Oswan173[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

Oswan173.zip
Size

116KB
MD5

215ccde4ff1d9934e6ffa0b7f127e3cf
SHA1

8cecc6bd3b07dd3905cf0f72dc9a0c5ee028995c
SHA256

60870d6573bd1f2fe880007a58adb5abcdcbde1bf27d892de1f9371b8465610d
SHA512

461366985d01ce127381eb0ce2862f1d6de87f94cf927e1898d38ad25a203a95be1a7686396a80fc3ccb00779095c674a1ec21dbce05ef0c1f9663b6cdcfa366
SSDEEP

3072:tgcxAydL+JEi0w51pjJ+Pkkr7oAR90QGPoNKs:tZAy43nPDdkV6QGPo5

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Oswan.exe
unpack001/zlib.dll

Files

Oswan173.zip
.zip
Oswan.exe
.exe windows:4 windows x86 arch:x86

b8effe88d8881cfd756758408f01f073

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LCMapStringW
LCMapStringA
MultiByteToWideChar
FlushFileBuffers
RtlUnwind
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
SetEndOfFile
SetStdHandle
GetCurrentDirectoryA
GetFullPathNameA
GetOEMCP
GetACP
GetStringTypeA
WideCharToMultiByte
HeapReAlloc
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
GetVersionExA
CompareStringA
GetStdHandle
SetHandleCount
SetFilePointer
GetCurrentProcess
TerminateProcess
ExitProcess
GetVersion
GetCommandLineA
GetStartupInfoA
GetStringTypeW
GetProcAddress
GetCPInfo
LoadLibraryA
CreateFileA
GetFileType
WriteFile
ReadFile
CloseHandle
FindFirstFileA
GetDriveTypeA
FileTimeToLocalFileTime
FileTimeToSystemTime
FindClose
GetLastError
GetLocalTime
GetSystemTime
GetTimeZoneInformation
HeapFree
HeapAlloc
CompareStringW
Sleep
GetModuleFileNameA
GetModuleHandleA
GetPrivateProfileIntA
WritePrivateProfileStringA
GetPrivateProfileStringA
GetEnvironmentVariableA
SetEnvironmentVariableA

user32

GetWindowLongA
GetDlgItem
SetWindowTextA
GetFocus
SetWindowLongA
SetTimer
GetDlgCtrlID
CallWindowProcA
GetClientRect
ReleaseDC
SetDlgItemTextA
SetFocus
EndDialog
MessageBoxA
GetMenu
EnableMenuItem
KillTimer
GetDC
SendMessageA
DestroyWindow
LoadIconA
RegisterClassA
CreateWindowExA
LoadAcceleratorsA
UpdateWindow
PeekMessageA
GetMessageA
TranslateAcceleratorA
TranslateMessage
DispatchMessageA
SetForegroundWindow
PostQuitMessage
DialogBoxParamA
CreateDialogParamA
ShowWindow
DefWindowProcA
CheckMenuItem
SetWindowPos
GetWindowRect
AdjustWindowRectEx
SetMenuItemInfoA

gdi32

DeleteObject
GetDCOrgEx
GetStockObject

comdlg32

GetOpenFileNameA
GetSaveFileNameA

shell32

SHBrowseForFolderA
SHGetSpecialFolderLocation
SHGetMalloc
DragFinish
DragQueryFileA
SHGetPathFromIDListA

winmm

timeGetTime
waveOutUnprepareHeader
waveOutReset
waveOutPrepareHeader
waveOutGetErrorTextA
waveOutOpen
waveOutClose
waveOutWrite

ddraw

DirectDrawCreateEx

dinput8

DirectInput8Create

dsound

ord1

comctl32

ord6
ord17

zlib

ord62
ord64
ord67
ord68
ord72
ord66
ord65
ord61

Sections

.text
Size: 208KB - Virtual size: 206KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 32KB - Virtual size: 2.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
readme-jp.txt
zlib.dll
.dll windows:4 windows x86 arch:x86

e5c5650f0b0c0414d7e983aacdedc6c6

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

crtdll

fwrite
fread
_errno
fclose
free
vsprintf
fflush
fseek
rewind
fputc
malloc
ftell
fprintf
_fdopen
fopen
sprintf
calloc
_initterm

kernel32

GlobalAlloc
GetVersion
GlobalFree

Exports

Exports

adler32
compress
compress2
crc32
deflate
deflateCopy
deflateEnd
deflateInit2_
deflateInit_
deflateParams
deflateReset
deflateSetDictionary
get_crc_table
gzclose
gzdopen
gzeof
gzerror
gzflush
gzgetc
gzgets
gzopen
gzprintf
gzputc
gzputs
gzread
gzrewind
gzseek
gzsetparams
gztell
gzwrite
inflate
inflateEnd
inflateInit2_
inflateInit_
inflateReset
inflateSetDictionary
inflateSync
inflateSyncPoint
uncompress
unzClose
unzCloseCurrentFile
unzGetCurrentFileInfo
unzGetGlobalComment
unzGetGlobalInfo
unzGetLocalExtrafield
unzGoToFirstFile
unzGoToNextFile
unzLocateFile
unzOpen
unzOpen2
unzOpenCurrentFile
unzOpenCurrentFile2
unzReadCurrentFile
unzStringFileNameCompare
unzeof
unztell
zError
zipClose
zipCloseFileInZip
zipCloseFileInZipRaw
zipOpen
zipOpenNewFileInZip
zipOpenNewFileInZip2
zipWriteInFileInZip
zlibVersion

Sections

.text
Size: 38KB - Virtual size: 37KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 880B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 692B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b8effe88d8881cfd756758408f01f073

Headers

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

shell32

winmm

ddraw

dinput8

dsound

comctl32

zlib

Sections

.text Size: 208KB - Virtual size: 206KB

.rdata Size: 8KB - Virtual size: 6KB

.data Size: 32KB - Virtual size: 2.9MB

.rsrc Size: 28KB - Virtual size: 25KB

e5c5650f0b0c0414d7e983aacdedc6c6

Headers

File Characteristics

Imports

crtdll

kernel32

Exports

Exports

Sections

.text Size: 38KB - Virtual size: 37KB

.rdata Size: 6KB - Virtual size: 6KB

.data Size: 4KB - Virtual size: 5KB

.rsrc Size: 1024B - Virtual size: 880B

.reloc Size: 1024B - Virtual size: 692B

.text
Size: 208KB - Virtual size: 206KB

.rdata
Size: 8KB - Virtual size: 6KB

.data
Size: 32KB - Virtual size: 2.9MB

.rsrc
Size: 28KB - Virtual size: 25KB

.text
Size: 38KB - Virtual size: 37KB

.rdata
Size: 6KB - Virtual size: 6KB

.data
Size: 4KB - Virtual size: 5KB

.rsrc
Size: 1024B - Virtual size: 880B

.reloc
Size: 1024B - Virtual size: 692B