CWindowsSysWOW64WindowsPowerShellv1[.]0[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

CWindowsSysWOW64WindowsPowerShellv1.0.zip
Size

390KB
MD5

72208c9824a0905eea78504bf5548f3f
SHA1

e012154db658386640ea258b40669cef453f76d0
SHA256

bcbbc75f0392d1ff67305d49fdf9be5e336fbc3ab8efb9692d11d59b284b4bcb
SHA512

6ae58ba22057b05580f78ba7abc5bc1317cc002e28a5763fcfb154e9bc92d274bd13ef4e7ff5610e1d22e72f007450b50780f2dc7ecd5c66a9458971c0fcc613
SSDEEP

12288:/ajN1wx+1Bl/kpck0hcMgdFsxQPxnKsoiL5qI/WciB:ijXrZ/IcnhEs2lKsouDecs

Score

3^/10

Malware Config

Signatures

Unsigned PE 5 IoCs

Checks for missing Authenticode signature.

resource
unpack001/PSEvents.dll
unpack001/powershell.exe
unpack001/powershell_ise.exe
unpack001/pspluginwkr.dll
unpack001/pwrshmsg.dll

Files

CWindowsSysWOW64WindowsPowerShellv1.0.zip
.zip
Certificate.format.ps1xml
Diagnostics.Format.ps1xml
DotNetTypes.format.ps1xml
.xml
Event.Format.ps1xml
FileSystem.format.ps1xml
Help.format.ps1xml
.ps1
HelpV3.format.ps1xml
.xml
PSEvents.dll
.dll windows:10 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.text
Size: 512B - Virtual size: 224B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 54KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
PowerShellCore.format.ps1xml
.ps1
PowerShellTrace.format.ps1xml
Registry.format.ps1xml
WSMan.Format.ps1xml
getevent.types.ps1xml
.ps1
powershell.exe
.exe windows:10 windows x86 arch:x86

9f91c97560360686d37b0e311bb8bd64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

powershell.pdb

Imports

msvcrt

__dllonexit
_unlock
_lock
_except_handler4_common
_initterm
__setusermatherr
__p__fmode
_cexit
_exit
exit
__set_app_type
_onexit
memcmp
__wgetmainargs
__CxxFrameHandler3
_controlfp
_vsnwprintf
_wcsicmp
_wcsnicmp
fclose
_wfopen
??1type_info@@UAE@XZ
wcstoul
wcschr
__uncaught_exception
_amsg_exit
__p__commode
_XcptFilter
memmove
memcpy
_CxxThrowException
?what@exception@@UBEPBDXZ
??1exception@@UAE@XZ
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@ABQBDH@Z
??0exception@@QAE@ABQBD@Z
_callnewh
malloc
wcsncmp
wcsrchr
free
_purecall
??3@YAXPAX@Z
memcpy_s
??_V@YAXPAX@Z
_itow_s
?terminate@@YAXXZ
memset

atl

ord30

kernel32

FindResourceExW
LCIDToLocaleName
UnmapViewOfFile
GetVersionExW
GetLocaleInfoW
GetUserDefaultUILanguage
GetLocaleInfoEx
GetSystemDefaultUILanguage
SearchPathW
LoadResource
GetTickCount
FreeLibrary
GetCurrentThreadId
QueryPerformanceCounter
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SleepConditionVariableSRW
CreateFileMappingW
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
Sleep
IsWow64Process
SetConsoleTitleW
GetFileType
VerifyVersionInfoW
GetSystemTimeAsFileTime
GetStartupInfoW
MapViewOfFile
FindFirstFileW
LoadLibraryExW
GetModuleHandleW
CompareStringW
GetModuleHandleExW
SetLastError
GetCurrentProcessId
GetCurrentProcess
GetStdHandle
WriteFile
VerSetConditionMask
ExpandEnvironmentStringsW
LocalFree
WriteConsoleW
GetModuleFileNameW
GetProcAddress
SetThreadUILanguage
K32GetModuleFileNameExW
SetErrorMode
WakeAllConditionVariable
FindClose
CreateFileW
GetFileAttributesW
OpenProcess
CreateToolhelp32Snapshot
Process32FirstW
FormatMessageW
CloseHandle
Process32NextW
GetLastError

oleaut32

SysFreeString
SafeArrayPutElement
SafeArrayCreate
SysAllocString
SysStringLen
VariantClear

advapi32

EventSetInformation
RegEnumKeyExW
RegGetValueW
EventUnregister
EventRegister
EventWriteTransfer
RegQueryValueExW
RegCloseKey
RegOpenKeyExW

ole32

CoInitialize
PropVariantClear
CoTaskMemAlloc
CoUninitialize
CoCreateInstance
CoInitializeEx

user32

LoadStringW

mscoree

CorBindToRuntimeEx

Sections

.text
Size: 53KB - Virtual size: 53KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 351KB - Virtual size: 351KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
powershell.exe.config
powershell_ise.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

powershell_ise.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 69KB - Virtual size: 69KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 138KB - Virtual size: 137KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
powershell_ise.exe.config
.xml
pspluginwkr.dll
.dll windows:6 windows x86 arch:x86

42e96c9d6b7177141016b69f4c2c69aa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

pspluginwkr.pdb

Imports

msvcrt

isleadbyte
__badioinfo
__pioinfo
_iob
_fileno
_isatty
_callnewh
?terminate@@YAXXZ
abort
memmove
_cexit
wcsncmp
??2@YAPAXI@Z
_CxxThrowException
??0exception@@QAE@ABQBD@Z
??0exception@@QAE@XZ
??1exception@@UAE@XZ
_except_handler4_common
_vsnwprintf
memset
_wcsnicmp
_wcsicmp
memcpy
bsearch
??1type_info@@UAE@XZ
??3@YAXPAX@Z
_amsg_exit
_initterm
free
malloc
_XcptFilter
_errno
?what@exception@@UBEPBDXZ
_snprintf
_itoa
wctomb
_lseeki64
_write
??0exception@@QAE@ABV0@@Z

kernel32

GetVersionExW
CreateFileW
CreateFileMappingW
CloseHandle
MapViewOfFile
LoadLibraryExW
LoadResource
FindResourceExW
UnregisterWaitEx
FormatMessageW
LocalFree
GetLocaleInfoW
Sleep
InterlockedCompareExchange
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InterlockedIncrement
InterlockedDecrement
FreeLibrary
UnmapViewOfFile
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
SearchPathW
InterlockedExchange
OutputDebugStringA
GetLastError
GetVersion
SetLastError
VirtualQuery
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
RegisterWaitForSingleObject

mscoree

CorBindToRuntimeEx
_CorDllMain

ole32

CoCreateInstance

advapi32

RegOpenKeyExW
RegQueryValueExW
RegCloseKey
EventWrite
EventUnregister
EventRegister
EventActivityIdControl
EventWriteTransfer

wsmsvc

WSManPluginOperationComplete
WSManPluginReceiveResult
WSManPluginGetOperationParameters
WSManPluginReportContext

Exports

Exports

InitPlugin
WSManPluginCommand
WSManPluginReceive
WSManPluginReleaseCommandContext
WSManPluginReleaseShellContext
WSManPluginSend
WSManPluginShell
WSManPluginSignal

Sections

.text
Size: 139KB - Virtual size: 139KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
pwrshmsg.dll
.dll windows:10 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.text
Size: 512B - Virtual size: 224B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
types.ps1xml
.ps1
typesv3.ps1xml

Sharing

General

Malware Config

Signatures

Files

Headers

DLL Characteristics

File Characteristics

Sections

.text Size: 512B - Virtual size: 224B

.rsrc Size: 54KB - Virtual size: 53KB

9f91c97560360686d37b0e311bb8bd64

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

atl

kernel32

oleaut32

advapi32

ole32

user32

mscoree

Sections

.text Size: 53KB - Virtual size: 53KB

.data Size: 1024B - Virtual size: 2KB

.idata Size: 3KB - Virtual size: 3KB

.rsrc Size: 351KB - Virtual size: 351KB

.reloc Size: 3KB - Virtual size: 3KB

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mscoree

Sections

.text Size: 69KB - Virtual size: 69KB

.rsrc Size: 138KB - Virtual size: 137KB

.reloc Size: 512B - Virtual size: 12B

42e96c9d6b7177141016b69f4c2c69aa

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

kernel32

mscoree

ole32

advapi32

wsmsvc

Exports

Exports

Sections

.text Size: 139KB - Virtual size: 139KB

.data Size: 1024B - Virtual size: 9KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 7KB - Virtual size: 7KB

Headers

DLL Characteristics

File Characteristics

Sections

.text Size: 512B - Virtual size: 224B

.rsrc Size: 1KB - Virtual size: 1KB

.text
Size: 512B - Virtual size: 224B

.rsrc
Size: 54KB - Virtual size: 53KB

.text
Size: 53KB - Virtual size: 53KB

.data
Size: 1024B - Virtual size: 2KB

.idata
Size: 3KB - Virtual size: 3KB

.rsrc
Size: 351KB - Virtual size: 351KB

.reloc
Size: 3KB - Virtual size: 3KB

.text
Size: 69KB - Virtual size: 69KB

.rsrc
Size: 138KB - Virtual size: 137KB

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 139KB - Virtual size: 139KB

.data
Size: 1024B - Virtual size: 9KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 7KB - Virtual size: 7KB

.text
Size: 512B - Virtual size: 224B

.rsrc
Size: 1KB - Virtual size: 1KB