023a44bdf894d9c4db9f0be45bbbbcea[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

023a44bdf894d9c4db9f0be45bbbbcea.zip
Size

332KB
MD5

e79e8a0ac9b0146d06f0906d5b3fe4a1
SHA1

fd6e5c50c939ab919c7b148a07c11af460ad424d
SHA256

ad8f254700d4250105030253431acbd0261adae3174aa88859b0907eabc9ed4a
SHA512

f3b5f74bd45cb412fb8425c07c89c9ea211090c49a4dddf594eb767c99d9e972033bc4c14d6cc9fe6c1bfab1037ad714f77380f3aa65c80090d2925f7a0dc2be
SSDEEP

6144:NLmfHomLU2qchGKhnw2gPNykjnOFL8yDQ+qjMEl2AbspkzhcDUUMxgzx9i:NqfUnwpUskjXyDQ+UvwAbtFcDU38I

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/e92cdffdb7a1dd4b7021c9c54d48abbd3e2b1280299410359f0bc78dd73bbd85

Files

023a44bdf894d9c4db9f0be45bbbbcea.zip
.zip

Password: infected
e92cdffdb7a1dd4b7021c9c54d48abbd3e2b1280299410359f0bc78dd73bbd85
.exe windows:10 windows x64 arch:x64

Password: infected

db6db794db9e5264490726992183fef7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

DeveloperToolsSvc.pdb

Imports

msvcrt

_exit
_unlock
calloc
exit
realloc
__setusermatherr
setlocale
free
??0bad_cast@@QEAA@PEBD@Z
??1bad_cast@@UEAA@XZ
??0bad_cast@@QEAA@AEBV0@@Z
swprintf_s
__pctype_func
isupper
__dllonexit
___lc_handle_func
___lc_codepage_func
wcscpy_s
sprintf_s
islower
strchr
__uncaught_exception
abort
__set_app_type
_amsg_exit
_XcptFilter
memmove
memcpy
_set_errno
strtol
_errno
strncpy_s
wcstombs
iswalpha
memset
_wcsdup
_CxxThrowException
_initterm
_cexit
iswdigit
?what@exception@@UEBAPEBDXZ
_lock
__wgetmainargs
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBQEBD@Z
_callnewh
malloc
_vsnprintf_s
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@XZ
_free_locale
??1exception@@UEAA@XZ
_get_current_locale
?terminate@@YAXXZ
_commode
__C_specific_handler
??1type_info@@UEAA@XZ
__crtLCMapStringA
_fmode
_onexit
memmove_s
_purecall
memcpy_s
_vsnwprintf
??_V@YAXPEAX@Z
__CxxFrameHandler3
??3@YAXPEAX@Z

api-ms-win-core-heap-obsolete-l1-1-0

LocalAlloc
LocalFree

api-ms-win-core-com-l1-1-0

CoCreateFreeThreadedMarshaler
CoResumeClassObjects
StringFromGUID2
CoTaskMemAlloc
CoWaitForMultipleHandles
CoRevokeClassObject
CoTaskMemFree
CoDisconnectContext
CoCreateGuid
CoReleaseServerProcess
CoCreateInstance
CoInitializeSecurity
CoAddRefServerProcess
CoRegisterClassObject

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
GetModuleFileNameA
GetModuleHandleW
GetModuleHandleExW

api-ms-win-core-synch-l1-1-0

AcquireSRWLockShared
CreateMutexExW
DeleteCriticalSection
ReleaseSRWLockShared
LeaveCriticalSection
CreateEventW
ReleaseMutex
CreateSemaphoreExW
SetEvent
InitializeCriticalSectionEx
CreateEventExW
OpenSemaphoreW
WaitForSingleObject
ReleaseSemaphore
WaitForSingleObjectEx
AcquireSRWLockExclusive
EnterCriticalSection
ReleaseSRWLockExclusive

api-ms-win-core-heap-l1-1-0

HeapFree
HeapAlloc
HeapSize
GetProcessHeap
HeapDestroy
HeapReAlloc

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError
SetLastError
RaiseException

api-ms-win-core-winrt-string-l1-1-0

WindowsGetStringRawBuffer
WindowsCreateString
WindowsCreateStringReference
WindowsIsStringEmpty
WindowsDeleteString
WindowsConcatString
WindowsDuplicateString
WindowsStringHasEmbeddedNull

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-processthreads-l1-1-0

SetThreadToken
OpenThreadToken
CreateProcessAsUserW
OpenProcessToken
GetCurrentProcess
TerminateProcess
GetCurrentProcessId
GetCurrentThreadId
GetCurrentThread

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory
RoRegisterActivationFactories
RoInitialize
RoUninitialize
RoRevokeActivationFactories
RoActivateInstance

api-ms-win-core-winrt-error-l1-1-0

RoOriginateErrorW
RoOriginateError

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
OutputDebugStringW
DebugBreak

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-service-core-l1-1-0

RegisterServiceCtrlHandlerExW
SetServiceStatus
StartServiceCtrlDispatcherW

api-ms-win-security-sddl-l1-1-0

ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW

api-ms-win-security-base-l1-1-0

ImpersonateLoggedOnUser
InitializeSid
CopySid
RevertToSelf
GetSecurityDescriptorDacl
CreateWellKnownSid
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
GetSidLengthRequired
AddAccessAllowedAce
InitializeAcl
GetSidSubAuthority
EqualSid
DuplicateTokenEx
MakeAbsoluteSD
DuplicateToken
GetTokenInformation
IsValidSid
GetLengthSid

api-ms-win-core-synch-l1-2-0

InitOnceComplete
InitOnceBeginInitialize
SleepConditionVariableSRW
Sleep
WakeAllConditionVariable

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-appmodel-unlock-l1-1-0

IsDeveloperModeEnabled

api-ms-win-core-toolhelp-l1-1-0

Process32NextW
Process32FirstW
CreateToolhelp32Snapshot

api-ms-win-core-processthreads-l1-1-1

OpenProcess

api-ms-win-security-lsalookup-l2-1-0

LookupAccountSidW
LookupAccountNameW

srvcli

NetShareAdd
NetShareDelEx
NetShareGetInfo

api-ms-win-core-file-l1-1-0

DeleteFileW
CreateDirectoryW
CreateFileW
SetFilePointer
GetFileAttributesW
ReadFile
WriteFile

netutils

NetApiBufferFree

rpcrt4

UuidCreate

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer
EventUnregister
EventRegister
EventActivityIdControl
EventSetInformation

userenv

CreateProfile
CreateEnvironmentBlock
DestroyEnvironmentBlock

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegQueryInfoKeyW
RegEnumKeyExW
RegOpenKeyExW
RegGetValueW

api-ms-win-security-credentials-l1-1-0

CredWriteW
CredFree
CredReadW
CredDeleteW

samcli

NetUserSetInfo
NetUserAdd
NetUserGetInfo
NetLocalGroupAddMembers
NetUserDel

sspicli

LogonUserExExW

api-ms-win-eventing-controller-l1-1-0

EventAccessControl
EventAccessQuery

api-ms-win-core-string-l1-1-0

MultiByteToWideChar

api-ms-win-security-provider-l1-1-0

SetEntriesInAclW
GetExplicitEntriesFromAclW
GetNamedSecurityInfoW
SetNamedSecurityInfoW

api-ms-win-security-lsapolicy-l1-1-0

LsaAddAccountRights
LsaClose
LsaOpenPolicy

cryptsp

CryptReleaseContext
CryptGenRandom
CryptAcquireContextW

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-appmodel-runtime-l1-1-0

GetApplicationUserModelId

api-ms-win-appmodel-runtime-l1-1-1

ParseApplicationUserModelId
FindPackagesByPackageFamily

ntdll

RtlGetDeviceFamilyInfoEnum
RtlIsMultiSessionSku

firewallapi

FWOpenPolicyStore
FWClosePolicyStore
FWAddFirewallRule

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Sections

.text
Size: 113KB - Virtual size: 112KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 45KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 112B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 400KB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

db6db794db9e5264490726992183fef7

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-winrt-error-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-service-core-l1-1-0

api-ms-win-security-sddl-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-appmodel-unlock-l1-1-0

api-ms-win-core-toolhelp-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-security-lsalookup-l2-1-0

srvcli

api-ms-win-core-file-l1-1-0

netutils

rpcrt4

api-ms-win-eventing-provider-l1-1-0

userenv

api-ms-win-core-registry-l1-1-0

api-ms-win-security-credentials-l1-1-0

samcli

sspicli

api-ms-win-eventing-controller-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-security-provider-l1-1-0

api-ms-win-security-lsapolicy-l1-1-0

cryptsp

api-ms-win-core-apiquery-l1-1-0

api-ms-win-appmodel-runtime-l1-1-0

api-ms-win-appmodel-runtime-l1-1-1

ntdll

firewallapi

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Sections

.text Size: 113KB - Virtual size: 112KB

.rdata Size: 45KB - Virtual size: 45KB

.data Size: 1024B - Virtual size: 3KB

.pdata Size: 6KB - Virtual size: 5KB

.didat Size: 512B - Virtual size: 112B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 400KB - Virtual size: 1.1MB

.text
Size: 113KB - Virtual size: 112KB

.rdata
Size: 45KB - Virtual size: 45KB

.data
Size: 1024B - Virtual size: 3KB

.pdata
Size: 6KB - Virtual size: 5KB

.didat
Size: 512B - Virtual size: 112B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 400KB - Virtual size: 1.1MB