malware-edited[.]7z

Sharing

Copy URL Twitter E-mail

General

Target
malware-edited.7z
Size 468KB
Sample241014-kkb7qssela
SHA256 277c2405bb6dcf4887fe68a25e960ffb424884b19e357b13229787825fe0b7d5
MD5 8cf32514ef6c2069470034a267f3b00c
SHA1 645f0c1552723040d13e24991b2f26c6e1946746
SHA512 dab7053f924f843e4839091dfdc36a84903b5fcda81d58d042ef841d206f85e1f4a433443caa42a3478da0a5b439c31a4c9e2f4ca10eca88050e91f87b49efc3
SSDEEP 12288:7Uqr5FU1fO7jiD6RYC+m7gK85fYd6kZatp:7Uq5FUhO7o7C/gh5tkZaD
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/1.exe

File Explorer

malware-edited.7z

.7z 468KB
1.exe

.exe 1.3MB

malware-edited.7z

SHA256 277c2405bb6dcf4887fe68a25e960ffb424884b19e357b13229787825fe0b7d5
MD5 8cf32514ef6c2069470034a267f3b00c
SHA1 645f0c1552723040d13e24991b2f26c6e1946746
SHA512 dab7053f924f843e4839091dfdc36a84903b5fcda81d58d042ef841d206f85e1f4a433443caa42a3478da0a5b439c31a4c9e2f4ca10eca88050e91f87b49efc3
SSDEEP 12288:7Uqr5FU1fO7jiD6RYC+m7gK85fYd6kZatp:7Uq5FUhO7o7C/gh5tkZaD
MD5 SHA1 SHA512 SSDEEP

1.exe

IMPHASH 988e38830f38f4e1388f24e669d6a878
SHA256 b6e472df537492e9bb591d531d6ee8a69ec94849a6aec7726a88074e4c097f6b
MD5 b59b1bb4ca3fd39ad225aad30e1f49ce
SHA1 c6b95cb11c78f29adbbee5df4fdd766d75fd0c8d
SHA512 6611373ce5b54005adc739315168ce42c543b64aacc1f0e750a8067a2eec10d13d8c97334797bf8a76469b706c09b44ac7dec559d9ca0389e839e5077aefef4e
SSDEEP 24576:dcfDcZZwNorzMIA5Bj6qki/fnKgmQDsNTa/dd6lPJBQn652MDOGbx:S8wNorYICj6qTnKGsNTa/ddyPJ82Tx
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5328

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

kernel32

AcquireSRWLockExclusive AcquireSRWLockShared AddVectoredExceptionHandler CloseHandle CompareStringOrdinal CopyFileExW CreateFileMappingA CreateFileW CreateIoCompletionPort CreateMutexA CreateNamedPipeW CreateProcessA CreateProcessW CreateThread CreateToolhelp32Snapshot DeleteFileW DuplicateHandle ExitProcess FindClose FindFirstFileW FormatMessageW FreeEnvironmentStringsW GetCommandLineW GetConsoleMode GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetEnvironmentStringsW GetEnvironmentVariableW GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFinalPathNameByHandleW GetFullPathNameW GetLastError GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetProcAddress GetProcessHeap GetQueuedCompletionStatusEx GetStartupInfoA GetStdHandle GetSystemDirectoryW GetSystemInfo GetTempPathW GetWindowsDirectoryW HeapAlloc HeapFree HeapReAlloc InitOnceBeginInitialize InitOnceComplete IsDebuggerPresent LoadLibraryA LocalFree MapViewOfFile Module32FirstW Module32NextW MoveFileExW MultiByteToWideChar PostQueuedCompletionStatus QueryPerformanceCounter QueryPerformanceFrequency ReadFileEx ReadProcessMemory ReleaseMutex ReleaseSRWLockExclusive ReleaseSRWLockShared ResumeThread RtlCaptureContext RtlLookupFunctionEntry SetFileCompletionNotificationModes SetHandleInformation SetLastError SetThreadStackGuarantee SetUnhandledExceptionFilter Sleep SleepConditionVariableSRW SleepEx SwitchToThread TlsAlloc TlsFree TlsGetValue TlsSetValue TryAcquireSRWLockExclusive UnmapViewOfFile VirtualAllocEx VirtualProtectEx WaitForSingleObject WaitForSingleObjectEx WakeAllConditionVariable WakeConditionVariable WriteConsoleW WriteFileEx WriteProcessMemory DeleteCriticalSection EnterCriticalSection GetCurrentThreadId GetSystemTimeAsFileTime GetTickCount InitializeCriticalSection LeaveCriticalSection RaiseException RtlAddFunctionTable RtlUnwindEx RtlVirtualUnwind TerminateProcess UnhandledExceptionFilter VirtualProtect VirtualQuery

ntdll

NtCancelIoFileEx NtCreateFile NtDeviceIoControlFile NtQueryInformationProcess NtWriteFile RtlNtStatusToDosError __C_specific_handler _wtoi64 memcmp memcpy memmove memset pow strlen

shell32

CommandLineToArgvW

ws2_32

WSACleanup WSAGetLastError WSAIoctl WSASend WSASocketW WSAStartup bind closesocket connect freeaddrinfo getaddrinfo getpeername getsockname getsockopt ioctlsocket recv send setsockopt shutdown socket

advapi32

RegCloseKey RegOpenKeyExW RegQueryValueExW SystemFunction036

bcrypt

BCryptGenRandom

msvcrt

__dllonexit __getmainargs __initenv __iob_func __lconv_init __set_app_type __setusermatherr _acmdln _amsg_exit _cexit _fmode _fpreset _initterm _lock _onexit _unlock abort atexit calloc exit fprintf free fwrite malloc signal strncmp vfprintf

Name

.text

Size

825KB

Virtual Size

824KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

496B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

391KB

Virtual Size

391KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

25KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

32KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

malware-edited.7z

1.exe

kernel32

ntdll

shell32

ws2_32

advapi32

bcrypt

msvcrt

generic