2973824de9a57eddfc1a7e44a117cbde[.]zip | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2973824de9a57eddfc1a7e44a117cbde.zip
Size

284KB
MD5

5281fcb9c755b6f3d5859155fce2bdd2
SHA1

6efa24dae88b32a8364b622dff5268777f75ba59
SHA256

aac35f8ca6d160123f81fcea35f72ac661c841dfaf3d6dfee8b8f73fdbd9a75d
SHA512

65be995a778c809e8744a74db876b784b7329bfc9ee327bd1ae154918a2b9ca672a2cb29faa51675221c7754934b069b10f1a1535087c61c0a52719b44f8e75b
SSDEEP

6144:3i0huWb9coTukiaf/Etz3Hj/0cCPuCiU4Vysf8OWhuscKWFJ:3iW95ukRfstz3HjYxvussJ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/e48271ffc03dca5deccf3d197948ff38d217d83d98bf0d3c8f1d177ad1c4ccbb

Files

2973824de9a57eddfc1a7e44a117cbde.zip
.zip

Password: infected
e48271ffc03dca5deccf3d197948ff38d217d83d98bf0d3c8f1d177ad1c4ccbb
.exe windows:6 windows x64 arch:x64

Password: infected

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

F:\Office\Target\x64\ship\postc2r\x-none\msohtmed.pdb

Sections

.text
Size: 58KB - Virtual size: 57KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.c2r
Size: 512B - Virtual size: 276B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ