88649f9a7c8ece46ce0c7f0a20e2bafe[.]zip

General

Target
88649f9a7c8ece46ce0c7f0a20e2bafe.zip
Size 255KB
Sample240831-mt1b2azbqd
SHA256 81487842c28a62ebd1ede9726fdcd5c0673fb314029f647956477fefaebd8cc8
MD5 67bea3a8c5ef2cc63163375b1b1abd62
SHA1 309f42b053467577e8565d8fcac8476513879694
SHA512 51d2a2d8bcbfb0e542b75b864e2830c555f327b89d7372c21eaf3b12a0343a5d4c5206559135932997fa8ed615228b4864891b98fc3448f6a1edc1fd9d9317e1
SSDEEP 6144:IARMzc9qJmeXw+0vANCtWR/6b2ISNRk1OQrgvibmz7:Pizc3ei8CwRSzSg1Lrz2
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/cb08c1a765482a557630fedcc246c7c957ca7748277999c799699b6c1b9f1bc2

File Explorer

88649f9a7c8ece46ce0c7f0a20e2bafe.zip

.zip 255KB
cb08c1a765482a557630fedcc246c7c957ca7748277999c799699b6c1b9f1bc2

.exe 418KB

88649f9a7c8ece46ce0c7f0a20e2bafe.zip

SHA256 81487842c28a62ebd1ede9726fdcd5c0673fb314029f647956477fefaebd8cc8
MD5 67bea3a8c5ef2cc63163375b1b1abd62
SHA1 309f42b053467577e8565d8fcac8476513879694
SHA512 51d2a2d8bcbfb0e542b75b864e2830c555f327b89d7372c21eaf3b12a0343a5d4c5206559135932997fa8ed615228b4864891b98fc3448f6a1edc1fd9d9317e1
SSDEEP 6144:IARMzc9qJmeXw+0vANCtWR/6b2ISNRk1OQrgvibmz7:Pizc3ei8CwRSzSg1Lrz2
MD5 SHA1 SHA512 SSDEEP

Password

infected

cb08c1a765482a557630fedcc246c7c957ca7748277999c799699b6c1b9f1bc2

IMPHASH b4cda15a674ef12000829b9be50880b2
SHA256 cb08c1a765482a557630fedcc246c7c957ca7748277999c799699b6c1b9f1bc2
MD5 88649f9a7c8ece46ce0c7f0a20e2bafe
SHA1 98b5dbb26e1d1cadb73854806a65d6bc20d4f244
SHA512 01fdb806c514c0e66fade3fc0fa696a6838cfb41c5f70252d7222cab8ab4ac6780fba48bf141afa87f37435709156e2a9d8eb172cf4167c87fc61274d51bcd34
SSDEEP 6144:ZcP/Hw+4h1qwar0MESciulCVWsUbdcCGadwOyjyeG0nNN7w9:Zyfg1qwarEScTlCVDAdcCGad6jPG0
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

1

Major OS version

5

Entry point

233536

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\busenalamamer34\vig.pdb

kernel32

InterlockedDecrement FindFirstFileExW OutputDebugStringW GetModuleHandleW GetTickCount IsBadReadPtr GetConsoleAliasesLengthA SetFileShortNameW TerminateThread GetVersionExW LocalHandle GetModuleFileNameW GetEnvironmentVariableA ExitThread lstrlenW GetStartupInfoW GetConsoleOutputCP SetCurrentDirectoryA GetCurrentDirectoryW SetLastError GetProcAddress GetLongPathNameA MoveFileW WriteProfileSectionA CopyFileA GlobalGetAtomNameA SearchPathA _hwrite OpenWaitableTimerA LoadLibraryA ProcessIdToSessionId OpenWaitableTimerW LocalAlloc WriteProfileSectionW GetOEMCP GetProcessShutdownParameters FreeEnvironmentStringsW CompareStringA GetFileTime GetWindowsDirectoryW DeleteTimerQueueTimer DeleteFileW AddConsoleAliasA CloseHandle CreateFileW WideCharToMultiByte InterlockedIncrement MultiByteToWideChar InterlockedExchange EncodePointer DecodePointer InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection HeapValidate GetCommandLineW HeapSetInformation GetCPInfo RtlUnwind RaiseException LCMapStringW TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent InitializeCriticalSectionAndSpinCount HeapAlloc GetModuleFileNameA GetLastError HeapReAlloc HeapSize HeapQueryInformation HeapFree HeapCreate GetACP IsValidCodePage TlsAlloc TlsGetValue TlsSetValue GetCurrentThreadId TlsFree QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime ExitProcess GetEnvironmentStringsW SetHandleCount GetStdHandle GetFileType WriteFile GetStringTypeW GetLocaleInfoW OutputDebugStringA WriteConsoleW LoadLibraryW GetLocaleInfoA IsValidLocale EnumSystemLocalesA GetUserDefaultLCID SetFilePointer GetConsoleCP GetConsoleMode SetStdHandle FlushFileBuffers

user32

GetAltTabInfoW

Sharing