c860eb7ea7b60eb68f467e0525aaa075[.]zip | Triage

Sharing

Copy URL Twitter E-mail

General

Target

c860eb7ea7b60eb68f467e0525aaa075.zip
Size

4.0MB
MD5

b61124ebfbcc43f19a0990e1dac6682f
SHA1

4ecc8a885ab6f79240cc6dceb97fe1d10e9de0ae
SHA256

70e586921e596af858be1af72386a7acbd006bda7293f5ec8af6f41a76104e87
SHA512

1b1aaa6e16b65986ab75b8b588e2b64539cd931951ecffeca6bb52b4cf8990007807f3eeb10caa41f0cec8ffeac85bf32268376267798de860209c009fb9969c
SSDEEP

98304:r0YRwbpzl7yrU2Nu1HUU5mOr0FUkcSIkr:r0YilzpQe0w0FTBp

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/40fd4378eb17587572ea0a078d9cae070fd0384c05580b2cc75a7286efbf4f74

Files

c860eb7ea7b60eb68f467e0525aaa075.zip
.zip

Password: infected
40fd4378eb17587572ea0a078d9cae070fd0384c05580b2cc75a7286efbf4f74
.exe windows:5 windows x86 arch:x86

Password: infected

07cd3d0e749e9d16e7a2e0a943c78b7a

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetFileAttributesW
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

wsprintfA
CharUpperBuffW

advapi32

CreateServiceA

msvcrt

realloc

Sections

.text
Size: - Virtual size: 26KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.0e&
Size: - Virtual size: 4.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.fON
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.YP\
Size: 4.0MB - Virtual size: 4.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ