File-HOTEL[.]BUSINESS[.]SIMULATOR-902716[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

File-HOTEL.BUSINESS.SIMULATOR-902716.zip
Size

19.6MB
MD5

81b45c197efb332edf07dd0535716ef3
SHA1

444a5d195d66c7f747881ca7c6656230a8c80e70
SHA256

c513b8f5a48e667e3dfb5114692748e8ac704cbb3f3f48935b0287db143dbbd4
SHA512

983eaaa87ec6ce377a26d29977667cf134afa5bfa0466c5ba985a9c50bb355ce1c309a823493e151690f1b7a9735b265171eea8a9c8bcf9157b7eb8a297caa33
SSDEEP

393216:ADsIrII4QIBkWbx7EvcXcrO/Hosi1KACbeBmcouPbMOQfkaFoVMLwvn4+NnC:uN0aIRbx72cGMZFAsIQJkaFoVMyn4+NC

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Setupprogram_01234.exe

Files

File-HOTEL.BUSINESS.SIMULATOR-902716.zip
.zip
Setupprogram_01234.exe
.exe windows:6 windows x86 arch:x86

9acb9c28ef53ff89bf9c2e4f4f75a7e6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

DeleteFileW
GetModuleHandleExW
VirtualProtect
MoveFileW
SetUnhandledExceptionFilter
GlobalFree
TryEnterCriticalSection
EncodePointer
GetNumaHighestNodeNumber
GetFullPathNameW
LCMapStringW
CreateTimerQueueTimer
SetFileTime
GetSystemTimeAsFileTime
GetThreadPriority
QueryDepthSList
WaitForMultipleObjects
GetTimeZoneInformation
GetProcAddress
AcquireSRWLockExclusive
GetLogicalDriveStringsW
MultiByteToWideChar
CompareFileTime
GetCommandLineW
FindFirstFileExW
FreeLibraryAndExitThread
ReleaseSemaphore
GetTickCount
HeapFree
GetLocaleInfoW
GetTimeFormatW
SetFilePointerEx
EnumSystemLocalesW
lstrcatA
HeapSize
IsValidLocale
GetFileInformationByHandle
CreateTimerQueue
UnhandledExceptionFilter
WriteConsoleW
TlsFree
ChangeTimerQueueTimer
InitializeSListHead
CreateEventW
LocalFree
Sleep
GlobalMemoryStatus
GetProcessAffinityMask
IsValidCodePage
LeaveCriticalSection
VerSetConditionMask
SetPriorityClass
GetFileAttributesExW
GetConsoleOutputCP
GlobalAlloc
GetStartupInfoW
GetCurrentProcess
GetEnvironmentVariableA
GetUserDefaultLCID
GetSystemDirectoryW
SetEvent
VerifyVersionInfoW
IsProcessorFeaturePresent
VirtualAlloc
SetEnvironmentVariableW
SignalObjectAndWait
GetSystemInfo
GetOEMCP
GetThreadTimes
GetFileSize
FlushFileBuffers
LoadLibraryExW
GetCurrentThread
DuplicateHandle
FormatMessageW
GlobalLock
FindFirstFileW
WaitForSingleObjectEx
WaitForSingleObject
TlsSetValue
InterlockedFlushSList
GetVersion
GetModuleHandleA
SystemTimeToTzSpecificLocalTime
InterlockedPopEntrySList
GetProcessHeap
GetCurrentThreadId
GetACP
GetLastError
VirtualFree
SetLastError
GetDriveTypeW
GetFileType
CreateThread
SetFileAttributesW
GetLogicalProcessorInformation
GetCurrentDirectoryW
GetModuleHandleW
ExitThread
PeekNamedPipe
GetEnvironmentStringsW
WriteFile
SetThreadAffinityMask
EnterCriticalSection
DecodePointer
GetCPInfo
TlsAlloc
CreateFileW
DeleteTimerQueueTimer
ReadConsoleW
WideCharToMultiByte
UnregisterWaitEx
LoadLibraryW
ReadFile
SetStdHandle
CreateSemaphoreW
SetFilePointer
InitializeCriticalSection
GetCurrentProcessId
ResetEvent
RemoveDirectoryW
FindNextFileW
FileTimeToLocalFileTime
FreeLibrary
QueryPerformanceFrequency
GetFileSizeEx
FileTimeToSystemTime
GetStdHandle
GetCommandLineA
SwitchToThread
SleepEx
DeleteCriticalSection
TerminateProcess
InitializeCriticalSectionEx
GetStringTypeW
GlobalUnlock
CreateDirectoryW
IsDebuggerPresent
GetVersionExW
RegisterWaitForSingleObject
ReleaseSRWLockExclusive
RtlUnwind
MoveFileExW
RaiseException
FreeEnvironmentStringsW
CompareStringW
GetDateFormatW
SetEndOfFile
TlsGetValue
FindClose
SetThreadPriority
InterlockedPushEntrySList
ExitProcess
lstrlenA
InitializeCriticalSectionAndSpinCount
HeapReAlloc
GetTickCount64
UnregisterWait
GetConsoleMode
GetFileAttributesW
QueryPerformanceCounter
CloseHandle
GetModuleFileNameW
HeapAlloc

user32

SetFocus
MessageBoxW
EndDialog
CharUpperW
GetKeyState
SetTimer
SetDlgItemTextW
MapDialogRect
SetClipboardData
PostMessageW
DialogBoxParamW
MonitorFromWindow
SystemParametersInfoW
GetMonitorInfoA
CheckDlgButton
KillTimer
LoadCursorW
GetWindowLongW
GetWindowTextW
SendMessageW
InvalidateRect
SetWindowLongW
IsDlgButtonChecked
SetCursor
GetFocus
GetWindowRect
SetWindowTextW
ShowWindow
OpenClipboard
CloseClipboard
GetDlgItem
LoadIconW
MoveWindow
ScreenToClient
GetWindowTextLengthW
EnableWindow
MessageBoxA
EmptyClipboard
GetParent
LoadStringW
wsprintfA

advapi32

CryptReleaseContext
CryptAcquireContextW
CryptDestroyKey
CloseServiceHandle
CryptHashData
CryptCreateHash
CryptEncrypt
CryptDestroyHash
CryptGetHashParam
CryptImportKey

shell32

SHGetSpecialFolderPathW
SHBrowseForFolderW
SHGetPathFromIDListW
SHGetFileInfoW

ole32

CoUninitialize
OleInitialize
CoInitialize
CoCreateInstance
CoTaskMemFree

oleaut32

SysAllocString
SysFreeString
VariantClear
SysAllocStringLen
SysStringLen

bcrypt

BCryptGenRandom

crypt32

CertFreeCertificateChain
CertCloseStore
CertFreeCertificateChainEngine
CryptQueryObject
CertOpenStore
CertFindExtension
CertFreeCertificateContext
CertGetNameStringW
PFXImportCertStore
CertAddCertificateContextToStore
CertFindCertificateInStore
CryptDecodeObjectEx
CertGetCertificateChain
CertCreateCertificateChainEngine
CertEnumCertificatesInStore
CryptStringToBinaryW

wldap32

ord73
ord301
ord147
ord133
ord79
ord142
ord167
ord127
ord145
ord219
ord46
ord14
ord216
ord208
ord41
ord117
ord26
ord27

ws2_32

recvfrom
sendto
getpeername
ioctlsocket
gethostname
WSACreateEvent
WSAIoctl
getsockopt
send
WSAEventSelect
freeaddrinfo
WSAWaitForMultipleEvents
socket
WSAResetEvent
WSAEnumNetworkEvents
closesocket
WSAGetLastError
ntohs
WSASetLastError
WSAStartup
WSACleanup
htons
setsockopt
getaddrinfo
__WSAFDIsSet
select
accept
bind
connect
getsockname
htonl
listen
recv
WSACloseEvent

Sections

.text
Size: 6.6MB - Virtual size: 6.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 275KB - Virtual size: 274KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 96KB - Virtual size: 95KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9acb9c28ef53ff89bf9c2e4f4f75a7e6

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

bcrypt

crypt32

wldap32

ws2_32

Sections

.text Size: 6.6MB - Virtual size: 6.6MB

.rdata Size: 275KB - Virtual size: 274KB

.data Size: 13KB - Virtual size: 34KB

.gfids Size: 3KB - Virtual size: 2KB

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 9KB - Virtual size: 9KB

.reloc Size: 96KB - Virtual size: 95KB

.text
Size: 6.6MB - Virtual size: 6.6MB

.rdata
Size: 275KB - Virtual size: 274KB

.data
Size: 13KB - Virtual size: 34KB

.gfids
Size: 3KB - Virtual size: 2KB

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 9KB - Virtual size: 9KB

.reloc
Size: 96KB - Virtual size: 95KB