9446474e1891350820484387790739f4[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
9446474e1891350820484387790739f4.zip
Size 2.3MB
Sample240903-nfkvvswfmd
SHA256 ce7fc4e3bd7e78de8ec3f7ee1e8b1883e951b2288e489b7630fff1e45ced69e8
MD5 a9f13c8b6240ed148ae64f1c0fc260c0
SHA1 f8f814a1bb1d7cb98b1f1856a92b990f10a2e63a
SHA512 08295cc6f2063370484aa3b2d0196e2973926655ab37a711570f438cbddad4f3d546d57b2069737f95877825a5a22fb0ff38600647de49083c2bfbf158ad7614
SSDEEP 49152:Sp1WmJ8FK5ZJ0ltUQ8GJowsrrRfgKFqNgf8nt+sHrU36n:uLJSuK2yKRfxg+U8r6n
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/b61d0ea030d98bcf26d5e6ad21d02234ea6cdfc4a3303c9456edbf9aa9f49627

File Explorer

9446474e1891350820484387790739f4.zip

.zip 2.3MB
b61d0ea030d98bcf26d5e6ad21d02234ea6cdfc4a3303c9456edbf9aa9f49627

.exe 5.7MB

9446474e1891350820484387790739f4.zip

SHA256 ce7fc4e3bd7e78de8ec3f7ee1e8b1883e951b2288e489b7630fff1e45ced69e8
MD5 a9f13c8b6240ed148ae64f1c0fc260c0
SHA1 f8f814a1bb1d7cb98b1f1856a92b990f10a2e63a
SHA512 08295cc6f2063370484aa3b2d0196e2973926655ab37a711570f438cbddad4f3d546d57b2069737f95877825a5a22fb0ff38600647de49083c2bfbf158ad7614
SSDEEP 49152:Sp1WmJ8FK5ZJ0ltUQ8GJowsrrRfgKFqNgf8nt+sHrU36n:uLJSuK2yKRfxg+U8r6n
MD5 SHA1 SHA512 SSDEEP

Password

infected

b61d0ea030d98bcf26d5e6ad21d02234ea6cdfc4a3303c9456edbf9aa9f49627

IMPHASH fef7b9a15dba0677216fced9bcd394bf
SHA256 b61d0ea030d98bcf26d5e6ad21d02234ea6cdfc4a3303c9456edbf9aa9f49627
MD5 9446474e1891350820484387790739f4
SHA1 35d1300f88e3c0c32eda5ce181bcda27b7cc80e1
SHA512 0618de0f0ae0997567eb17acdbae9327b04170a40415197aadf5743187bf51a6ec5d7400a77678abdc1329dba8ff53aa55170a4e669e304d4f26df25183564bb
SSDEEP 98304:HBv78HEFfNHX5rpiD0XTa3aLkBo6DjD7d/TLCQlQGpq6B:UEFfHp7X2NDjD7d3CQagqw
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

2496256

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\B\T\BuildResults\bin\Release\AdobeCollabSync.pdb

shlwapi

StrCmpNA PathRemoveFileSpecW PathCreateFromUrlW UrlIsW StrCmpNW UrlCanonicalizeA PathStripPathW

kernel32

FreeEnvironmentStringsW CreateDirectoryW ProcessIdToSessionId IsProcessInJob CreateJobObjectW AssignProcessToJobObject SetInformationJobObject QueryInformationJobObject VerifyVersionInfoA GetFileType GetCurrentProcess ResetEvent SystemTimeToTzSpecificLocalTime WakeConditionVariable GetProcessTimes K32GetProcessMemoryInfo CreateThreadpoolWork SubmitThreadpoolWork CreateThreadpoolTimer SetThreadpoolTimer CloseThreadpoolTimer SetThreadpoolThreadMaximum SetThreadpoolThreadMinimum WaitForThreadpoolWorkCallbacks WaitForThreadpoolTimerCallbacks CreateThreadpool DuplicateHandle GetCurrentThreadId GetCommandLineW GetTempPathW OpenProcess GetExitCodeProcess WaitNamedPipeW WaitForMultipleObjects GetOverlappedResult CreateNamedPipeW GetEnvironmentStringsW ConnectNamedPipe ResumeThread TerminateProcess GetCurrentProcessId VerifyVersionInfoW HeapSetInformation GetProcessHeap VerSetConditionMask FindResourceA SizeofResource LockResource LoadResource GetModuleHandleExA WideCharToMultiByte FormatMessageW FormatMessageA LocalFree GetThreadId LoadLibraryW CloseThreadpool CloseThreadpoolWork InitializeConditionVariable WakeAllConditionVariable SleepConditionVariableCS AreFileApisANSI GetWindowsDirectoryW GetCurrentDirectoryW GetEnvironmentVariableW GetProcAddress QueueUserWorkItem SetThreadErrorMode GetThreadErrorMode CreateProcessW DisconnectNamedPipe CreateThread GetSystemInfo VirtualProtect VirtualQuery FreeLibrary LoadLibraryExA ReleaseSemaphore WaitForSingleObject GetModuleHandleW SwitchToThread DeleteFileW FindClose FindFirstFileW FlushFileBuffers GetDriveTypeW GetFileInformationByHandle GetFullPathNameW SetEndOfFile SetFilePointer MoveFileW InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection TlsAlloc TlsGetValue TlsSetValue TlsFree LocalAlloc CreateSemaphoreA GetSystemTimeAsFileTime GetLocalTime FileTimeToSystemTime FindNextFileW RemoveDirectoryW MultiByteToWideChar GetFileAttributesW GetSystemDirectoryA LoadLibraryA lstrlenA InitializeCriticalSectionAndSpinCount FindCloseChangeNotification FindFirstChangeNotificationW FindNextChangeNotification GetDriveTypeA HeapAlloc HeapFree WaitForSingleObjectEx PeekNamedPipe CancelIoEx WaitForMultipleObjectsEx CreateNamedPipeA LoadLibraryExW GetUserDefaultLCID QueryPerformanceCounter QueryPerformanceFrequency EncodePointer CreateEventW CompareStringW LCMapStringW GetLocaleInfoW GetStringTypeW GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent InitializeSListHead IsDebuggerPresent GetStartupInfoW OutputDebugStringW CreateTimerQueue SignalObjectAndWait SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait QueryDosDeviceW GetThreadTimes FreeLibraryAndExitThread GetVersionExW VirtualAlloc VirtualFree InterlockedPopEntrySList InterlockedPushEntrySList InterlockedFlushSList QueryDepthSList UnregisterWaitEx RtlUnwind ExitThread GetModuleHandleExW GetStdHandle WriteConsoleW ExitProcess GetDateFormatW GetTimeFormatW IsValidLocale EnumSystemLocalesW GetConsoleCP GetConsoleMode GetFileSizeEx SetFilePointerEx ReadConsoleW GetTimeZoneInformation HeapReAlloc FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCommandLineA SetEnvironmentVariableW SetStdHandle HeapSize CreateWaitableTimerA GetModuleHandleA GetModuleFileNameW CreateEventA SetEvent DeleteCriticalSection InitializeCriticalSectionEx SetLastError RaiseException DecodePointer OutputDebugStringA lstrlenW GetTickCount Sleep DeviceIoControl OpenMutexW SetNamedPipeHandleState GetLastError CloseHandle WriteFile ReadFile GetVolumeInformationW CreateFileW GetCurrentThread SetWaitableTimer OpenEventA GlobalAlloc GlobalFree SetFileAttributesW TerminateThread GetFileSize GetFileAttributesExW QueueUserAPC GetQueuedCompletionStatus PostQueuedCompletionStatus SleepEx CreateIoCompletionPort CreateWaitableTimerW

user32

MsgWaitForMultipleObjects PeekMessageA DispatchMessageA GetForegroundWindow FindWindowW PostMessageW GetClassNameA FindWindowA IsHungAppWindow LoadImageW GetCursorPos GetPropW SetPropW SetForegroundWindow TrackPopupMenu InsertMenuW DestroyMenu CreatePopupMenu GetSystemMetrics DestroyWindow CreateWindowExW RegisterClassW CallWindowProcA PostQuitMessage DefWindowProcA PostMessageA GetMessageA LoadStringW GetWindowThreadProcessId TranslateMessage InsertMenuItemW

advapi32

RegOpenKeyA CryptSetHashParam RegSetValueExW CryptAcquireContextW CryptReleaseContext CryptDestroyKey CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash RegOpenKeyW OpenThreadToken GetTokenInformation ConvertStringSecurityDescriptorToSecurityDescriptorW ConvertStringSidToSidW SetTokenInformation GetLengthSid DuplicateTokenEx OpenProcessToken RegDeleteTreeW RegCreateKeyExW ConvertStringSecurityDescriptorToSecurityDescriptorA TreeSetNamedSecurityInfoW GetNamedSecurityInfoW RegSetValueExA RegQueryValueExA RegOpenKeyExA RegCreateKeyExA GetSidSubAuthorityCount GetSidSubAuthority GetSecurityDescriptorSacl GetAclInformation GetAce CreateProcessAsUserW RegQueryValueExW RegOpenKeyExW RegCloseKey CryptImportKey ConvertSidToStringSidA

shell32

SHFileOperationA SHGetPathFromIDListW SHCreateDirectoryExW SHGetSpecialFolderLocation ShellExecuteA SHGetKnownFolderPath SHQueryUserNotificationState Shell_NotifyIconW

ole32

CoCreateInstance CoUninitialize CoInitializeEx CoTaskMemFree

sensapi

IsNetworkAlive

ws2_32

WSAStartup WSACleanup WSAGetLastError WSACreateEvent WSAEventSelect WSAIoctl WSASocketA

wininet

InternetSetCookieExA InternetReadFile InternetWriteFile InternetSetOptionA HttpSendRequestExA InternetCloseHandle HttpAddRequestHeadersA HttpSendRequestA InternetCrackUrlA InternetOpenA InternetConnectA HttpOpenRequestA HttpEndRequestA DetectAutoProxyUrl HttpQueryInfoA

mpr

WNetAddConnection2W WNetGetConnectionW WNetGetResourceInformationW WNetCancelConnection2W

crypt32

CryptProtectData CryptUnprotectData

oleaut32

SafeArrayCreateVector SysAllocString SysFreeString SafeArrayDestroy SafeArrayAccessData SafeArrayUnaccessData

netapi32

NetShareGetInfo

winhttp

WinHttpOpen WinHttpConnect WinHttpOpenRequest WinHttpSetStatusCallback WinHttpSetCredentials WinHttpSendRequest WinHttpSetOption WinHttpGetProxyForUrl WinHttpQueryAuthSchemes WinHttpGetIEProxyConfigForCurrentUser WinHttpReadData WinHttpQueryHeaders WinHttpAddRequestHeaders WinHttpReceiveResponse WinHttpWriteData WinHttpCrackUrl WinHttpCloseHandle

Name

.text

Size

3.8MB

Virtual Size

3.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

898KB

Virtual Size

898KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

272KB

Virtual Size

291KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didat

Size

512B

Virtual Size

200B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

18KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

704KB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=25, id=259, version=26715,

count=211, id=261, version=26715,

count=18, id=260, version=28117,

count=28, id=259, version=28117,

count=171, id=265, version=28316,

count=51, id=109, productName=VS2005 build 50727, version=50727,

count=8, id=125, productName=VS2005 build 50727, version=50727,

count=11, id=260, productName=VS2019 v16.4.4 build 28316, version=28316,

count=160, id=261, version=28117,

count=25, id=260, version=26715,

count=1, id=262, version=26715,

count=29, id=257, version=26715,

count=492, id=1, productName=Unmarked objects,

count=206, id=261, productName=VS2019 v16.4.4 build 28316, version=28316,

count=1, id=256, productName=VS2019 v16.4.4 build 28316, version=28316,

count=1, id=255, productName=VS2019 v16.4.4 build 28316, version=28316,

count=2, id=151,

count=1, id=258, productName=VS2019 v16.4.4 build 28316, version=28316,