5fc7b5902da91c8eb17e79b878698674[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

5fc7b5902da91c8eb17e79b878698674.zip
Size

295KB
MD5

f760cea27489e804e3c6742bfb1d3c4a
SHA1

75eaa12be57cb211042d74b392ba0d38e13f6a4c
SHA256

4a2a80cdd301c893c3e7b0a783f13d0e0b22fba0b50f06cb399264b911f3a39c
SHA512

542348c369366f8ee998ec8f81a4842ae0cb2601032b9f935ad7c70c6ba0a7e591fffd93fa5f445ef1512f42b34492ff6661fac94e243b76fb0725e859167a35
SSDEEP

6144:7Bie4yVL3g9b9e5ZN8wJ+AQrLL7sL5KF4+ytEWrucdvmP+:Y6KQJ+AQfLwo2+ytPRkP+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/a9b1b8095adf5cdaed83e4e31a3544a0d733f60282c6befc26e81e617de68206

Files

5fc7b5902da91c8eb17e79b878698674.zip
.zip

Password: infected
a9b1b8095adf5cdaed83e4e31a3544a0d733f60282c6befc26e81e617de68206
.dll windows:4 windows x64 arch:x64

Password: infected

f7d8d90ab54224232700ea66b03425f4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

ntdll

__chkstk

shlwapi

StrStrIW

winmm

mciSendStringA
waveInGetDevCapsA
mciSendStringW
midiOutReset
waveInGetDevCapsW
midiOutGetDevCapsW
auxGetDevCapsW
waveOutSetPitch
midiInStart

user32

GetTopWindow

advapi32

CopySid

Exports

Exports

CallNtPowerInformation
CanUserWritePwrScheme
DeletePwrScheme
DevicePowerClose
DevicePowerEnumDevices
DevicePowerOpen
DevicePowerSetDeviceState
EnumPwrSchemes
GUIDFormatToGlobalPowerPolicy
GUIDFormatToPowerPolicy
GetActivePwrScheme
GetCurrentPowerPolicies
GetPwrCapabilities
GetPwrDiskSpindownRange
IsAdminOverrideActive
IsPwrHibernateAllowed
IsPwrShutdownAllowed
IsPwrSuspendAllowed
LoadCurrentPwrScheme
MergeLegacyPwrScheme
PowerApplyPowerRequestOverride
PowerCanRestoreIndividualDefaultPowerScheme
PowerCreatePossibleSetting
PowerCreateSetting
PowerCustomizePlatformPowerSettings
PowerDebugDifPowerPolicies
PowerDebugDifSystemPowerPolicies
PowerDebugDumpPowerPolicy
PowerDebugDumpPowerScheme
PowerDebugDumpSystemPowerCapabilities
PowerDebugDumpSystemPowerPolicy
PowerDeleteScheme
PowerDeterminePlatformRole
PowerDisableCoreParkingSelectively
PowerDuplicateScheme
PowerEnumerate
PowerGetActiveScheme
PowerImportPowerScheme
PowerOpenSystemPowerKey
PowerOpenUserPowerKey
PowerPolicyToGUIDFormat
PowerReadACDefaultIndex
PowerReadACValue
PowerReadACValueIndex
PowerReadDCDefaultIndex
PowerReadDCValue
PowerReadDCValueIndex
PowerReadDescription
PowerReadFriendlyName
PowerReadIconResourceSpecifier
PowerReadPossibleDescription
PowerReadPossibleFriendlyName
PowerReadPossibleValue
PowerReadSecurityDescriptor
PowerReadSettingAttributes
PowerReadValueIncrement
PowerReadValueMax
PowerReadValueMin
PowerReadValueUnitsSpecifier
PowerRemovePowerSetting
PowerReplaceDefaultPowerSchemes
PowerRestoreDefaultPowerSchemes
PowerRestoreIndividualDefaultPowerScheme
PowerSetActiveScheme
PowerSetAlsBrightnessOffset
PowerSettingAccessCheck
PowerSettingRegisterNotification
PowerSettingUnregisterNotification
PowerWriteACDefaultIndex
PowerWriteACValueIndex
PowerWriteDCDefaultIndex
PowerWriteDCValueIndex
PowerWriteDescription
PowerWriteFriendlyName
PowerWriteIconResourceSpecifier
PowerWritePossibleDescription
PowerWritePossibleFriendlyName
PowerWritePossibleValue
PowerWriteSecurityDescriptor
PowerWriteSettingAttributes
PowerWriteValueIncrement
PowerWriteValueMax
PowerWriteValueMin
PowerWriteValueUnitsSpecifier
ReadGlobalPwrPolicy
ReadProcessorPwrScheme
ReadPwrScheme
SetActivePwrScheme
SetSuspendState
ValidatePowerPolicies
WriteGlobalPwrPolicy
WriteProcessorPwrScheme
WritePwrScheme

Sections

.text
Size: 130KB - Virtual size: 129KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 223KB - Virtual size: 223KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 540B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.pwmi
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.uclgtf
Size: 1024B - Virtual size: 735B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.kfmznp
Size: 1024B - Virtual size: 1022B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.zgjovr
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.odqjc
Size: 1024B - Virtual size: 1022B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.lfzq
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.lqtezs
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.esa
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

f7d8d90ab54224232700ea66b03425f4

Headers

DLL Characteristics

File Characteristics

Imports

ntdll

shlwapi

winmm

user32

advapi32

Exports

Exports

Sections

.text Size: 130KB - Virtual size: 129KB

.rdata Size: 223KB - Virtual size: 223KB

.data Size: 6KB - Virtual size: 5KB

.pdata Size: 1024B - Virtual size: 540B

.rsrc Size: 4KB - Virtual size: 4KB

.reloc Size: 12KB - Virtual size: 12KB

.pwmi Size: 2KB - Virtual size: 2KB

.uclgtf Size: 1024B - Virtual size: 735B

.kfmznp Size: 1024B - Virtual size: 1022B

.zgjovr Size: 2KB - Virtual size: 1KB

.odqjc Size: 1024B - Virtual size: 1022B

.lfzq Size: 5KB - Virtual size: 4KB

.lqtezs Size: 1KB - Virtual size: 1KB

.esa Size: 3KB - Virtual size: 3KB

.text
Size: 130KB - Virtual size: 129KB

.rdata
Size: 223KB - Virtual size: 223KB

.data
Size: 6KB - Virtual size: 5KB

.pdata
Size: 1024B - Virtual size: 540B

.rsrc
Size: 4KB - Virtual size: 4KB

.reloc
Size: 12KB - Virtual size: 12KB

.pwmi
Size: 2KB - Virtual size: 2KB

.uclgtf
Size: 1024B - Virtual size: 735B

.kfmznp
Size: 1024B - Virtual size: 1022B

.zgjovr
Size: 2KB - Virtual size: 1KB

.odqjc
Size: 1024B - Virtual size: 1022B

.lfzq
Size: 5KB - Virtual size: 4KB

.lqtezs
Size: 1KB - Virtual size: 1KB

.esa
Size: 3KB - Virtual size: 3KB