78670270fdaee677893b72eb053c0687455d83bcf5e4dae4591fe0b775f0b6cc[.]zip

Sharing

Copy URL

Twitter E-mail

General

Target

78670270fdaee677893b72eb053c0687455d83bcf5e4dae4591fe0b775f0b6cc.zip
Size

1.9MB
MD5

fc22daea65d09d4694c3739e505b224a
SHA1

3998ddb7760e8707be667ad99b4b0ccf50536bb9
SHA256

11031f8eeaf12b23a48675e3cbc8a3174240138de62f5cab162b31d2c4d778ac
SHA512

202ef69beb47d568bf26235971b0e83526310eb5f5a5f0f7076b69b688357133c35803e07c2f10a2472a49a052b0498a3fe49f5659d1d315f2a23c2e3f25b345
SSDEEP

49152:tTBg/2vlh/JwDe/24i8f/R+Xc9r23EbMoyUCgddkqb:tTON62Wfss2EbMCCseqb

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/78670270fdaee677893b72eb053c0687455d83bcf5e4dae4591fe0b775f0b6cc

Files

78670270fdaee677893b72eb053c0687455d83bcf5e4dae4591fe0b775f0b6cc.zip
.zip

Password: infected
78670270fdaee677893b72eb053c0687455d83bcf5e4dae4591fe0b775f0b6cc
.exe windows:6 windows x64 arch:x64

Password: infected

f81d0cd312945790cb77821773546428

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

oleaut32

SysAllocStringLen
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetUBound
SafeArrayGetLBound
SysFreeString
VariantClear
SafeArrayDestroy

kernel32

GetFileInformationByHandle
GetModuleHandleA
GetCurrentThread
GetStdHandle
GetConsoleMode
WaitForSingleObject
WriteConsoleW
WaitForSingleObjectEx
CreateMutexA
ReleaseMutex
GetEnvironmentVariableW
RtlLookupFunctionEntry
GetModuleHandleW
FormatMessageW
GetTempPathW
GetModuleFileNameW
CreateFileW
GetFileInformationByHandleEx
GetFullPathNameW
GetProcessHeap
WakeAllConditionVariable
CreateDirectoryW
FindFirstFileW
FindClose
HeapReAlloc
GetSystemInfo
SetThreadStackGuarantee
AddVectoredExceptionHandler
GetEnvironmentStringsW
FreeEnvironmentStringsW
CompareStringOrdinal
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
GetFileAttributesW
DuplicateHandle
GetCurrentProcessId
CreateNamedPipeW
CreateThread
ReadFileEx
SleepEx
WriteFileEx
GlobalAlloc
ExitProcess
QueryPerformanceCounter
QueryPerformanceFrequency
GetSystemTimeAsFileTime
GetCurrentDirectoryW
RtlCaptureContext
AcquireSRWLockShared
ReleaseSRWLockShared
SleepConditionVariableSRW
SetHandleInformation
WakeConditionVariable
PostQueuedCompletionStatus
MultiByteToWideChar
WideCharToMultiByte
GlobalSize
GlobalLock
Sleep
ReleaseSRWLockExclusive
SetFileCompletionNotificationModes
CreateIoCompletionPort
TryAcquireSRWLockExclusive
GetFinalPathNameByHandleW
SetLastError
GetQueuedCompletionStatusEx
AcquireSRWLockExclusive
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
SystemTimeToFileTime
GetTimeZoneInformation
RtlVirtualUnwind
FlushFileBuffers
GetTickCount
MapViewOfFile
CreateFileMappingW
FormatMessageA
GetSystemTime
FreeLibrary
GetFileSize
LockFileEx
LocalFree
UnlockFile
HeapDestroy
HeapCompact
LoadLibraryW
DeleteFileW
DeleteFileA
CreateFileA
FlushViewOfFile
OutputDebugStringW
GetFileAttributesExW
GetFileAttributesA
GetDiskFreeSpaceA
GetTempPathA
HeapSize
HeapValidate
UnmapViewOfFile
CreateMutexW
UnlockFileEx
SetEndOfFile
GetFullPathNameA
SetFilePointer
LockFile
OutputDebugStringA
GetDiskFreeSpaceW
WriteFile
HeapCreate
ReadFile
AreFileApisANSI
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
GetCurrentThreadId
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
SwitchToThread
IsProcessorFeaturePresent
GlobalUnlock
GetLastError
HeapAlloc
GlobalFree
FindNextFileW
GetCurrentProcess
GetProcAddress
LoadLibraryA
CloseHandle
HeapFree
InitializeSListHead
IsDebuggerPresent
SetFilePointerEx
CopyFileExW

bcrypt

BCryptGenRandom

user32

GetMonitorInfoW
EnumDisplaySettingsExW
SetClipboardData
EmptyClipboard
CloseClipboard
GetClipboardData
OpenClipboard
EnumDisplayMonitors

ws2_32

accept
recv
ioctlsocket
socket
setsockopt
send
connect
getaddrinfo
freeaddrinfo
WSAStartup
getsockopt
WSAIoctl
shutdown
closesocket
WSACleanup
WSASocketW
getsockname
WSAGetLastError
getpeername
WSASend
listen
bind

ntdll

NtDeviceIoControlFile
NtCreateFile
NtCancelIoFileEx
RtlNtStatusToDosError

crypt32

CertDuplicateStore
CertCloseStore
CertFreeCertificateContext
CertVerifyCertificateChainPolicy
CertDuplicateCertificateContext
CertFreeCertificateChain
CertOpenStore
CertDuplicateCertificateChain
CertAddCertificateContextToStore
CertEnumCertificatesInStore
CertGetCertificateChain
CryptUnprotectData

secur32

QueryContextAttributesW
FreeContextBuffer
DeleteSecurityContext
EncryptMessage
ApplyControlToken
FreeCredentialsHandle
AcceptSecurityContext
InitializeSecurityContextW
AcquireCredentialsHandleA
DecryptMessage

advapi32

AllocateAndInitializeSid
RegCloseKey
CheckTokenMembership
RegOpenKeyExW
RegQueryValueExW
SystemFunction036
FreeSid

gdi32

DeleteDC
GetDeviceCaps
CreateDCW
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
SetStretchBltMode
StretchBlt
GetDIBits
GetObjectW
DeleteObject

ole32

CoInitializeEx
CoCreateInstance
CoSetProxyBlanket
CoInitializeSecurity

vcruntime140

__C_specific_handler
__CxxFrameHandler3
memmove
memset
memcmp
memcpy
__current_exception
__current_exception_context
strrchr

api-ms-win-crt-string-l1-1-0

strncmp
strlen
strcspn
strcmp

api-ms-win-crt-utility-l1-1-0

_rotl64
qsort

api-ms-win-crt-heap-l1-1-0

_set_new_mode
free
malloc
_msize
realloc

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-math-l1-1-0

log
__setusermatherr
_dclass

api-ms-win-crt-runtime-l1-1-0

exit
__p___argc
__p___argv
_initterm_e
_endthreadex
_exit
_seh_filter_exe
terminate
_beginthreadex
_crt_atexit
_cexit
_get_initial_narrow_environment
_c_exit
_register_thread_local_exe_atexit_callback
_register_onexit_function
_initialize_onexit_table
_set_app_type
_initialize_narrow_environment
_initterm
_configure_narrow_argv

api-ms-win-crt-stdio-l1-1-0

__p__commode
_set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 2.6MB - Virtual size: 2.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 64KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

f81d0cd312945790cb77821773546428

Headers

DLL Characteristics

File Characteristics

Imports

oleaut32

kernel32

bcrypt

user32

ws2_32

ntdll

crypt32

secur32

advapi32

gdi32

ole32

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 2.6MB - Virtual size: 2.6MB

.rdata Size: 1.1MB - Virtual size: 1.1MB

.data Size: 24KB - Virtual size: 27KB

.pdata Size: 64KB - Virtual size: 64KB

.reloc Size: 26KB - Virtual size: 26KB

.text
Size: 2.6MB - Virtual size: 2.6MB

.rdata
Size: 1.1MB - Virtual size: 1.1MB

.data
Size: 24KB - Virtual size: 27KB

.pdata
Size: 64KB - Virtual size: 64KB

.reloc
Size: 26KB - Virtual size: 26KB