59ae11cae7df961a8364a2432362c0bb[.]zip

Sharing

Copy URL

Twitter E-mail

General

Target

59ae11cae7df961a8364a2432362c0bb.zip
Size

401KB
MD5

fbe8d370ab5b54cfce31bab6be66573b
SHA1

370a84821935a335c34296564004c70a956f121e
SHA256

4ed17d1cc1320d3091d03f9c2938e47c06a10610747f49b429041d212716552f
SHA512

a52dc83ad279f02f927b7570ce6ef532ef417f43bf9404a2a361c6858adddd9fe145cc2ed182ab324c5f2b53e3fe9a4e3d0143353c46adb970943c955a59398d
SSDEEP

6144:6VyuItZii15+iZIiylkEcm2yCh6o4vUYask1wzNG6Ck8IUCb:6kciyIGlk4m3YyWNnUK

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/0d2a42f6f45780087afda39f76cf4786ca425228eede08b349d72d7c2dbf7e68

Files

59ae11cae7df961a8364a2432362c0bb.zip
.zip

Password: infected
0d2a42f6f45780087afda39f76cf4786ca425228eede08b349d72d7c2dbf7e68
.exe windows:10 windows x64 arch:x64

Password: infected

28877d46492df107820e0b11fd73235f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

TieringEngineService.pdb

Imports

msvcrt

_lock
__CxxFrameHandler3
??1type_info@@UEAA@XZ
?terminate@@YAXXZ
_unlock
__dllonexit
_onexit
realloc
_CxxThrowException
_vsnwprintf
wcsncmp
_snwprintf_s
wcsstr
wcscat_s
_commode
_fmode
_wcmdln
_initterm
__setusermatherr
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
_XcptFilter
wcscpy_s
_callnewh
malloc
free
_purecall
__C_specific_handler
swprintf_s
memset

ntdll

RtlSetBits
RtlInitializeBitMap
RtlCreateSystemVolumeInformationFolder
NtQueryInformationFile
NtSetInformationFile
RtlCopyUnicodeString
RtlDoesNameContainWildCards
NtFsControlFile
NtWaitForSingleObject
NtOpenFile
RtlGetThreadErrorMode
RtlNumberOfClearBits
WinSqmAddToStreamEx
RtlStringFromGUID
WinSqmEndSession
WinSqmStartSession
NtClose
RtlNtStatusToDosError
RtlGUIDFromString
RtlCompareUnicodeString
RtlInitUnicodeString
RtlCompareMemory
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlSetThreadErrorMode

oleaut32

VariantClear
SysAllocString
VariantInit
SysFreeString

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
TraceMessage
UnregisterTraceGuids
GetTraceLoggerHandle

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
GetLastError
RaiseException
SetUnhandledExceptionFilter

api-ms-win-core-com-l1-1-0

CoTaskMemFree
CoTaskMemAlloc
CoMarshalInterface
CoReleaseMarshalData
CoUnmarshalInterface
CoRevokeClassObject
CoInitializeEx
CoUninitialize
CoResumeClassObjects
CoRegisterClassObject
CreateStreamOnHGlobal
CoCreateGuid
CoCreateInstance
CoSuspendClassObjects

api-ms-win-core-synch-l1-1-0

SetEvent
ReleaseSRWLockShared
CreateEventW
InitializeCriticalSection
AcquireSRWLockShared
DeleteCriticalSection
AcquireSRWLockExclusive
InitializeSRWLock
ReleaseSRWLockExclusive
WaitForSingleObject
ResetEvent

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventWriteTransfer
EventSetInformation
EventUnregister

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW
LoadStringW
GetModuleHandleW

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
GetCurrentThreadId
GetCurrentProcessId
CreateThread
TerminateProcess
OpenProcessToken
GetStartupInfoW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-service-core-l1-1-0

StartServiceCtrlDispatcherW
SetServiceStatus

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-service-winsvc-l1-1-0

RegisterServiceCtrlHandlerW

api-ms-win-core-threadpool-l1-2-0

CreateThreadpoolCleanupGroup
CloseThreadpoolWork
CloseThreadpoolCleanupGroupMembers
CloseThreadpoolCleanupGroup
CreateThreadpoolTimer
WaitForThreadpoolWorkCallbacks
WaitForThreadpoolWaitCallbacks
CloseThreadpoolWait
CloseThreadpool
CreateThreadpoolWait
SetThreadpoolTimer
SetThreadpoolWait
SubmitThreadpoolWork
SetThreadpoolThreadMinimum
WaitForThreadpoolTimerCallbacks
SetThreadpoolThreadMaximum
CreateThreadpool
FreeLibraryWhenCallbackReturns
CreateThreadpoolWork

api-ms-win-core-string-l1-1-0

CompareStringW

api-ms-win-core-processenvironment-l1-1-0

SetCurrentDirectoryW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount
GetSystemWindowsDirectoryW

api-ms-win-core-synch-l1-2-1

CreateSemaphoreW

api-ms-win-core-file-l1-1-0

FindFirstVolumeW
FindVolumeClose
FindNextVolumeW
FindFirstFileW
FindNextFileW
GetFileAttributesW
CreateDirectoryW
FindClose
GetVolumePathNameW
GetFinalPathNameByHandleW
CreateFileW
DeleteFileW

api-ms-win-core-registry-l1-1-0

RegGetValueW
RegNotifyChangeKeyValue
RegCreateKeyExW

api-ms-win-eventing-controller-l1-1-0

EnableTraceEx2
ControlTraceW
StartTraceW

api-ms-win-eventing-consumer-l1-1-0

OpenTraceW
CloseTrace
ProcessTrace

api-ms-win-core-file-l1-2-0

GetVolumeNameForVolumeMountPointW

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-security-lsalookup-l2-1-0

LookupPrivilegeValueW

api-ms-win-security-base-l1-1-0

PrivilegeCheck
AdjustTokenPrivileges

api-ms-win-core-localization-l1-2-0

GetLocaleInfoW

api-ms-win-core-file-l2-1-0

GetFileInformationByHandleEx

api-ms-win-core-path-l1-1-0

PathCchRemoveFileSpec
PathCchStripPrefix
PathCchStripToRoot
PathCchSkipRoot

api-ms-win-core-file-l2-1-1

OpenFileById

api-ms-win-devices-config-l1-1-1

CM_Register_Notification
CM_Unregister_Notification

api-ms-win-core-realtime-l1-1-0

QueryUnbiasedInterruptTime

api-ms-win-core-file-l2-1-2

CopyFileW

api-ms-win-core-kernel32-legacy-l1-1-0

MoveFileW

esent

JetCreateTableColumnIndex2W
JetOpenTableW
JetDeleteTableW
JetSetCurrentIndexW
JetCreateDatabase2W
JetOpenDatabaseW
JetAttachDatabase2W
JetBeginSessionW
JetGetColumnInfoW
JetCloseDatabase
JetCloseTable
JetInit3W
JetTerm2
JetSetSystemParameterW
JetCreateInstance2W
JetEnableMultiInstanceW
JetResetSessionContext
JetSetSessionContext
JetComputeStats
JetGetObjectInfoW
JetEndSession
JetRollback
JetRetrieveColumns
JetSetColumns
JetPrepareUpdate
JetUpdate
JetMove
JetMakeKey
JetSeek
JetBeginTransaction
JetRetrieveColumn
JetDelete
JetCommitTransaction
JetOpenTempTable

clusapi

GetClusterInformation
CloseCluster
OpenCluster

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Sections

.text
Size: 253KB - Virtual size: 253KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 39KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 396KB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

28877d46492df107820e0b11fd73235f

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

oleaut32

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-service-core-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-service-winsvc-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-file-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-eventing-controller-l1-1-0

api-ms-win-eventing-consumer-l1-1-0

api-ms-win-core-file-l1-2-0

api-ms-win-core-io-l1-1-0

api-ms-win-security-lsalookup-l2-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-file-l2-1-0

api-ms-win-core-path-l1-1-0

api-ms-win-core-file-l2-1-1

api-ms-win-devices-config-l1-1-1

api-ms-win-core-realtime-l1-1-0

api-ms-win-core-file-l2-1-2

api-ms-win-core-kernel32-legacy-l1-1-0

esent

clusapi

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Sections

.text Size: 253KB - Virtual size: 253KB

.rdata Size: 39KB - Virtual size: 39KB

.data Size: 1024B - Virtual size: 3KB

.pdata Size: 6KB - Virtual size: 5KB

.didat Size: 512B - Virtual size: 16B

.rsrc Size: 7KB - Virtual size: 7KB

.reloc Size: 396KB - Virtual size: 1.1MB

.text
Size: 253KB - Virtual size: 253KB

.rdata
Size: 39KB - Virtual size: 39KB

.data
Size: 1024B - Virtual size: 3KB

.pdata
Size: 6KB - Virtual size: 5KB

.didat
Size: 512B - Virtual size: 16B

.rsrc
Size: 7KB - Virtual size: 7KB

.reloc
Size: 396KB - Virtual size: 1.1MB