1a7a48edfa76179155983ed5b49f9812[.]zip | Triage

Sharing

Copy URL Twitter E-mail

General

Target

1a7a48edfa76179155983ed5b49f9812.zip
Size

11KB
MD5

06503056b0295df1304fcf6d1d561013
SHA1

67e370844bc2379408747acad74db4a8217df057
SHA256

70132de4b1d1bd750f31d01324d4cf5104c8ff76f4c9042973c05abd7f0cb698
SHA512

90cc3a5fcc2acb9f609bcf09371889e0df1c212e47a4ee84a77a0eaf5e959d8cac38be87489a2cea76f036921ffa201c4a1e0443bfc8570e2d58bdfc178a585a
SSDEEP

192:3lql9RY5vg4tkU38Nx8kICewdv31uee8xrr0l797fN9c18YaWG6ynhm:u9RY5I4tkPfNvl48xrAd97NeeYaWH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/9f3edf9d954190069d624116c95a39ccde0db598fb7db1fddcdca820371b52fe

Files

1a7a48edfa76179155983ed5b49f9812.zip
.zip

Password: infected
9f3edf9d954190069d624116c95a39ccde0db598fb7db1fddcdca820371b52fe
.exe windows:4 windows x86 arch:x86

Password: infected

1fce7f41674c331756fcf74a3278cdec

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

user32

SendMessageA
DestroyWindow
PostQuitMessage
DefWindowProcA
CreateWindowExA
LoadIconA
RegisterClassExA
LoadBitmapA
GetMessageA
TranslateAcceleratorA
TranslateMessage
DispatchMessageA

kernel32

GetProcessHeap
GetCommandLineA
HeapAlloc
GetModuleHandleA
lstrcatA
GetLastError
GetCurrentProcess
UnmapViewOfFile
MapViewOfFile
Sleep
GetStartupInfoA
TerminateProcess
UnhandledExceptionFilter
InterlockedDecrement
CreateProcessA
InterlockedExchange
InterlockedIncrement

winmm

timeSetEvent
timeKillEvent

comctl32

ord17

ole32

FreePropVariantArray

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ