c97131868b85fbc0b92b61a5e2209347[.]zip

Sharing

Copy URL

Twitter E-mail

General

Target

c97131868b85fbc0b92b61a5e2209347.zip
Size

745KB
MD5

a0aea2356ac257580f9878762ef3707f
SHA1

97d6c8ab9f22ccbaa3e4099f0afed1a0db63d80a
SHA256

568428b5ef914af5d4868f76020f03ec80520fec9d5373c9a242105519103107
SHA512

1b9826a96d75611fc7ca7ad29a5ed11e892d0968f1aa7f93e2bd54fe3ae1cae8733dd4a21f33389311b9d247b96a568fcddd70867a98d0418fd1e80c03820aac
SSDEEP

12288:823booY6tTBTpQVZOKjPDTWhZ54zX5GsV27gL2ic7Exn9hoVMrqm96mkBMTqtV:3MNITBi/O2PDT5zXb27Uxcgx96MnsFBD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/2a11b3c885ff0b7bb54b8d115b5056b84b68667d2c2e8279905e39d348882103

Files

c97131868b85fbc0b92b61a5e2209347.zip
.zip

Password: infected
2a11b3c885ff0b7bb54b8d115b5056b84b68667d2c2e8279905e39d348882103
.exe windows:10 windows x64 arch:x64

Password: infected

19a0a662527a4979bd06835d6218fc60

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

WMPNetwk.pdb

Imports

advapi32

EventRegister
EventUnregister
TraceMessage
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
UnregisterTraceGuids
EventWriteTransfer
OpenSCManagerW
OpenServiceW
CloseServiceHandle
RegCloseKey
CreateServiceW
RegOpenKeyExW
ChangeServiceConfig2W
QueryServiceStatusEx
ControlService
DeleteService
StartServiceCtrlDispatcherW
RegisterServiceCtrlHandlerExW
SetServiceStatus
CopySid
GetLengthSid
IsValidSid
InitializeAcl
AddAce
GetAclInformation
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSecurityDescriptorToStringSecurityDescriptorW
GetSecurityDescriptorOwner
GetSecurityDescriptorGroup
GetSecurityDescriptorDacl
SetSecurityDescriptorDacl
GetSecurityDescriptorSacl
GetSecurityDescriptorControl
MakeAbsoluteSD
InitializeSecurityDescriptor
GetNamedSecurityInfoW
RegQueryValueExW
RegDeleteValueW
RegSetValueExW
RegNotifyChangeKeyValue
ConvertStringSidToSidW
RegCreateKeyExW
RegSetKeySecurity
RegEnumKeyExW
RegGetValueW
EventWriteEx
SetEntriesInAclW
ConvertSidToStringSidW
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
LsaOpenPolicy
LsaLookupNames2
LsaFreeMemory
LsaClose
SetSecurityInfo
GetSecurityInfo
SetSecurityDescriptorControl
GetAce
EqualSid
StartServiceW
ChangeServiceConfigW
LookupAccountSidW

kernel32

EnterCriticalSection
LeaveCriticalSection
CompareStringOrdinal
SetProcessWorkingSetSize
ResetEvent
IsWow64Process
LocalFree
GetModuleFileNameW
DeleteTimerQueueTimer
DeleteTimerQueueEx
CreateTimerQueue
ChangeTimerQueueTimer
CreateTimerQueueTimer
FindResourceW
CompareStringA
GetFullPathNameW
MultiByteToWideChar
MulDiv
RegisterWaitForSingleObject
UnregisterWaitEx
FormatMessageW
GetProcessHeap
HeapFree
CreateThread
WaitForMultipleObjects
GetStringTypeExW
IsProcessorFeaturePresent
lstrcmpiW
GetComputerNameW
GetDynamicTimeZoneInformation
FileTimeToLocalFileTime
FileTimeToSystemTime
GetFileAttributesExW
TzSpecificLocalTimeToSystemTime
GetCurrentThreadId
FindCloseChangeNotification
FindFirstChangeNotificationW
FindNextChangeNotification
WideCharToMultiByte
LocalAlloc
DelayLoadFailureHook
ResolveDelayLoadedAPI
PowerClearRequest
PowerSetRequest
GetTickCount64
WaitForSingleObject
CreateEventW
GetTickCount
Sleep
PowerCreateRequest
SetLastError
GetLastError
GetProcessMitigationPolicy
GetModuleHandleExW
LoadLibraryExW
FreeLibrary
GetProcAddress
LoadLibraryW
RegQueryInfoKeyW
RegGetKeySecurity
OutputDebugStringA
GetModuleHandleW
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetStartupInfoW
HeapDestroy
HeapAlloc
HeapReAlloc
HeapSize
SetEvent
OpenEventW
GetCurrentProcess
CompareStringW
FindResourceExW
LoadResource
LockResource
SizeofResource
HeapSetInformation
DeleteCriticalSection
InitializeCriticalSection
CloseHandle
RaiseException
lstrcmpW

msvcrt

?what@exception@@UEBAPEBDXZ
_CxxThrowException
memcpy
_XcptFilter
_amsg_exit
__wgetmainargs
_ui64tow_s
_i64tow_s
__set_app_type
??0exception@@QEAA@AEBV0@@Z
_exit
wcsrchr
strchr
_cexit
exit
??1exception@@UEAA@XZ
ceil
floor
memcmp
memset
??1type_info@@UEAA@XZ
realloc
_onexit
__dllonexit
_unlock
_lock
?terminate@@YAXXZ
_commode
_fmode
_wcmdln
_initterm
_ltow_s
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBQEBD@Z
_callnewh
strncpy_s
strcpy_s
wcschr
_strlwr_s
strncmp
_ultoa_s
_ultow_s
_wtol
_wtoi
qsort_s
_wcsicmp
_vsnwprintf
swscanf
wcsstr
wcstol
_wcslwr_s
_wcsnicmp
wcsncmp
iswdigit
towupper
_wcstoui64
wcstoul
_errno
_purecall
calloc
malloc
wcscpy_s
free
_wputenv
memmove_s
memcpy_s
__C_specific_handler
??_V@YAXPEAX@Z
__CxxFrameHandler3
??3@YAXPEAX@Z
__setusermatherr
memmove
wcscmp

user32

RegisterPowerSettingNotification
UnregisterClassA
CharUpperBuffW
wvsprintfA
CharUpperW
MsgWaitForMultipleObjectsEx
DispatchMessageW
PeekMessageW
wvsprintfW
UnregisterPowerSettingNotification

oleaut32

VarBstrCmp
SystemTimeToVariantTime
VariantTimeToSystemTime
SafeArrayUnlock
SafeArrayPtrOfIndex
SafeArrayLock
VariantInit
VariantChangeTypeEx
SetErrorInfo
CreateErrorInfo
SafeArrayCopy
SafeArrayCreate
SafeArrayDestroy
VariantClear
SysAllocStringLen
LoadRegTypeLi
SysStringLen
UnRegisterTypeLi
RegisterTypeLi
LoadTypeLi
SysAllocString
SysFreeString

ole32

CoSetProxyBlanket
StringFromGUID2
IIDFromString
CLSIDFromProgID
CoTaskMemAlloc
CoTaskMemFree
CoUnmarshalInterface
CoReleaseMarshalData
CoMarshalInterface
CreateStreamOnHGlobal
PropVariantClear
CoInitializeSecurity
CoInitializeEx
CoUninitialize
CoCreateInstance
CoCreateGuid

wsock32

WSAGetLastError
ntohs
inet_addr
htons

shell32

SHCreateItemFromParsingName
SHCreateItemWithParent
SHGetKnownFolderPath

iphlpapi

SendARP
GetIpNetEntry2
GetIpForwardTable
NotifyAddrChange
GetIpAddrTable
GetBestInterfaceEx
GetAdaptersAddresses
NotifyIpInterfaceChange
CancelIPChangeNotify
ResolveIpNetEntry2
CancelMibChangeNotify2

shlwapi

PathFindFileNameW
ord168
StrChrW
PathCreateFromUrlW
ord219
PathRemoveExtensionW
PathFindExtensionW

ntdll

RtlLookupFunctionEntry
RtlCaptureContext
RtlFreeUnicodeString
RtlVirtualUnwind
RtlInitString
RtlInitUnicodeString
RtlNtStatusToDosError
RtlIpv4StringToAddressExW
NtAllocateLocallyUniqueId

userenv

RegisterGPNotification
UnregisterGPNotification

netapi32

NetApiBufferFree
NetGetJoinInformation
NetShareGetInfo

wtsapi32

WTSQuerySessionInformationW
WTSFreeMemory
WTSEnumerateSessionsW

propsys

InitPropVariantFromCLSID
PropVariantToStringAlloc
PSGetPropertyDescriptionByName
PSGetPropertyKeyFromName
PropVariantToString

gdi32

DeleteObject

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

Sections

.text
Size: 791KB - Virtual size: 791KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 174KB - Virtual size: 174KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 344B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 72KB - Virtual size: 71KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 400KB - Virtual size: 740KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

19a0a662527a4979bd06835d6218fc60

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

msvcrt

user32

oleaut32

ole32

wsock32

shell32

iphlpapi

shlwapi

ntdll

userenv

netapi32

wtsapi32

propsys

gdi32

api-ms-win-core-apiquery-l1-1-0

Sections

.text Size: 791KB - Virtual size: 791KB

.rdata Size: 174KB - Virtual size: 174KB

.data Size: 14KB - Virtual size: 23KB

.pdata Size: 21KB - Virtual size: 21KB

.didat Size: 512B - Virtual size: 344B

.rsrc Size: 72KB - Virtual size: 71KB

.reloc Size: 400KB - Virtual size: 740KB

.text
Size: 791KB - Virtual size: 791KB

.rdata
Size: 174KB - Virtual size: 174KB

.data
Size: 14KB - Virtual size: 23KB

.pdata
Size: 21KB - Virtual size: 21KB

.didat
Size: 512B - Virtual size: 344B

.rsrc
Size: 72KB - Virtual size: 71KB

.reloc
Size: 400KB - Virtual size: 740KB