18197657768.zip
- SHA256 c041806df08b65e970ee6975569967a2e9379d475bfbb8154be0ba3dd08b34d6
Password
infected
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9845e65543e74e6b6e731af9349d932c7b4e70ddf0a79d9e2fe18a10002e912f.exe
Resource
win7-20240705-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
9845e65543e74e6b6e731af9349d932c7b4e70ddf0a79d9e2fe18a10002e912f.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target 18197657768.zip
- Size 2.4MB
- Sample240715-vpv6hstcle
- SHA256 c041806df08b65e970ee6975569967a2e9379d475bfbb8154be0ba3dd08b34d6
- MD5 eb9816b459aa84e0ca7085d2bb4ab57a
- SHA1 65a3f06fbf32b786870e5ed1de0d5fe940a772ca
- SHA512 0d5a517135510832d7160119de050b5eac21b34045023508e61d00a5f697650310376e635d0ddf138a9d55349f7e060d92f579266111ee2e743a967a1e4199c4
- SSDEEP 49152:NrT/9dzvysvrxTpbpKBZJfcPIES49SqDlPJ7TuixKYfZLq:NPnzvvvV9bMYIYBCi1xm
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/9845e65543e74e6b6e731af9349d932c7b4e70ddf0a79d9e2fe18a10002e912f
File Explorer
-
18197657768.zip.zip 2.4MB
-
9845e65543e74e6b6e731af9349d932c7b4e70ddf0a79d9e2fe18a10002e912f.exe 4.7MB
9845e65543e74e6b6e731af9349d932c7b4e70ddf0a79d9e2fe18a10002e912f
- IMPHASH 91e2c9646735f307d26381cfc949dfbc
- SHA256 9845e65543e74e6b6e731af9349d932c7b4e70ddf0a79d9e2fe18a10002e912f
- MD5 3d253352224aead7526d58a4e21932fb
- SHA1 ca2e53cf2ec7fc678c347198dbf1c6d76e32380b
- SHA512 516ff664fe2446df5793498f9daa565647c339fdc4423454fdc129b1fc43b6fe0b968600d00709c8f5e2dfe80a366858f67e148f40c9d85255d02bdae238d3a3
- SSDEEP 98304:fCsVbXGGHMUhn6kUC1h3TSx+Fn388qjYeQnV:asViQM
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
32262
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
CreateActCtxA
ActivateActCtx
GetWindowsDirectoryA
SetEndOfFile
CreateFileMappingA
SetFileTime
MapViewOfFile
CloseHandle
ExitProcess
VirtualAlloc
CreateMutexA
OpenMutexA
ReleaseMutex
MultiByteToWideChar
GetDriveTypeA
UnmapViewOfFile
CreateFileA
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
GetCurrentProcess
TerminateProcess
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
GetStdHandle
WriteFile
GetModuleFileNameW
WideCharToMultiByte
GetModuleHandleExW
GetACP
HeapFree
HeapAlloc
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
SetStdHandle
GetFileType
GetStringTypeW
GetProcessHeap
HeapSize
HeapReAlloc
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetFilePointerEx
WriteConsoleW
DecodePointer
CreateFileW
RaiseException
avifil32
AVIFileOpenA
Name
.text
Size
84KB
Virtual Size
83KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1.4MB
Virtual Size
1.4MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3.2MB
Virtual Size
3.2MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.gfids
Size
512B
Virtual Size
172B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rodata
Size
512B
Virtual Size
320B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, productName=Unmarked objects (old),
count=4, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,
count=17, id=259, version=24237,
count=29, id=261, version=24237,
count=17, id=260, version=24237,
count=9, id=241, version=40116,
count=120, id=243, version=40116,
count=24, id=242, version=40116,
count=5, id=203, version=65501,
count=99, id=1, productName=Unmarked objects,
count=2, id=261, version=24245,
count=1, id=255, version=24245,
count=1, id=258, version=24245,