8976781b9e1d6f794b30de6a350d5d4c[.]zip

Sharing

Copy URL

Twitter E-mail

General

Target

8976781b9e1d6f794b30de6a350d5d4c.zip
Size

163KB
MD5

c3d807773999eb2261e4c1ef4c140d68
SHA1

667aea339584ed8cc6de09dabb8142dc54678eaa
SHA256

dbf34555e73b3fc324dce63b0c7dcedfe1b2a243f122d04eaa6d67bcfef30f91
SHA512

d83c20681eabac06c5b876ce172c0f3750fb4e65fd995625eb4996d03060330ac035c996f7bba3f354e5634b195f3af0aca66cfa9b3c7a8fd0def1a854480ddb
SSDEEP

3072:4M2WBzNXpAYfGoSNdzcDcncoAxJKhkJ18iu/Loy8JVSZz7qXCL0lB/m3+lELRw9P:qWXZAYfNSjwUc8kz8C3J8Zz7fLUsjLah

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/e3dd0a078e3b5f532c6b5b3254eea71e4afac1eda00d349d6fc5582d2c3487e8

Files

8976781b9e1d6f794b30de6a350d5d4c.zip
.zip

Password: infected
e3dd0a078e3b5f532c6b5b3254eea71e4afac1eda00d349d6fc5582d2c3487e8
.exe windows:5 windows x86 arch:x86

Password: infected

654aff1ee1bc89531bd3b96ebe76ae67

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\yay.pdb

Imports

kernel32

lstrlenA
InterlockedDecrement
InitializeSListHead
GetSystemWindowsDirectoryW
HeapFree
FlushViewOfFile
LocalFlags
LoadLibraryW
FreeConsole
GetSystemWow64DirectoryW
SetConsoleCursorPosition
GetModuleFileNameW
GetOverlappedResult
GetStartupInfoW
CreateDirectoryA
GetCPInfoExW
FindFirstChangeNotificationW
GetProcAddress
SetVolumeLabelW
SetStdHandle
GetPrivateProfileStringA
OpenMutexA
LocalAlloc
PostQueuedCompletionStatus
AddAtomA
FindAtomA
GetPrivateProfileStructA
SetEnvironmentVariableA
WTSGetActiveConsoleSessionId
HeapSetInformation
FreeEnvironmentStringsW
GetCurrentDirectoryA
OutputDebugStringA
GetLastError
SearchPathW
CloseHandle
CreateFileW
DeleteFileA
GetCommandLineA
DecodePointer
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EncodePointer
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
InterlockedIncrement
GetModuleHandleW
ExitProcess
GetModuleFileNameA
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
HeapValidate
IsBadReadPtr
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
HeapCreate
WriteFile
EnterCriticalSection
LeaveCriticalSection
WriteConsoleW
OutputDebugStringW
GetACP
GetOEMCP
GetCPInfo
IsValidCodePage
HeapAlloc
HeapReAlloc
HeapSize
HeapQueryInformation
RtlUnwind
IsProcessorFeaturePresent
MultiByteToWideChar
LCMapStringW
GetStringTypeW
SetFilePointer
GetConsoleCP
GetConsoleMode
RaiseException
FlushFileBuffers

advapi32

AbortSystemShutdownA

winhttp

WinHttpReadData

Sections

.text
Size: 94KB - Virtual size: 93KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 67KB - Virtual size: 4.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12.0MB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

654aff1ee1bc89531bd3b96ebe76ae67

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

advapi32

winhttp

Sections

.text Size: 94KB - Virtual size: 93KB

.rdata Size: 31KB - Virtual size: 31KB

.data Size: 67KB - Virtual size: 4.2MB

.rsrc Size: 18KB - Virtual size: 18KB

.reloc Size: 12.0MB - Virtual size: 21KB

.text
Size: 94KB - Virtual size: 93KB

.rdata
Size: 31KB - Virtual size: 31KB

.data
Size: 67KB - Virtual size: 4.2MB

.rsrc
Size: 18KB - Virtual size: 18KB

.reloc
Size: 12.0MB - Virtual size: 21KB