181d1c2e441102f8bed4c0a50420d0ed[.]zip

General

Target
181d1c2e441102f8bed4c0a50420d0ed.zip
Size 450KB
Sample240901-aalnbatape
SHA256 627f09a238bb37b0282db45d7dee3adfdd9e53b2d53678cde8fbd3eb78c021e7
MD5 999b4a79a5978b17d746a7fd021e0093
SHA1 2f63158056a3a55484b022845b7a9277668b81b7
SHA512 fa1adb74d7d537d63b32b27f6ba014f385cafaeec28e625daacdfa24acda9cccf0cc0c7efea396833f8f78ada95899d213f74dc5b76695d28e52d974fad34039
SSDEEP 12288:3IG36RObkklpyo7fE9EtkkPHww8vJZtBT:3IM6ROrlD7fuEk8HzAZtF
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/8387ad32144c17a6ed8f986d4841d1caa85c54b41a0da7961bc199642a62380d

File Explorer

181d1c2e441102f8bed4c0a50420d0ed.zip

.zip 450KB
8387ad32144c17a6ed8f986d4841d1caa85c54b41a0da7961bc199642a62380d

.exe 540KB

181d1c2e441102f8bed4c0a50420d0ed.zip

SHA256 627f09a238bb37b0282db45d7dee3adfdd9e53b2d53678cde8fbd3eb78c021e7
MD5 999b4a79a5978b17d746a7fd021e0093
SHA1 2f63158056a3a55484b022845b7a9277668b81b7
SHA512 fa1adb74d7d537d63b32b27f6ba014f385cafaeec28e625daacdfa24acda9cccf0cc0c7efea396833f8f78ada95899d213f74dc5b76695d28e52d974fad34039
SSDEEP 12288:3IG36RObkklpyo7fE9EtkkPHww8vJZtBT:3IM6ROrlD7fuEk8HzAZtF
MD5 SHA1 SHA512 SSDEEP

Password

infected

8387ad32144c17a6ed8f986d4841d1caa85c54b41a0da7961bc199642a62380d

IMPHASH adb88ed13e4f2bd509ccf2261722d184
SHA256 8387ad32144c17a6ed8f986d4841d1caa85c54b41a0da7961bc199642a62380d
MD5 181d1c2e441102f8bed4c0a50420d0ed
SHA1 0146e0cb44fb072c0b7ca88df2edf97c101b078b
SHA512 64d5e3cbedd6069d3141defb1cc130c8da7ccba70ff9679e20324667a00b764fbccc0aa29e9cd67b103563a5ce1daf89185ffcc0550163d156bc35df95a8fe4e
SSDEEP 12288:kqNtfxD1cPk0SYbfMRamXMOtmcetnBndJugAwZGEX8cA0/M:kKtGPk0SYbEXetnpdJugFsEv
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

1

Major OS version

5

Entry point

8328

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\mesupec\xajariri\30\tatipuyinikin\suyik9\fatocoxanoge61\l.pdb

kernel32

EndUpdateResourceW GetCurrentProcess GetEnvironmentStringsW SetEvent FlushViewOfFile SleepEx ReadConsoleW InitAtomTable HeapCreate WriteConsoleW GetModuleFileNameW CreateActCtxA SetTapePosition SetProcessAffinityMask SetLastError GetProcAddress BeginUpdateResourceW GetAtomNameA LocalAlloc SetEnvironmentVariableA GetOEMCP CreateIoCompletionPort SetConsoleTitleW GetModuleHandleA GetProcessShutdownParameters VirtualProtect GetCPInfoExA Module32Next ReleaseMutex GetVersionExA FindNextVolumeA lstrcpyW LCMapStringW DeactivateActCtx HeapReAlloc IsProcessorFeaturePresent RaiseException EncodePointer DecodePointer GetModuleHandleW ExitProcess GetCommandLineW HeapSetInformation GetStartupInfoW UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement GetCurrentThreadId GetLastError InterlockedDecrement HeapAlloc ReadFile HeapFree SetHandleCount GetStdHandle InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection SetFilePointer EnterCriticalSection LeaveCriticalSection GetCPInfo GetACP IsValidCodePage CloseHandle LoadLibraryW WriteFile FreeEnvironmentStringsW QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime WideCharToMultiByte GetConsoleCP GetConsoleMode Sleep MultiByteToWideChar SetStdHandle RtlUnwind FlushFileBuffers GetStringTypeW HeapSize CreateFileW

user32

ClientToScreen

gdi32

GetBitmapBits

winhttp

WinHttpQueryOption

Sharing