17216742149[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

17216742149.zip
Size

54KB
MD5

100c6b8acb69b04f0f102fea9b0c1b3d
SHA1

3d602837f7c3cc5260a08bbebd28c33f9c7b4402
SHA256

795bc5ddf36495f93df99020bac800e6bf63a3bbd1e89f0a23db71fd922adff7
SHA512

9e73580a0fb3dd855078b4791abe4d75ebb885b910da2b346fb0d02a9d61e840a822972e48407f796266cccba9cddfb0bf4a314deafd72cad4c050b1307eadf1
SSDEEP

1536:UKb9/9mjoWWOI7XO75qXLypNhnTWagLH7nemq1B:Ui/YlvdqXLONhnT1gLrUB

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/2e460a10a736e4977dfc6ddf91559f50de3f8e8a5a0bcf456f2cb7d145fbd88b

Files

17216742149.zip
.zip

Password: infected
2e460a10a736e4977dfc6ddf91559f50de3f8e8a5a0bcf456f2cb7d145fbd88b
.exe windows:6 windows x86 arch:x86

aba1f9877cd072e1dc094b93a8f3c0a7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\Project\DB_SIMPLE\Release\DB_SIMPLE.pdb

Imports

kernel32

MultiByteToWideChar
GetLastError
GetLocalTime
GetModuleFileNameA
CreateFileA
GetFileSize
WideCharToMultiByte
Sleep
ReadFile
FindFirstFileA
FindNextFileA
CloseHandle
SetEndOfFile
CreateFileW
LCMapStringW
HeapSize
GetStringTypeW
WriteConsoleW
SetStdHandle
HeapReAlloc
HeapFree
HeapAlloc
EnterCriticalSection
LeaveCriticalSection
GetCommandLineA
IsDebuggerPresent
IsProcessorFeaturePresent
EncodePointer
DecodePointer
GetProcessHeap
ExitProcess
GetModuleHandleExW
GetProcAddress
AreFileApisANSI
GetStdHandle
WriteFile
GetModuleFileNameW
GetFileType
DeleteCriticalSection
GetStartupInfoW
FlushFileBuffers
GetConsoleCP
GetConsoleMode
RtlUnwind
SetLastError
GetCurrentThreadId
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
SetFilePointerEx
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
LoadLibraryExW
OutputDebugStringW
ReadConsoleW

winhttp

WinHttpAddRequestHeaders
WinHttpGetProxyForUrl
WinHttpOpenRequest
WinHttpOpen
WinHttpQueryHeaders
WinHttpCloseHandle
WinHttpConnect
WinHttpSendRequest
WinHttpGetIEProxyConfigForCurrentUser
WinHttpSetOption
WinHttpReceiveResponse
WinHttpQueryOption

Sections

.text
Size: 66KB - Virtual size: 65KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

aba1f9877cd072e1dc094b93a8f3c0a7

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

winhttp

Sections

.text Size: 66KB - Virtual size: 65KB

.rdata Size: 19KB - Virtual size: 19KB

.data Size: 5KB - Virtual size: 16KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 4KB - Virtual size: 3KB

.text
Size: 66KB - Virtual size: 65KB

.rdata
Size: 19KB - Virtual size: 19KB

.data
Size: 5KB - Virtual size: 16KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 4KB - Virtual size: 3KB