53ae3c780a2e4ea216456700149287c3[.]zip | Triage

Sharing

General

Target

53ae3c780a2e4ea216456700149287c3.zip
Size

262KB
MD5

a1addd36d46258b9e7628f2b531b2e67
SHA1

bfc84ec7e1bdbedc8c2c731c2b93106a0d41c0e9
SHA256

972ce8dd5e44ea0d65447c3c591014320e0f53caa8c5e3f03d69e6c09105a2ae
SHA512

2910b807d539e7942ff773bab28f8f8e214b8f1464e7c403f6dcd0369dde6250582e95a1e7f8376170cd5727e4fdc8af125d05cbea58f3112ee482989bced5b2
SSDEEP

6144:+l3Dx6mPs8HwLkA+c3IqIFXMYsH6xR10bpAxJJ:+NA8HwLkAR4qiXMBarmVA9

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/430c2e05eca22f5537f141dd06e0d8861c0d4e0eda157a18070b13e655b62128

Files

53ae3c780a2e4ea216456700149287c3.zip
.zip

Password: infected
430c2e05eca22f5537f141dd06e0d8861c0d4e0eda157a18070b13e655b62128
.dll windows:6 windows x86 arch:x86

Password: infected

5fa5234c56c604654f201a027c1f2ff7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CreateFileA
GetLastError
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
WaitForSingleObject
WaitForMultipleObjects
GetProcAddress
LoadLibraryA
WideCharToMultiByte

Exports

Exports

DorntErl

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 424KB - Virtual size: 424KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 144B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 112B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ