0724[.]zip | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0724.zip
Size

14.6MB
MD5

1a38a379384ed8817012d219cf573f47
SHA1

cbe4b687837379689385df7578e1d0bf831c8e3b
SHA256

1b0de5bd7a19749ef039a1d96ec62e389c877b0ebcff6b260f15699adae113bc
SHA512

0d9a8dc07e737471b48835c3fc43e9881d865df6a9b65a6f27f0a71666524c12c8e97d6de0cad36d01b26d2deacf765f21d397cc58db387a18512d3bc0368b93
SSDEEP

393216:NjbSGvbGQ9dWparx7EkEHovFvro6jdZmDhWhjF6:NjWGanal7FEHu86jdQDhW+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/pfd20240000004001340.exe

Files

0724.zip
.zip

Password: virus
pfd20240000004001340.exe
.exe windows:6 windows x86 arch:x86

Password: virus

89d6a880da5947d23bc71a2bb5c66d1c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

imm32

ImmGetVirtualKey
ImmSetCandidateWindow
ImmSetCompositionWindow
ImmNotifyIME
ImmGetOpenStatus
ImmGetCompositionStringW
ImmAssociateContextEx
ImmAssociateContext
ImmReleaseContext
ImmGetContext
ImmGetDefaultIMEWnd

oleaut32

SysAllocString
SafeArrayPutElement
SafeArrayCreateVector
VariantInit
VarBstrFromDate
VariantChangeType
SysFreeString
LoadTypeLi
SysAllocStringLen
SysStringLen
SystemTimeToVariantTime
VariantTimeToSystemTime
VariantClear
VariantCopy

wtsapi32

WTSFreeMemory
WTSQuerySessionInformationW

gdi32

GetStockObject
AddFontResourceExW
RemoveFontResourceExW
AddFontMemResourceEx
RemoveFontMemResourceEx
GetTextMetricsW
GetTextFaceW
GetCharABCWidthsW
GetCharABCWidthsFloatW
GetGlyphOutlineW
GetOutlineTextMetricsW
GetTextExtentPoint32W
GetCharABCWidthsI
SetBkMode
SetGraphicsMode
SetTextColor
GetFontData
SetWorldTransform
ExtTextOutW
EnumFontFamiliesExW
CreateFontIndirectW
GetObjectW
GetBitmapBits
SwapBuffers
SetPixelFormat
GetPixelFormat
DescribePixelFormat
ChoosePixelFormat
CreateBitmap
CreateDCW
CreateCompatibleBitmap
GetDeviceCaps
OffsetRgn
BitBlt
GdiFlush
CreateDIBSection
SelectObject
GetViewportOrgEx
GetWindowOrgEx
SetPixelV
SetPaletteEntries
ExtFloodFill
PtInRegion
GetBoundsRect
FrameRgn
SelectClipRgn
GetRegionData
DeleteObject
DeleteDC
CreateRectRgn
CreateCompatibleDC
CombineRgn
GetClipBox
ExcludeClipRect
Escape
CreateSolidBrush
CreatePatternBrush
CreatePen
CreateHatchBrush
SetBkColor
CopyMetaFileW
SetTextAlign
FillRgn
RoundRect
GetRgnBox
Rectangle
LPtoDP
CreateRoundRectRgn
Polyline
Polygon
CreatePolygonRgn
GetTextColor
Ellipse
CreateEllipticRgn
SetDIBColorTable
StretchBlt
SetPixel
GetTextCharsetInfo
EnumFontFamiliesW
CreateDIBitmap
GetBkColor
RealizePalette
GetSystemPaletteEntries
GetPaletteEntries
GetNearestPaletteIndex
CreatePalette
DPtoLP
SetRectRgn
PatBlt
CreateRectRgnIndirect
ScaleWindowExtEx
ScaleViewportExtEx
OffsetWindowOrgEx
OffsetViewportOrgEx
SetWindowOrgEx
SetWindowExtEx
SetViewportOrgEx
SetViewportExtEx
TextOutW
MoveToEx
SetROP2
SetPolyFillMode
GetLayout
SetLayout
SetMapMode
SelectPalette
ExtSelectClipRgn
SaveDC
RestoreDC
RectVisible
PtVisible
LineTo
IntersectClipRect
GetWindowExtEx
GetViewportExtEx
GetPixel
GetObjectType
GetDIBits

uxtheme

GetWindowTheme
GetThemeTransitionDuration
CloseThemeData
ord47
GetThemeBackgroundRegion
OpenThemeData
GetThemePartSize
GetThemeColor
GetThemeInt
IsThemeBackgroundPartiallyTransparent
GetThemeBool
SetWindowTheme
IsThemeActive
IsAppThemed
GetThemeEnumValue
GetThemeMargins
GetThemePropertyOrigin
GetCurrentThemeName
DrawThemeBackground
DrawThemeText
DrawThemeParentBackground
GetThemeSysColor

dwmapi

DwmEnableBlurBehindWindow
DwmIsCompositionEnabled

ole32

IsAccelerator
OleTranslateAccelerator
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
OleLockRunning
CreateStreamOnHGlobal
CoDisconnectObject
OleDuplicateData
CoTaskMemAlloc
StringFromGUID2
CoUninitialize
CoInitializeEx
CoCreateInstance
CoLockObjectExternal
RegisterDragDrop
RevokeDragDrop
OleInitialize
OleUninitialize
CoInitialize
OleSetClipboard
OleGetClipboard
OleFlushClipboard
OleIsCurrentClipboard
DoDragDrop
CoTaskMemFree
ReleaseStgMedium
CoGetMalloc
CoCreateGuid

advapi32

RegQueryValueExW
RegOpenKeyExW
RegCloseKey
CreateWellKnownSid
CreateProcessAsUserW
BuildTrusteeWithSidW
GetNamedSecurityInfoW
GetEffectiveRightsFromAclW
LookupAccountSidW
SystemFunction036
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegEnumKeyExW
RegEnumValueW
RegFlushKey
RegQueryInfoKeyW
RegSetValueExW
OpenProcessToken
AccessCheck
AllocateAndInitializeSid
CopySid
DuplicateToken
FreeSid
GetLengthSid
GetTokenInformation
MapGenericMask

user32

DestroyWindow
DefWindowProcW
SystemParametersInfoW
GetSystemMetrics
MessageBoxW
GetWindow
GetWindowThreadProcessId
GetClassNameA
FindWindowExW
FindWindowW
PostMessageW
ReleaseDC
GetSysColor
GetDesktopWindow
GetDoubleClickTime
IsWindow
MessageBeep
GetCaretBlinkTime
UpdateLayeredWindowIndirect
SendMessageW
AttachThreadInput
ClientToScreen
ScreenToClient
GetWindowLongW
SetWindowLongW
GetParent
SetParent
DestroyCursor
DestroyIcon
MonitorFromPoint
SetClipboardViewer
ChangeClipboardChain
RegisterClipboardFormatW
GetKeyboardLayout
RegisterWindowMessageW
IsWindowEnabled
CreateCaret
DestroyCaret
HideCaret
ShowCaret
SetCaretPos
FindWindowA
GetAncestor
GetKeyboardLayoutList
UnregisterClassW
GetClassInfoW
RegisterClassExW
GetFocus
GetClientRect
GetCursorPos
WindowFromPoint
ChildWindowFromPointEx
GetSysColorBrush
LoadImageW
SetMenu
DrawMenuBar
CreateMenu
CreatePopupMenu
DestroyMenu
InsertMenuW
AppendMenuW
ModifyMenuW
RemoveMenu
PeekMessageW
IsZoomed
GetKeyState
GetKeyboardState
ToAscii
TrackPopupMenu
GetMenuItemInfoW
ToUnicode
SetMenuItemInfoW
MonitorFromWindow
MapVirtualKeyW
GetMenu
TrackPopupMenuEx
SetCursorPos
GetCursor
LoadCursorW
CreateCursor
CreateIconIndirect
GetIconInfo
GetCursorInfo
RegisterClassW
EnumDisplayDevicesW
GetClipboardFormatNameW
TrackMouseEvent
GetMessageExtraInfo
GetAsyncKeyState
GetTouchInputInfo
GetMonitorInfoW
GetWindowTextW
EnumWindows
RealGetWindowClassW
ChangeWindowMessageFilterEx
EnumDisplayMonitors
CreateWindowExW
IsChild
ShowWindow
UpdateLayeredWindow
SetForegroundWindow
SetLayeredWindowAttributes
FlashWindowEx
MoveWindow
SetWindowPos
GetWindowPlacement
SetWindowPlacement
IsWindowVisible
IsIconic
SetFocus
RegisterTouchWindow
UnregisterTouchWindow
LoadIconW
GetDC
IsTouchWindow
BeginPaint
EndPaint
SetCursor
GetUpdateRect
SetWindowRgn
InvalidateRect
GetCapture
GetWindowRect
SetCapture
ReleaseCapture
GetSystemMenu
EnableMenuItem
AdjustWindowRectEx
DrawIconEx
TranslateMessage
DispatchMessageW
GetQueueStatus
MsgWaitForMultipleObjectsEx
SetTimer
KillTimer
SetWindowsHookExW
UnhookWindowsHookEx
CallNextHookEx
RegisterDeviceNotificationW
UnregisterDeviceNotification
CharNextExA
GetMenuStringW
GetMenuState
GetSubMenu
GetMenuItemID
GetMenuItemCount
EnableWindow
GetLastActivePopup
GetMessageW
GetActiveWindow
ValidateRect
GetWindowTextLengthW
CharUpperW
GetDlgCtrlID
PtInRect
GetClassNameW
RealChildWindowFromPoint
CheckMenuItem
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapW
GetMessagePos
GetMessageTime
CallWindowProcW
GetClassInfoExW
IsMenu
BeginDeferWindowPos
DeferWindowPos
EndDeferWindowPos
GetDlgItem
UpdateWindow
SetActiveWindow
RedrawWindow
ScrollWindow
SetScrollPos
GetScrollPos
SetScrollRange
GetScrollRange
ShowScrollBar
SetPropW
GetPropW
RemovePropW
MapWindowPoints
CopyRect
EqualRect
GetClassLongW
GetTopWindow
SetScrollInfo
GetScrollInfo
WinHelpW
CheckDlgButton
IsDialogMessageW
PostQuitMessage
DrawTextW
DrawTextExW
GrayStringW
TabbedTextOutW
GetWindowDC
FillRect
InflateRect
CopyImage
SendDlgItemMessageA
SetRectEmpty
OffsetRect
CreateDialogIndirectParamW
EndDialog
GetNextDlgTabItem
MapDialogRect
ShowOwnedPopups
DeleteMenu
IntersectRect
GetNextDlgGroupItem
DrawFocusRect
IsRectEmpty
EnableScrollBar
InvertRect
NotifyWinEvent
GetMenuDefaultItem
GetKeyNameTextW
LoadMenuW
OpenClipboard
CloseClipboard
SetClipboardData
EmptyClipboard
DrawStateW
SetClassLongW
DrawEdge
DrawFrameControl
BringWindowToTop
CopyIcon
FrameRect
DrawIcon
UnionRect
LoadAcceleratorsW
TranslateAcceleratorW
InsertMenuItemW
UnpackDDElParam
ReuseDDElParam
GetComboBoxInfo
PostThreadMessageW
WaitMessage
IsCharLowerW
MapVirtualKeyExW
ToUnicodeEx
CreateAcceleratorTableW
DestroyAcceleratorTable
CopyAcceleratorTableW
SetRect
LockWindowUpdate
SetMenuDefaultItem
CharUpperBuffW
IsClipboardFormatAvailable
DefFrameProcW
DefMDIChildProcW
TranslateMDISysAccel
SubtractRect
GetWindowRgn
SetWindowTextW
GetForegroundWindow
CloseTouchInputHandle
IsHungAppWindow

kernel32

FindResourceW
SizeofResource
LockResource
LoadResource
GetModuleHandleA
InitializeCriticalSectionAndSpinCount
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
OutputDebugStringA
GetCPInfo
GetStringTypeW
LCMapStringEx
DecodePointer
EncodePointer
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
RaiseException
InitializeSListHead
GetSystemTimeAsFileTime
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
GetExitCodeProcess
GetUserGeoID
GetGeoInfoW
GetTimeZoneInformation
GetModuleHandleExW
FreeLibrary
FindNextFileW
FindFirstFileExW
MultiByteToWideChar
GetProcessHeap
CloseHandle
GetLastError
InitializeCriticalSectionEx
Sleep
ExitProcess
OpenProcess
VirtualAllocEx
WriteProcessMemory
GetModuleFileNameW
lstrcmpiA
lstrcmpiW
GetUserDefaultUILanguage
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
ContinueDebugEvent
WaitForDebugEvent
SetLastError
WaitForSingleObject
CreateEventW
TerminateProcess
InitializeProcThreadAttributeList
DeleteProcThreadAttributeList
UpdateProcThreadAttribute
LocalAlloc
LocalFree
lstrcpyW
lstrcatW
lstrcmpW
GetCurrentThreadId
GetModuleHandleW
GetProcAddress
FormatMessageW
WTSGetActiveConsoleSessionId
SetErrorMode
ExpandEnvironmentStringsW
CreateProcessW
CheckRemoteDebuggerPresent
GlobalAlloc
GlobalUnlock
GlobalLock
GetLocaleInfoW
LoadLibraryA
GlobalSize
GetCurrentProcessId
GetUserDefaultLangID
CreateFileW
GetFileSize
ReadFile
SetFilePointer
WriteFile
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
WideCharToMultiByte
FindNextChangeNotification
FindFirstChangeNotificationW
FindCloseChangeNotification
RegisterWaitForSingleObject
UnregisterWaitEx
SetFilePointerEx
SetEndOfFile
GetFileType
FlushFileBuffers
GetFileInformationByHandleEx
SystemTimeToFileTime
FileTimeToSystemTime
TzSpecificLocalTimeToSystemTime
MoveFileExW
MoveFileW
CopyFileW
DeviceIoControl
GetVolumePathNamesForVolumeNameW
GetTempPathW
SetFileTime
RemoveDirectoryW
GetLogicalDrives
GetFullPathNameW
GetFileInformationByHandle
GetFileAttributesW
FindFirstFileW
FindClose
DeleteFileW
CreateDirectoryW
GetCurrentDirectoryW
GetStartupInfoW
LCMapStringW
CompareStringW
GetTickCount64
QueryPerformanceFrequency
QueryPerformanceCounter
GetFileAttributesExW
GetUserPreferredUILanguages
GetUserDefaultLCID
GetCurrencyFormatW
GetTimeFormatW
GetDateFormatW
ResetEvent
GetSystemInfo
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
ResumeThread
TerminateThread
GetThreadPriority
SetThreadPriority
GetCurrentThread
CreateThread
WaitForMultipleObjects
VirtualFree
DuplicateHandle
LoadLibraryW
GetSystemDirectoryW
WaitForSingleObjectEx
SetEvent
IsProcessorFeaturePresent
GetCurrentProcess
OutputDebugStringW
GetLocalTime
GetSystemTime
GetCommandLineW
CompareStringEx
GetConsoleWindow
GetDriveTypeW
GetLongPathNameW
GetVolumeInformationW
EnumSystemLocalesW
MulDiv
InitializeCriticalSection
GlobalReAlloc
GlobalHandle
LocalReAlloc
lstrcmpA
GlobalGetAtomNameW
GlobalAddAtomW
LockFile
UnlockFile
LoadLibraryExW
GlobalFlags
GlobalDeleteAtom
GlobalFindAtomW
GetVersionExW
FileTimeToLocalFileTime
GetFileSizeEx
GetFileTime
SetFileAttributesW
SystemTimeToTzSpecificLocalTime
VirtualProtect
CreateMutexW
ReleaseMutex
FindResourceExW
GetWindowsDirectoryW
VerSetConditionMask
VerifyVersionInfoW
GetProfileIntW
SearchPathW
GetTempFileNameW
GetCommandLineA
ExitThread
FreeLibraryAndExitThread
SetStdHandle
GetConsoleMode
ReadConsoleW
GetConsoleOutputCP
GetStdHandle
HeapQueryInformation
VirtualAlloc
VirtualQuery
IsValidLocale
GlobalFree
SetEnvironmentVariableW
IsValidCodePage
GetACP
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
WriteConsoleW

shell32

SHAppBarMessage
DragFinish
DragQueryFileW
SHGetDesktopFolder
SHGetSpecialFolderLocation
Shell_NotifyIconGetRect
Shell_NotifyIconW
SHBrowseForFolderW
SHGetKnownFolderIDList
SHGetPathFromIDListW
SHGetMalloc
SHCreateItemFromParsingName
SHCreateItemFromIDList
ord727
ShellExecuteW
SHGetStockIconInfo
SHGetFileInfoW
ord680
CommandLineToArgvW
SHGetKnownFolderPath

ntdll

qsort
strncpy
strrchr
_aulldiv
_allmul
strncmp
wcsncmp
_chkstk
strstr
wcsrchr
toupper
wcsstr
RtlAllocateHeap
RtlFreeHeap
memmove
_aullshr
strlen
DbgUiSetThreadDebugObject
NtClose
NtDuplicateObject
NtQueryInformationProcess
NtRemoveProcessDebug
strcmp
_alldiv
strtol
_alloca_probe
memchr
ceil
_aulldvrm
atoi
bsearch
floor
_allshl
_aullrem
_allrem
strchr
isdigit
isspace
_allshr
RtlUnwind
NtQueryVirtualMemory
memcpy
memset

msimg32

TransparentBlt
AlphaBlend

ws2_32

WSAAsyncSelect

rpcrt4

RpcAsyncInitializeHandle
RpcBindingFromStringBindingW
RpcRaiseException
RpcBindingSetAuthInfoExW
RpcStringFreeW
RpcStringBindingComposeW
RpcBindingFree
NdrAsyncClientCall
RpcAsyncCompleteCall

gdiplus

GdipGetImagePixelFormat
GdipDrawImageRectI
GdipSetInterpolationMode
GdipCreateFromHDC
GdipCreateBitmapFromHBITMAP
GdipDrawImageI
GdipDeleteGraphics
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStream
GdipGetImagePaletteSize
GdipGetImagePalette
GdipGetImageHeight
GdipGetImageWidth
GdipGetImageGraphicsContext
GdipDisposeImage
GdipCloneImage
GdiplusStartup
GdipFree
GdipAlloc
GdiplusShutdown

oleacc

CreateStdAccessibleObject
AccessibleObjectFromWindow
LresultFromObject

winspool.drv

OpenPrinterW
DocumentPropertiesW
ClosePrinter

shlwapi

PathRemoveFileSpecW
PathFindExtensionW
PathStripToRootW
PathIsUNCW
PathFindFileNameW
StrFormatKBSizeW

winmm

PlaySoundW
timeKillEvent
timeSetEvent

netapi32

NetApiBufferFree
NetShareEnum

userenv

GetUserProfileDirectoryW

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

Sections

.text
Size: 8.7MB - Virtual size: 8.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5.9MB - Virtual size: 5.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7.2MB - Virtual size: 7.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.qtmetad
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 736B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 356KB - Virtual size: 356KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: virus

Password: virus

89d6a880da5947d23bc71a2bb5c66d1c

Headers

DLL Characteristics

File Characteristics

Imports

imm32

oleaut32

wtsapi32

gdi32

uxtheme

dwmapi

ole32

advapi32

user32

kernel32

shell32

ntdll

msimg32

ws2_32

rpcrt4

gdiplus

oleacc

winspool.drv

shlwapi

winmm

netapi32

userenv

version

Sections

.text Size: 8.7MB - Virtual size: 8.7MB

.rdata Size: 5.9MB - Virtual size: 5.9MB

.data Size: 7.2MB - Virtual size: 7.3MB

.qtmetad Size: 1KB - Virtual size: 1KB

.rsrc Size: 1024B - Virtual size: 736B

.reloc Size: 356KB - Virtual size: 356KB

.text
Size: 8.7MB - Virtual size: 8.7MB

.rdata
Size: 5.9MB - Virtual size: 5.9MB

.data
Size: 7.2MB - Virtual size: 7.3MB

.qtmetad
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 1024B - Virtual size: 736B

.reloc
Size: 356KB - Virtual size: 356KB