=3, id=123, productName=VS2005 build 50727, version=50727,
count=7, id=1, productName=Unmarked objects,
count=2, id=138, version=21022,
count=8, id=149, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,