New folder[.]zip | Triage

Sharing

Copy URL Twitter E-mail

General

Target

New folder.zip
Size

11.9MB
MD5

68218ad0e7083439e4a28d8c6e67386c
SHA1

418699976ff391700eb4676877c7b38fa3ff4e5f
SHA256

37f7dc8238d186684a1685c78dcc25f27810ede4bd4f0e36a757c7a51f32c4f6
SHA512

449c8bd984459b84a8fb350b0b80b7ce587c013615b5f7b58385075380b96f75f1007909c51b210cb74da5b2dedc44b24f174c5166c6d93142db18b2f6b5732e
SSDEEP

196608:TmjXAl2xEcN/nq5h3lJTgGHvullL138yI7pWVbICa+RMD2F3BMVg9Et000IZhSZy:qEcNeKllN8dpWVkiRMe+Vg9E60nZ0ZpE

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/New folder/Patch.exe

Files

New folder.zip
.zip
New folder/Patch.exe
.exe windows:4 windows x86 arch:x86

ea118a7e5acdd72acecbf33396c4df7d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

GetModuleHandleA
GetProcAddress

user32

CharNextA

oleaut32

SysFreeString

advapi32

FreeSid

version

VerQueryValueA

gdi32

SaveDC

msimg32

AlphaBlend

ole32

CoTaskMemFree

shell32

SHGetPathFromIDListA

comdlg32

GetSaveFileNameA

imagehlp

CheckSumMappedFile

winmm

sndPlaySoundA

Sections

.MPRESS1
Size: 114KB - Virtual size: 388KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.MPRESS2
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
New folder/Persi0.sys