Trololo[.]zip | Triage

Resubmissions

11-03-2024 12:49

240311-p2e26sfc44 8

11-03-2024 12:46

240311-pz318afb99 8

Sharing

General

Target

Trololo.zip
Size

2.1MB
MD5

0d6fc3ace016c93aee727de88e129563
SHA1

b7ff775554b565c2412209bb13a6bb101f91b269
SHA256

0475c528402646e56df92200386b7aaedec2208eb03f8ddcfff64efa16b750fa
SHA512

537e971007965187fa25c9051f61f92061cf9fb9dd50208958e75e687e493ac5df2c30073d2cf632b5c7c59e0c7dc4a77984e740e3eb0007f8e515656d6168e5
SSDEEP

49152:l3Jo4JXTWy6kRoedelfDs9qPX7IdDeNLILjGCCd8DVwS0pB7Q:o4J7aedAXwDuELjGCCdWT0TQ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/[email protected]

Files

Trololo.zip
.zip

Password: mysubsarethebest
[email protected]
.exe windows:4 windows x86 arch:x86

Password: mysubsarethebest

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Users\Alexander\Documents\Visual Studio 2008\Projects\Virus\Virus\obj\Release\Virus.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 3.0MB - Virtual size: 3.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.sdata
Size: 512B - Virtual size: 143B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ