0ec08e63776de78d8f1719d83109338e[.]001

Sharing

Copy URL

Twitter E-mail

General

Target

0ec08e63776de78d8f1719d83109338e.001
Size

579KB
MD5

0ec08e63776de78d8f1719d83109338e
SHA1

f8f3b4366464de4131d5dbd4c920547c1d24c93b
SHA256

c77882f467d466b5b619943dc1eeba33a4b966e1555e22fc212d93fb7238c128
SHA512

b211556f7b4d00c731e3cb19d2fb8092d8a898fb0c105d149506ccd67cd9de4490c7c9497d61525b7fd3cc9a8d065f6e4f21f607bd6dca5e9f73bebaf0ae034c
SSDEEP

12288:GOsNWJZAuurQjZYHVFYCtkVgPonMRWXH0JGBRUl2bXOBuB0VsFKUi:nnuTwZYHMmkVgwnMmH0sRUl2aBvS4Ui

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack002/NOTIFICACION ELECTRONICA J AGRADECEMOS PRONTA CONFIRMACION DE RECIBIDO NUMERO DE RADICADO 0201494303 432943/00004Notificacion Electronica.exe

Files

0ec08e63776de78d8f1719d83109338e.001
.rar

Password: 04DIC2024ESM
NOTIFICACION ELECTRONICA J AGRADECEMOS PRONTA CONFIRMACION DE RECIBIDO NUMERO DE RADICADO 0201494303 432943.tar.arj.tar
.tar

Password: 04DIC2024ESM
NOTIFICACION ELECTRONICA J AGRADECEMOS PRONTA CONFIRMACION DE RECIBIDO NUMERO DE RADICADO 0201494303 432943/00004Notificacion Electronica.exe
.exe windows:6 windows x86 arch:x86

Password: 04DIC2024ESM

2faddcf21ecbc6ccdd4042d2ada77dd0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\jenkins-slave\workspace\unifab_win_x86_vs2019_build_release_newClient\dtshdprocess_bin\x86\DtshdProcess.pdb

Imports

kernel32

SwitchToThread
DuplicateHandle
CreateSemaphoreA
MapViewOfFileEx
GetFileSizeEx
SetEndOfFile
SetFilePointerEx
WriteFile
OutputDebugStringA
GetStdHandle
AllocConsole
VirtualQuery
VirtualFree
VirtualAlloc
SetLastError
CreateFileMappingA
UnmapViewOfFile
MapViewOfFile
CopyFileW
GetFileAttributesW
CreateFileW
CreateDirectoryW
lstrlenA
IsDBCSLeadByte
GlobalLock
GlobalUnlock
LoadLibraryW
GetNativeSystemInfo
GetVersionExA
CreateProcessA
GetExitCodeProcess
GetDiskFreeSpaceExA
VirtualLock
WaitForMultipleObjects
CreateMutexA
ReleaseMutex
MoveFileExW
MoveFileExA
MoveFileW
MoveFileA
CopyFileA
QueryDosDeviceA
GetShortPathNameA
GetModuleFileNameA
GetWindowsDirectoryA
GetTickCount
DeviceIoControl
FreeConsole
GetTempPathA
GetTempPathW
SetFilePointer
SetFileAttributesW
SetFileAttributesA
RemoveDirectoryW
RemoveDirectoryA
GetVolumeInformationW
GetFileSize
GetFileAttributesA
GetDriveTypeA
GetDiskFreeSpaceA
FindNextFileW
FindNextFileA
FindFirstFileW
FindFirstFileA
FindClose
DeleteFileW
DeleteFileA
CreateFileA
GetSystemInfo
WaitForSingleObject
OpenProcess
GetLastError
ResetEvent
GetCurrentProcessId
CreateProcessW
TerminateProcess
Sleep
HeapFree
QueryPerformanceFrequency
HeapAlloc
GetProcessHeap
QueryPerformanceCounter
OutputDebugStringW
GetSystemDirectoryA
lstrcpyA
LoadLibraryA
GetProcAddress
FreeLibrary
LocalAlloc
LocalFree
GetModuleHandleA
GetModuleFileNameW
FormatMessageA
ReleaseSemaphore
WaitForSingleObjectEx
WaitForMultipleObjectsEx
OpenEventA
SetWaitableTimer
GetCurrentThreadId
ResumeThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
CreateWaitableTimerA
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
CreateEventW
GetModuleHandleW
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetCurrentProcess
GetSystemTimeAsFileTime
InitializeSListHead
MultiByteToWideChar
WideCharToMultiByte
IsValidCodePage
IsDBCSLeadByteEx
SetConsoleTitleA
CreateEventA
SetEvent
CreateDirectoryA
GetProcessTimes
GetVolumeInformationA
CloseHandle

crypt32

CertGetNameStringA
CertFreeCertificateContext
CryptMsgClose
CryptQueryObject
CryptMsgGetParam
CertFindCertificateInStore
CertCloseStore

user32

GetForegroundWindow
CharNextA
SystemParametersInfoA
ExitWindowsEx
CloseDesktop
EnumDesktopWindows
OpenDesktopA
GetSystemMetrics
IsClipboardFormatAvailable
GetClipboardData
CloseClipboard
OpenClipboard
wvsprintfW
IsWindowVisible
SetWindowPos
GetDesktopWindow
PostMessageA

advapi32

ReadEventLogA
RegEnumKeyA
SetSecurityDescriptorDacl
CloseEventLog
OpenEventLogA
InitializeSecurityDescriptor
RegEnumKeyExA
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueA
RegCloseKey
RegOpenKeyA
RegQueryValueExA
RegCreateKeyA
RegCreateKeyExA
RegDeleteKeyA
RegDeleteValueA
RegEnumValueA
RegOpenKeyExA
RegSetValueExA
RegSetValueA
RegQueryValueA
RegQueryInfoKeyA

iphlpapi

GetAdaptersInfo

oleaut32

VariantClear
SysFreeString
SysAllocString

version

VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA

ole32

CoCreateInstance
CoSetProxyBlanket
CoInitializeSecurity
CoInitializeEx
CoUninitialize

shell32

SHGetSpecialFolderLocation
SHGetFolderPathW
ShellExecuteA
ShellExecuteExA
SHGetPathFromIDListA

Exports

Exports

?get_lock@singleton_module@serialization@boost@@CAAA_NXZ
?is_locked@singleton_module@serialization@boost@@SA_NXZ
?lock@?1??get_lock@singleton_module@serialization@boost@@CAAA_NXZ@4_NA
?lock@singleton_module@serialization@boost@@SAXXZ
?unlock@singleton_module@serialization@boost@@SAXXZ

Sections

.text
Size: 279KB - Virtual size: 279KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 64KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: 04DIC2024ESM

Password: 04DIC2024ESM

Password: 04DIC2024ESM

2faddcf21ecbc6ccdd4042d2ada77dd0

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

crypt32

user32

advapi32

iphlpapi

oleaut32

version

ole32

shell32

Exports

Exports

Sections

.text Size: 279KB - Virtual size: 279KB

.rdata Size: 64KB - Virtual size: 63KB

.data Size: 8KB - Virtual size: 12KB

.rsrc Size: 1.5MB - Virtual size: 1.5MB

.text
Size: 279KB - Virtual size: 279KB

.rdata
Size: 64KB - Virtual size: 63KB

.data
Size: 8KB - Virtual size: 12KB

.rsrc
Size: 1.5MB - Virtual size: 1.5MB