18505459239.zip
- SHA256 5d94282522c59df310e1355dea5e28c4085f08c8dc2738629550bbb9404bf6d3
Password
infected
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
35ed65d9919843300db648bf93ae57d7330095eb1ce18d6c6050db88a2e4f297.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
15 signatures
150 seconds
General
- Target 18505459239.zip
- Size 916KB
- Sample240807-ltrt8azele
- SHA256 5d94282522c59df310e1355dea5e28c4085f08c8dc2738629550bbb9404bf6d3
- MD5 e3fba0aee1193f7ddfb5f4783b1c7474
- SHA1 9f6ed2a8c27637c935153a586ae5fa7a67db3949
- SHA512 afd8d71fa446a539cbd8b5edb42b7fd15ab5e64766fb4502b67e606bacdd7238ee60ff05cf74f9d673f0423f8860152c3f14588ffe9edfcc005416ae7f80ef42
- SSDEEP 24576:jtE78j8Gv/bPZsU34WCSI4IGS2AXM/HRWX0PSSu2Q0LSE9Q:e8j8GvzBsU3iXM/MXGS0/Q
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/35ed65d9919843300db648bf93ae57d7330095eb1ce18d6c6050db88a2e4f297
File Explorer
-
18505459239.zip.zip 916KB
-
35ed65d9919843300db648bf93ae57d7330095eb1ce18d6c6050db88a2e4f297.exe 934KB
-
$INTERNET_CACHE/Anatomy268KB
-
$INTERNET_CACHE/Cap152KB
-
$INTERNET_CACHE/Church113KB
-
$INTERNET_CACHE/Cingular262KB
-
$INTERNET_CACHE/Customs239KB
-
$INTERNET_CACHE/Dominican137KB
-
$INTERNET_CACHE/Observed25KB
-
$INTERNET_CACHE/Ons140B
-
$INTERNET_CACHE/Placing247KB
-
$INTERNET_CACHE/Software101KB
-
$INTERNET_CACHE/Typing220KB
35ed65d9919843300db648bf93ae57d7330095eb1ce18d6c6050db88a2e4f297
- IMPHASH 56a78d55f3f7af51443e58e0ce2fb5f6
- SHA256 35ed65d9919843300db648bf93ae57d7330095eb1ce18d6c6050db88a2e4f297
- MD5 7def16e0ceea0ad69d53e0e636541dd9
- SHA1 92080bb5ad272cf69f69aa0588856cda4b4b1c28
- SHA512 9616fb69ed3fd6d59ae060a671c5af86f0d7e1a4e6f8436a9c7244928a2bb1f0a76ec4f1968f77180141493c16a4e1090faf8786ead929c3bd3812f2e09e596a
- SSDEEP 24576:gbVB9BI+CacE07NGWx1G0MEL2XH09GIGiSUS00dpf:qVrIacF7dnMBXU9GIzSUlypf
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
13613
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
advapi32
RegCreateKeyExW
RegEnumKeyW
RegQueryValueExW
RegSetValueExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
SetFileSecurityW
RegOpenKeyExW
RegEnumValueW
shell32
SHGetSpecialFolderLocation
SHFileOperationW
SHBrowseForFolderW
SHGetPathFromIDListW
ShellExecuteExW
SHGetFileInfoW
ole32
OleInitialize
OleUninitialize
CoCreateInstance
IIDFromString
CoTaskMemFree
comctl32
ord17
ImageList_Create
ImageList_Destroy
ImageList_AddMasked
user32
GetClientRect
EndPaint
DrawTextW
IsWindowEnabled
DispatchMessageW
wsprintfA
CharNextA
CharPrevW
MessageBoxIndirectW
GetDlgItemTextW
SetDlgItemTextW
GetSystemMetrics
FillRect
AppendMenuW
TrackPopupMenu
OpenClipboard
SetClipboardData
CloseClipboard
IsWindowVisible
CallWindowProcW
GetMessagePos
CheckDlgButton
LoadCursorW
SetCursor
GetSysColor
SetWindowPos
GetWindowLongW
PeekMessageW
SetClassLongW
GetSystemMenu
EnableMenuItem
GetWindowRect
ScreenToClient
EndDialog
RegisterClassW
SystemParametersInfoW
CreateWindowExW
GetClassInfoW
DialogBoxParamW
CharNextW
ExitWindowsEx
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
FindWindowExW
IsWindow
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
ReleaseDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
EmptyClipboard
CreatePopupMenu
gdi32
SetBkMode
SetBkColor
GetDeviceCaps
CreateFontIndirectW
CreateBrushIndirect
DeleteObject
SetTextColor
SelectObject
kernel32
GetExitCodeProcess
WaitForSingleObject
GetModuleHandleA
GetProcAddress
GetSystemDirectoryW
lstrcatW
Sleep
lstrcpyA
WriteFile
GetTempFileNameW
CreateFileW
lstrcmpiA
RemoveDirectoryW
CreateProcessW
CreateDirectoryW
GetLastError
CreateThread
GlobalLock
GlobalUnlock
GetDiskFreeSpaceW
WideCharToMultiByte
lstrcpynW
lstrlenW
SetErrorMode
GetVersionExW
GetCommandLineW
GetTempPathW
GetWindowsDirectoryW
SetEnvironmentVariableW
CopyFileW
ExitProcess
GetCurrentProcess
GetModuleFileNameW
GetFileSize
GetTickCount
MulDiv
SetFileAttributesW
GetFileAttributesW
SetCurrentDirectoryW
MoveFileW
GetFullPathNameW
GetShortPathNameW
SearchPathW
CompareFileTime
SetFileTime
CloseHandle
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalFree
GlobalAlloc
GetModuleHandleW
LoadLibraryExW
MoveFileExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
lstrlenA
MultiByteToWideChar
ReadFile
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW
Name
.text
Size
26KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
172KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
64KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
27KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=165, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
$INTERNET_CACHE/Anatomy
- SHA256 f1e2acd5399b8fd82a7d3be16aba6cf70dd4f5fea82211979b89e6293b736e85
- MD5 3d0fe94011bfc11f960f3692773becf6
- SHA1 eda278f584c80b7a5ec1a48c16c1453fd79d30fe
- SHA512 4f15232e5966d2c024e929de468a4ff427d5ec714b15c3a19c55ce6c03342f01a4dd9784672aa3a4ec738db9c926727fc0108d36d751f2669b27837470bce0d8
- SSDEEP 3072:l6EgnTnuk8KjN0QOeZxJeP0uJ7mUUgEyPEtUO4mBV8sQskY/gJBF+Y8:l6EgnLukXNc+J7i7mIN8uO4mBV5Q1J8
- MD5 SHA1 SHA512 SSDEEP
$INTERNET_CACHE/Cap
- SHA256 b64c28e45770c23ba7b4cc1b80efd0edafaa0ad8109d3c9e340b45ae40565929
- MD5 d7b3e4a1f20444dd37b4ef305b6f8199
- SHA1 bfd1d1bdff7c9d7e1ab6b46399252e94bbab8258
- SHA512 24e83d25a23170f0d5c5f9f2afac13e72c017c98e443014e82a7b1b5a3a7aa9aafdfd795517e0a2b93bae2f742809c6a9e0627669c73dc3a8a0b57e9b2b8663a
- SSDEEP 3072:EJBzLZDKJtIs8di/37EM/j2xQeixApVIa0/A:EJBnGtINsegA/12A
- MD5 SHA1 SHA512 SSDEEP
$INTERNET_CACHE/Church
- SHA256 1713e9701d98f06a20391a048b2f5cb213b0ccf23f45df39df3cdbd55b23935c
- MD5 b020ac666f105e582800755e46b87e54
- SHA1 33c9afc7390f7fefe0b11ee2f9e32f8107d5ec21
- SHA512 0d6c163717bef8e894cdf95b619ac1d7728bc1b88a2485606b1f2270d5c683caab7c4d693f467ec89d83a7ae34ca4e1afad1df3a7d25e8a7fc750826a89a59b9
- SSDEEP 1536:wohYh2nlGFuYHWaU7ifmgKBJqiMophCFPOntgQOY+XhfKHZgOuNEAGIWga8n6M2M:wd0lNOp0w8hJV9xIWc
- MD5 SHA1 SHA512 SSDEEP
$INTERNET_CACHE/Cingular
- SHA256 53a87d85121c6e590a928d3fae1f72ab3c266c980cc6a89f39cd74a2127d6b1e
- MD5 5b18970d8c464ca95ef183c6eddf2c79
- SHA1 30f9ef49ce58ded149dd60a32359052c7fda6b25
- SHA512 2f636bb7527a194467ce15046d9bf1368fca37a9b160c22aeb022a1c15a0c6cbf978373fb6d59ac692c9e7de37310c9fcc9f26c1c1d54ecace41f94ccc5fedbe
- SSDEEP 3072:So2IkVvh8p65Nu+dVtqi/x4Rqf21Rgat0g/bZaUAg0FuPOKBNEBNUGXEyaAt7Po:58JTDD/xcq21R1p/rAOPOei7TdFQ
- MD5 SHA1 SHA512 SSDEEP
$INTERNET_CACHE/Customs
- SHA256 3a6b764666b1675287f39a952e072fcd41332b4d0ce2b4e59a96aa5a27af8707
- MD5 4c4ea6968e54f5f5c4c254587fee63dc
- SHA1 d21927f93dfb1626405cf09f3379d6bc7dd8a505
- SHA512 8b3f479dd3accfffe0235f2a3e102c306c288788d533ae78f9b8d8bbd95f36a4a613f6c1c1f2443566e17971c6116274b8b901b83608a6189e4d4927e47e42b0
- SSDEEP 1536:QxOkSLAyvgYcsfoaRbwl2V2RJRxZT5kSxEsOdGrF5tWaePJkQEqpwDCSw8vpDfmK:QxDuvAgEbfB36jEtE0X62yL8
- MD5 SHA1 SHA512 SSDEEP
$INTERNET_CACHE/Dominican
- SHA256 740648b4a35012828dc95ef4258677d80659d820461ccfc9f98216facf0fea9a
- MD5 3c699f1767c677adfed1c113de6d184f
- SHA1 ca15988fb3c81b6b4e0d7c5914e0bb2e07b35d1b
- SHA512 9ba925d63f2f9c0dbb244d6cea56d4bfd0b39de973e9c68c743ef6a1014c2a72b93072606af17bc770a837320c3cf8dc5f51976389cd599922c7b668d263c2af
- SSDEEP 1536:r6JPTcUNx6/xhgariwYLTN3EfrDWyu0uZo2+9BBVgCOa1ZBPaPQaEwo0yv:r6i/xhgariwYLTNaWy4ZNoBVxjCPjojv
- MD5 SHA1 SHA512 SSDEEP
$INTERNET_CACHE/Observed
- SHA256 eb882bf341c37bcd1c625e156f33db1b338d0e435aa074fa379cc3e73d6d9dad
- MD5 ad5b9509809e2c43efd8e4e0cbb697aa
- SHA1 440d24a228fd1a0b125d535e55b887713b237f37
- SHA512 553bf92ac85b4b5ce9605fd0630e9f0396f282ece3f2cd4c0741cfd2b29acdb2246c7df749b0ae6d0d7cd3327f0fd34588ab205659f7cdd91a43e92b34dcd695
- SSDEEP 768:RFCaZ3M9cC47yV1yV8tKyFFrB3QuHcawRT4pRhIRhiT/U:RFCaZ8o7yV0FyfrVT8awRT4pRhIRhiTM
- MD5 SHA1 SHA512 SSDEEP
$INTERNET_CACHE/Ons
- SHA256 4dab1074edd81fc8d7b5c1e989b025f96ff09ae42e58934668bcc2f696a167c9
- MD5 61bab20dd66e4690943a6165fd4ff9ca
- SHA1 01237b42f749d18c2529aa6233349ecc5de29db2
- SHA512 9419cde00c25107d5ea4dd683b43d437fb508b951f5d7fbe919169724218b8bb13f2e91b3068f7a31433c3b899e9ae26e18cf94f9a9468ac5624efaa8c8f2ed2
- MD5 SHA1 SHA512
$INTERNET_CACHE/Placing
- SHA256 fdd8a7a40fdee48bd3a93b70e27c8efbb1aa860e2f7f587e1eecacbee3d6dd68
- MD5 b68df1f6cc55a943bd8bd6a1ba4baeb2
- SHA1 ed2f9c007bef6a9e8d52aba49704b56c9babea6d
- SHA512 0f622f1d33bcbe46483fa9f578eaa845e49c3617d6f0c76f46d2a32bf33e350a74bb44b4b0c43ddb25fa9f808de763d49f2af37072748b3f98010a8eb6ded273
- SSDEEP 3072:pQZCvxA58pED+N7S0lXJummb/Clu+teg5bT2PX:p6C5A58CDEommbMsgaX
- MD5 SHA1 SHA512 SSDEEP
$INTERNET_CACHE/Software
- SHA256 00559112065d90d8ba296b46949907ea4141c19323e999670a918bd50c5ae162
- MD5 722238ba226d0e01df25a8d6e95d609f
- SHA1 2f5e912ff0660bdc3f85ccf6d61bcb10fab8edef
- SHA512 3200e2063b157198c62a69fce4435d1c139c6e7b7f00e0a8e0d05fb0bf54fc886adeea0a2a4e4e8ec055ae0c94eabb1867e6d019920aade7ccef33e91e3be042
- SSDEEP 1536:V6CV21YEsmnq7Cv/+/Coc5m+4Xf8O46895LmNpRGDox2S3hPt8gNpkUu:0CV26MqgQTc5F446iYNpK5SB7S
- MD5 SHA1 SHA512 SSDEEP
$INTERNET_CACHE/Typing
- SHA256 2e933f3194ac2649b3f2c3f0289174b787ef71314143d63980b4d0c3ca698582
- MD5 f0c0d7aff4f13ac8f3c247cb9fca2943
- SHA1 94b642aa412319f2bfd814fefefa1b66c9fd7cc7
- SHA512 36f1296f06acccfb3d621aaaf60ea24b354633568b0a946b2f2239e0e61f62dac2f6c418f1b9d2512572b308f176eeb657d479e1448bc330c63b9b01ae585b39
- SSDEEP 6144:qk6AQzyMfA+eyVPlcBgtoTqnvAfcaG9b2E:zMyyzlcqikvAfcN9b2E
- MD5 SHA1 SHA512 SSDEEP