MDE_File_Sample_b4979a9f970029889713d756c3f123643dde73da(1)[.]zip

Resubmissions

11/06/2024, 17:21

240611-vw5njavekn 4

11/06/2024, 17:18

240611-vvdhnavblg 3

Sharing

Copy URL Twitter E-mail

General

Target

MDE_File_Sample_b4979a9f970029889713d756c3f123643dde73da(1).zip
Size

29KB
MD5

bdc040729134051aa65e272ffc69f5c2
SHA1

315e8455a6a8f703bf0dff359df367a407a977ee
SHA256

60762b322863113b2e3552c773a60f65182e06ea6bb9e1dff646124aca24e37f
SHA512

8df2f2c93f5f3d503fc45c5f96b1f0818febb539339c0da17e17f23cd12e89be2c5d303940ff0cc9a6d214f43ff6d79018b0d29c5633bb2beeb733a6cc9c50db
SSDEEP

768:S+g/8NECKNX7Ozqk5ZXVfgg8xN8n+tVsuQxujf5gq4y:S+y8IXAp5JV4NQGsurz94y

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/b4979a9f970029889713d756c3f123643dde73da

Files

MDE_File_Sample_b4979a9f970029889713d756c3f123643dde73da(1).zip
.zip

Password: infected
b4979a9f970029889713d756c3f123643dde73da
.exe windows:10 windows x64 arch:x64

Password: infected

803254e010814e69947095a2725b2afd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

sc.pdb

Imports

msvcrt

__setusermatherr
_initterm
__C_specific_handler
_fmode
_XcptFilter
memcpy
__set_app_type
_cexit
_exit
exit
__wgetmainargs
_vsnwprintf
_amsg_exit
?terminate@@YAXXZ
wcsncmp
_wtol
_wcsnicmp
_getche
wcschr
isupper
_ultow
_tolower
_wcsicmp
_commode
memmove

rpcrt4

UuidFromStringW
UuidEqual
UuidToStringW
RpcStringFreeW
RpcBindingFree
I_RpcExceptionFilter
NdrClientCall2

api-ms-win-core-processenvironment-l1-1-0

GetStdHandle

api-ms-win-core-file-l1-1-0

WriteFile
GetFileType

api-ms-win-core-localization-l1-2-0

SetThreadUILanguage
FormatMessageW

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-core-console-l1-1-0

WriteConsoleW
GetConsoleMode

api-ms-win-core-errorhandling-l1-1-0

SetLastError
GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter

api-ms-win-security-base-l1-1-0

GetSecurityDescriptorControl

api-ms-win-core-heap-l1-1-0

HeapSetInformation

api-ms-win-core-string-l1-1-0

WideCharToMultiByte

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

ntdll

RtlCreateServiceSid
RtlInitUnicodeString
RtlAdjustPrivilege
RtlNtStatusToDosError

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Sections

.text
Size: 39KB - Virtual size: 39KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 296B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 124B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

803254e010814e69947095a2725b2afd

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

rpcrt4

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-console-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

ntdll

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Sections

.text Size: 39KB - Virtual size: 39KB

.rdata Size: 24KB - Virtual size: 24KB

.data Size: 512B - Virtual size: 3KB

.pdata Size: 1KB - Virtual size: 1KB

.didat Size: 512B - Virtual size: 296B

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 512B - Virtual size: 124B

.text
Size: 39KB - Virtual size: 39KB

.rdata
Size: 24KB - Virtual size: 24KB

.data
Size: 512B - Virtual size: 3KB

.pdata
Size: 1KB - Virtual size: 1KB

.didat
Size: 512B - Virtual size: 296B

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 512B - Virtual size: 124B