16941757236[.]zip

General

Target

16941757236.zip
Size

16KB
MD5

150dbf3a108410803e9f97b9b1e2a597
SHA1

650282d16bf86185572250c1134e0e2c7fcfe01f
SHA256

1e86c9b1a92c3624e69ecaabb8abf495475f07a60e9a5449053270cfd2a78b51
SHA512

4db482e0d09fac095deb18b4769de24ac64036ddcb2d07d4ddf430a44a14bd5b16fd3e5dc5c0cde48e73cac602b1eb3466b60e2af353baee55b25be4fd65ca2d
SSDEEP

384:O6DQ1gCQUQUMqzNdgxTSxvXwoGHVTw7kyxBXgOu:OI3bUQUMq8YXwozHfvu

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/0cc54ffd005b4d3d048e72f6d66bcc1ac5a7a511ab9ecf59dc1d2ece72c69e85

Files

16941757236.zip
.zip

Password: infected
0cc54ffd005b4d3d048e72f6d66bcc1ac5a7a511ab9ecf59dc1d2ece72c69e85
.exe windows:5 windows x86 arch:x86

795ac0c8980e7eada30923a008ec96ec

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

wininet

DeleteUrlCacheEntryW

msvcr90

_adjust_fdiv
__p__commode
__p__fmode
_encode_pointer
__set_app_type
__setusermatherr
_unlock
__dllonexit
_configthreadlocale
_onexit
_decode_pointer
_except_handler4_common
_invoke_watson
_controlfp_s
_crt_debugger_hook
_initterm_e
_initterm
_acmdln
exit
_ismbblead
_XcptFilter
_exit
_cexit
__getmainargs
_amsg_exit
srand
mbstowcs
rand
strlen
?terminate@@YAXXZ
_lock

kernel32

IsDebuggerPresent
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
SetUnhandledExceptionFilter
GetStartupInfoA
InterlockedCompareExchange
InterlockedExchange
Sleep
LoadLibraryA
GetProcAddress
GetTickCount
FreeLibrary
UnhandledExceptionFilter
GetCurrentProcess

user32

wsprintfW
MessageBoxA

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 908B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 49KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 610B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

795ac0c8980e7eada30923a008ec96ec

Headers

DLL Characteristics

File Characteristics

Imports

wininet

msvcr90

kernel32

user32

Sections

.text Size: 3KB - Virtual size: 3KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 512B - Virtual size: 908B

.rsrc Size: 49KB - Virtual size: 49KB

.reloc Size: 1024B - Virtual size: 610B

.text
Size: 3KB - Virtual size: 3KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 512B - Virtual size: 908B

.rsrc
Size: 49KB - Virtual size: 49KB

.reloc
Size: 1024B - Virtual size: 610B