f5cc8cf85e25f8ef42232c5597607836ee2f0d3b720aaf0ed840141bdc705378[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

f5cc8cf85e25f8ef42232c5597607836ee2f0d3b720aaf0ed840141bdc705378.zip
Size

13.6MB
MD5

cc0e09a43841236a9b1fc62e73f2130b
SHA1

1d22ecc94263d2963b6e7dd59a9060a2927f11fd
SHA256

ae79f6d040662480beb526a3076ca3e293c4ff7a4f609dbb9c7bc43d8301f590
SHA512

390ebbfd6740903fc7f529c8de71ec707dfc304d2d2f094537629c4558b736ef0838899b8834f194e6f12fd10f4b513361cb0b9a8dab38886f3fb1f68b28e933
SSDEEP

196608:7Cr5kuOKJbNW2DGuE6dQXs0PpquwkWNZ++YkqV93IFcpLlGM0+uY3w5u0v2YGEk+:7Cr5kGvoJVoguu4FElGR+r3w9ZUVRS

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/f5cc8cf85e25f8ef42232c5597607836ee2f0d3b720aaf0ed840141bdc705378

Files

f5cc8cf85e25f8ef42232c5597607836ee2f0d3b720aaf0ed840141bdc705378.zip
.zip

Password: infected
f5cc8cf85e25f8ef42232c5597607836ee2f0d3b720aaf0ed840141bdc705378
.exe windows:6 windows x64 arch:x64

Password: infected

b715fdf3ae865e52714d83057bd2c5bc

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

sas

SendSAS

newdev

UpdateDriverForPlugAndPlayDevicesW

wtsapi32

WTSFreeMemory
WTSQuerySessionInformationW
WTSEnumerateSessionsA

kernel32

WaitForSingleObject
ReleaseSemaphore
lstrlenW
FormatMessageW
TryAcquireSRWLockExclusive
QueryPerformanceFrequency
FindClose
VerSetConditionMask
VerifyVersionInfoW
GetCurrentThread
RtlCaptureContext
GetLogicalDrives
SetFileTime
CreateFileW
GetConsoleMode
SetConsoleMode
GetStdHandle
GetSystemInfo
WakeAllConditionVariable
SetFilePointerEx
GetFileType
GetFileInformationByHandleEx
SleepConditionVariableSRW
UnmapViewOfFile
GetExitCodeProcess
LocalFree
PostQueuedCompletionStatus
LocalAlloc
ProcessIdToSessionId
ConnectNamedPipe
FlushFileBuffers
OpenProcess
DeviceIoControl
GetModuleHandleExA
GetCurrentThreadId
GetNativeSystemInfo
TerminateProcess
WTSGetActiveConsoleSessionId
VirtualAllocEx
WriteProcessMemory
GetModuleHandleA
QueueUserAPC
ResumeThread
SetThreadExecutionState
CopyFileExW
GlobalLock
GlobalSize
GlobalUnlock
MultiByteToWideChar
GlobalAlloc
GlobalFree
GetUserPreferredUILanguages
GetModuleHandleW
CreateSemaphoreA
SetConsoleCtrlHandler
GlobalMemoryStatusEx
K32GetPerformanceInfo
SetHandleInformation
GetQueuedCompletionStatusEx
SetLastError
GetFinalPathNameByHandleW
ReadFile
GetOverlappedResult
WriteFile
CancelIoEx
CreateIoCompletionPort
SetFileCompletionNotificationModes
LoadLibraryW
GetLogicalProcessorInformation
CreateNamedPipeW
WakeConditionVariable
FreeLibrary
LoadLibraryExA
CreateFileMappingW
OpenFileMappingW
MapViewOfFile
WriteConsoleW
GetCurrentDirectoryW
GetEnvironmentVariableW
SetEnvironmentVariableW
GetTempPathW
SetWaitableTimer
GetCommandLineW
SetFileInformationByHandle
GetFileInformationByHandle
GetFullPathNameW
FindNextFileW
CreateDirectoryW
FindFirstFileW
ReadFileEx
SleepEx
GetEnvironmentStringsW
FreeEnvironmentStringsW
CompareStringOrdinal
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
GetFileAttributesW
DuplicateHandle
InitializeProcThreadAttributeList
UpdateProcThreadAttribute
DeleteProcThreadAttributeList
CreateThread
WriteFileEx
WaitForMultipleObjects
CreateEventW
CancelIo
ExitProcess
GetSystemTimeAsFileTime
GetProcessHeap
HeapAlloc
RtlVirtualUnwind
DeleteFileW
MoveFileExW
RemoveDirectoryW
CreateSymbolicLinkW
GetTickCount64
GetProcessTimes
ReadProcessMemory
VirtualQueryEx
GetSystemTimes
GetProcessIoCounters
SetErrorMode
SetThreadErrorMode
GetComputerNameExW
VirtualQuery
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetFileSize
GetFileTime
SetFilePointer
ResetEvent
InitializeCriticalSectionEx
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeConditionVariable
InitOnceBeginInitialize
InitOnceComplete
SleepConditionVariableCS
SetThreadPriority
CreateSemaphoreW
TryEnterCriticalSection
InitializeCriticalSection
SetUnhandledExceptionFilter
FindFirstFileExW
OutputDebugStringW
ReadConsoleW
GetFileSizeEx
GetConsoleCP
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetCommandLineA
Sleep
CreateWaitableTimerExW
WaitForMultipleObjectsEx
QueryPerformanceCounter
SetEvent
SwitchToThread
CreateEventA
ReleaseSRWLockExclusive
SystemTimeToTzSpecificLocalTime
SystemTimeToFileTime
TzSpecificLocalTimeToSystemTime
RtlLookupFunctionEntry
ReleaseMutex
GetCurrentProcess
GetProcAddress
CreateMutexA
GetCurrentProcessId
LoadLibraryA
WaitForSingleObjectEx
AcquireSRWLockExclusive
HeapReAlloc
GetLastError
SetThreadStackGuarantee
AddVectoredExceptionHandler
ReleaseSRWLockShared
AcquireSRWLockShared
HeapFree
CloseHandle
IsValidCodePage
GetACP
GetOEMCP
SetStdHandle
HeapSize
SetEndOfFile
GetModuleFileNameW
RtlUnwind
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
LoadLibraryExW
RaiseException
RtlPcToFileHeader
RtlUnwindEx
GetCPInfo
GetLocaleInfoW
LCMapStringW
CompareStringW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
DecodePointer
EncodePointer
GetStringTypeW
WideCharToMultiByte
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
IsProcessorFeaturePresent
UnhandledExceptionFilter

secur32

AcquireCredentialsHandleA
DecryptMessage
QueryContextAttributesW
DeleteSecurityContext
FreeCredentialsHandle
InitializeSecurityContextW
FreeContextBuffer
AcceptSecurityContext
EncryptMessage
ApplyControlToken

advapi32

CreateProcessWithTokenW
ImpersonateLoggedOnUser
DuplicateTokenEx
RegDeleteKeyW
QueryServiceStatusEx
OpenServiceW
OpenSCManagerW
CloseServiceHandle
LookupAccountSidW
EqualSid
RegEnumValueW
AdjustTokenPrivileges
LookupPrivilegeValueW
CopySid
GetLengthSid
IsValidSid
CreateProcessWithLogonW
CreateProcessAsUserW
RegEnumKeyExW
RegSetValueExW
GetTokenInformation
OpenProcessToken
RegDeleteTreeW
GetUserNameW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
SetSecurityDescriptorDacl
FreeSid
AllocateAndInitializeSid
SetEntriesInAclW
InitializeSecurityDescriptor
SetServiceStatus
RegisterServiceCtrlHandlerExW
StartServiceCtrlDispatcherW
SystemFunction036

api-ms-win-shcore-scaling-l1-1-1

SetProcessDpiAwareness

ole32

OleSetClipboard
OleGetClipboard
CoTaskMemFree
OleIsCurrentClipboard
CoInitializeEx
OleInitialize
PropVariantClear
OleUninitialize
CoTaskMemAlloc
CoUninitialize
ReleaseStgMedium
CoCreateInstance

user32

GetClientRect
MapWindowPoints
OffsetRect
GetWindowDC
MessageBoxW
AppendMenuW
CreateAcceleratorTableW
DrawIconEx
SetMenuItemInfoW
ClientToScreen
SetForegroundWindow
TrackPopupMenu
MonitorFromWindow
IsProcessDPIAware
DestroyAcceleratorTable
PostQuitMessage
AttachThreadInput
GetKeyboardState
ToUnicodeEx
CheckMenuItem
MsgWaitForMultipleObjectsEx
DestroyMenu
RemoveMenu
DrawMenuBar
SetMenu
SendMessageW
SetWindowPos
AdjustWindowRectEx
GetMenu
GetWindowLongW
SetWindowTextW
ShowWindow
GetMessageW
InvalidateRgn
DestroyIcon
GetUpdateRect
MapVirtualKeyW
PostThreadMessageW
PostMessageW
PeekMessageW
ValidateRect
GetRawInputData
ExitWindowsEx
RegisterWindowMessageA
RegisterClassExW
DefWindowProcW
TranslateMessage
DispatchMessageW
OpenClipboard
RedrawWindow
DestroyWindow
RegisterClassW
CreatePopupMenu
CreateMenu
OpenInputDesktop
SetThreadDesktop
CloseDesktop
GetThreadDesktop
GetUserObjectInformationA
PeekMessageA
SendMessageA
PostMessageA
GetAsyncKeyState
RegisterRawInputDevices
CreateIcon
SystemParametersInfoA
wsprintfW
GetClipboardOwner
SetClipboardViewer
ChangeClipboardChain
RegisterClipboardFormatA
RegisterClipboardFormatW
CountClipboardFormats
GetClipboardFormatNameA
SetWindowLongPtrW
CreateWindowExW
SetClipboardData
EmptyClipboard
CloseClipboard
GetClipboardData
IsClipboardFormatAvailable
ReleaseDC
GetDC
GetIconInfo
GetMenuBarInfo
GetWindowRect
FindWindowA
CallNextHookEx
UnhookWindowsHookEx
DispatchMessageA
GetMessageA
SetWindowsHookExA
EnumDisplaySettingsExW
PostThreadMessageA
EnumDisplayDevicesW
FindWindowExA
CreateWindowExA
RegisterClassExA
LoadCursorA
DefWindowProcA
ChangeDisplaySettingsExW
SystemParametersInfoW
EnumDisplaySettingsW
GetCursorInfo
LockWorkStation
GetSystemMetrics
GetCursorPos
BlockInput
GetKeyState
VkKeyScanExW
MapVirtualKeyExW
GetKeyboardLayout
GetWindowThreadProcessId
GetForegroundWindow
SendInput
GetMenuItemInfoW

iphlpapi

GetAdaptersAddresses
SendARP

shell32

CommandLineToArgvW
Shell_NotifyIconGetRect
SHGetKnownFolderPath
SHAddToRecentDocs
ShellExecuteW
Shell_NotifyIconW
ShellExecuteA
ShellExecuteExW

pdh

PdhGetFormattedCounterValue
PdhRemoveCounter
PdhCloseQuery
PdhAddEnglishCounterW
PdhCollectQueryData
PdhAddEnglishCounterA
PdhCollectQueryDataEx
PdhOpenQueryA

ws2_32

getpeername
recvfrom
getsockname
WSACleanup
WSAStartup
freeaddrinfo
getaddrinfo
send
WSASend
setsockopt
recv
WSAIoctl
socket
sendto
accept
listen
getsockopt
shutdown
WSAGetLastError
connect
WSASocketW
closesocket
bind
ioctlsocket

bcrypt

BCryptGenRandom

gdi32

CreateCompatibleBitmap
DeleteObject
GetDeviceCaps
CreateDCW
DeleteDC
BitBlt
CreateDIBSection
GetObjectA
GetBitmapBits
GetDIBits
CreateCompatibleDC
SelectObject

setupapi

SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInterfaceDetailW
SetupDiDestroyDeviceInfoList
SetupDiSetClassInstallParamsW
SetupDiGetClassDevsExW
SetupDiGetDeviceInfoListDetailW
SetupDiEnumDeviceInfo
SetupDiCallClassInstaller
SetupDiSetDeviceRegistryPropertyW
SetupDiCreateDeviceInfoW
SetupDiCreateDeviceInfoList
SetupDiGetINFClassW
SetupDiGetClassDevsW
SetupDiGetDeviceRegistryPropertyW
SetupDiGetDeviceInstallParamsW

crypt32

CertEnumCertificatesInStore
CertVerifyCertificateChainPolicy
CertFreeCertificateChain
CertDuplicateCertificateContext
CertAddCertificateContextToStore
CertDuplicateCertificateChain
CertOpenStore
CertCloseStore
CertDuplicateStore
CertFreeCertificateContext
CertGetCertificateChain

cfgmgr32

CM_Get_DevNode_Status

comctl32

SetWindowSubclass
DefSubclassProc
RemoveWindowSubclass

ntdll

RtlNtStatusToDosError
NtWriteFile
RtlGetNtVersionNumbers
NtQueryInformationProcess
NtReadFile
NtQuerySystemInformation
NtCancelIoFileEx
NtDeviceIoControlFile
RtlGetVersion
NtCreateFile

uxtheme

DrawThemeBackground
OpenThemeData
DrawThemeText
CloseThemeData

d3d11

D3D11CreateDevice

dxgi

CreateDXGIFactory1

psapi

GetModuleFileNameExW
GetProcessMemoryInfo

powrprof

CallNtPowerInformation

oleaut32

SysStringLen
GetErrorInfo
SysFreeString

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock

Sections

.text
Size: 15.0MB - Virtual size: 15.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rodata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16.6MB - Virtual size: 16.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 44KB - Virtual size: 377KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 288KB - Virtual size: 287KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 106KB - Virtual size: 106KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 184KB - Virtual size: 183KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

b715fdf3ae865e52714d83057bd2c5bc

Headers

DLL Characteristics

File Characteristics

Imports

sas

newdev

wtsapi32

kernel32

secur32

advapi32

api-ms-win-shcore-scaling-l1-1-1

ole32

user32

iphlpapi

shell32

pdh

ws2_32

bcrypt

gdi32

setupapi

crypt32

cfgmgr32

comctl32

ntdll

uxtheme

d3d11

dxgi

psapi

powrprof

oleaut32

userenv

Sections

.text Size: 15.0MB - Virtual size: 15.0MB

.rodata Size: 2KB - Virtual size: 2KB

.rdata Size: 16.6MB - Virtual size: 16.6MB

.data Size: 44KB - Virtual size: 377KB

.pdata Size: 288KB - Virtual size: 287KB

_RDATA Size: 11KB - Virtual size: 10KB

.rsrc Size: 106KB - Virtual size: 106KB

.reloc Size: 184KB - Virtual size: 183KB

.text
Size: 15.0MB - Virtual size: 15.0MB

.rodata
Size: 2KB - Virtual size: 2KB

.rdata
Size: 16.6MB - Virtual size: 16.6MB

.data
Size: 44KB - Virtual size: 377KB

.pdata
Size: 288KB - Virtual size: 287KB

_RDATA
Size: 11KB - Virtual size: 10KB

.rsrc
Size: 106KB - Virtual size: 106KB

.reloc
Size: 184KB - Virtual size: 183KB