57adc8f2d8b412478bbe12f650d204d9[.]zip

General

Target
57adc8f2d8b412478bbe12f650d204d9.zip
Size 247KB
Sample240903-rdtlrsyell
SHA256 5059d48e717c1a2582c8e797725041d7730e9881c0b42029b4dd05b23ecc1f89
MD5 c90e9aaa9d666c38f5fb4d03c87308f2
SHA1 f96470dc7ea11a0c635014fb5b81ac84ccbfb38e
SHA512 78fe244a860002dd646478e066fcb7732bce3e351b99288df3684f936950c9ac62d73933279c874bf5f81dfd2ef351b924250d6564c8ef69069a17da8eb65a63
SSDEEP 6144:hGQTHTNkmfWXkt6kNScuhjFFF5Ny16ryJd+xS7BpMvB1:hnTTNK08kZWFpc6ryJsx2BpMvB1
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/75ebc3327a9adb4a9a7a78dbe0927c25d53a7e8a3cfd2fead2580e7dcbea44a4

File Explorer

57adc8f2d8b412478bbe12f650d204d9.zip

.zip 247KB
75ebc3327a9adb4a9a7a78dbe0927c25d53a7e8a3cfd2fead2580e7dcbea44a4

.exe 324KB

57adc8f2d8b412478bbe12f650d204d9.zip

SHA256 5059d48e717c1a2582c8e797725041d7730e9881c0b42029b4dd05b23ecc1f89
MD5 c90e9aaa9d666c38f5fb4d03c87308f2
SHA1 f96470dc7ea11a0c635014fb5b81ac84ccbfb38e
SHA512 78fe244a860002dd646478e066fcb7732bce3e351b99288df3684f936950c9ac62d73933279c874bf5f81dfd2ef351b924250d6564c8ef69069a17da8eb65a63
SSDEEP 6144:hGQTHTNkmfWXkt6kNScuhjFFF5Ny16ryJd+xS7BpMvB1:hnTTNK08kZWFpc6ryJsx2BpMvB1
MD5 SHA1 SHA512 SSDEEP

Password

infected

75ebc3327a9adb4a9a7a78dbe0927c25d53a7e8a3cfd2fead2580e7dcbea44a4

IMPHASH 0dd592f35b48076810a8314d458b6b4b
SHA256 75ebc3327a9adb4a9a7a78dbe0927c25d53a7e8a3cfd2fead2580e7dcbea44a4
MD5 57adc8f2d8b412478bbe12f650d204d9
SHA1 68e44600199d09d089b0d1578877baa1c4328ad3
SHA512 65899b1cf4d8a9efcbce235c89b668d4c75fee3315ac293815e54eb6bb657d6ba51422df7d37f479d3c710791c55e6f441b0f5593b6828e89b3752f61eba0d78
SSDEEP 6144:IIUQFwFFglbbdDFnQk5LoFfGl6G9hCaY7B/:MawolbbxFQAh70
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

16160

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\cin.pdb

kernel32

HeapReAlloc lstrlenA GetLocaleInfoA EndUpdateResourceW GetQueuedCompletionStatus GetCurrentProcess SetEvent BackupSeek GetConsoleTitleA ReadConsoleW WriteFile CreateActCtxW InitializeCriticalSection GetEnvironmentStrings InitAtomTable HeapDestroy FindNextVolumeW IsProcessorFeaturePresent GetFileAttributesW GetModuleFileNameW DeactivateActCtx InterlockedExchange GetProcAddress BeginUpdateResourceW PrepareTape GetProcessVersion WriteConsoleA LocalAlloc RemoveDirectoryW SetConsoleWindowInfo GetModuleHandleA VirtualProtect SetProcessShutdownParameters ReleaseMutex GetCurrentProcessId FindNextVolumeA lstrcpyA WriteConsoleW ReadFile WideCharToMultiByte InterlockedIncrement InterlockedDecrement InterlockedCompareExchange MultiByteToWideChar GetStringTypeW EncodePointer DecodePointer Sleep DeleteCriticalSection EnterCriticalSection LeaveCriticalSection GetLastError HeapFree GetCommandLineW HeapSetInformation GetStartupInfoW GetCPInfo RaiseException RtlUnwind HeapAlloc LCMapStringW HeapCreate InitializeCriticalSectionAndSpinCount UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess SetFilePointer GetModuleHandleW ExitProcess GetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError GetCurrentThreadId QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime GetLocaleInfoW HeapSize GetACP GetOEMCP IsValidCodePage GetUserDefaultLCID EnumSystemLocalesA IsValidLocale CloseHandle CreateFileA SetStdHandle GetConsoleCP GetConsoleMode FlushFileBuffers LoadLibraryW SetEndOfFile GetProcessHeap CreateFileW

Name

.text

Size

225KB

Virtual Size

225KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

24KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

39.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.novexa

Size

1024B

Virtual Size

624B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.fil

Size

512B

Virtual Size

23B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

59KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

57adc8f2d8b412478bbe12f650d204d9.zip

75ebc3327a9adb4a9a7a78dbe0927c25d53a7e8a3cfd2fead2580e7dcbea44a4

kernel32

generic