240809-bmcfvapl9s_pw_infected[.]zip

Resubmissions

09/08/2024, 02:42

240809-c7emdaygjf 9

09/08/2024, 01:53

240809-ca46rsvcnm 9

Sharing

Copy URL Twitter E-mail

General

Target

240809-bmcfvapl9s_pw_infected.zip
Size

929KB
MD5

4484c783130200a96389591f38a508aa
SHA1

1ffeb593951e94d80797dd6c9671b48b246b6bfb
SHA256

74bfc567c46ef910ba10021645577d5a51b303ecdd60e039558a462a2d01ddbd
SHA512

c3f4c282b3408d089428f0c20617611248d56669f512f070492fcb048f5f3f9403d3749d02050c62949bbd775d0dbdac9eb08eacfedc85fd0d6beac48bf61b41
SSDEEP

24576:Y5OdlOSyJ8eAqq6sdRtVuXQYwnQCTk/GyN/IZoH0LKX:GedHetsDzuAYCQCTcJ/IZoHv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/7057e38c383528f0645bb8b31d7ac4c855d30719ca2671345cc88e82dc968f36

Files

240809-bmcfvapl9s_pw_infected.zip
.zip

Password: infected
7057e38c383528f0645bb8b31d7ac4c855d30719ca2671345cc88e82dc968f36
.exe windows:6 windows x64 arch:x64

Password: infected

e47669c7aa998210e7ab6b21e663205c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

SystemFunction036
GetUserNameW

kernel32

GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc
AddVectoredExceptionHandler
SetThreadStackGuarantee
GetLastError
GetSystemInfo
CloseHandle
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
SwitchToThread
PostQueuedCompletionStatus
SetFileAttributesW
GetFileInformationByHandleEx
CreateSymbolicLinkW
FindClose
SetFilePointerEx
GetSystemTime
WakeAllConditionVariable
GetFileInformationByHandle
GetQueuedCompletionStatusEx
SetLastError
GetFinalPathNameByHandleW
CreateIoCompletionPort
SetFileCompletionNotificationModes
TryAcquireSRWLockExclusive
Sleep
GetModuleHandleA
GetProcAddress
SleepConditionVariableSRW
WakeConditionVariable
GetCurrentThread
GetStdHandle
GetConsoleMode
WaitForSingleObject
MultiByteToWideChar
WriteConsoleW
CreateWaitableTimerExW
SetWaitableTimer
QueryPerformanceFrequency
GetModuleHandleW
FormatMessageW
GetCurrentProcess
GetEnvironmentVariableW
GetModuleFileNameW
CreateFileW
SetFileInformationByHandle
GetFullPathNameW
FindNextFileW
CreateDirectoryW
FindFirstFileW
SetHandleInformation
GetEnvironmentStringsW
FreeEnvironmentStringsW
CompareStringOrdinal
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
GetFileAttributesW
DuplicateHandle
InitializeProcThreadAttributeList
UpdateProcThreadAttribute
DeleteProcThreadAttributeList
GetCurrentProcessId
CreateNamedPipeW
CreateThread
ReadFileEx
SleepEx
WriteFileEx
WaitForMultipleObjects
GetOverlappedResult
GetExitCodeProcess
CreateEventW
CancelIo
ReadFile
ExitProcess
QueryPerformanceCounter
GetCurrentDirectoryW
RtlCaptureContext
RtlLookupFunctionEntry
CreateMutexA
WaitForSingleObjectEx
LoadLibraryA
ReleaseMutex
RtlVirtualUnwind
AcquireSRWLockShared
ReleaseSRWLockShared
DeleteFileW
MoveFileExW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
IsProcessorFeaturePresent

user32

MessageBoxW
SystemParametersInfoW

ws2_32

connect
ioctlsocket
WSASocketW
setsockopt
WSAGetLastError
closesocket
socket
WSAIoctl
WSACleanup
WSAStartup
freeaddrinfo
getaddrinfo
recv
send
shutdown
bind
getsockopt

ntdll

NtCreateFile
NtReadFile
RtlNtStatusToDosError
NtDeviceIoControlFile
NtCancelIoFileEx
NtWriteFile

bcrypt

BCryptGenRandom

vcruntime140

__C_specific_handler
memset
memcmp
memmove
memcpy
__CxxFrameHandler3
__current_exception_context
__current_exception

api-ms-win-crt-math-l1-1-0

log2f
pow
truncf
floorf
__setusermatherr
ceilf

api-ms-win-crt-heap-l1-1-0

free
_set_new_mode

api-ms-win-crt-runtime-l1-1-0

_initialize_narrow_environment
_set_app_type
_initterm
_initterm_e
exit
_exit
_seh_filter_exe
__p___argc
__p___argv
_cexit
_get_initial_narrow_environment
_register_thread_local_exe_atexit_callback
_configure_narrow_argv
_c_exit
terminate
_initialize_onexit_table
_register_onexit_function
_crt_atexit

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 582KB - Virtual size: 581KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 872B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

e47669c7aa998210e7ab6b21e663205c

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

user32

ws2_32

ntdll

bcrypt

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 1.2MB - Virtual size: 1.2MB

.rdata Size: 582KB - Virtual size: 581KB

.data Size: 512B - Virtual size: 872B

.pdata Size: 20KB - Virtual size: 20KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 7KB - Virtual size: 6KB

.text
Size: 1.2MB - Virtual size: 1.2MB

.rdata
Size: 582KB - Virtual size: 581KB

.data
Size: 512B - Virtual size: 872B

.pdata
Size: 20KB - Virtual size: 20KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 7KB - Virtual size: 6KB