ff1ed1c599b724d4c2ec9d886e4df3f695646add801e4a792dd280b424fb79a9[.]7z

Resubmissions

19-12-2024 03:58

241219-ej1aaawrcw 10

19-12-2024 03:57

241219-ejezcawrav 3

Sharing

Copy URL

Twitter E-mail

General

Target

ff1ed1c599b724d4c2ec9d886e4df3f695646add801e4a792dd280b424fb79a9.7z
Size

75KB
MD5

64f5244103c0f250906cb924631aa939
SHA1

dac7489a1b398745f854d09526fe29594a418796
SHA256

413de79262e326c80f1ed67363f257c84d3f68c7463a9db0818e9d8968275f9b
SHA512

11be3cafc53bb1cdb8e3b23fd959e005e9f54f2de37c4364feed51ed51930ca6d75f3d8751f540eb8ac99039174d1697cb58b8556241d7e42070d51c7f5c18f7
SSDEEP

1536:hwGHypyaSu09w7u65qgKa9Of8DHUxf6Df1CxamPXU1JNe4sooMI9:hwaypyLy7uqkq0N0wU1LI9

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/ff1ed1c599b724d4c2ec9d886e4df3f695646add801e4a792dd280b424fb79a9

Files

ff1ed1c599b724d4c2ec9d886e4df3f695646add801e4a792dd280b424fb79a9.7z
.7z

Password: infected
ff1ed1c599b724d4c2ec9d886e4df3f695646add801e4a792dd280b424fb79a9
.exe windows:5 windows x86 arch:x86

Password: infected

1c2489367a741a394ef5f46c06397c1b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualAllocEx
FindClose
LoadLibraryA
RemoveDirectoryW
WaitForMultipleObjects
lstrcmpiW
FindNextFileW
VirtualProtect
GetFileTime
ReleaseMutex
FileTimeToLocalFileTime
GetVolumeNameForVolumeMountPointW
DeleteFileW
GetFileInformationByHandle
LocalFree
GetSystemTime
WriteProcessMemory
SetFileAttributesW
CreateThread
ExpandEnvironmentStringsW
GetCurrentThreadId
ExitProcess
SetEvent
lstrcmpiA
WTSGetActiveConsoleSessionId
CreateEventW
MapViewOfFile
WriteFile
SetThreadPriority
VirtualProtectEx
TlsAlloc
TlsFree
GetFileAttributesExW
GetPrivateProfileStringW
GetPrivateProfileIntW
GetLocalTime
ResetEvent
TlsGetValue
TlsSetValue
TerminateProcess
MoveFileExW
GetModuleFileNameW
GetUserDefaultUILanguage
GetThreadContext
SetThreadContext
GetProcessId
GetNativeSystemInfo
GetVersionExW
GetCommandLineW
SetErrorMode
GetComputerNameW
OpenEventW
DuplicateHandle
GetCurrentProcessId
VirtualQueryEx
SetFileTime
VirtualAlloc
GetProcAddress
SetLastError
GetLastError
OpenMutexW
GetFileSizeEx
GetTempPathW
FlushFileBuffers
MultiByteToWideChar
IsBadReadPtr
GetProcessHeap
CreateFileW
GetTimeZoneInformation
ReadFile
Thread32Next
GetFileAttributesW
HeapCreate
HeapDestroy
ReadProcessMemory
Sleep
LoadLibraryW
WideCharToMultiByte
CreateFileMappingW
Thread32First
VirtualFree
GetCurrentThread
GetModuleHandleW
CreateDirectoryW
HeapFree
SetFilePointerEx
SystemTimeToFileTime
HeapAlloc
CreateProcessW
FreeLibrary
SetEndOfFile
FindFirstFileW
CreateMutexW
HeapReAlloc
GetTempFileNameW
FileTimeToDosDateTime
GetEnvironmentVariableW
CloseHandle
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
VirtualFreeEx
OpenProcess
CreateRemoteThread
WaitForSingleObject
EnterCriticalSection
GlobalUnlock
LeaveCriticalSection
InitializeCriticalSection
GetTickCount
UnmapViewOfFile
GlobalLock

user32

OpenInputDesktop
MenuItemFromPoint
GetMenu
RegisterClassExW
GetMenuItemRect
TrackPopupMenuEx
SystemParametersInfoW
GetClassNameW
GetMenuState
DefWindowProcA
DefMDIChildProcW
SwitchDesktop
GetMenuItemCount
DefDlgProcA
PostThreadMessageW
DefMDIChildProcA
HiliteMenuItem
DefFrameProcA
SendMessageW
CallWindowProcA
EndMenu
CallWindowProcW
DefWindowProcW
DefFrameProcW
GetWindowThreadProcessId
GetMessageW
GetShellWindow
CharLowerW
CreateDesktopW
SetProcessWindowStation
GetThreadDesktop
GetSystemMetrics
MapVirtualKeyW
GetUpdateRgn
CharLowerBuffA
ExitWindowsEx
FillRect
DrawEdge
IntersectRect
EqualRect
PrintWindow
GetWindowRect
PostMessageW
GetParent
GetWindowInfo
GetClassLongW
GetAncestor
SetWindowPos
IsWindow
MapWindowPoints
IsRectEmpty
DrawIcon
GetIconInfo
EndPaint
GetWindowDC
SetCapture
GetSubMenu
BeginPaint
GetMessageA
RegisterClassW
GetUpdateRect
DefDlgProcW
SetCursorPos
GetDCEx
ToUnicode
GetClipboardData
PeekMessageA
GetCursorPos
ReleaseCapture
GetMessagePos
CloseWindowStation
CreateWindowStationW
GetProcessWindowStation
OpenDesktopW
CloseDesktop
SetThreadDesktop
GetUserObjectInformationW
OpenWindowStationW
GetTopWindow
LoadImageW
MsgWaitForMultipleObjects
WindowFromPoint
CharToOemW
GetDC
GetWindowLongW
CharLowerA
RegisterClassExA
RegisterWindowMessageW
GetMenuItemID
SetKeyboardState
RegisterClassA
GetKeyboardState
TranslateMessage
DispatchMessageW
GetWindow
SendMessageTimeoutW
SetWindowLongW
CharUpperW
ReleaseDC
PeekMessageW
GetCapture

advapi32

GetLengthSid
CryptGetHashParam
OpenProcessToken
GetSidSubAuthority
CryptAcquireContextW
OpenThreadToken
GetSidSubAuthorityCount
GetTokenInformation
RegCreateKeyExW
CryptReleaseContext
RegQueryValueExW
CreateProcessAsUserW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetNamedSecurityInfoW
LookupPrivilegeValueW
CryptCreateHash
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegOpenKeyExW
GetSecurityDescriptorSacl
SetSecurityDescriptorSacl
CryptDestroyHash
AdjustTokenPrivileges
RegCloseKey
RegSetValueExW
CryptHashData
EqualSid
RegEnumKeyExW
InitiateSystemShutdownExW
ConvertSidToStringSidW
IsWellKnownSid

shlwapi

wvnsprintfW
PathQuoteSpacesW
PathIsURLW
PathRenameExtensionW
StrStrIW
StrStrIA
StrCmpNIW
wvnsprintfA
StrCmpNIA
PathMatchSpecW
PathRemoveBackslashW
PathUnquoteSpacesW
PathAddExtensionW
PathCombineW
SHDeleteKeyW
PathSkipRootW
SHDeleteValueW
PathAddBackslashW
PathRemoveFileSpecW
PathFindFileNameW
PathIsDirectoryW
UrlUnescapeA

shell32

ShellExecuteW
SHGetFolderPathW
CommandLineToArgvW

secur32

GetUserNameExW

ole32

StringFromGUID2
CLSIDFromString
CoUninitialize
CoCreateInstance
CoInitializeEx

gdi32

RestoreDC
SaveDC
DeleteDC
GdiFlush
SetViewportOrgEx
SelectObject
CreateCompatibleDC
CreateDIBSection
GetDeviceCaps
GetDIBits
DeleteObject
SetRectRgn
CreateCompatibleBitmap

ws2_32

WSASetLastError
freeaddrinfo
socket
bind
recv
setsockopt
shutdown
getsockname
getpeername
recvfrom
sendto
WSASend
WSAEventSelect
WSAIoctl
connect
WSAAddressToStringW
WSAStartup
getaddrinfo
select
closesocket
send
listen
accept
WSAGetLastError

crypt32

PFXExportCertStoreEx
CertDuplicateCertificateContext
CertEnumCertificatesInStore
PFXImportCertStore
CertCloseStore
CertOpenSystemStoreW
CertDeleteCertificateFromStore
CryptUnprotectData

wininet

HttpAddRequestHeadersW
InternetSetStatusCallbackW
GetUrlCacheEntryInfoW
HttpAddRequestHeadersA
HttpSendRequestW
InternetReadFileExA
InternetQueryDataAvailable
HttpSendRequestExW
HttpSendRequestExA
InternetQueryOptionA
InternetCloseHandle
InternetOpenA
HttpSendRequestA
HttpOpenRequestA
InternetSetOptionA
InternetReadFile
InternetCrackUrlA
InternetQueryOptionW
InternetConnectA
HttpQueryInfoA

oleaut32

VariantInit
SysAllocString
VariantClear
SysFreeString

netapi32

NetApiBufferFree
NetUserEnum
NetUserGetInfo

Sections

.text
Size: 129KB - Virtual size: 129KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

1c2489367a741a394ef5f46c06397c1b

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shlwapi

shell32

secur32

ole32

gdi32

ws2_32

crypt32

wininet

oleaut32

netapi32

Sections

.text Size: 129KB - Virtual size: 129KB

.data Size: 1024B - Virtual size: 8KB

.reloc Size: 6KB - Virtual size: 5KB

.text
Size: 129KB - Virtual size: 129KB

.data
Size: 1024B - Virtual size: 8KB

.reloc
Size: 6KB - Virtual size: 5KB