18137359327[.]zip

Sharing

Copy URL

Twitter E-mail

General

Target

18137359327.zip
Size

958KB
MD5

f3d44048304cc11dc68a871199dbfda1
SHA1

b932c671f2cde1645a02503e350e083827cac78b
SHA256

0da3ad64a8ca5b5923b48ac83632969351ff9f3702db5898dc3726879371993a
SHA512

cd698933409b964a33a20d1de0cc6f5b6ecbd3110fca0f6400ede01a86d256b20f047b62e80a2fe61ec47904ff8c06b637f1d0d9fdbf896d7efe08381561640b
SSDEEP

24576:oH5YH/4C+Uy/pmacivjeoh2m8aheEvW195JX0hmrdj:a+H/fyB9eOsh5Jkh4t

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/ad151a7ff1d02e3ff5043b3cc7c85d3e1d7961d012ec0950233f52601e76ff09

Files

18137359327.zip
.zip

Password: infected
ad151a7ff1d02e3ff5043b3cc7c85d3e1d7961d012ec0950233f52601e76ff09
.exe windows:6 windows x86 arch:x86

106cbfdf6ab2fd719fc4ae78e1cb0910

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

NtWriteFile
NtQueryInformationProcess
RtlUnwind
RtlNtStatusToDosError
RtlGetVersion
NtQuerySystemInformation
RtlCaptureContext

kernel32

HeapAlloc
ReadProcessMemory
SetUnhandledExceptionFilter
TlsGetValue
TlsSetValue
CreateFileW
OpenProcess
HeapFree
CloseHandle
InitializeSListHead
GetCurrentThreadId
LocalFree
VirtualProtect
WriteProcessMemory
VirtualProtectEx
GetCurrentProcess
GetProcAddress
SleepConditionVariableSRW
TryAcquireSRWLockExclusive
IsDebuggerPresent
CheckRemoteDebuggerPresent
LoadLibraryA
GetProcessHeap
IsProcessorFeaturePresent
GetProcessIoCounters
GetLastError
WaitForSingleObject
UnhandledExceptionFilter
GetSystemTimes
FreeLibrary
EncodePointer
FormatMessageW
VirtualAlloc
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LoadLibraryExW
ReleaseMutex
FindClose
ReleaseSRWLockShared
AddVectoredExceptionHandler
SetThreadStackGuarantee
SwitchToThread
Sleep
QueryPerformanceCounter
GetCurrentThread
SetLastError
GetCurrentDirectoryW
GetEnvironmentVariableW
GetComputerNameExW
GetProcessTimes
K32GetPerformanceInfo
GlobalMemoryStatusEx
VirtualQueryEx
RaiseException
GetSystemInfo
ReleaseSRWLockExclusive
GetStdHandle
AcquireSRWLockExclusive
TerminateProcess
WakeAllConditionVariable
WakeConditionVariable
HeapReAlloc
AcquireSRWLockShared
WaitForSingleObjectEx
CreateMutexA
GetModuleHandleA
GetFileInformationByHandle
GetFileInformationByHandleEx
FindFirstFileW
GetConsoleMode
LoadLibraryExA
GetModuleHandleW
ExitProcess
GetFullPathNameW
MultiByteToWideChar
WriteConsoleW
CreateThread
InitOnceBeginInitialize
TlsAlloc
InitOnceComplete
TlsFree
GetSystemTimeAsFileTime
GetCurrentProcessId

advapi32

OpenProcessToken
RegOpenKeyExW
GetTokenInformation
RegQueryValueExW
SystemFunction036
AddAccessAllowedAce
SetSecurityInfo
InitializeAcl
IsValidSid
CopySid
GetLengthSid
RegCloseKey

pdh

PdhCollectQueryData
PdhAddEnglishCounterW
PdhGetFormattedCounterValue
PdhRemoveCounter
PdhCloseQuery
PdhOpenQueryA

powrprof

CallNtPowerInformation

oleaut32

SysFreeString
GetErrorInfo
SysStringLen

psapi

GetProcessMemoryInfo
GetModuleFileNameExW

shell32

CommandLineToArgvW

bcrypt

BCryptGenRandom

api-ms-win-crt-heap-l1-1-0

malloc
calloc
_set_new_mode
free

api-ms-win-crt-string-l1-1-0

strcpy_s
wcsncmp
wcslen

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv
__p___argv
_cexit
_c_exit
__p___argc
_initialize_narrow_environment
_register_thread_local_exe_atexit_callback
abort
_set_app_type
_exit
_initterm_e
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_controlfp_s
terminate
_get_initial_narrow_environment
_initterm
exit
_seh_filter_exe

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 244KB - Virtual size: 244KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 992KB - Virtual size: 991KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

106cbfdf6ab2fd719fc4ae78e1cb0910

Headers

DLL Characteristics

File Characteristics

Imports

ntdll

kernel32

advapi32

pdh

powrprof

oleaut32

psapi

shell32

bcrypt

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 244KB - Virtual size: 244KB

.rdata Size: 992KB - Virtual size: 991KB

.data Size: 512B - Virtual size: 1KB

.reloc Size: 9KB - Virtual size: 9KB

.text
Size: 244KB - Virtual size: 244KB

.rdata
Size: 992KB - Virtual size: 991KB

.data
Size: 512B - Virtual size: 1KB

.reloc
Size: 9KB - Virtual size: 9KB