AVM 5[.]2[.]zip | Triage

Sharing

General

Target

AVM 5.2.zip
Size

22.5MB
MD5

43a2a78c1bbebaae20a3937d70ce998e
SHA1

0a62c85b7bf82de7bdc65491f61933dfcbf6675f
SHA256

039d0f74cbff6dc13b7913cfbb5a70581af84b2c649bb83a65d651ab254a5f33
SHA512

5de3f68d15526e83d930d94536b01a2ddac9dd46d2a21224b10d97fcb80e3ac67bacf13c3adbde3fbd762c1be4c22e412030fc623cc66e751e1d0766283e0b0e
SSDEEP

393216:8nWmvhw9C9oGlIWTyVI4N1HpnQ3DF6NQ5Aj4jdYn1n0PC9CeSigjWkT3o/Lq1wS5:8WmZp1yn1HpnQ3Z6x4jdYn10Pde1Q4/S

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/RENAME.exe

Files

AVM 5.2.zip
.zip
RENAME.exe
.exe windows:6 windows x64 arch:x64

fbce56f96b2322a3c1c40a01307a7a16

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

RegQueryValueW

kernel32

GetModuleHandleA

shell32

DragFinish

user32

DefWindowProcA

Sections

.pdata
Size: - Virtual size: 56.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: - Virtual size: 2.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: - Virtual size: 3.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 157KB - Virtual size: 156KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.text
Size: - Virtual size: 2.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 148KB - Virtual size: 148KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE