sample_07[.]zip | Triage

Sharing

Copy URL Twitter E-mail

General

Target

sample_07.zip
Size

9KB
MD5

ac7a1427d195b0992e92fa72d8747834
SHA1

829db5202bc468edc24f95fc3f30787bc71986df
SHA256

d67e84b800e694c761eeae8df95fb47b1890d3bd095cec870d03429040f3f5cf
SHA512

b223eba61b03513ffe719734ad066472ea346c1ff4afbdaa686d82224329471cf65e79cd6f76d6206ea77243295a99dab1d6c090d6f203c0c995576032e6f1bc
SSDEEP

192:HxbWUFgKlMCArq0tng+wcGYRZFxaOjndk5ill8Yftv/12/ja:RiUyKlMfr7tgfux/y5q8YFM/m

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/sample_07/sample_07.dne

Files

sample_07.zip
.zip

Password: malware
sample_07/sample_07.dne
.exe windows:4 windows x86 arch:x86

Password: malware

058dc95f89656af78e1cde9d00861259

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

CloseHandle
CreateProcessA
ExitProcess
GetEnvironmentVariableA
GetModuleFileNameA
GetShortPathNameA
GetThreadContext
ReadProcessMemory
ResumeThread
SetThreadContext
VirtualAllocEx
WriteProcessMemory
lstrcatA
lstrcpyA

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 512B - Virtual size: 508B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE