789f56bacb93e6f5c862e114fbc78628[.]zip | Triage

Sharing

Copy URL Twitter E-mail

General

Target

789f56bacb93e6f5c862e114fbc78628.zip
Size

228KB
MD5

2f95980e6804dfe7a4800e4976f2b697
SHA1

25165ad5946ba834dceacb897bafb22da924eb28
SHA256

161fe7e97db8145ccb0d01512f89ad2f0114f43062706810fab23ea1b94663a5
SHA512

49462284802a378832a4cec9a4ae53f29705037f4a8bebd8bf78d7d90f69882adbf0970cb6dcc5fc3a20110b1b103794af94291d9a3b083f2df50d321c69acef
SSDEEP

6144:ZylTYRxXJVM+JLZXWNV5QYl4DMsphiJKlX44uh:AYrZF9FWtls7rlo4U

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/b99d86a1019659a002a7b37ded4af5be96dba272d1f269d5f5e2a10412b1f46f

Files

789f56bacb93e6f5c862e114fbc78628.zip
.zip

Password: infected
b99d86a1019659a002a7b37ded4af5be96dba272d1f269d5f5e2a10412b1f46f
.exe windows:4 windows x86 arch:x86

Password: infected

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\udoku\Desktop\VS PROJECTS\GTools\GTools\obj\Release\GTools.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 755KB - Virtual size: 755KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 116KB - Virtual size: 115KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ