e22e7c6baeebd701b760f4a27a02d8c4[.]zip

General

Target
e22e7c6baeebd701b760f4a27a02d8c4.zip
Size 9.9MB
Sample240906-3tapdatfnj
SHA256 fc8b39e1550508fc277adb212c06b4d858eec204fe9157947fcd8db28296a1d4
MD5 e81b146b59e15eac54134447700222a8
SHA1 5bedbe1b9f0e3f145784f01e607b77ffa5c62403
SHA512 32c4513d02df5dca9069381473bc11d161bff78210868bf5cd629eda4b58a83a66f0f9d7b71f7a4077322372474a0a5035ac40121b673eaf18750ee6fa0a8272
SSDEEP 196608:hBvQ42JxvG4YULhzKrQqxdiY4N7F7xWGoiMUA1er41IvxRSytJqdQ3oY3B2:mJxoUVzKklRF7IGEUA1eUQnJQQ3oYR2
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/8f770e85d9789cd77a5ebdf321ae54f5162d4b28c9f929ba4bf109bb770acfda

File Explorer

e22e7c6baeebd701b760f4a27a02d8c4.zip

.zip 9.9MB
8f770e85d9789cd77a5ebdf321ae54f5162d4b28c9f929ba4bf109bb770acfda

.exe 14.6MB

e22e7c6baeebd701b760f4a27a02d8c4.zip

SHA256 fc8b39e1550508fc277adb212c06b4d858eec204fe9157947fcd8db28296a1d4
MD5 e81b146b59e15eac54134447700222a8
SHA1 5bedbe1b9f0e3f145784f01e607b77ffa5c62403
SHA512 32c4513d02df5dca9069381473bc11d161bff78210868bf5cd629eda4b58a83a66f0f9d7b71f7a4077322372474a0a5035ac40121b673eaf18750ee6fa0a8272
SSDEEP 196608:hBvQ42JxvG4YULhzKrQqxdiY4N7F7xWGoiMUA1er41IvxRSytJqdQ3oY3B2:mJxoUVzKklRF7IGEUA1eUQnJQQ3oYR2
MD5 SHA1 SHA512 SSDEEP

Password

infected

8f770e85d9789cd77a5ebdf321ae54f5162d4b28c9f929ba4bf109bb770acfda

IMPHASH 3cd0350cb20713093b4eb51a8785dabd
SHA256 8f770e85d9789cd77a5ebdf321ae54f5162d4b28c9f929ba4bf109bb770acfda
MD5 e22e7c6baeebd701b760f4a27a02d8c4
SHA1 1b924330a134a074ecb6f59affde76d6989100c0
SHA512 aa15560cb2fee8ae0c07acc6403f1ec9f33dc63cd6965d5e8af2f645970bb3c0fb7cec48646ddcaaa0fbef010bcdbc0468ea5c78658ea25994d1e1cd80e904e4
SSDEEP 98304:SC+PPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPf:x
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

0

Major OS version

5

Entry point

7000

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\hesisuficuti39\poxeti\ficoveroput39_fabejaka72_reja.pdb

kernel32

LoadResource UpdateResourceA InterlockedIncrement GetEnvironmentStringsW SetEvent OpenSemaphoreA GetSystemTimeAsFileTime GetCommandLineA WriteFileGather CreateActCtxW EnumResourceTypesA GlobalAlloc LeaveCriticalSection GetFileAttributesA FindNextVolumeW ReadFile GetLocaleInfoA GetDevicePowerState GetProcAddress HeapSize VerLanguageNameA RemoveDirectoryA FreeUserPhysicalPages GlobalGetAtomNameA PrepareTape WriteConsoleA GetProcessId WaitForMultipleObjects GetModuleFileNameA GetModuleHandleA ReleaseMutex EndUpdateResourceA FindFirstVolumeW AddConsoleAliasA lstrcpyW HeapReAlloc HeapAlloc GetStartupInfoA DeleteCriticalSection EnterCriticalSection HeapFree VirtualFree VirtualAlloc HeapCreate GetModuleHandleW Sleep ExitProcess WriteFile GetStdHandle SetHandleCount GetFileType GetLastError SetFilePointer TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetCurrentThreadId InterlockedDecrement QueryPerformanceCounter GetTickCount GetCurrentProcessId InitializeCriticalSectionAndSpinCount RtlUnwind LoadLibraryA SetStdHandle GetConsoleCP GetConsoleMode FlushFileBuffers GetCPInfo GetACP GetOEMCP IsValidCodePage GetConsoleOutputCP WriteConsoleW MultiByteToWideChar LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW CloseHandle CreateFileA

user32

GetCursorPos

gdi32

GetCharWidthFloatA

advapi32

DeregisterEventSource

Sharing