New WinRAR ZIP archive[.]zip | Triage

Sharing

Copy URL Twitter E-mail

General

Target

New WinRAR ZIP archive.zip
Size

176KB
MD5

248ca72114c192aec2f31672c8456701
SHA1

1d68c0b1da835ddb7cf108874a48a71bd46d0525
SHA256

3002715768e8635179b01839effafdffdca801bc58bd53b3eaaea8a70500de79
SHA512

25539624565d7a8132292988d94512e28c30fc52fc5407f81bb015472636ae44f959ec5c335387f6313327be6b4e7e61d691ec84801cb561a326529ebfc5b2db
SSDEEP

3072:Z3UDQiCwaYQrZes5RKbF2c3+4CP+4hB0cVG2lh0GEuriOL63yifxH3:JJqaryFzYlOc4UPrF6CAd3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/swoofer.exe

Files

New WinRAR ZIP archive.zip
.zip
main.bat
swoofer.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 244KB - Virtual size: 243KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 63KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.zSYR
Size: 512B - Virtual size: 134B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.null
Size: 512B - Virtual size: 276B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ