bb41a3013d57b05be2a117acbd09bfa7[.]zip | Triage

Sharing

Copy URL Twitter E-mail

General

Target

bb41a3013d57b05be2a117acbd09bfa7.zip
Size

4KB
MD5

de9869b9d6da8c84f783d0e768504278
SHA1

2cb1ec93476fc646ae24ff51f23894eab1d3f1a5
SHA256

3feed052a6fc19c2d7c3f46875205137c92751b32c3e31a718587da49692f597
SHA512

c7af6e56fe8635171f2fadfcba348ee0383b996f303ea11504da836cd71956c6f6574cc08336b1d80fe9f2ec2da41cfa23ce20d2c77a47d5eb6abfbc810f4ad8
SSDEEP

96:t0vgYG8YuVUHyyIIegjBIfdx9LE7QoXsrUiuL6Z7jp251Atg2U21Ax:IHGIKHV5euBIfdx9LEsoXTLCjI5+Xf16

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/38b0e6f3f2f5a59ad3053e373ed89c41951e97221636030cd47dddc51bea0cb8

Files

bb41a3013d57b05be2a117acbd09bfa7.zip
.zip

Password: infected
38b0e6f3f2f5a59ad3053e373ed89c41951e97221636030cd47dddc51bea0cb8
.exe windows:5 windows x86 arch:x86

Password: infected

e836076a09dba03e4d6faa46dda0fefc

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

wininet

HttpSendRequestW
InternetSetOptionW
InternetQueryOptionW
HttpOpenRequestW
HttpQueryInfoW
InternetReadFile
InternetConnectW
InternetOpenW

kernel32

GetTempPathW
GetFileSize
GetCurrentDirectoryW
DeleteFileW
CloseHandle
WriteFile
lstrcmpW
ReadFile
GetModuleHandleW
ExitProcess
HeapCreate
HeapAlloc
GetModuleFileNameW
CreateFileW
lstrlenW

user32

wsprintfW

shell32

ShellExecuteW

Sections

.text
Size: 1024B - Virtual size: 904B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 1020B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 166B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ