9446474e1891350820484387790739f4[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

9446474e1891350820484387790739f4.zip
Size

2.3MB
MD5

a9f13c8b6240ed148ae64f1c0fc260c0
SHA1

f8f814a1bb1d7cb98b1f1856a92b990f10a2e63a
SHA256

ce7fc4e3bd7e78de8ec3f7ee1e8b1883e951b2288e489b7630fff1e45ced69e8
SHA512

08295cc6f2063370484aa3b2d0196e2973926655ab37a711570f438cbddad4f3d546d57b2069737f95877825a5a22fb0ff38600647de49083c2bfbf158ad7614
SSDEEP

49152:Sp1WmJ8FK5ZJ0ltUQ8GJowsrrRfgKFqNgf8nt+sHrU36n:uLJSuK2yKRfxg+U8r6n

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/b61d0ea030d98bcf26d5e6ad21d02234ea6cdfc4a3303c9456edbf9aa9f49627

Files

9446474e1891350820484387790739f4.zip
.zip

Password: infected
b61d0ea030d98bcf26d5e6ad21d02234ea6cdfc4a3303c9456edbf9aa9f49627
.exe windows:6 windows x86 arch:x86

fef7b9a15dba0677216fced9bcd394bf

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\B\T\BuildResults\bin\Release\AdobeCollabSync.pdb

Imports

shlwapi

StrCmpNA
PathRemoveFileSpecW
PathCreateFromUrlW
UrlIsW
StrCmpNW
UrlCanonicalizeA
PathStripPathW

kernel32

FreeEnvironmentStringsW
CreateDirectoryW
ProcessIdToSessionId
IsProcessInJob
CreateJobObjectW
AssignProcessToJobObject
SetInformationJobObject
QueryInformationJobObject
VerifyVersionInfoA
GetFileType
GetCurrentProcess
ResetEvent
SystemTimeToTzSpecificLocalTime
WakeConditionVariable
GetProcessTimes
K32GetProcessMemoryInfo
CreateThreadpoolWork
SubmitThreadpoolWork
CreateThreadpoolTimer
SetThreadpoolTimer
CloseThreadpoolTimer
SetThreadpoolThreadMaximum
SetThreadpoolThreadMinimum
WaitForThreadpoolWorkCallbacks
WaitForThreadpoolTimerCallbacks
CreateThreadpool
DuplicateHandle
GetCurrentThreadId
GetCommandLineW
GetTempPathW
OpenProcess
GetExitCodeProcess
WaitNamedPipeW
WaitForMultipleObjects
GetOverlappedResult
CreateNamedPipeW
GetEnvironmentStringsW
ConnectNamedPipe
ResumeThread
TerminateProcess
GetCurrentProcessId
VerifyVersionInfoW
HeapSetInformation
GetProcessHeap
VerSetConditionMask
FindResourceA
SizeofResource
LockResource
LoadResource
GetModuleHandleExA
WideCharToMultiByte
FormatMessageW
FormatMessageA
LocalFree
GetThreadId
LoadLibraryW
CloseThreadpool
CloseThreadpoolWork
InitializeConditionVariable
WakeAllConditionVariable
SleepConditionVariableCS
AreFileApisANSI
GetWindowsDirectoryW
GetCurrentDirectoryW
GetEnvironmentVariableW
GetProcAddress
QueueUserWorkItem
SetThreadErrorMode
GetThreadErrorMode
CreateProcessW
DisconnectNamedPipe
CreateThread
GetSystemInfo
VirtualProtect
VirtualQuery
FreeLibrary
LoadLibraryExA
ReleaseSemaphore
WaitForSingleObject
GetModuleHandleW
SwitchToThread
DeleteFileW
FindClose
FindFirstFileW
FlushFileBuffers
GetDriveTypeW
GetFileInformationByHandle
GetFullPathNameW
SetEndOfFile
SetFilePointer
MoveFileW
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LocalAlloc
CreateSemaphoreA
GetSystemTimeAsFileTime
GetLocalTime
FileTimeToSystemTime
FindNextFileW
RemoveDirectoryW
MultiByteToWideChar
GetFileAttributesW
GetSystemDirectoryA
LoadLibraryA
lstrlenA
InitializeCriticalSectionAndSpinCount
FindCloseChangeNotification
FindFirstChangeNotificationW
FindNextChangeNotification
GetDriveTypeA
HeapAlloc
HeapFree
WaitForSingleObjectEx
PeekNamedPipe
CancelIoEx
WaitForMultipleObjectsEx
CreateNamedPipeA
LoadLibraryExW
GetUserDefaultLCID
QueryPerformanceCounter
QueryPerformanceFrequency
EncodePointer
CreateEventW
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
OutputDebugStringW
CreateTimerQueue
SignalObjectAndWait
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
QueryDosDeviceW
GetThreadTimes
FreeLibraryAndExitThread
GetVersionExW
VirtualAlloc
VirtualFree
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
RtlUnwind
ExitThread
GetModuleHandleExW
GetStdHandle
WriteConsoleW
ExitProcess
GetDateFormatW
GetTimeFormatW
IsValidLocale
EnumSystemLocalesW
GetConsoleCP
GetConsoleMode
GetFileSizeEx
SetFilePointerEx
ReadConsoleW
GetTimeZoneInformation
HeapReAlloc
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
SetEnvironmentVariableW
SetStdHandle
HeapSize
CreateWaitableTimerA
GetModuleHandleA
GetModuleFileNameW
CreateEventA
SetEvent
DeleteCriticalSection
InitializeCriticalSectionEx
SetLastError
RaiseException
DecodePointer
OutputDebugStringA
lstrlenW
GetTickCount
Sleep
DeviceIoControl
OpenMutexW
SetNamedPipeHandleState
GetLastError
CloseHandle
WriteFile
ReadFile
GetVolumeInformationW
CreateFileW
GetCurrentThread
SetWaitableTimer
OpenEventA
GlobalAlloc
GlobalFree
SetFileAttributesW
TerminateThread
GetFileSize
GetFileAttributesExW
QueueUserAPC
GetQueuedCompletionStatus
PostQueuedCompletionStatus
SleepEx
CreateIoCompletionPort
CreateWaitableTimerW

user32

MsgWaitForMultipleObjects
PeekMessageA
DispatchMessageA
GetForegroundWindow
FindWindowW
PostMessageW
GetClassNameA
FindWindowA
IsHungAppWindow
LoadImageW
GetCursorPos
GetPropW
SetPropW
SetForegroundWindow
TrackPopupMenu
InsertMenuW
DestroyMenu
CreatePopupMenu
GetSystemMetrics
DestroyWindow
CreateWindowExW
RegisterClassW
CallWindowProcA
PostQuitMessage
DefWindowProcA
PostMessageA
GetMessageA
LoadStringW
GetWindowThreadProcessId
TranslateMessage
InsertMenuItemW

advapi32

RegOpenKeyA
CryptSetHashParam
RegSetValueExW
CryptAcquireContextW
CryptReleaseContext
CryptDestroyKey
CryptGetHashParam
CryptCreateHash
CryptHashData
CryptDestroyHash
RegOpenKeyW
OpenThreadToken
GetTokenInformation
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertStringSidToSidW
SetTokenInformation
GetLengthSid
DuplicateTokenEx
OpenProcessToken
RegDeleteTreeW
RegCreateKeyExW
ConvertStringSecurityDescriptorToSecurityDescriptorA
TreeSetNamedSecurityInfoW
GetNamedSecurityInfoW
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegCreateKeyExA
GetSidSubAuthorityCount
GetSidSubAuthority
GetSecurityDescriptorSacl
GetAclInformation
GetAce
CreateProcessAsUserW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
CryptImportKey
ConvertSidToStringSidA

shell32

SHFileOperationA
SHGetPathFromIDListW
SHCreateDirectoryExW
SHGetSpecialFolderLocation
ShellExecuteA
SHGetKnownFolderPath
SHQueryUserNotificationState
Shell_NotifyIconW

ole32

CoCreateInstance
CoUninitialize
CoInitializeEx
CoTaskMemFree

sensapi

IsNetworkAlive

ws2_32

WSAStartup
WSACleanup
WSAGetLastError
WSACreateEvent
WSAEventSelect
WSAIoctl
WSASocketA

wininet

InternetSetCookieExA
InternetReadFile
InternetWriteFile
InternetSetOptionA
HttpSendRequestExA
InternetCloseHandle
HttpAddRequestHeadersA
HttpSendRequestA
InternetCrackUrlA
InternetOpenA
InternetConnectA
HttpOpenRequestA
HttpEndRequestA
DetectAutoProxyUrl
HttpQueryInfoA

mpr

WNetAddConnection2W
WNetGetConnectionW
WNetGetResourceInformationW
WNetCancelConnection2W

crypt32

CryptProtectData
CryptUnprotectData

oleaut32

SafeArrayCreateVector
SysAllocString
SysFreeString
SafeArrayDestroy
SafeArrayAccessData
SafeArrayUnaccessData

netapi32

NetShareGetInfo

winhttp

WinHttpOpen
WinHttpConnect
WinHttpOpenRequest
WinHttpSetStatusCallback
WinHttpSetCredentials
WinHttpSendRequest
WinHttpSetOption
WinHttpGetProxyForUrl
WinHttpQueryAuthSchemes
WinHttpGetIEProxyConfigForCurrentUser
WinHttpReadData
WinHttpQueryHeaders
WinHttpAddRequestHeaders
WinHttpReceiveResponse
WinHttpWriteData
WinHttpCrackUrl
WinHttpCloseHandle

Exports

Exports

gudeCancel
gudeClearCache
gudeCreate
gudeDestroy
gudeDownload
gudeDownloadRangeToMemory
gudeDownloadToMemory
gudeErrorString
gudeHTTPStatusString
gudePause
gudeRegisterAddChunkHeaderCallback
gudeRegisterAddHeaderCallback
gudeRegisterAddParametersCallback
gudeRegisterCancellationCallback
gudeRegisterChunkErrorRetryCallback
gudeRegisterCompletionCallback
gudeRegisterErrorCallback
gudeRegisterLoggingCallback
gudeRegisterMonitorCallback
gudeRegisterPausedCallback
gudeRegisterProgressCallback
gudeRegisterRequestBodyCallback
gudeRegisterResponseBodyCallback
gudeRegisterResponseHeaderCallback
gudeRegisterSSLCertificatePolicyCallback
gudeRegisterSetServerTypeCallback
gudeRegisterSetTimeoutCallback
gudeRegisterStatusLineCallback
gudeResume
gudeSendRequest
gudeSetLogLevel
gudeSetMultipartUploadThreshold
gudeSetSystemProxyCredentials
gudeSetTargetDataRates
gudeSetWorkerPoolUpperLimit
gudeUpload
gudeUploadFromMemory
gudeVersion

Sections

.text
Size: 3.8MB - Virtual size: 3.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 898KB - Virtual size: 898KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 272KB - Virtual size: 291KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.didat
Size: 512B - Virtual size: 200B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 704KB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

fef7b9a15dba0677216fced9bcd394bf

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

shlwapi

kernel32

user32

advapi32

shell32

ole32

sensapi

ws2_32

wininet

mpr

crypt32

oleaut32

netapi32

winhttp

Exports

Exports

Sections

.text Size: 3.8MB - Virtual size: 3.8MB

.rdata Size: 898KB - Virtual size: 898KB

.data Size: 272KB - Virtual size: 291KB

.didat Size: 512B - Virtual size: 200B

.rsrc Size: 18KB - Virtual size: 17KB

.reloc Size: 704KB - Virtual size: 1.3MB

.text
Size: 3.8MB - Virtual size: 3.8MB

.rdata
Size: 898KB - Virtual size: 898KB

.data
Size: 272KB - Virtual size: 291KB

.didat
Size: 512B - Virtual size: 200B

.rsrc
Size: 18KB - Virtual size: 17KB

.reloc
Size: 704KB - Virtual size: 1.3MB