e66050583ed0a03fb5bb87498bf74332[.]zip

Sharing

Copy URL

Twitter E-mail

General

Target

e66050583ed0a03fb5bb87498bf74332.zip
Size

3.3MB
MD5

87b6f1e6eac1674fc8f967f165540435
SHA1

78b093cd20ec2911413507542e62b04761360d9d
SHA256

1be84237db58aa5e96589954b8108eb1e1554ac2e8e9c6bcef155b7f9ef4c720
SHA512

526d92206157c16a1f61a555abd6b03a2ba9c9c14bf1c13ee0341c3b7a29a22ce2c1bdf2bea00f70455f1b10e5affdcccd599c85b8d6d427bcc5058205eedbaf
SSDEEP

98304:mQPAJ36vmCXb7N+wYmdsGqfllJW5DlVPtt5:meAV+70wYmanflelVPF

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/29642c465abea7da61d365491fc99e09181b23401c16fc6ff97c167959557815

Files

e66050583ed0a03fb5bb87498bf74332.zip
.zip

Password: infected
29642c465abea7da61d365491fc99e09181b23401c16fc6ff97c167959557815
.exe windows:5 windows x86 arch:x86

Password: infected

a4ca106683d53fdc14c5d55ebb7bcbb3

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msacm32

acmStreamUnprepareHeader
acmFormatTagDetailsW
acmFormatSuggest

advapi32

RegOpenKeyExW
RegQueryInfoKeyW

secur32

QuerySecurityPackageInfoW
DeleteSecurityContext
FreeCredentialsHandle

user32

EndDialog

shlwapi

StrChrW
PathCreateFromUrlW
PathGetDriveNumberW
StrToIntW
UrlCanonicalizeW
PathFindExtensionW
UrlIsW
StrFormatByteSizeW
AssocCreate
StrChrIW
StrToIntExW
StrTrimW
PathIsRelativeW
PathParseIconLocationW
PathIsUNCW
PathBuildRootW
PathStripPathW
AssocQueryStringW
StrCmpNW
PathCombineW
PathIsUNCServerW
StrRChrW
UrlEscapeW
SHDeleteEmptyKeyW
PathRemoveBackslashW
StrRetToBufW
SHDeleteValueW
PathAppendW
SHGetValueW
UrlUnescapeW

kernel32

TlsGetValue
GetCurrentProcess
SetLastError
GetACP
LCMapStringA
WideCharToMultiByte
GetStringTypeW
GetStringTypeA
LoadLibraryA
HeapReAlloc
HeapAlloc
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
InterlockedDecrement
GetModuleFileNameA
WriteFile
RtlUnwind
VirtualFree
HeapCreate
GetCPInfo
CreateDirectoryW
GetConsoleCP
InterlockedIncrement
GetModuleFileNameW
InterlockedExchange
InterlockedCompareExchange
WriteConsoleW
LCMapStringW
HeapFree
CreateMutexW
GetUserDefaultLCID
GetOEMCP
GetLastError
GetEnvironmentStringsW
GetVersionExW
GetSystemTimeAsFileTime
GlobalUnlock
GlobalAlloc
VirtualAlloc
CreateFileMappingW
RemoveDirectoryW
GetModuleHandleA
GetStartupInfoW
GetVersion
ExitProcess
RaiseException
GetProcAddress
TerminateProcess
UnhandledExceptionFilter
FreeEnvironmentStringsA
MultiByteToWideChar
FreeEnvironmentStringsW
GetEnvironmentStrings
GetCommandLineW
GetCommandLineA
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetCurrentThreadId
TlsSetValue
TlsAlloc
HeapDestroy

ws2_32

WSARecvFrom
WSACreateEvent
WSASocketW
getnameinfo
WSARecv
WSASendTo
WSAEventSelect
WSADuplicateSocketW
WSALookupServiceEnd
WSACloseEvent

comdlg32

ChooseColorW
GetOpenFileNameW
GetSaveFileNameW
CommDlgExtendedError

wintrust

CryptCATAdminReleaseCatalogContext
WTHelperProvDataFromStateData
WTHelperGetProvSignerFromChain

Sections

.text
Size: 2.4MB - Virtual size: 2.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 542KB - Virtual size: 48.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

a4ca106683d53fdc14c5d55ebb7bcbb3

Headers

File Characteristics

Imports

msacm32

advapi32

secur32

user32

shlwapi

kernel32

ws2_32

comdlg32

wintrust

Sections

.text Size: 2.4MB - Virtual size: 2.4MB

.rdata Size: 1.5MB - Virtual size: 1.5MB

.data Size: 542KB - Virtual size: 48.1MB

.rsrc Size: 24KB - Virtual size: 24KB

.text
Size: 2.4MB - Virtual size: 2.4MB

.rdata
Size: 1.5MB - Virtual size: 1.5MB

.data
Size: 542KB - Virtual size: 48.1MB

.rsrc
Size: 24KB - Virtual size: 24KB