c19eab93813d60acf03302efcfa9b81e[.]zip

General

Target

c19eab93813d60acf03302efcfa9b81e.zip
Size

18KB
MD5

336fbc03d8eab8ff42e20bbaba18d2f4
SHA1

3db00885671333d7336e8ca8aa9fbda5d73bfe27
SHA256

cd7cd3b460b9988aa3f1acf38f0decf22891845aa1649b268c19fea87ac100d0
SHA512

ffd5643fdc667d89660b831726308d50b963f1a9d676b6ecba78da7ec048dc6db753dcae32168d37ee003fa3cfe39a6e51cc99dffec1900b3fa0fbd401e22d8c
SSDEEP

384:tQHfw42k5ymbS2ac4M/GtEKgufpnL+D/DOd9+0psKpQGXamvzZ6kAV:2j5G2GM/GqKJL+D7Odbps+dXaKEBV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/cea28662da532561b0b7deed7ed6df7560fb947083a737bb2b400e2919439fa2

Files

c19eab93813d60acf03302efcfa9b81e.zip
.zip

Password: infected
cea28662da532561b0b7deed7ed6df7560fb947083a737bb2b400e2919439fa2
.dll windows:6 windows x86 arch:x86

Password: infected

08e0323eae2a316a0af14ed6f39c0b81

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

setupapi

SetupQueueCopyA
SetupQueueDeleteA

mscms

GetColorDirectoryA
RegisterCMMW
SetColorProfileElement

msacm32

acmFilterChooseW
acmFilterTagDetailsW
acmMessage32
acmStreamClose

odbc32

ODBCInternalConnectW
ord77
ord23

wininet

FtpFindFirstFileA
InternetConfirmZoneCrossing
InternetConnectW
InternetSetOptionA
ReadUrlCacheEntryStream

advapi32

GetUserNameA
GetUserNameW
RegCloseKey
RegCreateKeyExW
RegDeleteKeyW
RegEnumKeyExW
RegOpenCurrentUser
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW

kernel32

CloseHandle
CreateFileW
ExpandEnvironmentStringsW
FreeLibrary
GetDriveTypeA
GetDriveTypeW
GetLastError
GetProcAddress
GetProcessHeap
HeapAlloc
HeapFree
LoadLibraryW
MultiByteToWideChar
SetLastError
VirtualProtect
WideCharToMultiByte
lstrcmpW
lstrcpyA
lstrcpyW
lstrlenA
lstrlenW

user32

LoadStringW

msvcrt

_adjust_fdiv
_initterm
free
iswctype
malloc
memcpy
memset
strcpy
strlen
swprintf
wcschr

Exports

Exports

wwczbth

Sections

.text
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 424B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

08e0323eae2a316a0af14ed6f39c0b81

Headers

File Characteristics

Imports

setupapi

mscms

msacm32

odbc32

wininet

advapi32

kernel32

user32

msvcrt

Exports

Exports

Sections

.text Size: 31KB - Virtual size: 31KB

.rdata Size: 3KB - Virtual size: 3KB

.data Size: 5KB - Virtual size: 5KB

.rsrc Size: 512B - Virtual size: 424B

.text
Size: 31KB - Virtual size: 31KB

.rdata
Size: 3KB - Virtual size: 3KB

.data
Size: 5KB - Virtual size: 5KB

.rsrc
Size: 512B - Virtual size: 424B