s[.]zip[.]zip | Triage

Sharing

General

Target

s.zip.zip
Size

109KB
MD5

f38428e8ba0c4d1c0c7a5d0cfa78c25c
SHA1

3ad008936d12e4aab3cb8481ed6898d98f03ab97
SHA256

fed94556d81622a39c4bfbaf39fa11dcab6a9b63fc487e037ccb1771f92ea894
SHA512

b43a91ff8680bea849987a6969da41155f4ea3efc8d57d7592135a2c48b874203e8a21053d4607487e6a523d72926c5bca8c569951a3308802b3a743a4dd48d6
SSDEEP

3072:7X21vskWriCiMb8UA0gRP8DuRCWxfGxOskz5PQokcQV0T:7X2Bsk28Y8UA08OuTxexOgL2T

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack003/hey/superstring.dll

Files

s.zip.zip
.zip

Password: infected
s.zip
.zip

Password: infected
db7cd6d0f75ddf78e0e6e09119d9071df07b50ef3f5289d474921adba4f35047.iso
.iso
Document.lnk
.lnk
hey/superstring.dll
.dll .js windows:6 windows x64 arch:x64 polyglot

a52e5c67083c9a6469ce9283f8b67c82

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

WaitForSingleObjectEx
CreateEventW
OpenEventW
VirtualAlloc
CloseHandle

usp10

ScriptStringGetOrder
ScriptGetFontAlternateGlyphs

ole32

OleQueryCreateFromData
OleTranslateAccelerator
StgCreatePropStg

Exports

Exports

MMdIfEzjTRTMf
PrPLlcFIDhjM
RbijOueUefJVZaM
TDvVBhCTzraQ
TdPDbFrAWSPdEKqZ
VRLfArwvMiEFiGx
VTRItTHWuSOqXxqr
VgxXOnyXxBAJK
fuadsyguasgduhaisudjyuagsdua
iasfsgpELrVmJ
kRNIciuuPyv
qWsGwsFPXXwN
rmrKKkuldHY
vMjDGnbaECjI
wPSEHNPbjettJ

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 721KB - Virtual size: 720KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1024B - Virtual size: 534B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.grHx
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
hey/twelfth.bat