2d357e20218ecce7a188d34e2163ac1c[.]zip

Sharing

Copy URL

Twitter E-mail

General

Target

2d357e20218ecce7a188d34e2163ac1c.zip
Size

141KB
MD5

d7ddc1532cb71975cab306673d44ac55
SHA1

f7c069045f9058817566f86477ab7fc733f1998b
SHA256

befeb13d03669a0f610ba500df017d7b1c2155d86cc7e985feb439a867851fe0
SHA512

ba125edc6b8a8f9a0098252b788a64b328ce25aad5e5cd470604dc72926b74cac2c13e909411498250ec83b4ac4f988606e5ffab0f5b4b2b79225a971cbcdef0
SSDEEP

3072:4XyZCJ7cO4Ft68Nf9hdUAilUGVJN2jd+PQZ3jmrM3lCAAvEX:yygJ7cO2U8lzdYfYSsv3lRA8X

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/ed38d0a2443e4c2ea2ccb9c381f06aa11380c1c51117ef3eb9f327e9bca88411

Files

2d357e20218ecce7a188d34e2163ac1c.zip
.zip

Password: infected
ed38d0a2443e4c2ea2ccb9c381f06aa11380c1c51117ef3eb9f327e9bca88411
.exe windows:5 windows x86 arch:x86

Password: infected

a07a52f9260a9a13a9d974f54b55a466

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

nddeapi

NDdeShareAddA
NDdeShareGetInfoA
NDdeShareEnumA
NDdeShareSetInfoA

certcli

CACloseCertType
CACloseCA
CADeleteCA
CAEnumFirstCA

user32

IsDialogMessageW
CreateDesktopA
wsprintfW
LoadIconA
LoadMenuW
GetMessageW
DrawStateW
LoadCursorA
DialogBoxParamA
InsertMenuA
PeekMessageW
GetClassLongA
PostMessageW

kernel32

GetModuleHandleA
WaitNamedPipeA
CreateDirectoryA
EnterCriticalSection
lstrcmp
lstrcmp
CreateMutexA
IsBadStringPtrA
FindFirstFileA
SystemTimeToFileTime
LoadLibraryW
LoadLibraryExW
GetProcAddress
lstrcmp
lstrcmp
lstrcmp

shlwapi

PathIsRootA
UrlIsA
PathCommonPrefixA
UrlGetPartA
UrlGetLocationA
UrlEscapeA
UrlHashA
PathCombineA
UrlCombineA
UrlCreateFromPathA
UrlIsNoHistoryA
UrlUnescapeA
PathCompactPathA

clusapi

ClusterEnum
CloseCluster
ClusterControl
CloseClusterNode
CloseClusterGroup

advapi32

ReadEventLogW
CryptSignHashA
RegOpenKeyA
RegUnLoadKeyA
RegReplaceKeyA
RegCreateKeyExW
OpenEventLogA
RegRestoreKeyW
IsTextUnicode
GetUserNameA
RegEnumKeyW

comsvcs

CoCreateActivity
CoLoadServices
CoEnterServiceDomain
RecycleSurrogate
SafeRef

Sections

.text
Size: 96KB - Virtual size: 96KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.kdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.zdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rcrs
Size: 14.2MB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

a07a52f9260a9a13a9d974f54b55a466

Headers

DLL Characteristics

File Characteristics

Imports

nddeapi

certcli

user32

kernel32

shlwapi

clusapi

advapi32

comsvcs

Sections

.text Size: 96KB - Virtual size: 96KB

.kdata Size: 8KB - Virtual size: 8KB

.zdata Size: 1KB - Virtual size: 1KB

.rcrs Size: 14.2MB - Virtual size: 1KB

.text
Size: 96KB - Virtual size: 96KB

.kdata
Size: 8KB - Virtual size: 8KB

.zdata
Size: 1KB - Virtual size: 1KB

.rcrs
Size: 14.2MB - Virtual size: 1KB