df049efbfa7ac0b76c8daff5d792c550c7a7a24f6e9e887d01a01013c9caa763[.]zip

Target
df049efbfa7ac0b76c8daff5d792c550c7a7a24f6e9e887d01a01013c9caa763.zip
Size 229KB
Sample240803-dr286swdrd
SHA256 91312ac2c8fa00d56b7ce9839f8a2934620f69ef6043a0c177c810870d6edd92
MD5 e0532c3452c5de166144de85144ab86e
SHA1 a1ac8137db77d51f426500a89c5009adaf0313bf
SHA512 a5c6236e637d9717438cda12e85302302435ad5df6a2ef7a068f6c62c01b4e89a546023226364970d9e01e79455977cd12662eff4b30b4f001bb3520c2850176
SSDEEP 6144:UyrJsTTaZCw3vCznBbiKzt9LyKtDrobuuZaK+0+:UCJs6ZCd1tz/pu3/+
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/rBlbqI2.bin

File Explorer

df049efbfa7ac0b76c8daff5d792c550c7a7a24f6e9e887d01a01013c9caa763.zip

.zip 229KB
rBlbqI2.bin

.exe 291KB

df049efbfa7ac0b76c8daff5d792c550c7a7a24f6e9e887d01a01013c9caa763.zip

SHA256 91312ac2c8fa00d56b7ce9839f8a2934620f69ef6043a0c177c810870d6edd92
MD5 e0532c3452c5de166144de85144ab86e
SHA1 a1ac8137db77d51f426500a89c5009adaf0313bf
SHA512 a5c6236e637d9717438cda12e85302302435ad5df6a2ef7a068f6c62c01b4e89a546023226364970d9e01e79455977cd12662eff4b30b4f001bb3520c2850176
SSDEEP 6144:UyrJsTTaZCw3vCznBbiKzt9LyKtDrobuuZaK+0+:UCJs6ZCd1tz/pu3/+
MD5 SHA1 SHA512 SSDEEP

Password

infected

rBlbqI2.bin

IMPHASH 9dd8c0ff4fc84287e5b766563240f983
SHA256 df049efbfa7ac0b76c8daff5d792c550c7a7a24f6e9e887d01a01013c9caa763
MD5 2fec9bf50de5395f799b23a1099b10d6
SHA1 6000969e75d7d7a3fa1b908bdb9d5daeb5f2534e
SHA512 5f6885fb1940ee4f84507e2b7929f637d8f264a5c77329aeae31803b772608ea93370177017f90f6f8d8bc9e0b30eb8607ed120d4ead68104fd70feec71a9ab8
SSDEEP 6144:pdSK04ETTZ+4TBpvjLCnVlBpevKBauJirVuD05VSKJ:poL4EnU4T/vjLeVlayRihuA5D
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

52463

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

RaiseException GetLastError MultiByteToWideChar lstrlenA InterlockedDecrement GetProcAddress LoadLibraryA FreeResource SizeofResource LockResource LoadResource FindResourceA GetModuleHandleA Module32Next CloseHandle Module32First CreateToolhelp32Snapshot GetCurrentProcessId SetEndOfFile GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA GetLocaleInfoA CreateFileA HeapFree GetProcessHeap HeapAlloc GetCommandLineA HeapCreate VirtualFree DeleteCriticalSection LeaveCriticalSection EnterCriticalSection VirtualAlloc HeapReAlloc HeapSize TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetModuleHandleW Sleep ExitProcess WriteFile GetStdHandle GetModuleFileNameA WideCharToMultiByte GetConsoleCP GetConsoleMode ReadFile TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId FlushFileBuffers SetFilePointer SetHandleCount GetFileType GetStartupInfoA RtlUnwind FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime InitializeCriticalSectionAndSpinCount GetCPInfo GetACP GetOEMCP IsValidCodePage CompareStringA CompareStringW SetEnvironmentVariableA WriteConsoleA GetConsoleOutputCP WriteConsoleW SetStdHandle

ole32

OleInitialize

oleaut32

VariantInit SafeArrayCreate SafeArrayAccessData SafeArrayUnaccessData SafeArrayDestroy SafeArrayCreateVector VariantClear SysFreeString SysAllocString

mscoree

CorBindToRuntimeEx

Resubmissions

Sharing

General