afce72cd3bc717c784962083066e3ede2b0aaadbe0908ec7360096c923774fa5[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
afce72cd3bc717c784962083066e3ede2b0aaadbe0908ec7360096c923774fa5.zip
Size 178KB
Sample240402-msnlvaga74
SHA256 48215bd9b4d020a4760a0ce57d0ba081c0cc85164813827b976b0290b99632eb
MD5 a5adfece4974db7122c0c2ccc9cf5016
SHA1 8842ef61509f999fb9731bcb70c033abae465747
SHA512 315de82beebf876016cf546dbbf04d1dd093558bcce04ca93cec069f058fce93bb67dc3461ce61c1feeadfe2cfc984332786a44016747e081587cfcaa43f0c1f
SSDEEP 3072:g7Zeo3zyLc2RAuq60uBhfZMTVW0T2RJAh90cDnDJP7/4Zqd1HspMNI8/:KZeizyL+H63BE80T2RahGqDJj/4Z6sq/
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/afce72cd3bc717c784962083066e3ede2b0aaadbe0908ec7360096c923774fa5.exe

File Explorer

afce72cd3bc717c784962083066e3ede2b0aaadbe0908ec7360096c923774fa5.zip

.zip 178KB
afce72cd3bc717c784962083066e3ede2b0aaadbe0908ec7360096c923774fa5.exe

.exe 277KB

afce72cd3bc717c784962083066e3ede2b0aaadbe0908ec7360096c923774fa5.zip

SHA256 48215bd9b4d020a4760a0ce57d0ba081c0cc85164813827b976b0290b99632eb
MD5 a5adfece4974db7122c0c2ccc9cf5016
SHA1 8842ef61509f999fb9731bcb70c033abae465747
SHA512 315de82beebf876016cf546dbbf04d1dd093558bcce04ca93cec069f058fce93bb67dc3461ce61c1feeadfe2cfc984332786a44016747e081587cfcaa43f0c1f
SSDEEP 3072:g7Zeo3zyLc2RAuq60uBhfZMTVW0T2RJAh90cDnDJP7/4Zqd1HspMNI8/:KZeizyL+H63BE80T2RahGqDJj/4Z6sq/
MD5 SHA1 SHA512 SSDEEP

Password

infected

afce72cd3bc717c784962083066e3ede2b0aaadbe0908ec7360096c923774fa5.exe

IMPHASH e381a5a93083caf35e69fd7d319ba0c4
SHA256 afce72cd3bc717c784962083066e3ede2b0aaadbe0908ec7360096c923774fa5
MD5 8dae8b6a6be6e3527183594d1c26a2d3
SHA1 b87e40cee60869a36e79c88c8a3a34baf0bc4889
SHA512 0bf065700db647efba39a13a58242a595907e6c11885575cf0bdad9e23ab40583c8a6535464e46d75d075e20d88b7a6305a761df9da787fdc8728483dd48f96e
SSDEEP 6144:GtcSsUDC2OZuhYRQqPY3x/OKV/LYZsTZgzENh+a1:TSsUO2cuhY1m/VYZsI
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

7857

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetNumaProcessorNode DebugActiveProcessStop GetConsoleAliasExesLengthA SetUnhandledExceptionFilter InterlockedIncrement WaitForSingleObject SetComputerNameW ConnectNamedPipe GetModuleHandleW GetTickCount LoadLibraryW GetLocaleInfoW GetFileAttributesA HeapCreate lstrcpynW FindNextVolumeMountPointW SetConsoleTitleA GetConsoleOutputCP GetLastError TryEnterCriticalSection GetThreadLocale GetProcAddress HeapSize GetAtomNameA CreateHardLinkW FindAtomA GlobalFindAtomW SetSystemTime GetModuleFileNameA SetConsoleTitleW HeapSetInformation GetCurrentDirectoryA SetCalendarInfoA FindAtomW CloseHandle GetLongPathNameW CreateFileA CreateFileW ReadFile FlushFileBuffers HeapReAlloc HeapAlloc GetCommandLineA GetStartupInfoW RaiseException TerminateProcess GetCurrentProcess UnhandledExceptionFilter IsDebuggerPresent DecodePointer EncodePointer HeapFree IsProcessorFeaturePresent ExitProcess WriteFile GetStdHandle GetModuleFileNameW EnterCriticalSection LeaveCriticalSection FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError GetCurrentThreadId InterlockedDecrement QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime SetFilePointer GetConsoleCP GetConsoleMode GetCPInfo GetACP GetOEMCP IsValidCodePage Sleep RtlUnwind MultiByteToWideChar SetStdHandle WriteConsoleW LCMapStringW GetStringTypeW

user32

CopyRect GetMonitorInfoW LoadIconW

advapi32

RegCreateKeyW

ole32

CoTaskMemFree

winhttp

WinHttpOpen