cb1c506be26eb65bd7c79abc7e54d356adea2c3e0993e605e98cc39611f7add1[.]zip

General

Target
cb1c506be26eb65bd7c79abc7e54d356adea2c3e0993e605e98cc39611f7add1.zip
Size 141KB
Sample240402-l8py6sed7y
SHA256 e784b886059f077e303e48b572d98be151001e31fa09cef4264a083cd1822473
MD5 960e4664daa29f117f471631d02621e2
SHA1 cafd44899db37340da115edbfd10e2599a07605a
SHA512 ff573857ddfcc6e325e9eff2bfeee15773055d7f8da6fff59ebed855a7647bf2beef3ce790a5e52e31ba5a8647744cbc4e4d23ddcb4eff0090ded84bf3b08d7c
SSDEEP 3072:nZyTwHnYSCvIv5xN1GKYlyplW8dsBsSAOTKxJV+kNlZZdFwpnXmDzW8Am:4UHYSCv2531GXlynBSwJgkvZZdFKn2J9
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/cb1c506be26eb65bd7c79abc7e54d356adea2c3e0993e605e98cc39611f7add1.exe

File Explorer

cb1c506be26eb65bd7c79abc7e54d356adea2c3e0993e605e98cc39611f7add1.zip

.zip 141KB
cb1c506be26eb65bd7c79abc7e54d356adea2c3e0993e605e98cc39611f7add1.exe

.exe 242KB

cb1c506be26eb65bd7c79abc7e54d356adea2c3e0993e605e98cc39611f7add1.zip

SHA256 e784b886059f077e303e48b572d98be151001e31fa09cef4264a083cd1822473
MD5 960e4664daa29f117f471631d02621e2
SHA1 cafd44899db37340da115edbfd10e2599a07605a
SHA512 ff573857ddfcc6e325e9eff2bfeee15773055d7f8da6fff59ebed855a7647bf2beef3ce790a5e52e31ba5a8647744cbc4e4d23ddcb4eff0090ded84bf3b08d7c
SSDEEP 3072:nZyTwHnYSCvIv5xN1GKYlyplW8dsBsSAOTKxJV+kNlZZdFwpnXmDzW8Am:4UHYSCv2531GXlynBSwJgkvZZdFKn2J9
MD5 SHA1 SHA512 SSDEEP

Password

infected

cb1c506be26eb65bd7c79abc7e54d356adea2c3e0993e605e98cc39611f7add1.exe

IMPHASH c060277555f1b0da4ad9d7285dda191d
SHA256 cb1c506be26eb65bd7c79abc7e54d356adea2c3e0993e605e98cc39611f7add1
MD5 f5d6e5056dea42913c3191340b0a4c0b
SHA1 1d7138a2bbd768cd32a5fb1f69b2fc1f9a8c51ac
SHA512 44b7cf4fbed4b31f178a1e3bd6c444a637864292ad738fdd44e4b3eca7ce9f85b3ebe67b7119a3365c50a8e2d8913cfef142e9c8abe04e311b47a527dac401c5
SSDEEP 3072:cqgKrfAukEDcJV8hGDRUwlqahBCXEKWd+7hTS6Ks48TR+TkFKu:fftDcGGDRblqahBkW2hTS78t+TkI
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

1

Major OS version

5

Entry point

35214

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetComputerNameA CreateFileA SetDefaultCommConfigA FindFirstFileW SetLocaleInfoA WriteConsoleInputW HeapAlloc UpdateResourceA VerSetConditionMask InterlockedDecrement CreateJobObjectW GetProfileSectionA OutputDebugStringW ReadConsoleW GetCommandLineA GlobalAlloc TerminateThread GetLocaleInfoW ReadConsoleInputA SetConsoleCP GlobalFlags WritePrivateProfileStructW WriteConsoleW CreateActCtxA FindNextVolumeMountPointW GetNamedPipeHandleStateW GetCPInfoExW GetLastError GetProcAddress HeapSize PeekConsoleInputW IsValidCodePage VerLanguageNameW LoadLibraryA UnhandledExceptionFilter OpenWaitableTimerW GetConsoleScreenBufferInfo IsWow64Process BuildCommDCBAndTimeoutsW GetNumberFormatW GlobalFindAtomW GetModuleHandleA OpenFileMappingW SetProcessShutdownParameters LocalSize GetWindowsDirectoryW GlobalReAlloc ExpandEnvironmentStringsW CloseHandle SetStdHandle FlushFileBuffers WideCharToMultiByte InterlockedIncrement InterlockedCompareExchange InterlockedExchange MultiByteToWideChar GetStringTypeW EncodePointer DecodePointer Sleep InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection HeapFree HeapReAlloc GetCommandLineW HeapSetInformation GetStartupInfoW GetCPInfo RaiseException RtlUnwind LCMapStringW IsProcessorFeaturePresent GetACP GetOEMCP TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW SetLastError GetCurrentThreadId SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess HeapCreate ExitProcess WriteFile GetStdHandle GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale LoadLibraryW SetFilePointer GetConsoleCP GetConsoleMode CreateFileW

user32

CharToOemBuffW CharUpperW

Sharing