malware[.]zip | Triage™

General

Target
malware.zip
Size 121KB
Sample240913-ragg2atdnf
SHA256 98e0c1e5d2e8e25ff99029d2f76a45a1b320c8cf3349df45d02dcd4070c0f49f
MD5 abaf4783b0757ec06b31251e980a1eaa
SHA1 40b6f277c5d8c50d5e8007b498a92c2ff73b8029
SHA512 74933dfa0a0cc46a40a71efdf30e57848d1130cbf00b44bd77bd58458d671d03916b1432bb2b062f9d076390283da7f89e4680fd7c32ea6f60be0533e6bd42b8
SSDEEP 3072:+iRgX3TJXl/CvZmnm/S0kXIj4rq5rbSC4bpsFUUR28VfS:PWX3TJXsom/SVSGqvhc8tS
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/locky sample/document_copy_payload.exe

File Explorer

malware.zip

.zip 121KB
locky sample/document_copy.js

.js 5KB
locky sample/document_copy_payload.exe

.exe 151KB
sample2/invoice.js

.js 1KB

malware.zip

SHA256 98e0c1e5d2e8e25ff99029d2f76a45a1b320c8cf3349df45d02dcd4070c0f49f
MD5 abaf4783b0757ec06b31251e980a1eaa
SHA1 40b6f277c5d8c50d5e8007b498a92c2ff73b8029
SHA512 74933dfa0a0cc46a40a71efdf30e57848d1130cbf00b44bd77bd58458d671d03916b1432bb2b062f9d076390283da7f89e4680fd7c32ea6f60be0533e6bd42b8
SSDEEP 3072:+iRgX3TJXl/CvZmnm/S0kXIj4rq5rbSC4bpsFUUR28VfS:PWX3TJXsom/SVSGqvhc8tS
MD5 SHA1 SHA512 SSDEEP

Password

infected

locky sample/document_copy_payload.exe

IMPHASH 6c7a689fe4b26f0ecb3b07b4c974cb0b
SHA256 d5c93927b531e8629898b31e277034c0802befa26ffe66ed3df96d25282fc408
MD5 f2675f682e00488c346924d2fbec10eb
SHA1 1a8588c8e1be08f72804ae3a4e0a34b1b492ad79
SHA512 8218839e91aeb68f12dc7f2cfbe431ace4d444e033a8f8300413297e5fd9d78e752576bb77415005051a08ddb0ea355d707e2be3b1b92faa2fa000fe6e182338
SSDEEP 3072:ebnZrimJ3dTNIj9dRR34lc3Stj0tVfNNMa1:ez9nJzIZzRIG0iVfX
MD5 SHA1 SHA512 SSDEEP

windows:3 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

2

Major OS version

3

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_DEBUG_STRIPPED

PDB paths

malware.zip

locky sample/document_copy.js

locky sample/document_copy_payload.exe

kernel32

dsauth

imm32

winhttp

generic

sample2/invoice.js

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

malware.zip

locky sample/document_copy.js

locky sample/document_copy_payload.exe

kernel32

dsauth

imm32

winhttp

generic

sample2/invoice.js