+[.]zip | Triage

Sharing

Copy URL Twitter E-mail

General

Target

+.zip
Size

7.9MB
MD5

996c7e070a378b04370ee3666a56ff41
SHA1

0f8610a373eb5c25c8e91c80f99ac57fc46176e2
SHA256

18cc2b9fe87ff9916765beab59e34c7a26fe8cab3c6a5c5e192fa317789f9f9e
SHA512

ad6f8dee29c32c0703f0239221d5ea26c8d5db50c547d8e71ac83698e6986da4b7f7b36a142ee789f3ab0a3d66f2be6ecac6602dd14bd7642be94f8540c3d4c5
SSDEEP

196608:fq+PE8aHoXPjOfw6dNwXeI5BhqcdxjOQ9O:DjOoONw3ckxiQ9O

Score

3^/10

Malware Config

Signatures

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
unpack001/RAR Password Cracker 4.44 [PeskTop.com]/RAR Password Cracker 4.44 [PeskTop.com]/Crack/rpc.exe
unpack002/bin/rpc.exe
unpack002/bin/unrar.dll

Files

+.zip
.zip
Blank-jagge.rar
.rar
RAR Password Cracker 4.44 [PeskTop.com]/RAR Password Cracker 4.44 [PeskTop.com]/Crack/rpc.exe
.exe windows:5 windows x86 arch:x86

5f1a0c0d708a7e68d78aed468c63c33d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

HeapSize
InitializeCriticalSectionAndSpinCount
LoadLibraryA
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
VirtualAlloc
DeleteCriticalSection
VirtualFree
InterlockedDecrement
GetCurrentThreadId
SetLastError
InterlockedIncrement
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
InterlockedExchange
SetConsoleCtrlHandler
HeapReAlloc
GetCommandLineA
ExitProcess
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
RaiseException
RtlUnwind
HeapFree
CreateThread
ResumeThread
ExitThread
GetEnvironmentVariableW
ReadConsoleW
ReadConsoleA
SetConsoleMode
GetConsoleMode
WriteFile
WideCharToMultiByte
GlobalMemoryStatus
GetCurrentProcessId
QueryPerformanceCounter
FreeEnvironmentStringsA
DeleteFiber
GetSystemTimeAsFileTime
GetStdHandle
GetEnvironmentStrings
UnmapViewOfFile
FreeEnvironmentStringsW
GlobalSize
GetVersionExA
LocalLock
LocalUnlock
GetFileType
GetVersion
GetModuleHandleW
GetLastError
SetHandleCount
GetConsoleCP
FindResourceA
SizeofResource
LoadResource
LockResource
FlushFileBuffers
SetStdHandle
InitializeCriticalSection
InterlockedCompareExchange
HeapDestroy
HeapCreate
HeapAlloc
GetTickCount
SetFilePointer
GlobalLock
GlobalUnlock
GetModuleHandleA
GetProcAddress
EnterCriticalSection
GetProcessHeap
SetEndOfFile
GetTimeZoneInformation
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetEnvironmentVariableA
CompareStringW
CompareStringA
LeaveCriticalSection
GetLocaleInfoW
CreateFileW
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetDateFormatA
GetTimeFormatA
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
GetFullPathNameA
DeleteFileA
GetModuleFileNameA
GetStartupInfoA
CreateProcessA
CreateFileMappingA
MapViewOfFile
CreateFileA
GetFileSize
CloseHandle
ReadFile
MultiByteToWideChar
GlobalFree
GlobalAlloc
Sleep
GetCurrentThread
SetThreadPriority
ConvertFiberToThread
GetEnvironmentStringsW

user32

GetProcessWindowStation
GetUserObjectInformationW
FindWindowExA
LoadCursorA
SetClassLongA
LoadImageA
MessageBoxA
GetKeyState
DestroyWindow
CreateDialogParamA
UpdateWindow
EnableWindow
SetMenuDefaultItem
CreatePopupMenu
InsertMenuA
InsertMenuItemW
CallWindowProcA
GetDlgItemTextA
CheckDlgButton
OpenClipboard
GetClipboardData
CloseClipboard
GetClientRect
MapDialogRect
GetWindowPlacement
SetWindowPlacement
SendMessageA
IsIconic
ShowWindow
SetForegroundWindow
GetDoubleClickTime
IsDlgButtonChecked
CheckRadioButton
GetDlgCtrlID
GetParent
PostMessageA
SetWindowLongA
GetDlgItem
GetWindowTextLengthA
GetDlgItemTextW
LoadMenuA
GetSubMenu
GetWindowRect
TrackPopupMenuEx
DestroyMenu
SetDlgItemInt
wsprintfW
SetDlgItemTextW
SetDlgItemTextA
wsprintfA
DialogBoxParamA
SendDlgItemMessageA
EndDialog
SetTimer
KillTimer
MessageBoxW

gdi32

SetBkMode
SetTextColor
GetObjectA
CreateFontIndirectA
DeleteObject
GetStockObject
SelectObject

shell32

ShellExecuteW
ShellExecuteA
SHGetMalloc
SHGetPathFromIDListA
SHGetSpecialFolderLocation
Shell_NotifyIconA

comdlg32

GetOpenFileNameA
GetSaveFileNameA
GetOpenFileNameW

ole32

CoUninitialize
CoCreateInstance
CoInitialize

comctl32

CreatePropertySheetPageA
PropertySheetA
InitCommonControlsEx

shlwapi

PathRelativePathToW
PathCombineW
PathRemoveFileSpecW
PathIsRelativeW
SHGetValueA

ws2_32

send
WSASetLastError
recv
closesocket
WSACleanup
WSAGetLastError

crypt32

CertEnumCertificatesInStore
CertGetCertificateContextProperty
CertFreeCertificateContext
CertCloseStore
CertDuplicateCertificateContext
CertOpenStore
CertFindCertificateInStore

advapi32

CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptDestroyKey
CryptEnumProvidersW
CryptAcquireContextW
CryptGenRandom
CryptReleaseContext
RegisterEventSourceW
ReportEventW
DeregisterEventSource
CryptDestroyHash
CryptSignHashW
CryptSetHashParam
CryptCreateHash
CryptDecrypt

unrar

LoadArchive
ReadFiles2
UserBreak
SetBase

Exports

Exports

_GetHardwareID@4
_GetKeyExpirationDate@12
_GetRegistrationInformation@4
_SetRegistrationKey@0

Sections

.text
Size: 854KB - Virtual size: 853KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 319KB - Virtual size: 318KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 29KB - Virtual size: 118KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 55KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
RAR Password Cracker 4.44 [PeskTop.com]/RAR Password Cracker 4.44 [PeskTop.com]/RAR Password Cracker 4.44.zip
.zip
10-million-password-list-top-1000000.txt
RAR Password Cracker Wizard.lnk
.lnk
RAR Password Cracker.lnk
.lnk
bin/basedict.txt
.vbs
bin/rpc.exe
.exe windows:5 windows x86 arch:x86

5f1a0c0d708a7e68d78aed468c63c33d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

HeapSize
InitializeCriticalSectionAndSpinCount
LoadLibraryA
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
VirtualAlloc
DeleteCriticalSection
VirtualFree
InterlockedDecrement
GetCurrentThreadId
SetLastError
InterlockedIncrement
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
InterlockedExchange
SetConsoleCtrlHandler
HeapReAlloc
GetCommandLineA
ExitProcess
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
RaiseException
RtlUnwind
HeapFree
CreateThread
ResumeThread
ExitThread
GetEnvironmentVariableW
ReadConsoleW
ReadConsoleA
SetConsoleMode
GetConsoleMode
WriteFile
WideCharToMultiByte
GlobalMemoryStatus
GetCurrentProcessId
QueryPerformanceCounter
FreeEnvironmentStringsA
DeleteFiber
GetSystemTimeAsFileTime
GetStdHandle
GetEnvironmentStrings
UnmapViewOfFile
FreeEnvironmentStringsW
GlobalSize
GetVersionExA
LocalLock
LocalUnlock
GetFileType
GetVersion
GetModuleHandleW
GetLastError
SetHandleCount
GetConsoleCP
FindResourceA
SizeofResource
LoadResource
LockResource
FlushFileBuffers
SetStdHandle
InitializeCriticalSection
InterlockedCompareExchange
HeapDestroy
HeapCreate
HeapAlloc
GetTickCount
SetFilePointer
GlobalLock
GlobalUnlock
GetModuleHandleA
GetProcAddress
EnterCriticalSection
GetProcessHeap
SetEndOfFile
GetTimeZoneInformation
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetEnvironmentVariableA
CompareStringW
CompareStringA
LeaveCriticalSection
GetLocaleInfoW
CreateFileW
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetDateFormatA
GetTimeFormatA
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
GetFullPathNameA
DeleteFileA
GetModuleFileNameA
GetStartupInfoA
CreateProcessA
CreateFileMappingA
MapViewOfFile
CreateFileA
GetFileSize
CloseHandle
ReadFile
MultiByteToWideChar
GlobalFree
GlobalAlloc
Sleep
GetCurrentThread
SetThreadPriority
ConvertFiberToThread
GetEnvironmentStringsW

user32

GetProcessWindowStation
GetUserObjectInformationW
FindWindowExA
LoadCursorA
SetClassLongA
LoadImageA
MessageBoxA
GetKeyState
DestroyWindow
CreateDialogParamA
UpdateWindow
EnableWindow
SetMenuDefaultItem
CreatePopupMenu
InsertMenuA
InsertMenuItemW
CallWindowProcA
GetDlgItemTextA
CheckDlgButton
OpenClipboard
GetClipboardData
CloseClipboard
GetClientRect
MapDialogRect
GetWindowPlacement
SetWindowPlacement
SendMessageA
IsIconic
ShowWindow
SetForegroundWindow
GetDoubleClickTime
IsDlgButtonChecked
CheckRadioButton
GetDlgCtrlID
GetParent
PostMessageA
SetWindowLongA
GetDlgItem
GetWindowTextLengthA
GetDlgItemTextW
LoadMenuA
GetSubMenu
GetWindowRect
TrackPopupMenuEx
DestroyMenu
SetDlgItemInt
wsprintfW
SetDlgItemTextW
SetDlgItemTextA
wsprintfA
DialogBoxParamA
SendDlgItemMessageA
EndDialog
SetTimer
KillTimer
MessageBoxW

gdi32

SetBkMode
SetTextColor
GetObjectA
CreateFontIndirectA
DeleteObject
GetStockObject
SelectObject

shell32

ShellExecuteW
ShellExecuteA
SHGetMalloc
SHGetPathFromIDListA
SHGetSpecialFolderLocation
Shell_NotifyIconA

comdlg32

GetOpenFileNameA
GetSaveFileNameA
GetOpenFileNameW

ole32

CoUninitialize
CoCreateInstance
CoInitialize

comctl32

CreatePropertySheetPageA
PropertySheetA
InitCommonControlsEx

shlwapi

PathRelativePathToW
PathCombineW
PathRemoveFileSpecW
PathIsRelativeW
SHGetValueA

ws2_32

send
WSASetLastError
recv
closesocket
WSACleanup
WSAGetLastError

crypt32

CertEnumCertificatesInStore
CertGetCertificateContextProperty
CertFreeCertificateContext
CertCloseStore
CertDuplicateCertificateContext
CertOpenStore
CertFindCertificateInStore

advapi32

CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptDestroyKey
CryptEnumProvidersW
CryptAcquireContextW
CryptGenRandom
CryptReleaseContext
RegisterEventSourceW
ReportEventW
DeregisterEventSource
CryptDestroyHash
CryptSignHashW
CryptSetHashParam
CryptCreateHash
CryptDecrypt

unrar

LoadArchive
ReadFiles2
UserBreak
SetBase

Exports

Exports

_GetHardwareID@4
_GetKeyExpirationDate@12
_GetRegistrationInformation@4
_SetRegistrationKey@0

Sections

.text
Size: 854KB - Virtual size: 853KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 319KB - Virtual size: 318KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 29KB - Virtual size: 118KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 55KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
bin/unrar.dll
.dll windows:6 windows x86 arch:x86

d64773855844feb00e0331e10eafb0ab

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\Users\dmitry_n\Documents\unrar\build\unrardll32\Release\UnRAR.pdb

Imports

kernel32

GetCurrentProcess
FlushFileBuffers
ReadFile
SetEndOfFile
SetFilePointer
WriteFile
FindClose
GetVersionExW
GetCurrentDirectoryW
GetModuleFileNameW
FoldStringW
CreateFileA
GetCurrentThread
SetThreadPriority
GetTickCount
GetLogicalProcessorInformation
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GetModuleHandleW
LoadResource
LockResource
SizeofResource
FindResourceW
GlobalAlloc
GlobalReAlloc
GlobalSize
GlobalFree
SetThreadAffinityMask
CloseHandle
MultiByteToWideChar
GetCurrentProcessId
FreeLibrary
GetProcAddress
GetSystemDirectoryW
LoadLibraryW
SetThreadExecutionState
FileTimeToLocalFileTime
LocalFileTimeToFileTime
SystemTimeToTzSpecificLocalTime
TzSpecificLocalTimeToSystemTime
FileTimeToSystemTime
SystemTimeToFileTime
CompareStringW
WideCharToMultiByte
GetCPInfo
IsDBCSLeadByte
RaiseException
GetSystemInfo
VirtualProtect
VirtualQuery
LoadLibraryExA
WriteConsoleW
HeapSize
ReadConsoleW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
GetProcessHeap
DeleteFileW
CreateFileW
Sleep
SetLastError
GetLastError
GetStdHandle
GetConsoleMode
GetFileType
MoveFileExA
SetFilePointerEx
GetConsoleCP
SetStdHandle
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
DuplicateHandle
WaitForSingleObjectEx
GetCurrentThreadId
GetExitCodeThread
QueryPerformanceCounter
QueryPerformanceFrequency
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
GetStringTypeW
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
EncodePointer
DecodePointer
LCMapStringW
GetLocaleInfoW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
SetEvent
ResetEvent
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
CreateTimerQueue
SignalObjectAndWait
SwitchToThread
CreateThread
GetThreadPriority
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetThreadTimes
FreeLibraryAndExitThread
GetModuleHandleA
LoadLibraryExW
VirtualAlloc
VirtualFree
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
RtlUnwind
ExitProcess
GetModuleHandleExW
ExitThread
HeapAlloc
HeapFree
HeapReAlloc
GetModuleFileNameA
GetACP

user32

MessageBoxW
GetLastInputInfo
IsCharUpperW
CharLowerW
CharUpperW
PostMessageW
SendMessageW
OemToCharBuffA
EnableWindow

shell32

ShellExecuteW

Exports

Exports

Build
CheckPassword2
CheckPassword3
LoadArchive
Parse
RARGetDllVersion
ReadFiles2
ReadFiles3
Samples
SetBase
UserBreak
ask_for_curr
ask_for_save
calculate_stat_total
gpu
sha_ni
start_dict
start_ml
start_regexp
start_stat
stop

Sections

.text
Size: 440KB - Virtual size: 440KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 94KB - Virtual size: 93KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 517KB - Virtual size: 516KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
example.rar
.rar
example.rpc

Sharing

General

Malware Config

Signatures

Files

5f1a0c0d708a7e68d78aed468c63c33d

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

comdlg32

ole32

comctl32

shlwapi

ws2_32

crypt32

advapi32

unrar

Exports

Exports

Sections

.text Size: 854KB - Virtual size: 853KB

.rdata Size: 319KB - Virtual size: 318KB

.data Size: 29KB - Virtual size: 118KB

.rsrc Size: 18KB - Virtual size: 17KB

.reloc Size: 55KB - Virtual size: 55KB

5f1a0c0d708a7e68d78aed468c63c33d

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

comdlg32

ole32

comctl32

shlwapi

ws2_32

crypt32

advapi32

unrar

Exports

Exports

Sections

.text Size: 854KB - Virtual size: 853KB

.rdata Size: 319KB - Virtual size: 318KB

.data Size: 29KB - Virtual size: 118KB

.rsrc Size: 18KB - Virtual size: 17KB

.reloc Size: 55KB - Virtual size: 55KB

d64773855844feb00e0331e10eafb0ab

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

shell32

Exports

Exports

Sections

.text Size: 440KB - Virtual size: 440KB

.rdata Size: 94KB - Virtual size: 93KB

.data Size: 10KB - Virtual size: 76KB

.rsrc Size: 517KB - Virtual size: 516KB

.reloc Size: 20KB - Virtual size: 19KB

.text
Size: 854KB - Virtual size: 853KB

.rdata
Size: 319KB - Virtual size: 318KB

.data
Size: 29KB - Virtual size: 118KB

.rsrc
Size: 18KB - Virtual size: 17KB

.reloc
Size: 55KB - Virtual size: 55KB

.text
Size: 854KB - Virtual size: 853KB

.rdata
Size: 319KB - Virtual size: 318KB

.data
Size: 29KB - Virtual size: 118KB

.rsrc
Size: 18KB - Virtual size: 17KB

.reloc
Size: 55KB - Virtual size: 55KB

.text
Size: 440KB - Virtual size: 440KB

.rdata
Size: 94KB - Virtual size: 93KB

.data
Size: 10KB - Virtual size: 76KB

.rsrc
Size: 517KB - Virtual size: 516KB

.reloc
Size: 20KB - Virtual size: 19KB