0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.zip.zip
- SHA256 5636c11f398189fe534d4b673d95dbe79337082b316d45223ca6e287cb913fcc
Password
infected
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe
Resource
win7-20240221-en
windows7-x64
23 signatures
150 seconds
Behavioral task
behavioral2
Sample
0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
19 signatures
150 seconds
General
- Target 0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.zip.zip
- Size 79KB
- Sample240305-pkn9hsfd46
- SHA256 5636c11f398189fe534d4b673d95dbe79337082b316d45223ca6e287cb913fcc
- MD5 101c2eaa0c21c246aeb5e3c1b0f413c8
- SHA1 a49a76a4665292e456cf99f28aee9590e80f7691
- SHA512 8718a9ac758b719bd5bec1f2e703795cb3bd73508202164a4d4c9695904deb6af76a7947f5f556254ac4adc98aefc9d39ed27231f6b7a805e237d7b28b487338
- SSDEEP 1536:iHHEKzwt8hu6GuBISRQu8wquFE0og2G1GNpzJr+OmDNV:6H+4tGuBDAwtd2GkNptr+OmDNV
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe
File Explorer
-
0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.zip.zip.zip 79KB
-
0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.zip.zip 79KB
-
0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe.exe 150KB
0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.zip
- SHA256 e94a083d8625a65b03889b5a0f41fe4c2126d044d8be3415e40a80f63c7d9600
- MD5 1e3a794bd7c4ab5703b0b07b2b52c6d0
- SHA1 e777ec7c627c97f4539b9ca8797bea77e33c9ca4
- SHA512 fcc48b6b4724f11dfb0c3b2e976f50addec5e6d46c4de8dfe14a7ef2541727d7998ad4b6f7ca9a1c969f64a5fba62d0fc4e07d1ce3f285a9994758a431baf41b
- SSDEEP 1536:Nkb3J8DaxRoomzq3bs0elJSSwwOokPZuaWvQwzfuJRAdA+7Az:NkzJVxKoVsl0Xwej7GWJRAdA+Ez
- MD5 SHA1 SHA512 SSDEEP
Password
infected
0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe
- IMPHASH be232aa2621354bf5dd7b405cc99198c
- SHA256 0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76
- MD5 5761ee98b1c2fea31b5408516a8929ea
- SHA1 4d043df23e55088bfc04c14dfb9ddb329a703cc1
- SHA512 9dbf296719bc130bc700db94fd43985c32cb9de3b1867ed7c8666b62e4b9d0826b6df03cb125644c9338118d9caf679bfa1eb55da39f46b94db023bdcd9ff338
- SSDEEP 3072:pm3/OyVPX/1jTCAR4fsp0Vb2xosM89QJ49cqO2DDHMqqD/Tx0Hv/:pq/1VP1OyysNmJyXsqqD/ls/
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
1
Major OS version
5
Entry point
110944
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
netapi32
NetShareEnum
NetWkstaGetInfo
NetApiBufferFree
iphlpapi
GetAdaptersInfo
ws2_32
WSAGetLastError
ioctlsocket
htons
connect
socket
inet_addr
WSAStartup
select
closesocket
__WSAFDIsSet
WSACleanup
crypt32
CryptBinaryToStringA
gdiplus
GdipDeleteGraphics
GdipDeleteStringFormat
GdipDeleteFont
GdipCreateBitmapFromScan0
GdipSetStringFormatAlign
GdipSaveImageToFile
GdipGetImageEncodersSize
GdipGetImageGraphicsContext
GdipDeleteFontFamily
GdipCreateLineBrushFromRect
GdipCreateStringFormat
GdiplusStartup
GdipDisposeImage
GdipCloneBrush
GdipDrawString
GdipFree
GdipGetGenericFontFamilySansSerif
GdipFillRectangle
GdipCreateFont
GdipAlloc
GdipDeleteBrush
GdipCreateFontFamilyFromName
GdipGetImageEncoders
GdipSetStringFormatLineAlign
shlwapi
PathAddBackslashW
PathFindExtensionW
PathRemoveExtensionA
PathRemoveFileSpecW
PathRemoveBackslashW
StrFormatByteSize64A
mpr
WNetAddConnection2W
WNetOpenEnumW
WNetEnumResourceW
WNetGetConnectionW
WNetCloseEnum
ntdll
RtlEnterCriticalSection
RtlLeaveCriticalSection
RtlDeleteCriticalSection
RtlInitializeCriticalSection
NtSetInformationThread
RtlCreateUserThread
NtAdjustPrivilegesToken
NtOpenProcessToken
NtQueryInformationToken
VerSetConditionMask
RtlGetAce
NtOpenProcess
RtlQueryInformationAcl
RtlAllocateAndInitializeSid
RtlAddAce
RtlLengthSid
RtlAdjustPrivilege
RtlFreeSid
RtlAddAccessDeniedAce
RtlCreateAcl
NtSetInformationFile
RtlDosPathNameToNtPathName_U
RtlInterlockedPushEntrySList
RtlInitializeSListHead
RtlInterlockedPopEntrySList
RtlInterlockedFlushSList
RtlInitUnicodeString
NtAllocateVirtualMemory
LdrEnumerateLoadedModules
RtlAcquirePebLock
RtlReleasePebLock
msvcrt
srand
malloc
free
rand
calloc
kernel32
CreateFileW
GetFileAttributesW
GetDiskFreeSpaceExW
FindClose
WaitForMultipleObjects
GetWindowsDirectoryW
CreateIoCompletionPort
GetQueuedCompletionStatus
GetFileSizeEx
ReadFile
CreateProcessW
FindNextVolumeW
GetVolumePathNamesForVolumeNameW
FindVolumeClose
SetVolumeMountPointW
FindNextFileW
FindFirstFileExW
GetLogicalDrives
AllocConsole
GetConsoleWindow
GetProcAddress
FindFirstVolumeW
QueryDosDeviceW
WaitForSingleObject
CreateProcessA
lstrcmpiA
GetCurrentProcessId
MoveFileExW
Process32Next
CreateToolhelp32Snapshot
OpenProcess
TerminateProcess
Process32First
GetComputerNameA
VerifyVersionInfoW
GetSystemInfo
GetVersionExA
LoadLibraryA
OpenMutexA
CreateMutexA
GetTickCount
GetTempFileNameW
GetTempPathW
GetDriveTypeW
lstrcmpiW
ExitProcess
CreateThread
CloseHandle
DeleteFileW
GetLocalTime
SetConsoleCtrlHandler
SetConsoleTextAttribute
SetConsoleTitleA
WriteFile
SetConsoleMode
SetProcessShutdownParameters
SetThreadUILanguage
ExitThread
GetModuleHandleA
Sleep
GetConsoleMode
SetFileAttributesW
user32
DispatchMessageA
IsWindowVisible
DeleteMenu
wsprintfA
ShowWindow
SetWindowLongA
GetMessageA
GetWindowLongA
RegisterHotKey
RegisterClassA
DefWindowProcA
FlashWindow
CreateWindowExA
SetLayeredWindowAttributes
TranslateMessage
wsprintfW
EnableMenuItem
SetForegroundWindow
CharUpperA
GetSystemMenu
GetMessageW
SystemParametersInfoW
wvsprintfA
GetSystemMetrics
CharLowerBuffW
PeekMessageW
advapi32
OpenSCManagerA
RegCreateKeyExA
RegQueryValueExA
RegCloseKey
SetThreadToken
RegOpenKeyA
CryptReleaseContext
EqualSid
AllocateAndInitializeSid
OpenProcessToken
FreeSid
CreateProcessAsUserW
DuplicateToken
DuplicateTokenEx
GetTokenInformation
SetSecurityInfo
GetSecurityInfo
EnumDependentServicesA
CloseServiceHandle
InitializeSecurityDescriptor
CheckTokenMembership
RegSetValueExA
ControlService
RegSetValueExW
RegDeleteValueW
QueryServiceStatusEx
RegQueryValueExW
OpenServiceA
SetFileSecurityW
CryptAcquireContextW
SetSecurityDescriptorOwner
CryptGenRandom
LookupPrivilegeValueA
CreateWellKnownSid
shell32
CommandLineToArgvW
SHEmptyRecycleBinW
ShellExecuteExA
ShellExecuteExW
ole32
CoGetObject
CoUninitialize
CoInitializeEx
Name
.text
Size
123KB
Virtual Size
123KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
25KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=2, id=257, version=26126,
count=2, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=9, id=260, version=27032,
count=25, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=230, id=1, productName=Unmarked objects,
count=16, id=265, version=27032,
count=6, id=259, version=27032,
count=1, id=258, version=27032,