c4c9428ea6a30325f8ac6a3fecc199a1[.]zip

General

Target
c4c9428ea6a30325f8ac6a3fecc199a1.zip
Size 180KB
Sample240901-lltzlsxbrj
SHA256 65355c0a686d8ba5f7551152571545331d64fe207a4f6c44ae67b240f3cbb19c
MD5 4127829c259610b80c10aabd0ceb04d4
SHA1 a431686ca42aa314cdceafb059e3989d1a316617
SHA512 c7d8ec1f13d1d62c892ae2db5b7b8befc0e30f1bb73ce7bf22f1a7b5d376e7937f2a28838cddc69b759c1edab62266b498e187090050042f1b97ff94255407df
SSDEEP 3072:pRrjzAtl2NZQxPoyaCDpqjyrUKE7hwQBUec4HzDGi9UleibJFAR1rg9zgAQYPXKl:b+V75pqnK+hwJlC8eibDU1rU/PayBoqA
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/4fb9ec0883d7b509a16d73e2181f5236d13042706cb8bbe82091f8a9db4575d1

File Explorer

c4c9428ea6a30325f8ac6a3fecc199a1.zip

.zip 180KB
4fb9ec0883d7b509a16d73e2181f5236d13042706cb8bbe82091f8a9db4575d1

.exe 12.5MB

c4c9428ea6a30325f8ac6a3fecc199a1.zip

SHA256 65355c0a686d8ba5f7551152571545331d64fe207a4f6c44ae67b240f3cbb19c
MD5 4127829c259610b80c10aabd0ceb04d4
SHA1 a431686ca42aa314cdceafb059e3989d1a316617
SHA512 c7d8ec1f13d1d62c892ae2db5b7b8befc0e30f1bb73ce7bf22f1a7b5d376e7937f2a28838cddc69b759c1edab62266b498e187090050042f1b97ff94255407df
SSDEEP 3072:pRrjzAtl2NZQxPoyaCDpqjyrUKE7hwQBUec4HzDGi9UleibJFAR1rg9zgAQYPXKl:b+V75pqnK+hwJlC8eibDU1rU/PayBoqA
MD5 SHA1 SHA512 SSDEEP

Password

infected

4fb9ec0883d7b509a16d73e2181f5236d13042706cb8bbe82091f8a9db4575d1

IMPHASH b12236dc2017ad7d1928e8cd9feb8c2e
SHA256 4fb9ec0883d7b509a16d73e2181f5236d13042706cb8bbe82091f8a9db4575d1
MD5 c4c9428ea6a30325f8ac6a3fecc199a1
SHA1 e8c27d01e8e1b4f11f6183e8ba4b3065392349ce
SHA512 b052061f5936ee2f30fc18e81daa9542451a1ad58235bd180e7d01fa49977813945492890a1a37a3cec59bb261a626cd175f12ac85bec9e000273159980e7a33
SSDEEP 196608:TPRMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMP:T
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

1

Major OS version

5

Entry point

7264

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\yek\rizetawasusa96_dekagadas_gis.pdb

kernel32

GetCommandLineW GetThreadContext lstrlenA InterlockedIncrement GetQueuedCompletionStatus GetCommState GetSystemWindowsDirectoryW GetProfileStringW SetConsoleScreenBufferSize CallNamedPipeW FreeEnvironmentStringsA SetTapeParameters CreateNamedPipeW GetCompressedFileSizeW CreateActCtxW FindResourceExA GetPrivateProfileIntA GetSystemDirectoryW SetFileShortNameW LoadLibraryW SizeofResource GetSystemWow64DirectoryW HeapDestroy CreateSemaphoreA GetBinaryTypeA QueryInformationJobObject GetStartupInfoW LCMapStringA GetPrivateProfileIntW GetLastError SetLastError GetProcAddress SetStdHandle SearchPathA LocalAlloc GetNumberFormatW FindAtomA GetModuleFileNameA FindNextFileA CreateIoCompletionPort FindFirstChangeNotificationA HeapSetInformation GetCurrentDirectoryA OutputDebugStringA GetCPInfoExA FindAtomW DeleteFileW GetSystemTime CopyFileExA InterlockedDecrement DecodePointer GetModuleHandleW ExitProcess TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent EncodePointer GetModuleFileNameW WriteFile GetStdHandle EnterCriticalSection LeaveCriticalSection RtlUnwind GetACP GetOEMCP GetCPInfo IsValidCodePage TlsAlloc TlsGetValue TlsSetValue GetCurrentThreadId TlsFree SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime FreeEnvironmentStringsW GetEnvironmentStringsW HeapValidate IsBadReadPtr HeapCreate SetFilePointer WideCharToMultiByte GetConsoleCP GetConsoleMode WriteConsoleW OutputDebugStringW MultiByteToWideChar GetStringTypeW LCMapStringW HeapAlloc HeapReAlloc HeapSize HeapQueryInformation HeapFree IsProcessorFeaturePresent FlushFileBuffers ReadFile RaiseException CreateFileW CloseHandle

Sharing