18777909570[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

18777909570.zip
Size

129KB
MD5

ed1026b3c6ab944783846fb9ec0913cf
SHA1

6c8f4c9ee1948f11a46295f39fe4681f0f6ba108
SHA256

beda279cffa7c3b2b689680cbf0ac4d8c5c41c485f2039fff247ea2399582073
SHA512

a2f756d0bc82ea0fc8916325e015984ab0ccbcd1bf5292069b6522aa4148d303f52715ce8a9d0b23ce3376c69be302ff52fe4ed51a67481e39697e844a022d24
SSDEEP

3072:ginfxYKmNNHPJQhktMstzC7SMMM878FBFmi8Mezxgfm4OX:g+WKmNNPq2MKzMMmoiszW1S

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/6827d2c3153bbdba8ecd387e55d07535676eb7b1bd1633faad865c5055e16076

Files

18777909570.zip
.zip

Password: infected
6827d2c3153bbdba8ecd387e55d07535676eb7b1bd1633faad865c5055e16076
.exe windows:6 windows x86 arch:x86

Password: infected

7d2dbc8c81fc75a012f01cf4d8c3f431

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

ie4uinit.pdb

Imports

advapi32

RegCreateKeyExW
RegQueryValueExW
RegEnumValueW
RegOpenKeyExW
RegCloseKey
RegSetValueExW
RegCreateKeyW
RegSetValueW
RegOpenKeyW
RegQueryInfoKeyW
RegDeleteKeyW
RegDeleteValueW
RegEnumKeyExW
RegGetValueW
OpenThreadToken
CryptEncrypt
CryptGetKeyParam
CryptSetKeyParam
CryptDeriveKey
CryptDestroyKey
CryptVerifySignatureW
CryptSetHashParam
CryptGenRandom
CryptDestroyHash
CryptGetHashParam
CryptHashData
CryptCreateHash
CryptReleaseContext
CryptAcquireContextW
ConvertSidToStringSidW
EventWrite
GetNamedSecurityInfoW
SetNamedSecurityInfoW
AddMandatoryAce
SetSecurityDescriptorSacl
GetSecurityDescriptorSacl
IsValidSid
CopySid
GetTokenInformation
OpenProcessToken
GetSecurityDescriptorDacl
GetLengthSid
AddAce
FreeSid
ConvertStringSecurityDescriptorToSecurityDescriptorW
AllocateAndInitializeSid
InitializeAcl
SetKernelObjectSecurity
GetAce
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
EqualSid
GetKernelObjectSecurity
AddAccessAllowedAceEx
GetSidSubAuthorityCount
DeleteAce
GetSidSubAuthority
GetSidIdentifierAuthority
ConvertStringSidToSidW
CheckTokenMembership

kernel32

GetCurrentThread
FreeLibrary
SetErrorMode
GetEnvironmentVariableW
QueueUserWorkItem
QueryPerformanceFrequency
LCMapStringW
GetSystemTime
GetUserDefaultLocaleName
OpenFileMappingW
CreateFileMappingW
OpenMutexW
GetFileSizeEx
FlushFileBuffers
SetFileTime
FlushViewOfFile
SystemTimeToFileTime
SetEndOfFile
UnmapViewOfFile
MapViewOfFile
GetFullPathNameW
ReleaseMutex
GetSystemInfo
GetSystemDefaultLangID
GetUserPreferredUILanguages
MultiByteToWideChar
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
CreateMutexW
RaiseException
VirtualAlloc
GetFileAttributesW
OpenProcess
GetProcessHeap
HeapFree
HeapAlloc
LocalAlloc
WideCharToMultiByte
GetNativeSystemInfo
IsWow64Process
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetModuleHandleA
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetStartupInfoW
GetModuleHandleW
GetSystemDirectoryW
LoadLibraryW
ExpandEnvironmentStringsW
DuplicateHandle
GetStdHandle
GetTempPathW
GetExitCodeProcess
CompareStringOrdinal
WaitForSingleObject
GetTempFileNameW
SetFilePointer
SetFileAttributesW
DeleteFileW
CloseHandle
GetVersionExA
GetShortPathNameW
FindNextFileW
SetCurrentDirectoryW
LockResource
FindClose
GetCurrentDirectoryW
lstrcmpW
CreateFileW
ReadFile
SizeofResource
WriteFile
GetTickCount
FindFirstFileExW
CreateDirectoryW
GetCurrentProcess
CreateProcessW
LoadResource
FindResourceW
FindFirstFileW
SetPriorityClass
LocalFree
HeapSetInformation
GetProcAddress
GetLastError
GetModuleFileNameW
GetVersionExW
Sleep

user32

CharNextW
GetShellWindow
SendMessageTimeoutW
LoadStringW
PostMessageW

msvcrt

_vsnwprintf_s
_purecall
rand_s
wcscat_s
iswalpha
wcschr
memset
wcsnlen
strnlen
??_V@YAXPAX@Z
sprintf_s
_wfopen_s
fgetws
swscanf_s
fclose
??2@YAPAXI@Z
_XcptFilter
isalnum
_wtoi
_ultow_s
wcsrchr
_wcsnicmp
??_U@YAPAXI@Z
_time64
_vsnwprintf
??3@YAXPAX@Z
_CxxThrowException
memcmp
wcsncpy_s
_onexit
__dllonexit
_unlock
_lock
_except_handler4_common
_controlfp
?terminate@@YAXXZ
??1type_info@@UAE@XZ
_wcmdln
_initterm
__setusermatherr
__p__fmode
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
__p__commode
memcpy_s

shell32

CommandLineToArgvW
SHSetLocalizedName
ord190
SHChangeNotify
SHCreateItemFromParsingName
SHGetSpecialFolderLocation
SHGetKnownFolderPath
ord526
SHGetDesktopFolder
ord155
ord165
SHGetFolderPathW
SHGetSpecialFolderPathW

ieadvpack

ExecuteCabW
RegRestoreAllW

shlwapi

SHCopyKeyW
StrCmpIW
SHRegSetUSValueW
ord388
PathFileExistsW
SHDeleteKeyW
StrCmpNIW
PathFindFileNameW
SHDeleteValueW
PathRemoveBlanksW
SHGetValueW
SHSetValueW
SHStrDupW
ord158
SHRegDeleteUSValueW
StrStrW
SHRegGetUSValueW
StrTrimW
PathRemoveExtensionW
ord2
UrlCreateFromPathW
UrlCanonicalizeW
UrlApplySchemeW
PathIsURLW
StrCmpNIA
ord487
UrlEscapeW
UrlUnescapeW
PathIsNetworkPathW
StrStrIW
ord219
ord433
StrCmpW
StrCmpNA
StrCmpNW

iertutil

ord151
ord701
ord654
ord665
ord660
ord675
ord678
ord672
ord655
ord682
ord651
ord657
ord650
ord652
ord653
ord662
ord91
ord74
ord81
ord90
ord76
ord85
ord79
ord134
ord398
ord791
ord559
ord281
ord282
ord677
ord558

oleaut32

VariantClear
SysStringByteLen
VarBstrCat
SysAllocStringLen
VarBstrCmp
SysAllocStringByteLen
VariantCopy
SysStringLen
SysFreeString
VariantInit
SysAllocString

ole32

OleInitialize
OleUninitialize
CoCreateInstance
CoUninitialize
PropVariantClear
CoTaskMemFree
CoInitializeEx
StringFromGUID2
CoCreateGuid

iedkcs32

BrandIEActiveSetup

crypt32

CertGetIntendedKeyUsage
CertGetEnhancedKeyUsage
CryptStringToBinaryW
CertGetNameStringW
CertOpenStore
CertCreateCertificateContext
CertAddCertificateContextToStore
CertFreeCertificateContext
CertCloseStore
CertFindCertificateInStore
CryptImportPublicKeyInfo
CertGetCertificateChain
CertVerifyCertificateChainPolicy
CertFreeCertificateChain
CryptHashCertificate
CryptStringToBinaryA
CryptBinaryToStringA
CertGetCertificateContextProperty
CertEnumCertificatesInStore

urlmon

CreateIUriBuilder
CreateUri
ord410
ord414
CoInternetCreateSecurityManager

wininet

InternetReadFile
HttpSendRequestW
InternetCanonicalizeUrlW
InternetCrackUrlW
InternetOpenW
InternetConnectW
HttpOpenRequestW
InternetCloseHandle
HttpQueryInfoW

slc

SLGetWindowsInformation

netapi32

NetApiBufferFree
NetGetJoinInformation

version

VerQueryValueW
GetFileVersionInfoSizeExW
GetFileVersionInfoExW

mlang

ord123

Sections

.text
Size: 140KB - Virtual size: 139KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 511KB - Virtual size: 511KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 34KB - Virtual size: 35KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

7d2dbc8c81fc75a012f01cf4d8c3f431

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

user32

msvcrt

shell32

ieadvpack

shlwapi

iertutil

oleaut32

ole32

iedkcs32

crypt32

urlmon

wininet

slc

netapi32

version

mlang

Sections

.text Size: 140KB - Virtual size: 139KB

.data Size: 1024B - Virtual size: 2KB

.idata Size: 9KB - Virtual size: 8KB

.rsrc Size: 511KB - Virtual size: 511KB

.reloc Size: 34KB - Virtual size: 35KB

.text
Size: 140KB - Virtual size: 139KB

.data
Size: 1024B - Virtual size: 2KB

.idata
Size: 9KB - Virtual size: 8KB

.rsrc
Size: 511KB - Virtual size: 511KB

.reloc
Size: 34KB - Virtual size: 35KB