e0bdeb58cea583eb7652e6f9fe92337f[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

e0bdeb58cea583eb7652e6f9fe92337f.zip
Size

389KB
MD5

f26ce7b195a000f035c16a3ef0f8eef3
SHA1

80f01c64f40c52fdda47d5ec64b4ec01a885d04d
SHA256

b52b2d7aa1114db3fe310d3bdeee85114d2ad2ac19b93fa45540b44b57537798
SHA512

4dd644a656e48d0f59d644eafa82955e25423045b9488f8a13b3986a990cbc8f4686eb2352e7b73037de8da7e878a74cf20e7af50af294dba73ca7b576791cc2
SSDEEP

12288:MVwEo2ztMrL7K4k79WyxGjFwL7ifvI3NV8+J+Q1QMYb1:MVwiKprD5wLGfvI3NG+J+Q101

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/e87939ad47a2512082e71accb69a1ee551f392a0ed1c09f9c4dad0067af14b95

Files

e0bdeb58cea583eb7652e6f9fe92337f.zip
.zip

Password: infected
e87939ad47a2512082e71accb69a1ee551f392a0ed1c09f9c4dad0067af14b95
.exe windows:6 windows x64 arch:x64

Password: infected

045715ac29c84a0e47dab339e337bc06

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

calc.pdb

Imports

shell32

ord165
ShellAboutW
SHGetSpecialFolderPathW

shlwapi

ord225

gdiplus

GdipGetImageGraphicsContext
GdipDeleteGraphics
GdipSetInterpolationMode
GdipSetSmoothingMode
GdipSetPageUnit
GdipDrawLineI
GdipDrawArcI
GdipFillRectangleI
GdipCloneImage
GdipCreateBitmapFromScan0
GdipDeletePen
GdipCreateFromHDC
GdipDrawImageRectI
GdipCreateBitmapFromHBITMAP
GdipCloneBitmapAreaI
GdipCreatePen1
GdipDisposeImage
GdipDeleteBrush
GdipAlloc
GdipFree
GdiplusShutdown
GdiplusStartup
GdipCreateHBITMAPFromBitmap
GdipCreateSolidFill

advapi32

RegEnumKeyExW
RegOpenKeyExW
RegEnumValueW
RegGetValueW
RegDeleteKeyW
RegQueryInfoKeyW
RegQueryValueExW
RegSetValueExW
EventUnregister
EventRegister
RegCloseKey
RegCreateKeyExW
EventWrite

oleaut32

SysStringLen
SysAllocStringByteLen
VariantClear
VariantInit
SysFreeString
SysAllocString

uxtheme

IsThemeActive

ole32

CoUninitialize
CoInitialize
CoCreateInstance

comctl32

ImageList_Destroy
ImageList_Create
ImageList_Add
ord413
ord410
ord380
ord392

ntdll

WinSqmAddToStreamEx
WinSqmAddToStream

kernel32

SetUnhandledExceptionFilter
UnhandledExceptionFilter
OutputDebugStringA
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetStartupInfoW
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
lstrlenA
GetModuleHandleW
SizeofResource
LockResource
LoadResource
GetModuleFileNameW
GetSystemTime
WaitForSingleObject
CreateEventW
CreateThread
ResetEvent
SetEvent
CloseHandle
GlobalSize
GlobalLock
GlobalUnlock
GlobalAlloc
lstrcmpW
MulDiv
GlobalFindAtomW
FindResourceW
GetLastError
MultiByteToWideChar
GetLocalTime
GetDateFormatW
GetLocaleInfoW
WritePrivateProfileStringW
GetPrivateProfileStringW
lstrcmpiW
LoadLibraryW
GetProcAddress
GetLocaleInfoEx
FreeLibrary
LocalFree
LocalAlloc
LocalReAlloc
GetProfileStringW
lstrlenW
CompareStringW
RegisterApplicationRecoveryCallback
ApplicationRecoveryInProgress
Sleep
ApplicationRecoveryFinished
RegisterApplicationRestart
GetTempFileNameW
SystemTimeToFileTime
CompareFileTime
GetFileAttributesW
FileTimeToSystemTime
CreateFileW
DeleteFileW
LeaveCriticalSection
DeleteCriticalSection
SetLastError
GetModuleHandleExW
EnterCriticalSection
InitializeCriticalSection
RaiseException
GetProcessHeap
HeapSize
HeapFree
DelayLoadFailureHook
ResolveDelayLoadedAPI
HeapReAlloc
HeapAlloc
WideCharToMultiByte
FindResourceExW
HeapDestroy

user32

OpenClipboard
GetClipboardData
InvalidateRect
CloseClipboard
EmptyClipboard
SetClipboardData
PostQuitMessage
DefWindowProcW
LoadAcceleratorsW
InsertMenuItemW
RegisterClassExW
SetWindowPlacement
SetForegroundWindow
GetMessageW
TranslateAcceleratorW
GetMessageExtraInfo
TranslateMessage
DispatchMessageW
GetKeyState
IsDialogMessageW
GetClassNameW
GetDC
ReleaseDC
GetSystemMetrics
GetWindowLongW
EnumChildWindows
DrawTextW
SetPropW
SystemParametersInfoW
CheckRadioButton
UpdateWindow
SendDlgItemMessageW
IsDlgButtonChecked
MoveWindow
SetDlgItemInt
GetDlgItemInt
FillRect
GetNextDlgTabItem
MonitorFromWindow
GetMonitorInfoW
OffsetRect
EqualRect
MonitorFromRect
GetClassWord
EnumDesktopWindows
EnumDisplayMonitors
IntersectRect
CopyRect
CreateDialogParamW
GetFocus
CreatePopupMenu
TrackPopupMenu
IsClipboardFormatAvailable
CharNextA
IsWindowEnabled
PostMessageW
GetWindowTextW
GetWindowTextLengthW
EnableWindow
GetWindowLongPtrW
SetWindowLongPtrW
SetWindowLongW
SetClassLongW
SetWindowTextW
GetWindowPlacement
CheckMenuItem
GetSysColor
SetClassLongPtrW
GetClassLongPtrW
DrawMenuBar
SetMenuItemInfoW
AppendMenuW
LoadStringW
GetSubMenu
RemoveMenu
CheckMenuRadioItem
SetFocus
MapWindowPoints
EnableMenuItem
GetMenu
GetClientRect
ShowWindow
CreateWindowExW
DestroyWindow
DialogBoxParamW
EndDialog
SetWindowPos
GetDlgItem
GetWindowRect
SendMessageW
MessageBeep
LoadCursorW
SetCursor
LoadImageW
UnregisterClassA
GetProcessDefaultLayout
GetMenuState
GetParent

rpcrt4

RpcStringFreeW
UuidToStringW
UuidCreate

winmm

timeGetTime

gdi32

CreateDIBSection
GetStockObject
SetBkColor
SetBkMode
CreatePatternBrush
DeleteObject
DeleteDC
EqualRgn
CombineRgn
SetRectRgn
CreateRectRgnIndirect
CreateRectRgn
CreateCompatibleBitmap
GetRgnBox
LineTo
MoveToEx
ExtCreatePen
GetObjectW
GetTextExtentPoint32W
GetTextMetricsW
CreateSolidBrush
SetTextColor
GetDeviceCaps
CreateCompatibleDC
CreateFontIndirectW
SelectObject
GetTextExtentPointW

msvcrt

difftime
memmove
memset
__C_specific_handler
??0exception@@QEAA@AEBQEBDH@Z
_callnewh
_CxxThrowException
__CxxFrameHandler3
setlocale
__pctype_func
___lc_handle_func
___lc_codepage_func
memcpy
___mb_cur_max_func
_errno
__mb_cur_max
__crtGetStringTypeW
__crtLCMapStringW
__uncaught_exception
isspace
tolower
abort
isalnum
_XcptFilter
_amsg_exit
__getmainargs
__set_app_type
time
_cexit
_ismbblead
__setusermatherr
_initterm
_acmdln
_fmode
_commode
??1type_info@@UEAA@XZ
_lock
_unlock
__dllonexit
_onexit
?terminate@@YAXXZ
mbstowcs_s
exit
isdigit
isxdigit
toupper
_purecall
malloc
??0exception@@QEAA@XZ
memmove_s
??0exception@@QEAA@AEBQEBD@Z
??1exception@@UEAA@XZ
?what@exception@@UEBAPEBDXZ
memcpy_s
??0exception@@QEAA@AEBV0@@Z
free
isalpha
wcstoul
strcspn
memchr
_wcsrev
strchr
_strtoui64
_strtoi64
sprintf_s
_wtoi64
_i64tow_s
_wcsdup
localeconv
iswalpha
iswdigit
_wcslwr_s
_wcsnicmp
wcsncmp
_itow_s
calloc
wcschr
_wcsicmp
_itoa
_wtoi
_vsnwprintf
wcscat_s
wcscpy_s
_exit
wcstol
wcscmp

Sections

.text
Size: 473KB - Virtual size: 472KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 372KB - Virtual size: 372KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

045715ac29c84a0e47dab339e337bc06

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

shell32

shlwapi

gdiplus

advapi32

oleaut32

uxtheme

ole32

comctl32

ntdll

kernel32

user32

rpcrt4

winmm

gdi32

msvcrt

Sections

.text Size: 473KB - Virtual size: 472KB

.data Size: 19KB - Virtual size: 19KB

.pdata Size: 20KB - Virtual size: 20KB

.idata Size: 12KB - Virtual size: 12KB

.rsrc Size: 372KB - Virtual size: 372KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 473KB - Virtual size: 472KB

.data
Size: 19KB - Virtual size: 19KB

.pdata
Size: 20KB - Virtual size: 20KB

.idata
Size: 12KB - Virtual size: 12KB

.rsrc
Size: 372KB - Virtual size: 372KB

.reloc
Size: 1KB - Virtual size: 1KB