appcopier[.]zip | Triage

Sharing

General

Target

appcopier.zip
Size

108KB
MD5

8ab5576922bd7dedc2054aa3879fec32
SHA1

98e09a4f2ec22d2ceb8cbccf7cf52e8bcc9b89b7
SHA256

8469c3df36e53d9e0c047234b56f575e06699cb0aaef2a25cfc1d7245c6ff984
SHA512

39577784cacc535562ebf2736522ac5f69f023cb31c0875ba62b34ae8feefd7deb83ae2d40af02adf49fdecf85a5a8e2a69c4d296b8f84aabd97c100e70f5432
SSDEEP

3072:sxoK/SXysARzQPdSMKzkFml/8VKUfKoJNBA6KVs5:9gwmQPdTmSDyoVA6KVS

Score

3^/10

qr link

Malware Config

Signatures

One or more HTTP URLs in qr code identified
Detects presence of HTTP links in QR codes.
qr link

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Appcopier.exe

Files

appcopier.zip
.zip
Appcopier.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\Belim\Desktop\Appcopier\Appcopier\obj\Debug\Appcopier.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 85KB - Virtual size: 84KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 53KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
app/AppIcon.png
.png
app/qr.png
.png
- https://github.com/builtbybel/Appcopier