17171216515[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

17171216515.zip
Size

12.0MB
MD5

a72e8488efdac86865e0770b2eb6b435
SHA1

fac23c93520d0fcdc0f6ee86b2bc809f78fdc4b1
SHA256

c449e5499baede693f2854c24f438ba744f8ad5bd7a4fe5fc9197261d16d257d
SHA512

8d229a326dc322b4fcb577e9fe41e1d38d0cee7357e7024f5c1131722c85e06df63da660df74cee4b12c0346f5beb9cdce50be1ccc8a6b332e57ff5b5882c80f
SSDEEP

196608:1M02A9ffHFMNvanm4idxSjKBcrgVHLXrO6XdRbzNkAaPy8/NGD0IDSgPed51idQo:SI1EvGm4igqcrg5vNbDSdVd/XSHWHm

Score

3^/10

Malware Config

Signatures

Unsigned PE 4 IoCs

Checks for missing Authenticode signature.

resource
unpack002/NL7Lexicons0404.dll
unpack002/Valorant Checker by Xinax.exe
unpack002/eappcfg.dll
unpack002/filemgmt.dll

Files

17171216515.zip
.zip

Password: infected
02b44833e6fa7641ab297abd18605960dd98cab96dc31a381914010e0353971a
.rar

Password: infected
NL7Lexicons0404.dll
.dll windows:6 windows x64 arch:x64

Password: infected

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Sections

.rsrc
Size: 351KB - Virtual size: 351KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
README.txt
Valorant Checker by Xinax.exe
.exe windows:6 windows x86 arch:x86

Password: infected

8f1547238aec20c1538cc920b3bcd457

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ole32

CoGetObjectContext

kernel32

GetCPInfo
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress

Sections

.text
Size: - Virtual size: 161KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.r @
Size: - Virtual size: 5.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.v)0
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.=RX
Size: 12.0MB - Virtual size: 12.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 469B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
eappcfg.dll
.dll regsvr32 windows:6 windows x64 arch:x64

Password: infected

82dbfbea36f16764cf8570838f21e15a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

eappcfg.pdb

Imports

msvcrt

wcsrchr
_purecall
??0exception@@QEAA@AEBQEBDH@Z
memmove
__RTDynamicCast
floorf
memcmp
realloc
_errno
_onexit
_vsnwprintf
_vsnprintf
__dllonexit
_snwprintf_s
_lock
??1type_info@@UEAA@XZ
_initterm
_amsg_exit
_XcptFilter
__CxxFrameHandler3
_CxxThrowException
__C_specific_handler
memset
_wcsicmp
swprintf_s
_wcsnicmp
_wtol
_beginthreadex
wcscpy_s
??0exception@@QEAA@XZ
wcscat_s
memmove_s
??0exception@@QEAA@AEBQEBD@Z
_unlock
?what@exception@@UEBAPEBDXZ
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBV0@@Z
memcpy_s
malloc
free
wcsncpy_s
_endthreadex
memcpy

ntdll

DbgPrint
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
WinSqmAddToStream
RtlInitString
RtlNtStatusToDosError
EtwEventEnabled
EtwEventWrite
EtwTraceMessage
EtwGetTraceLoggerHandle
EtwUnregisterTraceGuids
EtwEventUnregister
EtwRegisterTraceGuidsW
EtwEventRegister
EtwGetTraceEnableFlags
EtwGetTraceEnableLevel

api-ms-win-core-synch-l1-2-0

WaitForSingleObject
EnterCriticalSection
WaitForMultipleObjectsEx
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
Sleep
InitializeCriticalSectionAndSpinCount

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW
LoadStringW
DisableThreadLibraryCalls
GetModuleFileNameW
FindResourceExW
FreeLibrary
LoadResource
LoadLibraryExW
GetModuleHandleExW
GetProcAddress
SizeofResource

api-ms-win-core-registry-l1-1-0

RegQueryValueExW
RegSetValueExW
RegCloseKey
RegEnumKeyExW
RegQueryInfoKeyW
RegOpenKeyExW
RegLoadMUIStringW
RegCreateKeyExW
RegDeleteValueW

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
WideCharToMultiByte

api-ms-win-core-errorhandling-l1-1-1

GetLastError
SetUnhandledExceptionFilter
RaiseException
UnhandledExceptionFilter

api-ms-win-core-localization-l1-2-1

FormatMessageW
SetThreadLocale
GetThreadLocale

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-processthreads-l1-1-2

GetCurrentThreadId
GetCurrentProcess
CreateThread
TerminateProcess
GetCurrentProcessId

api-ms-win-core-sysinfo-l1-2-1

GetSystemInfo
GetVersionExW
GetSystemDirectoryW
GetComputerNameExW
GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-security-credentials-l1-1-0

CredIsProtectedW
CredProtectW
CredUnprotectW

api-ms-win-core-processenvironment-l1-2-0

ExpandEnvironmentStringsW

api-ms-win-core-debug-l1-1-1

OutputDebugStringA
IsDebuggerPresent
DebugBreak

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-kernel32-legacy-l1-1-1

LoadLibraryW

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

api-ms-win-core-heap-obsolete-l1-1-0

LocalFree

api-ms-win-core-heap-l1-2-0

HeapSize
HeapFree
HeapAlloc
GetProcessHeap

api-ms-win-core-file-l1-2-1

CreateFileW

api-ms-win-core-memory-l1-1-2

MapViewOfFile
CreateFileMappingW
UnmapViewOfFile

api-ms-win-core-threadpool-legacy-l1-1-0

DeleteTimerQueueEx

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI
DelayLoadFailureHook

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
EapHostPeerConfigBlob2Xml
EapHostPeerConfigXml2Blob
EapHostPeerCreateMethodConfiguration
EapHostPeerCredentialsXml2Blob
EapHostPeerFreeErrorMemory
EapHostPeerFreeMemory
EapHostPeerGetMethodProperties
EapHostPeerGetMethods
EapHostPeerInvokeConfigUI
EapHostPeerInvokeIdentityUI
EapHostPeerInvokeInteractiveUI
EapHostPeerQueryCredentialInputFields
EapHostPeerQueryInteractiveUIInputFields
EapHostPeerQueryUIBlobFromInteractiveUIInputFields
EapHostPeerQueryUserBlobFromCredentialInputFields

Sections

.text
Size: 291KB - Virtual size: 291KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
filemgmt.dll
.dll regsvr32 windows:6 windows x64 arch:x64

Password: infected

143e831df3a27a66b8a87d012844721e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

filemgmt.pdb

Imports

mfc42u

ord665
ord832
ord2586
ord4741
ord3743
ord822
ord3774
ord867
ord3892
ord1033
ord2329
ord6614
ord6418
ord2661
ord4131
ord1498
ord6351
ord2781
ord2393
ord4860
ord2593
ord4747
ord3501
ord3806
ord912
ord4795
ord4894
ord4846
ord852
ord1035
ord4257
ord4262
ord6395
ord6385
ord2906
ord3396
ord3894
ord337
ord2326
ord4557
ord5245
ord1286
ord3761
ord1067
ord4721
ord4612
ord1043
ord3754
ord629
ord599
ord6734
ord3182
ord2801
ord1264
ord5694
ord2666
ord1787
ord3177
ord2377
ord6632
ord2324
ord4344
ord1781
ord2665
ord2379
ord2316
ord4521
ord4127
ord4601
ord3003
ord1657
ord2474
ord1082
ord288
ord812
ord1544
ord1586
ord1555
ord1583
ord1585
ord355
ord1477
ord1553
ord1416
ord1491
ord1577
ord3751
ord3535
ord5229
ord5712
ord4743
ord1778
ord6440
ord2589
ord4542
ord2023
ord2422
ord1906
ord1566
ord1499
ord1442
ord2975
ord625
ord6216
ord5585
ord5583
ord5304
ord5114
ord5352
ord4699
ord5687
ord4722
ord5246
ord5406
ord2517
ord6437
ord4365
ord1777
ord4752
ord5663
ord2399
ord5586
ord6812
ord4694
ord5709
ord4017
ord5227
ord4789
ord2670
ord2060
ord6814
ord3933
ord5484
ord1736
ord5683
ord2457
ord2140
ord5699
ord4988
ord4771
ord3868
ord4548
ord6328
ord6147
ord5584
ord6767
ord5077
ord2764
ord2328
ord2311
ord2384
ord5382
ord999
ord549
ord4582
ord2629
ord6708
ord6705
ord2371
ord6813
ord4836
ord2559
ord2515
ord6071
ord4191
ord1388
ord5615
ord2412
ord3468
ord5722
ord5724
ord4368
ord5065
ord5730
ord5711
ord6053
ord3049
ord3243
ord3362
ord4815
ord3231
ord3366
ord3052
ord3166
ord3046
ord3534
ord4082
ord4083
ord4077
ord3164
ord4371
ord4983
ord4770
ord3916
ord622
ord1426
ord2752
ord4214
ord1063
ord659
ord1562
ord1647
ord1441
ord1124
ord2856
ord6050
ord621
ord4436
ord4523
ord2676
ord1677
ord1463
ord3790
ord3830
ord286
ord1574
ord2427
ord3740
ord1284
ord5887
ord2979
ord1287
ord2846
ord4473
ord5719
ord2408
ord287
ord620
ord1122
ord3873
ord568
ord1483
ord6880
ord5950
ord1355
ord626
ord5935
ord6886
ord1126
ord1040
ord624
ord1006
ord5702
ord6887

msvcrt

__RTDynamicCast
memcpy
?terminate@@YAXXZ
_onexit
__dllonexit
_unlock
_lock
??1type_info@@UEAA@XZ
__C_specific_handler
_initterm
_amsg_exit
_XcptFilter
_CxxThrowException
_callnewh
??0exception@@QEAA@AEBQEBDH@Z
__CxxFrameHandler3
_vsnwprintf
_wtoi64
_wcsnicmp
wcschr
calloc
iswspace
wcsstr
wcsncmp
memmove
??0exception@@QEAA@XZ
memmove_s
memcpy_s
?what@exception@@UEBAPEBDXZ
_wcsicmp
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@AEBQEBD@Z
_purecall
malloc
free
??1exception@@UEAA@XZ
memset

atl

ord21
ord22
ord32
ord16
ord15
ord18

ntdll

RtlLookupFunctionEntry
RtlCaptureContext
RtlIpv6AddressToStringW
RtlIpv4AddressToStringW
RtlVirtualUnwind

advapi32

RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
InitializeSecurityDescriptor
SetSecurityDescriptorOwner
GetLengthSid
CopySid
SetSecurityDescriptorGroup
SetSecurityDescriptorDacl
InitializeAcl
AddAccessAllowedAce
EnumServicesStatusW
RegDeleteValueW
GetUserNameW
RegConnectRegistryW
IsWellKnownSid
RevertToSelf
MapGenericMask
AllocateAndInitializeSid
MakeSelfRelativeSD
FreeSid
GetSecurityDescriptorLength
GetSecurityDescriptorControl
LsaFreeMemory
LsaClose
LsaSetSystemAccessAccount
LsaGetSystemAccessAccount
LsaCreateAccount
LsaOpenAccount
GetSidSubAuthority
GetSidSubAuthorityCount
LsaLookupNames
LsaOpenPolicy

user32

CallNextHookEx
SetWindowsHookExW
UnhookWindowsHookEx
FindWindowExW
GetWindowThreadProcessId
GetDlgCtrlID
GetSystemMetrics
GetWindowRect
SetTimer
KillTimer
DispatchMessageW
TranslateMessage
PeekMessageW
MsgWaitForMultipleObjects
EnumThreadWindows
IsWindowVisible
GetDesktopWindow
GetFocus
GetWindowLongW
SetActiveWindow
SetWindowTextW
GetClientRect
ShowWindow
MessageBoxW
PostMessageW
GetParent
LoadImageW
LoadIconW
GetActiveWindow
LoadBitmapW
WinHelpW
EnableWindow
SetDlgItemTextW
EndDialog
GetWindowLongPtrW
GetDlgItemTextW
IsDlgButtonChecked
SetFocus
SetWindowLongPtrW
GetDlgItem
SendMessageW
RegisterClipboardFormatW
LoadStringW
DialogBoxParamW

gdi32

DeleteObject

cfgmgr32

CM_Connect_MachineW
CM_Disconnect_Machine
CM_Get_HW_Prof_Flags_ExW
CM_Set_HW_Prof_Flags_ExW

kernel32

SetLastError
GetProcAddress
lstrcmpiW
GetModuleHandleW
GetLastError
GetModuleFileNameW
GetCurrentThreadId
DeactivateActCtx
MultiByteToWideChar
LeaveCriticalSection
EnterCriticalSection
ActivateActCtx
FindActCtxSectionStringW
CreateActCtxW
GetModuleHandleExW
QueryActCtxW
OutputDebugStringA
GetCurrentProcess
LoadLibraryW
CloseHandle
lstrlenW
DelayLoadFailureHook
ResolveDelayLoadedAPI
CreateThread
Sleep
GetCurrentThread
InitializeCriticalSection
DeleteCriticalSection
FormatMessageW
LocalFree
GetSystemWindowsDirectoryW
GlobalLock
GlobalUnlock
ResumeThread
LocalAlloc
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetTickCount
ReleaseActCtx
CreateProcessW
GetExitCodeProcess
GetComputerNameExW
GlobalFree
GlobalAlloc
LoadLibraryExW
GetCommandLineW
FreeLibrary
CompareStringW
GetComputerNameW
WideCharToMultiByte
SetEvent
lstrcmpW
CreateEventW
DuplicateHandle
WaitForSingleObject

Exports

Exports

CacheSettingsDlg
CacheSettingsDlg2
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 324KB - Virtual size: 323KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 172KB - Virtual size: 172KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

Password: infected

Headers

DLL Characteristics

File Characteristics

Sections

.rsrc Size: 351KB - Virtual size: 351KB

Password: infected

8f1547238aec20c1538cc920b3bcd457

Headers

DLL Characteristics

File Characteristics

Imports

ole32

kernel32

Sections

.text Size: - Virtual size: 161KB

.rdata Size: - Virtual size: 59KB

.data Size: - Virtual size: 1.2MB

.r @ Size: - Virtual size: 5.9MB

.v)0 Size: 1KB - Virtual size: 1KB

.=RX Size: 12.0MB - Virtual size: 12.0MB

.reloc Size: 2KB - Virtual size: 1KB

.rsrc Size: 512B - Virtual size: 469B

Password: infected

82dbfbea36f16764cf8570838f21e15a

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

api-ms-win-core-synch-l1-2-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-localization-l1-2-1

api-ms-win-core-string-l2-1-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-handle-l1-1-0

api-ms-win-security-credentials-l1-1-0

api-ms-win-core-processenvironment-l1-2-0

api-ms-win-core-debug-l1-1-1

api-ms-win-core-profile-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-1

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-core-heap-l1-2-0

api-ms-win-core-file-l1-2-1

api-ms-win-core-memory-l1-1-2

api-ms-win-core-threadpool-legacy-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-apiquery-l1-1-0

Exports

Exports

Sections

.text Size: 291KB - Virtual size: 291KB

.data Size: 9KB - Virtual size: 12KB

.pdata Size: 10KB - Virtual size: 9KB

.idata Size: 6KB - Virtual size: 6KB

.rsrc Size: 6KB - Virtual size: 6KB

.reloc Size: 3KB - Virtual size: 2KB

Password: infected

143e831df3a27a66b8a87d012844721e

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mfc42u

msvcrt

.rsrc
Size: 351KB - Virtual size: 351KB

.text
Size: - Virtual size: 161KB

.rdata
Size: - Virtual size: 59KB

.data
Size: - Virtual size: 1.2MB

.r @
Size: - Virtual size: 5.9MB

.v)0
Size: 1KB - Virtual size: 1KB

.=RX
Size: 12.0MB - Virtual size: 12.0MB

.reloc
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 512B - Virtual size: 469B

.text
Size: 291KB - Virtual size: 291KB

.data
Size: 9KB - Virtual size: 12KB

.pdata
Size: 10KB - Virtual size: 9KB

.idata
Size: 6KB - Virtual size: 6KB

.rsrc
Size: 6KB - Virtual size: 6KB

.reloc
Size: 3KB - Virtual size: 2KB

.text
Size: 324KB - Virtual size: 323KB

.data
Size: 22KB - Virtual size: 21KB

.pdata
Size: 14KB - Virtual size: 13KB

.idata
Size: 11KB - Virtual size: 10KB

.rsrc
Size: 172KB - Virtual size: 172KB

.reloc
Size: 8KB - Virtual size: 7KB