fix[.]zip | Triage™

General

Target
fix.zip
Size 366KB
Sample240826-vhsrtawepj
SHA256 ddcc8c2d5496b09efa3a27a5bd1c9386b5595cb009c980a2703fc8c9f355b3b1
MD5 cff8585ad323864f4f7d238a1d8c44bb
SHA1 0fab9e24d34091d7cbbe07ccddb7e9536ab3a221
SHA512 627dc5ca40475ec43faaba0d3c0f00ee3fd60bb27ced69e87137eb363ba5dd949d0cf77e511ef1f5ca6eb79db1dced1e8dec9663388e00135bbba6803f67b38d
SSDEEP 6144:S7hxy0X5JxYye8AvkhoQokI0fOh7GNgrzKqo8FCv6xI:S7hU0X5Jy5DkhNtI60sCfo8FCCxI
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/fix/x86_64-w64-ranlib.exe

File Explorer

fix.zip

.zip 366KB
fix/msvcp140.dll

489KB
fix/x86_64-w64-ranlib.exe

.exe 240KB

fix.zip

SHA256 ddcc8c2d5496b09efa3a27a5bd1c9386b5595cb009c980a2703fc8c9f355b3b1
MD5 cff8585ad323864f4f7d238a1d8c44bb
SHA1 0fab9e24d34091d7cbbe07ccddb7e9536ab3a221
SHA512 627dc5ca40475ec43faaba0d3c0f00ee3fd60bb27ced69e87137eb363ba5dd949d0cf77e511ef1f5ca6eb79db1dced1e8dec9663388e00135bbba6803f67b38d
SSDEEP 6144:S7hxy0X5JxYye8AvkhoQokI0fOh7GNgrzKqo8FCv6xI:S7hU0X5Jy5DkhNtI60sCfo8FCCxI
MD5 SHA1 SHA512 SSDEEP

Password

changeme

fix/x86_64-w64-ranlib.exe

IMPHASH 2ca53fefee819fb338d7a7a06e21cce5
SHA256 546c34c2782216278a8273d3c9d3a954a980c7c2c7be220914aefe446fe94fd8
MD5 f22f1c4c170a1725d30ee476e6d8ab49
SHA1 4dffb9f7e03b4fa10d7320251a09dae205757a78
SHA512 6313cfafc8d8c2b459039803dc8e53b20d1febf7d395cec3aca8737fe605fe53961c98e5a0140752125032ea329ee84991556de7d6c06f2397d116892482c1a3
SSDEEP 3072:1DjBbSIIgnhE2ilnp1qyJEozan2/5NRnJsDqjUnM6tMhfa37/:1p2Tp0Mjy2Rfn1jEZz
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

changeme

Minor OS version

0

Major OS version

6

Entry point

151321

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CreateFileA CloseHandle ReadFile WriteFile GetCurrentProcess GetModuleHandleA K32GetModuleInformation GetModuleFileNameA CreateFileMappingA MapViewOfFile VirtualProtect GetFileAttributesA SetFileAttributesA DeleteFileA GetFileSize LoadLibraryA WaitForSingleObject UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW WriteConsoleW RaiseException RtlUnwind GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW EncodePointer GetStdHandle GetModuleFileNameW ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW HeapAlloc HeapFree FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetFileType GetStringTypeW CompareStringW LCMapStringW GetProcessHeap HeapSize HeapReAlloc FlushFileBuffers GetConsoleOutputCP GetConsoleMode SetFilePointerEx CreateFileW DecodePointer

Sharing