Malware-1[.]zip | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Malware-1.zip
Size 637KB
Sample240926-dnj87atgnk
SHA256 97a8f2f308df9132d47723a1c610f3109d29e7b3da135d0730226c79a73a8a62
MD5 2efb281516b6957add95c376485eb726
SHA1 1e69331881299fdf6f9f1b3f024d508ccf88c473
SHA512 5fc506cdf549c3fd48ae1412681fd220697600df9c7760d148f5a7aa0ccb2d3b2e4b78de0c92212a5acd424fba55da29e1a7fc0b98708d0c88e44b6a2e65d580
SSDEEP 12288:b8WE9mmhwFWFbdIe6YL/1UrObziLvuiPFu6hwkgOCHameDEH+wbNk5+v7:fE2FW9dIe6KHbGdtu6KsC6HDEH+wWMj
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/vim.dll

File Explorer

Malware-1.zip

.zip 637KB
Run-Malware-1.bat

23B
vim.dll

.dll 1.5MB

Malware-1.zip

SHA256 97a8f2f308df9132d47723a1c610f3109d29e7b3da135d0730226c79a73a8a62
MD5 2efb281516b6957add95c376485eb726
SHA1 1e69331881299fdf6f9f1b3f024d508ccf88c473
SHA512 5fc506cdf549c3fd48ae1412681fd220697600df9c7760d148f5a7aa0ccb2d3b2e4b78de0c92212a5acd424fba55da29e1a7fc0b98708d0c88e44b6a2e65d580
SSDEEP 12288:b8WE9mmhwFWFbdIe6YL/1UrObziLvuiPFu6hwkgOCHameDEH+wbNk5+v7:fE2FW9dIe6KHbGdtu6KsC6HDEH+wWMj
MD5 SHA1 SHA512 SSDEEP

vim.dll

IMPHASH 271c8a61a1fa8deb146a1856fb1b8a91
SHA256 e194627c6eab59f38a73e97054a78f8859c5d6325bb4c04c10ea668d931adedc
MD5 9346378bbb68e22940e3f49b1570ecf3
SHA1 d9fd4d0f6f55bdf2ee8004e73eacb8663508a680
SHA512 0f80fff027e58ed37bd4b0d94b0d6c3074f9e3618840d9826fdb097c2af7388a9a3b49a339bb5d9753fe542b176eb06c6c599b223d25a32c4154daa631601a34
SSDEEP 24576:kjNaFtPs+XGNTmJRAPqw+VaM6eEJgw3P55DoF9Ea7X:kjNaFtPr4yXAPv+kM6BJg2LsW
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

265328

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\dvs\p4\build\sw\gcomp\rel\gs_04_50\src\Mjolnir\RemoteInput\rxinput\nvgamepad\_out\win7_amd64_release\rxnvgamepad.pdb

kernel32

ResetEvent GetLocalTime GetOverlappedResult GetProcAddress CreateFileMappingA DeleteCriticalSection OpenFileMappingA CreateEventA MapViewOfFile FormatMessageA VerifyVersionInfoA VerSetConditionMask UnmapViewOfFile GetModuleFileNameA SetLastError GetFullPathNameW GetModuleFileNameW LocalAlloc CreateFileW GetFileAttributesW lstrcmpA GetSystemDirectoryW OutputDebugStringW FileTimeToSystemTime LocalFree CreateProcessW CreateThread FreeLibrary VerifyVersionInfoW CreateProcessA LoadLibraryExW GetModuleHandleA SetThreadPriority GetCurrentThread RtlCaptureStackBackTrace LoadLibraryW WaitForMultipleObjectsEx UnregisterWaitEx QueryDepthSList InterlockedPopEntrySList ReleaseSemaphore DuplicateHandle SetProcessAffinityMask VirtualFree VirtualProtect VirtualAlloc GetVersionExW GetThreadTimes UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber TerminateThread SetEvent CreateFileA Sleep WaitForSingleObject InitializeCriticalSection LeaveCriticalSection WaitForMultipleObjects WriteFile GetCurrentProcess EnterCriticalSection ReadFile PowerClearRequest CloseHandle GetLastError PowerCreateRequest GetModuleHandleW PowerSetRequest DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SignalObjectAndWait CreateTimerQueue SetEndOfFile WriteConsoleW HeapSize SetStdHandle HeapReAlloc InitializeCriticalSectionAndSpinCount WaitForSingleObjectEx CreateEventW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead FormatMessageW WideCharToMultiByte TryEnterCriticalSection MultiByteToWideChar QueryPerformanceFrequency SwitchToThread GetExitCodeThread GetNativeSystemInfo TlsAlloc TlsGetValue TlsSetValue TlsFree GetTickCount EncodePointer DecodePointer CompareStringW LCMapStringW GetLocaleInfoW GetStringTypeW GetCPInfo RtlUnwindEx RtlPcToFileHeader RaiseException InterlockedPushEntrySList InterlockedFlushSList ExitProcess GetModuleHandleExW ExitThread ResumeThread FreeLibraryAndExitThread HeapFree HeapAlloc GetStdHandle GetFileType GetTimeZoneInformation GetFileSizeEx SetFilePointerEx FlushFileBuffers GetConsoleCP GetConsoleMode GetDateFormatW GetTimeFormatW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ReadConsoleW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetConsoleCtrlHandler RtlUnwind

ole32

CoTaskMemFree

user32

UnregisterDeviceNotification RegisterClassExA PostQuitMessage LoadIconA TranslateMessage CreateWindowExA GetMessageA DispatchMessageA LoadCursorA DestroyWindow PostMessageA RegisterDeviceNotificationA DefWindowProcA

shell32

SHGetKnownFolderPath

advapi32

SetSecurityDescriptorDacl AdjustTokenPrivileges LookupPrivilegeValueA InitializeSecurityDescriptor RegNotifyChangeKeyValue RegCloseKey RegGetValueA RegQueryValueExA RegCreateKeyExA RegDeleteKeyExA RegSetValueExA RegQueryInfoKeyA RegOpenKeyExA RegEnumValueA RegDeleteValueA RegEnumKeyExA OpenProcessToken

setupapi

SetupDiEnumDeviceInterfaces SetupDiGetClassDevsA SetupDiGetDeviceInterfaceDetailA SetupDiDestroyDeviceInfoList

Name

.text

Size

1.0MB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

313KB

Virtual Size

312KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

16KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

64KB

Virtual Size

63KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

148B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

72KB

Virtual Size

72KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Malware-1.zip

Run-Malware-1.bat

vim.dll

kernel32

ole32

user32

shell32

advapi32

setupapi

generic