7f4482e9ab02f158feef9a7a877be904[.]zip | Triage

Sharing

General

Target

7f4482e9ab02f158feef9a7a877be904.zip
Size

222KB
MD5

90c7f4e756b8cd3333afa5b251c80a89
SHA1

eba6c4b97dd4107f75c8b1e794f579310aae7880
SHA256

45921980c3fbc6cc7b8e0ebfe7f25c292fa46eaa7a0ed6079ae54a7d90d4e8a3
SHA512

3b807bc4ebcb4742eeee06cca625d3c99ecccd8de6b4cb54a61cd192e4b727bdb9f4bb32a43d03e6a13186c3aff621c2beb538b85217926eb463ec7d8b2f4fd4
SSDEEP

6144:l5Uo8D/14SaWXJrUMNeCv4CS8Nlviv4j6jd20YjDBsnJANFur765:fUd4SaWZVxk8Nlv4qsBYhSIurm5

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/9b152b0d7b72e6533cf64fa984e23a90cfeee970d37159028ef43d55bac373b3

Files

7f4482e9ab02f158feef9a7a877be904.zip
.zip

Password: infected
9b152b0d7b72e6533cf64fa984e23a90cfeee970d37159028ef43d55bac373b3
.exe windows:1 windows x86 arch:x86

Password: infected

9c0050334da711b5147027326c52827d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCommandLineA
GetFileSize
GetModuleHandleA
CloseHandle
GetTickCount
GetWindowsDirectoryA
CopyFileA
LocalAlloc
LocalFree
CreateFileA
ReadFile
RtlUnwind
WinExec
WriteFile
DeleteFileA

user32

MessageBoxA

advapi32

RegCloseKey
RegOpenKeyA
RegSetValueExA

crtdll

__GetMainArgs
exit
memcpy
memset
printf
raise
signal
strcat
strchr
strlen
strncpy

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 1024B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ieoo
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ