3dc6902dc87d976787bdf0878e7174ec526df613645d3f275e0216d05cf2d217[.]zip

Sharing

Copy URL

Twitter E-mail

General

Target

3dc6902dc87d976787bdf0878e7174ec526df613645d3f275e0216d05cf2d217.zip
Size

204KB
MD5

1c892a6b5558a9485efc2ca878322e27
SHA1

1541678c70443313944ba7826ca6535a2d5b81cc
SHA256

8986b4c72e21adfd8b7987a7fe4287d9b281cd2f190d7aaaa74841a0d3f48ae8
SHA512

d9d771df9b5a1c90c864e5aa23646a3b4304ce22583f62130dd6a5004e42edbb697e39606ebf2db070018fa8560a66260ebeb1e66c76096c8a7e42f47c5551a8
SSDEEP

6144:/BVokOWdPz3TcstZ8cI4oZOhUsv/epXK1ex:pVokdQstZVoZOh/XepXUex

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack002/3dc6902dc87d976787bdf0878e7174ec526df613645d3f275e0216d05cf2d217

Files

3dc6902dc87d976787bdf0878e7174ec526df613645d3f275e0216d05cf2d217.zip
.zip

Password: infected
3dc6902dc87d976787bdf0878e7174ec526df613645d3f275e0216d05cf2d217
.zip

Password: infected
3dc6902dc87d976787bdf0878e7174ec526df613645d3f275e0216d05cf2d217
.exe windows:6 windows x64 arch:x64

b5f1a1d1c89893764273d20e9396c5d5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

lstrcmpW
GetLocalTime
GetCommandLineW
GetCurrentProcess
FindClose
SetEndOfFile
WriteConsoleW
HeapSize
CreateFileW
ReadConsoleW
lstrlenA
FindNextFileW
FindFirstFileExW
MoveFileExW
CloseHandle
GetLastError
GetModuleFileNameW
GetFileAttributesW
SetStdHandle
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
GetTimeZoneInformation
HeapReAlloc
ReadFile
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
SetFilePointerEx
GetFileSizeEx
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
GetFileType
HeapFree
HeapAlloc
MultiByteToWideChar
GetStringTypeW
WideCharToMultiByte
QueryPerformanceCounter
QueryPerformanceFrequency
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
Sleep
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
GetLocaleInfoEx
LCMapStringEx
GetSystemTimeAsFileTime
GetModuleHandleW
GetProcAddress
CompareStringEx
GetCPInfo
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
WakeAllConditionVariable
SleepConditionVariableSRW
IsDebuggerPresent
GetStartupInfoW
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
RtlPcToFileHeader
RaiseException
RtlUnwindEx
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetStdHandle
WriteFile
RtlUnwind

user32

SystemParametersInfoW
wsprintfW
ExitWindowsEx

advapi32

AdjustTokenPrivileges
RegCloseKey
RegEnumKeyExW
RegSetValueExW
OpenProcessToken
RegOpenKeyExW
LookupPrivilegeValueW

shell32

CommandLineToArgvW
ShellExecuteW

ole32

CLSIDFromString

shlwapi

StrStrIW

gdiplus

GdipCreateFont
GdipCreateSolidFill
GdipGetGenericFontFamilySansSerif
GdipDrawString
GdipSetStringFormatLineAlign
GdipFillRectangleI
GdipDeleteGraphics
GdipDeleteStringFormat
GdipDeleteFont
GdipCreateBitmapFromScan0
GdipSetStringFormatAlign
GdipSaveImageToFile
GdipDisposeImage
GdiplusStartup
GdiplusShutdown
GdipDeleteBrush
GdipCreateFontFamilyFromName
GdipDeleteFontFamily
GdipCreateStringFormat
GdipGetImageGraphicsContext

ws2_32

htons
WSAGetLastError

Sections

.text
Size: 473KB - Virtual size: 473KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 100KB - Virtual size: 99KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 500B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

b5f1a1d1c89893764273d20e9396c5d5

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

shlwapi

gdiplus

ws2_32

Sections

.text Size: 473KB - Virtual size: 473KB

.rdata Size: 100KB - Virtual size: 99KB

.data Size: 8KB - Virtual size: 15KB

.pdata Size: 16KB - Virtual size: 16KB

_RDATA Size: 512B - Virtual size: 500B

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 3KB - Virtual size: 3KB

.text
Size: 473KB - Virtual size: 473KB

.rdata
Size: 100KB - Virtual size: 99KB

.data
Size: 8KB - Virtual size: 15KB

.pdata
Size: 16KB - Virtual size: 16KB

_RDATA
Size: 512B - Virtual size: 500B

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 3KB - Virtual size: 3KB