eff8f73d4e5ffbfd8cb4a8f509e7b5e8[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
eff8f73d4e5ffbfd8cb4a8f509e7b5e8.zip
Size 80KB
Sample240831-jne75ashlf
SHA256 d5941c64e562641077190060c556ff40f0a643014e7fa6a38ab4d9de686757d2
MD5 e7c303914f9d57aeed9c0ab30fda5a79
SHA1 dc4805f8e543ca975b97441fc1acf009f5829d18
SHA512 9f80b55265f4f0f259ceaebe1dec0cd2fddcecac3d51edbaf848db2ac5ea3c9bfaa9215e4fe9f17c4b759d6947f83b80487888a1a1b67f10763a767e4345b181
SSDEEP 1536:ZnTOCd8FKmL6yw2loTA4mxFBNc8Mj3tuodgMnps/90AMU9qVBwMGNzsmXl:Znxa3loE4cb5M5kMnpo90kO+1zsmV
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/2909051344dd80a33dfd47d1cf60372ba535aa3745ed0df8434681a3e715f32d

File Explorer

eff8f73d4e5ffbfd8cb4a8f509e7b5e8.zip

.zip 80KB
2909051344dd80a33dfd47d1cf60372ba535aa3745ed0df8434681a3e715f32d

.exe 135KB

eff8f73d4e5ffbfd8cb4a8f509e7b5e8.zip

SHA256 d5941c64e562641077190060c556ff40f0a643014e7fa6a38ab4d9de686757d2
MD5 e7c303914f9d57aeed9c0ab30fda5a79
SHA1 dc4805f8e543ca975b97441fc1acf009f5829d18
SHA512 9f80b55265f4f0f259ceaebe1dec0cd2fddcecac3d51edbaf848db2ac5ea3c9bfaa9215e4fe9f17c4b759d6947f83b80487888a1a1b67f10763a767e4345b181
SSDEEP 1536:ZnTOCd8FKmL6yw2loTA4mxFBNc8Mj3tuodgMnps/90AMU9qVBwMGNzsmXl:Znxa3loE4cb5M5kMnpo90kO+1zsmV
MD5 SHA1 SHA512 SSDEEP

Password

infected

2909051344dd80a33dfd47d1cf60372ba535aa3745ed0df8434681a3e715f32d

IMPHASH e043befb9ef1f4fe48f2d3182b440d00
SHA256 2909051344dd80a33dfd47d1cf60372ba535aa3745ed0df8434681a3e715f32d
MD5 eff8f73d4e5ffbfd8cb4a8f509e7b5e8
SHA1 bedbda380d25eaa952738340b3d3c3a6b9cc03f2
SHA512 e6e236f195ed860f35bb2ec0fb830744f1f14b4ee00b7f14ae120fc083d3b9461532178e14c0aed38c1070b2326387018e7283d14f64f17d11ac0aef6afa0fb8
SSDEEP 3072:8ir6VutmzgApobYr1fpCjeAaacVoh3EYvp3zoodIy:8E6sEgAmYhfpCCAjNBXd7
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

110870

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msi

ord30 ord8 ord57

gdi32

GetMetaFileBitsEx OffsetWindowOrgEx SetBoundsRect GetEnhMetaFileW CreateEnhMetaFileA CreateBitmapIndirect CreateHalftonePalette GetBkColor StrokePath GetBoundsRect ExtFloodFill GetTextExtentPoint32W GetTextMetricsW PathToRegion SetWindowExtEx SetGraphicsMode GetCurrentObject GetTextExtentPointA

oleaut32

VarDateFromR4 VarI2FromDisp DispGetParam SysReAllocString VarUI1FromR8 VarUI1FromI1

version

GetFileVersionInfoSizeW

kernel32

GetModuleHandleA GetStartupInfoA GlobalFindAtomW FlushFileBuffers GetModuleHandleW

wininet

SetUrlCacheEntryInfoA FindNextUrlCacheEntryExA InternetSetCookieW InternetCloseHandle CreateUrlCacheEntryW FindFirstUrlCacheEntryA InternetAutodialHangup HttpSendRequestExW FtpRenameFileA RetrieveUrlCacheEntryStreamW InternetSetFilePointer GopherCreateLocatorA

ole32

StgCreatePropSetStg

winspool.drv

DeletePrinterConnectionW AddPortA EnumPrinterDriversW AddPrintProcessorW EnumPrinterDataA DeletePrintProcessorA FindNextPrinterChangeNotification FindFirstPrinterChangeNotification DeleteMonitorA SetPortA DocumentPropertiesA EnumFormsA

setupapi

SetupCloseLog

pdh

PdhValidatePathA PdhGetLogFileSize

user32

CallMsgFilterW DdeAccessData GetWindowContextHelpId DeleteMenu InsertMenuA CharUpperBuffW SendMessageTimeoutA GetClassInfoExW DdeQueryConvInfo CreateDialogParamA GetMessagePos SetProcessWindowStation MessageBoxW CallNextHookEx IsWindow DrawFrameControl GetNextDlgTabItem GetClipboardFormatNameW GetWindowTextLengthW GetKeyboardType DrawAnimatedRects GetMessageA

msvcrt

_adjust_fdiv _except_handler3 _exit _controlfp __set_app_type __p__fmode __p__commode memcmp __setusermatherr _initterm __getmainargs _acmdln exit _XcptFilter

advapi32

SetNamedSecurityInfoW EnumServicesStatusW RegOpenKeyW RegEnumValueA RegUnLoadKeyW RegEnumKeyExA CreateProcessAsUserW AdjustTokenPrivileges

rpcrt4

RpcMgmtInqStats I_RpcBindingIsClientLocal NdrNonEncapsulatedUnionUnmarshall NDRSContextUnmarshallEx RpcAsyncInitializeHandle NdrConformantStructMarshall RpcSmSetThreadHandle I_RpcFreeBuffer NdrEncapsulatedUnionMemorySize I_RpcBindingCopy MIDL_wchar_strcpy float_from_ndr NdrFreeBuffer NdrUserMarshalSimpleTypeConvert RpcServerUseProtseqExW NdrSimpleStructFree I_RpcGetCurrentCallHandle I_RpcBindingInqTransportType I_RpcAsyncSetHandle RpcBindingInqAuthClientW UuidFromStringA NdrSimpleStructMarshall

imm32

ImmGetIMEFileNameW

rasapi32

RasDialA

oleacc

WindowFromAccessibleObject