infected[.]zip | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
infected.zip
Size 59KB
Sample251013-xnnfdshr7t
SHA256 fa0f043bb9f700063a5dc388322de207e08b53886b4112a5cb0bab26d5ee91aa
MD5 b5f6dc4b4fa888fcaa718ef274df2ae3
SHA1 6cf731f2a84f6b23892d9419500d9199b800bc3d
SHA512 612afa284747a092bf78789ef4db7e2a00f60c545d41805a58887ac70d822c3616102d63e097a439b08659064831f413ac19d308baac8b403a047f6f59593978
SSDEEP 1536:R1CuZHyudk7jLfdGhm/O3/vYcuZkYPxU0guZPgWJMTn:R1CuZHyudk7nfomoYJxU0P9k
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/l.exe

File Explorer

infected.zip

.zip 59KB
l.exe

.exe 103KB

infected.zip

SHA256 fa0f043bb9f700063a5dc388322de207e08b53886b4112a5cb0bab26d5ee91aa
MD5 b5f6dc4b4fa888fcaa718ef274df2ae3
SHA1 6cf731f2a84f6b23892d9419500d9199b800bc3d
SHA512 612afa284747a092bf78789ef4db7e2a00f60c545d41805a58887ac70d822c3616102d63e097a439b08659064831f413ac19d308baac8b403a047f6f59593978
SSDEEP 1536:R1CuZHyudk7jLfdGhm/O3/vYcuZkYPxU0guZPgWJMTn:R1CuZHyudk7nfomoYJxU0P9k
MD5 SHA1 SHA512 SSDEEP

Password

infected

l.exe

IMPHASH 2a95b01ccc503b1c5d8806ef2d22c0b2
SHA256 b6c1ee0c0a7b9a88d6cffaf90c950b7e0e96a841cc3e37c5242f6bff2a1c8202
MD5 6195c398e48d65c5e33278a01089a45b
SHA1 6f8308c45f3dcc6c3c1a26b7b5a429dc1514d107
SHA512 cfe7b82895f31164ef93e1067c7af14acd63641bc3c8b46aa6ef8849575ee1f572d182d12f60a08cce9eaf961421613f59f799efa971bfb286371fd354697ab7
SSDEEP 3072:FwNiEMgu56nQZ3GWctLiIALi3S7LMU6NQaJ:FwNijgu56Q9qtLgHMppJ
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

68688

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

mpr

WNetOpenEnumA WNetCloseEnum WNetEnumResourceA WNetGetLastErrorA

kernel32

WaitForMultipleObjects Sleep GetFileSizeEx WriteFile ReadFile SetFilePointerEx CloseHandle GetTickCount GetDiskFreeSpaceExW CreateFileW DeleteFileW FindFirstFileW FindNextFileW MoveFileW GlobalMemoryStatusEx GetCurrentProcessId ExitProcess GetStdHandle GetSystemTime GetSystemInfo CreateMutexA GetLogicalDriveStringsA GetCommandLineW GetDriveTypeA QueryDosDeviceA FindFirstVolumeA FindNextVolumeA FindVolumeClose GetVolumePathNamesForVolumeNameA AllocConsole lstrlenA CreateFileA GetTimeFormatA GetDateFormatA VirtualAlloc WaitForSingleObject VirtualQuery HeapAlloc HeapFree GetProcessHeap TerminateProcess GetExitCodeProcess ResumeThread CreatePipe PeekNamedPipe CreateProcessA MultiByteToWideChar WideCharToMultiByte GetProcAddress RtlUnwind GetCurrentProcess ExitThread TlsAlloc TlsGetValue TlsSetValue CreateToolhelp32Snapshot Process32First Process32Next TerminateThread SetEvent CreateEventA GetCPInfo GetOEMCP IsValidCodePage LeaveCriticalSection DeleteCriticalSection EnterCriticalSection InitializeCriticalSection GetLastError GetCurrentThreadId CreateThread GetModuleHandleExW RaiseException VirtualFree OpenProcess SetLastError GetACP IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetStringTypeW DecodePointer GetModuleHandleW FreeLibrary LoadLibraryExW LCMapStringW

user32

wvsprintfA wsprintfA

shell32

SHEmptyRecycleBinA SHGetSpecialFolderPathA CommandLineToArgvW

crypt32

CryptStringToBinaryA

advapi32

OpenSCManagerA EnumServicesStatusA ControlService CloseServiceHandle CryptEncrypt CryptImportKey CryptDestroyKey CryptReleaseContext CryptAcquireContextA OpenServiceA