HOSTNAME[.]ZIP | Triage™

General

Target
HOSTNAME.ZIP
Size 7KB
Sample240603-wtb4waed6z
SHA256 a532233eb5aed4ff9ae13c36670295dd60b96e9b3ca4b4c9c42771c0a15f17f8
MD5 9b00b0b5da70439b3ab9c17b5f420abd
SHA1 dd95ba3afac1c81983bc06b3189b0cd7b2445885
SHA512 d1a8f4445f0eab2ab7d3f16f7daebec261775414fa28f632b03b46d645856e9beafe34055c210632c02e96209e7b15e6e91b6c9f59b89179726b37ad424eb457
SSDEEP 192:BcyOuPwZtVhtcNqaOfPkilV7PoxuuJaC1NT10bYZyEv1T6Wa:iyxwZtVhtckhVLl8JwYsa1mWa
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/HOSTNAME.EXE

File Explorer

HOSTNAME.ZIP

.zip 7KB
HOSTNAME.EXE

.exe 36KB

HOSTNAME.ZIP

SHA256 a532233eb5aed4ff9ae13c36670295dd60b96e9b3ca4b4c9c42771c0a15f17f8
MD5 9b00b0b5da70439b3ab9c17b5f420abd
SHA1 dd95ba3afac1c81983bc06b3189b0cd7b2445885
SHA512 d1a8f4445f0eab2ab7d3f16f7daebec261775414fa28f632b03b46d645856e9beafe34055c210632c02e96209e7b15e6e91b6c9f59b89179726b37ad424eb457
SSDEEP 192:BcyOuPwZtVhtcNqaOfPkilV7PoxuuJaC1NT10bYZyEv1T6Wa:iyxwZtVhtckhVLl8JwYsa1mWa
MD5 SHA1 SHA512 SSDEEP

HOSTNAME.EXE

IMPHASH 23013edf627646ab5226d15ac880bad8
SHA256 4634e6685e402cc3cc8843589f4e8d8ac515f5f05d319e835a262b69b32bdb45
MD5 e1ea6eff1f45aa136a2a2e18eacc1f73
SHA1 eabb80f923cf33e9200149c0c576f1fcf5024935
SHA512 1d035fcc18008320ae3c40633f2b7fe8f9e22b32ad623fea747ca7905eeebccad719789ed23eb53296fafdf4be704de9b66a411e881bda968ed8cea8f1971567
SSDEEP 384:gMohQNHGboNheKedrripmFbbEPfLlswW+6W:V0bM4dHipMAHLlss
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

10

Entry point

4896

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

hostname.pdb

msvcrt

?terminate@@YAXXZ _commode _fmode __C_specific_handler _initterm __setusermatherr _cexit __set_app_type __wgetmainargs _amsg_exit _XcptFilter fwprintf fgetpos wcschr _vscwprintf _fileno _write _setmode vswprintf_s fflush _exit _wcsicmp _get_osfhandle exit __iob_func

api-ms-win-core-localization-l1-2-0

FormatMessageW SetThreadUILanguage

api-ms-win-core-processenvironment-l1-1-0

GetEnvironmentVariableW

api-ms-win-core-heap-l2-1-0

LocalFree LocalAlloc

api-ms-win-core-console-l1-1-0

GetConsoleMode

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter SetUnhandledExceptionFilter GetLastError

ws2_32

WSAStartup GetHostNameW

api-ms-win-core-heap-l1-1-0

HeapSetInformation

mswsock

GetSocketErrorMessageW

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW GetProcAddress

api-ms-win-core-string-l1-1-0

WideCharToMultiByte

api-ms-win-core-file-l1-1-0

GetFileType

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

TerminateProcess GetCurrentThreadId GetCurrentProcess GetCurrentProcessId

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime GetTickCount

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext

Sharing