9923[.]png[.]zip | Triage™

General

Target
9923.png.zip
Size 452KB
Sample240306-thkwjaca68
SHA256 a519b9d032a342985bfe1fa3f1244f1db6699805d7883139a8245eba1c2e5dab
MD5 4c94707bdcf5c18307c69c9c6fe7a536
SHA1 699045992aa12571dd608717c6f2987e3d01f22f
SHA512 b835b91aca8f11a7df5f6c6c9fa88a21d42ea8ffd75c2175ba4f1c1071b14c083b1a3921a7c73e03fb1999d99f9cc70e10edd4d4a3baffe16aa8b0f86a68fb5d
SSDEEP 12288:EG3UIUv5oi4tMgXq8URMZ4nTzQYAeF/ofpdCqax4bzy4kba:E6i4Z81nTzlVofpdCNoBt
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/9923.png

File Explorer

9923.png.zip

.zip 452KB
9923.png

.dll 840KB

9923.png.zip

SHA256 a519b9d032a342985bfe1fa3f1244f1db6699805d7883139a8245eba1c2e5dab
MD5 4c94707bdcf5c18307c69c9c6fe7a536
SHA1 699045992aa12571dd608717c6f2987e3d01f22f
SHA512 b835b91aca8f11a7df5f6c6c9fa88a21d42ea8ffd75c2175ba4f1c1071b14c083b1a3921a7c73e03fb1999d99f9cc70e10edd4d4a3baffe16aa8b0f86a68fb5d
SSDEEP 12288:EG3UIUv5oi4tMgXq8URMZ4nTzQYAeF/ofpdCqax4bzy4kba:E6i4Z81nTzlVofpdCNoBt
MD5 SHA1 SHA512 SSDEEP

Password

infected

9923.png

IMPHASH 55f1ba0b782341fa929d61651ef47f0c
SHA256 28d318a64d06bd5c86c11002be6805ebd114600b2f1e28f136924668b915e77b
MD5 f6da6e194c429fe815f7d592688f3009
SHA1 6df03d98320c3877567a05efa94c52f828269e21
SHA512 20e73161b2615b207c1c61360db9283cb9aec8a1295ce03f1b34976a13ba3b6e992337ac6e39d51789eadeec8d7db322abc494e667f4f9f2c3f3a3642c9fd91c
SSDEEP 24576:ee9nfmpSVmL+Cf72yb1SFEtEfPmY4uRD7HpUMhOw8ghE:dBmpSVmLfCDfPJ4cDFPhmghE
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

Infected

Minor OS version

0

Major OS version

6

Entry point

189353

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

E:\Jenkins\workspace\Osprey\Osprey_5.01\output\app\symbol\Win32\Release\TmopphDns.pdb

kernel32

WideCharToMultiByte CreateDirectoryA Sleep LocalFree LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection WriteConsoleW GetProcAddress ResetEvent CloseHandle LoadLibraryA SetEvent GetLastError MultiByteToWideChar OpenEventW GetModuleFileNameW GetShortPathNameW SetLastError OpenEventA GetModuleFileNameA GetShortPathNameA EnterCriticalSection GetVersionExA HeapSize GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW FormatMessageW InitializeCriticalSectionAndSpinCount CreateEventW SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetTickCount GetModuleHandleW EncodePointer DecodePointer CompareStringW LCMapStringW GetLocaleInfoW GetStringTypeW GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId InitializeSListHead RtlUnwind RaiseException InterlockedPushEntrySList InterlockedFlushSList FreeLibrary LoadLibraryExW CreateFileW GetFileType ExitProcess GetModuleHandleExW HeapAlloc HeapFree GetDateFormatW GetTimeFormatW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetStdHandle GetCurrentThread GetFileAttributesExW WriteFile GetConsoleCP GetConsoleMode SetStdHandle SetEndOfFile ReadFile ReadConsoleW SetFilePointerEx GetFileSizeEx FlushFileBuffers DeleteFileW HeapReAlloc SetConsoleCtrlHandler GetTimeZoneInformation FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW OutputDebugStringW

advapi32

GetTraceLoggerHandle GetTraceEnableFlags GetTraceEnableLevel UnregisterTraceGuids RegisterTraceGuidsA GetSecurityDescriptorSacl SetEntriesInAclA GetSecurityDescriptorDacl SetNamedSecurityInfoA ConvertStringSecurityDescriptorToSecurityDescriptorA TraceMessage GetNamedSecurityInfoA SetSecurityInfo ConvertStringSidToSidA ConvertStringSecurityDescriptorToSecurityDescriptorW

shell32

SHGetFolderPathW

ole32

CoTaskMemFree

Sharing