MDE_File_Sample_2e02c53db307be2e56d7735f1919129010592290[.]zip

Resubmissions

28/05/2024, 18:10

240528-wr8easff86 3

28/05/2024, 18:09

240528-wrfz2see21 3

Sharing

Copy URL Twitter E-mail

General

Target

MDE_File_Sample_2e02c53db307be2e56d7735f1919129010592290.zip
Size

33KB
MD5

0e6431293c283573cd2b04b9d7f71554
SHA1

541ea720ef3ffeea0c26cf9b9025545e32b44051
SHA256

d6cfa25a6e566bedc1e6b44fb5c4389d0991632f8eb9896a7c41879b79d113e8
SHA512

79ebacb5645becd5c26c15bcafe61d1da14645cf2e5feba02d86c3a96a98a047c1225b75175cc824809309b0cf5e9409a35e08ef2520f22af6ec682aa7a67e9c
SSDEEP

768:9/CgqjGFI36vpKs1vOvPeI1pBtWt728kNnOORxVXQsC7NqrHiiQ:dCdjGFI210Pv8728oFxVXfG

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/ComScan.exe

Files

MDE_File_Sample_2e02c53db307be2e56d7735f1919129010592290.zip
.zip

Password: infected
ComScan.exe
.exe windows:4 windows x86 arch:x86

Password: infected

220806a95d5fc91b58fa1a0734e3fcab

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LeaveCriticalSection
EnterCriticalSection
LoadLibraryA
FreeLibrary
LCMapStringW
LCMapStringA
GetStringTypeW
GetStringTypeA
IsBadCodePtr
InterlockedIncrement
DeleteCriticalSection
InitializeCriticalSection
GetCommandLineA
GetOEMCP
GetACP
GetCPInfo
VirtualAlloc
SetUnhandledExceptionFilter
HeapSize
HeapReAlloc
WriteFile
RtlUnwind
VirtualFree
GetCurrentThreadId
lstrcmpiA
Sleep
CreateEventA
CreateThread
WaitForSingleObject
CloseHandle
InterlockedDecrement
SetEvent
lstrlenW
GetProcAddress
GetLastError
MultiByteToWideChar
WideCharToMultiByte
LocalFree
GetModuleHandleA
GetStartupInfoA
GetVersion
ExitProcess
RaiseException
HeapFree
HeapAlloc
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate

user32

CharNextA
PostThreadMessageA
DispatchMessageA
GetMessageA

advapi32

RegCloseKey
RegCreateKeyExA
RegSetValueExA

ole32

CoInitialize
CoUninitialize

oleaut32

SysAllocString
SafeArrayLock
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayUnlock
SysStringLen
LoadRegTypeLi
SysFreeString
VariantClear

atl

ord57
ord18
ord16
ord20
ord21
ord23
ord32
ord58
ord17
ord30

Sections

.text
Size: 44KB - Virtual size: 43KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

220806a95d5fc91b58fa1a0734e3fcab

Headers

File Characteristics

Imports

kernel32

user32

advapi32

ole32

oleaut32

atl

Sections

.text Size: 44KB - Virtual size: 43KB

.rdata Size: 8KB - Virtual size: 4KB

.data Size: 12KB - Virtual size: 12KB

.rsrc Size: 8KB - Virtual size: 7KB

.text
Size: 44KB - Virtual size: 43KB

.rdata
Size: 8KB - Virtual size: 4KB

.data
Size: 12KB - Virtual size: 12KB

.rsrc
Size: 8KB - Virtual size: 7KB