C1C410655773F828F3241046A69DC03D[.]zip

Sharing

Copy URL

Twitter E-mail

General

Target

C1C410655773F828F3241046A69DC03D.zip
Size

226KB
MD5

30ad36447dc6d26f66c3506cf91dd623
SHA1

1582081aca251c5c9cca312109b1baf8dd74c2ea
SHA256

37cf690fa5fb83e819a97c64af020f95c375afe80377b18b2261e0e9aa1bd837
SHA512

d2627508c7ddd73902baba26f980b07f8bca05fc63ded8675a93e88134d5e9a37d0a3f56d78e0b323c69eb44e0a05f4590ebbffa2fe66a1ec1363f99c6532650
SSDEEP

6144:fwxVG4xEWxpsOgNDAxfM8ryN5ktaGqwDS4hHh:fwjG4xEWxDBoN2bPDPhB

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/C1C410655773F828F3241046A69DC03D

Files

C1C410655773F828F3241046A69DC03D.zip
.zip

Password: infected
C1C410655773F828F3241046A69DC03D
.exe windows:5 windows x86 arch:x86

Password: infected

dd2701b4c52a962967bf0681cde86ff5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetComputerNameA
GetTempFileNameW
SetComputerNameExA
InterlockedIncrement
EnumCalendarInfoW
InterlockedDecrement
GetCurrentProcess
GetLogicalDriveStringsW
InterlockedCompareExchange
WriteConsoleInputA
SetComputerNameW
FreeEnvironmentStringsA
GetModuleHandleW
FindNextVolumeMountPointA
EscapeCommFunction
GetCurrencyFormatA
EnumTimeFormatsA
TlsSetValue
LoadLibraryW
GetCalendarInfoW
SetVolumeMountPointA
GetVersionExW
FindNextVolumeW
GetFileAttributesW
GetDevicePowerState
LCMapStringA
VerifyVersionInfoW
GetLastError
GetCurrentDirectoryW
SetLastError
GetProcAddress
VirtualAlloc
CreateJobSet
CopyFileA
SetFileAttributesA
LoadLibraryA
SetCalendarInfoW
EnumDateFormatsA
GlobalUnWire
OpenEventW
GetShortPathNameW
GetDiskFreeSpaceExW
ReadConsoleInputW
EnumCalendarInfoExA
GetVolumeInformationW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
HeapAlloc
HeapFree
EnterCriticalSection
LeaveCriticalSection
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
TerminateProcess
IsDebuggerPresent
Sleep
ExitProcess
WriteFile
GetModuleFileNameA
SetFilePointer
CloseHandle
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
TlsGetValue
TlsAlloc
TlsFree
GetCurrentThreadId
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
RtlUnwind
RaiseException
HeapReAlloc
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
WideCharToMultiByte
InitializeCriticalSectionAndSpinCount
SetStdHandle
GetConsoleCP
GetConsoleMode
FlushFileBuffers
GetModuleHandleA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapSize
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA

winhttp

WinHttpCheckPlatform

Sections

.text
Size: 345KB - Virtual size: 345KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

dd2701b4c52a962967bf0681cde86ff5

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

winhttp

Sections

.text Size: 345KB - Virtual size: 345KB

.data Size: 24KB - Virtual size: 42KB

.rsrc Size: 15KB - Virtual size: 14KB

.text
Size: 345KB - Virtual size: 345KB

.data
Size: 24KB - Virtual size: 42KB

.rsrc
Size: 15KB - Virtual size: 14KB