f97ce7510caa12b0faf781e07c35df57[.]zip | Triage

Sharing

General

Target

f97ce7510caa12b0faf781e07c35df57.zip
Size

111KB
MD5

b5fb2396e3792d6597b4eb9d3a406d92
SHA1

adaaa27a315bbb1825c2bf55f4c57cdacec84a76
SHA256

507c0af7ef1602e37db2b8524531ee35ffe292439a603aae8ba5786ff4db377f
SHA512

fb4aa6f28eb08586c102c3aac42db461f41ce24579ad3caaafff5efd3a02a91f0a14db3e09217a3da81a9b34438f68ec64c9b6a9cb385f3385b53dbbda043606
SSDEEP

3072:jn8jNqi3Z0jDVLcMsOb8MH4PdMgYRh2Wwr9muj+C4UYeB4:j8j1ujDFb8MH4HSMjx3hVB4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/294cd07d87e0c83058253f27a4147417183d405d4405ff54c164e6028d684249

Files

f97ce7510caa12b0faf781e07c35df57.zip
.zip

Password: infected
294cd07d87e0c83058253f27a4147417183d405d4405ff54c164e6028d684249
.exe windows:1 windows x86 arch:x86

Password: infected

9c0050334da711b5147027326c52827d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCommandLineA
GetFileSize
GetModuleHandleA
CloseHandle
GetTickCount
GetWindowsDirectoryA
CopyFileA
LocalAlloc
LocalFree
CreateFileA
ReadFile
RtlUnwind
WinExec
WriteFile
DeleteFileA

user32

MessageBoxA

advapi32

RegCloseKey
RegOpenKeyA
RegSetValueExA

crtdll

__GetMainArgs
exit
memcpy
memset
printf
raise
signal
strcat
strchr
strlen
strncpy

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 1024B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ieoo
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ