456fcf9be13fdf4851e2a8e396ae190e73c913452c368dddd7a60bd21beec9ef[.]zip

Sharing

Copy URL

Twitter E-mail

General

Target

456fcf9be13fdf4851e2a8e396ae190e73c913452c368dddd7a60bd21beec9ef.zip
Size

397KB
MD5

db6af693f5a82e700a0540a9d35e88f5
SHA1

b0cb7ee0347ad62c2a98105e5c5ff15113078e13
SHA256

be0e410325f31cf09f54042868d31e9bcbdf0abf374c3cdf18b47ad2e54b67d4
SHA512

3769d36fbecd6404587a774e2ecaec4104b13df513a5011860aa85d2457ab72f30eafba90a422f352102f76c19c5bc81a1f66f28227f563aea01786e9cb878f7
SSDEEP

12288:24EGd80I4xPXVNiedIdC+Qgw2SutxSm8rPUv3gvQBQ:RPp1MYdASWN8IvwvT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/port_drain_flow.exe

Files

456fcf9be13fdf4851e2a8e396ae190e73c913452c368dddd7a60bd21beec9ef.zip
.zip

Password: infected
port_drain_flow.exe
.exe windows:5 windows x86 arch:x86

5c1f32ed59d0cc250879099bc3c8e29b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\develop\port_drain_flow\port_drain_flow\Debug\port_drain_flow.pdb

Imports

kernel32

CloseHandle
InterlockedExchange
Sleep
TlsGetValue
TlsSetValue
TlsFree
TlsAlloc
SetLastError
WaitForSingleObject
SetFilePointer
GetFileType
GetLastError
WriteFile
VirtualAlloc
VirtualFree
GetThreadLocale
LoadLibraryA
GetStdHandle
FormatMessageA
IsDebuggerPresent
GetModuleHandleA
GetProcAddress
CreateFileA
FreeLibrary
SetEndOfFile
ReadFile
ReleaseMutex
GetCurrentThreadId
CreateMutexA
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
SetEvent
CreateEventA
ExitThread
TerminateThread
CreateThread
SetConsoleCtrlHandler
GetACP
GetCommandLineA
SetErrorMode
GetFileInformationByHandle
GetFullPathNameA
GetTempFileNameA
GetTempPathA
OpenFileMappingA
CreateFileMappingA
MapViewOfFile
IsBadReadPtr
GetHandleInformation
UnmapViewOfFile
CreateProcessA
SetThreadPriority
GetVersionExA
DeleteFileA
FlushFileBuffers
HeapSetInformation
EncodePointer
DecodePointer
ResumeThread
HeapValidate
InterlockedIncrement
InterlockedDecrement
GetModuleHandleW
ExitProcess
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
InitializeCriticalSectionAndSpinCount
SetStdHandle
GetCurrentProcessId
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetStartupInfoW
GetCurrentThread
HeapCreate
HeapDestroy
GetModuleFileNameW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
FatalAppExitA
LCMapStringW
MultiByteToWideChar
GetOEMCP
GetCPInfo
IsValidCodePage
IsProcessorFeaturePresent
HeapAlloc
HeapReAlloc
HeapSize
HeapQueryInformation
HeapFree
RtlUnwind
LoadLibraryW
GetLocaleInfoW
WriteConsoleW
OutputDebugStringA
OutputDebugStringW
GetStringTypeW
GetLocaleInfoA
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
CompareStringW
SetEnvironmentVariableA
CreateFileW
GetProcessHeap
RaiseException
VirtualQuery

imagehlp

SymCleanup
StackWalk64
SymInitialize

Sections

.text
Size: 777KB - Virtual size: 776KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text1
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 118KB - Virtual size: 117KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.trace
Size: 512B - Virtual size: 272B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

5c1f32ed59d0cc250879099bc3c8e29b

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

imagehlp

Sections

.text Size: 777KB - Virtual size: 776KB

.text1 Size: 512B - Virtual size: 176B

.rdata Size: 118KB - Virtual size: 117KB

.data Size: 14KB - Virtual size: 62KB

.trace Size: 512B - Virtual size: 272B

.rsrc Size: 512B - Virtual size: 436B

.reloc Size: 36KB - Virtual size: 35KB

.text
Size: 777KB - Virtual size: 776KB

.text1
Size: 512B - Virtual size: 176B

.rdata
Size: 118KB - Virtual size: 117KB

.data
Size: 14KB - Virtual size: 62KB

.trace
Size: 512B - Virtual size: 272B

.rsrc
Size: 512B - Virtual size: 436B

.reloc
Size: 36KB - Virtual size: 35KB