5319c14fbff21277f101b2632b9babbc[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

5319c14fbff21277f101b2632b9babbc.zip
Size

530KB
MD5

3118318ccab2948ecb0d267fdb42b2fd
SHA1

36238d94e909b3ed0c26c7d64f51c3a4c75d0d65
SHA256

2285687f39cdc6d98f94a9d2d6a06e427707519661d00b410267bb25ef8fba50
SHA512

72d9879dc95a1b3741f16b6f450f07ff017319ad823585b02c2a0f444f8dd9f807b871adb7dd95c5e60063e00081b17050fb5e04f4e7512de3966b0f1049f8a7
SSDEEP

12288:viIsmbT8NovITu8iwmgJ6oa9aENJzdies7eSXNo610qJ8PT1a7QB:vio0PNiCJ6oWZDgeytSKJcT1ac

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/aa8d6e40a9ec54bf63766f79cb03ab1151a333f3808b75ebd2e9bf8056b8a0dc

Files

5319c14fbff21277f101b2632b9babbc.zip
.zip

Password: infected
aa8d6e40a9ec54bf63766f79cb03ab1151a333f3808b75ebd2e9bf8056b8a0dc
.exe windows:10 windows x86 arch:x86

Password: infected

0af8419be362159398343d7b31721726

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

cmd.pdb

Imports

msvcrt

__setusermatherr
__p__fmode
exit
iswxdigit
time
srand
_wtol
fflush
wcsstr
iswalpha
wcstoul
_errno
printf
rand
fprintf
_initterm
wcsncmp
_pipe
_cexit
wcsrchr
realloc
towlower
_ultoa
_exit
setlocale
_wcsupr
iswdigit
_lock
_vsnwprintf
_unlock
_wcsicmp
iswspace
wcschr
memmove
__set_app_type
fgets
_pclose
__dllonexit
_onexit
__getmainargs
_open_osfhandle
ferror
_close
feof
_wpopen
_except_handler4_common
?terminate@@YAXXZ
_wcsnicmp
wcstol
_controlfp
_get_osfhandle
_getch
memcmp
_dup
towupper
_setmode
_dup2
qsort
wcsspn
_amsg_exit
_tell
__CxxFrameHandler3
_setjmp3
??_V@YAXPAX@Z
longjmp
??3@YAXPAX@Z
_local_unwind4
_wcslwr
free
calloc
_XcptFilter
__p__commode
??1type_info@@UAE@XZ
memcpy
memcpy_s
swscanf
__iob_func
malloc
_callnewh
_purecall
??0exception@@QAE@ABQBD@Z
??0exception@@QAE@ABQBDH@Z
??0exception@@QAE@ABV0@@Z
??1exception@@UAE@XZ
?what@exception@@UBEPBDXZ
_CxxThrowException
memset

ntdll

NtOpenProcessToken
NtQueryInformationToken
NtClose
NtOpenThreadToken
NtFsControlFile
RtlDosPathNameToNtPathName_U
RtlFindLeastSignificantBit
RtlFreeHeap
RtlReleaseRelativeName
NtOpenFile
RtlDosPathNameToRelativeNtPathName_U_WithStatus
NtSetInformationFile
NtQueryVolumeInformationFile
NtSetInformationProcess
NtQueryInformationProcess
RtlNtStatusToDosError
NtCancelSynchronousIoFile
RtlCreateUnicodeStringFromAsciiz
RtlFreeUnicodeString

api-ms-win-core-kernel32-legacy-l1-1-0

CopyFileW

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
GetModuleFileNameA
LoadLibraryExW
GetModuleFileNameW
GetModuleHandleExW
GetModuleHandleW

api-ms-win-core-synch-l1-1-0

AcquireSRWLockShared
TryAcquireSRWLockExclusive
ReleaseMutex
WaitForSingleObjectEx
InitializeCriticalSection
WaitForSingleObject
ReleaseSemaphore
OpenSemaphoreW
LeaveCriticalSection
CreateMutexExW
CreateSemaphoreExW
ReleaseSRWLockShared
ReleaseSRWLockExclusive
EnterCriticalSection

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapAlloc
HeapSize
HeapSetInformation
HeapReAlloc
HeapFree

api-ms-win-core-errorhandling-l1-1-0

SetLastError
UnhandledExceptionFilter
GetLastError
SetErrorMode
SetUnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-0

DeleteProcThreadAttributeList
UpdateProcThreadAttribute
CreateProcessAsUserW
GetStartupInfoW
CreateProcessW
InitializeProcThreadAttributeList
GetCurrentProcessId
GetCurrentThreadId
OpenThread
TerminateProcess
GetExitCodeProcess
GetCurrentProcess
ResumeThread

api-ms-win-core-localization-l1-2-0

FormatMessageW
SetThreadLocale
GetACP
GetCPInfo
GetLocaleInfoW
GetUserDefaultLCID
GetThreadLocale

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
IsDebuggerPresent
DebugBreak

api-ms-win-core-handle-l1-1-0

DuplicateHandle
CloseHandle

api-ms-win-core-memory-l1-1-0

VirtualAlloc
VirtualFree
VirtualQuery
ReadProcessMemory

api-ms-win-core-console-l1-1-0

ReadConsoleW
SetConsoleCtrlHandler
SetConsoleMode
WriteConsoleW
GetConsoleMode
GetConsoleOutputCP

api-ms-win-core-file-l1-1-0

CreateFileW
FlushFileBuffers
GetFileAttributesExW
GetDriveTypeW
FindClose
FindNextFileW
CreateDirectoryW
GetVolumeInformationW
SetFileAttributesW
SetEndOfFile
SetFilePointerEx
WriteFile
DeleteFileW
SetFileTime
GetVolumePathNameW
SetFilePointer
ReadFile
GetFileAttributesW
GetFileType
RemoveDirectoryW
FindFirstFileExW
CompareFileTime
GetFullPathNameW
GetDiskFreeSpaceExW
FileTimeToLocalFileTime
GetFileSize
FindFirstFileW

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
MultiByteToWideChar

api-ms-win-core-processenvironment-l1-1-0

GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
ExpandEnvironmentStringsW
SetCurrentDirectoryW
GetCurrentDirectoryW
SearchPathW
GetEnvironmentVariableW
GetStdHandle
SetEnvironmentStringsW

api-ms-win-core-console-l2-1-0

SetConsoleCursorPosition
GetConsoleScreenBufferInfo
ScrollConsoleScreenBufferW
FillConsoleOutputAttribute
FillConsoleOutputCharacterW
FlushConsoleInputBuffer
SetConsoleTextAttribute

api-ms-win-security-base-l1-1-0

RevertToSelf
GetFileSecurityW
GetSecurityDescriptorOwner

api-ms-win-core-sysinfo-l1-1-0

GetVersion
GetTickCount
GetLocalTime
GetSystemTime
GetSystemTimeAsFileTime
SetLocalTime
GetWindowsDirectoryW

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime
SystemTimeToFileTime

api-ms-win-core-datetime-l1-1-0

GetDateFormatW
GetTimeFormatW

api-ms-win-core-systemtopology-l1-1-0

GetNumaHighestNodeNumber
GetNumaNodeProcessorMaskEx

api-ms-win-core-console-l2-2-0

SetConsoleTitleW
GetConsoleTitleW

api-ms-win-core-processenvironment-l1-2-0

NeedCurrentDirectoryForExePathW

api-ms-win-core-registry-l1-1-0

RegDeleteValueW
RegQueryValueExW
RegCloseKey
RegOpenKeyExW
RegEnumKeyExW
RegCreateKeyExW
RegDeleteKeyExW
RegSetValueExW

api-ms-win-core-file-l2-1-0

MoveFileExW
CreateSymbolicLinkW
CreateHardLinkW
MoveFileWithProgressW
GetFileInformationByHandleEx

api-ms-win-core-heap-l2-1-0

GlobalAlloc
GlobalFree
LocalFree

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-core-processtopology-l1-1-0

GetThreadGroupAffinity

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW
lstrcmpW

api-ms-win-core-processtopology-obsolete-l1-1-0

SetProcessAffinityMask

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Sections

.text
Size: 173KB - Virtual size: 172KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 109KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

0af8419be362159398343d7b31721726

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-console-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-console-l2-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-datetime-l1-1-0

api-ms-win-core-systemtopology-l1-1-0

api-ms-win-core-console-l2-2-0

api-ms-win-core-processenvironment-l1-2-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-file-l2-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-io-l1-1-0

api-ms-win-core-processtopology-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-processtopology-obsolete-l1-1-0

api-ms-win-core-apiquery-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Sections

.text Size: 173KB - Virtual size: 172KB

.data Size: 512B - Virtual size: 109KB

.idata Size: 9KB - Virtual size: 9KB

.didat Size: 512B - Virtual size: 64B

.rsrc Size: 33KB - Virtual size: 33KB

.reloc Size: 9KB - Virtual size: 9KB

.text
Size: 173KB - Virtual size: 172KB

.data
Size: 512B - Virtual size: 109KB

.idata
Size: 9KB - Virtual size: 9KB

.didat
Size: 512B - Virtual size: 64B

.rsrc
Size: 33KB - Virtual size: 33KB

.reloc
Size: 9KB - Virtual size: 9KB