goldeneye[.]zip | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
goldeneye.zip
Size 323KB
Sample260616-2cfzdsfs4p
SHA256 24e74afd2f0d567fb433a84af7065770ba4f75825bf071dc5862eee78009bdd1
MD5 fc9a825f9d890c48a1680ba6edb404b6
SHA1 187ad9c4164e57674f770b05a22d62a12eb86c6f
SHA512 2b7f1b102ebc42eb5524a1e689254ed31540c53f2e268e8506315aacf1ec103eecd36d7c3462011bd424ce664f348f2ae1c52345d071942c68bfa8cd62f7ab79
SSDEEP 6144:w7Tu21ldM1vm+M64qM0gcjcTY3BmzRlHvVI82njmRgAZR6hFd:wfc4qDgdTJnvVIjmRgAEX
TLSH
T1086423DF1C8D777BC4530970267B908225EA25629FA962AE0CE45FB0C8473FAD234B57
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/GoldenEye.exe

File Explorer

goldeneye.zip

.zip 323KB
GoldenEye.exe

.exe 254KB
GoldenEye.js

.js 365KB

goldeneye.zip

SHA256 24e74afd2f0d567fb433a84af7065770ba4f75825bf071dc5862eee78009bdd1
MD5 fc9a825f9d890c48a1680ba6edb404b6
SHA1 187ad9c4164e57674f770b05a22d62a12eb86c6f
SHA512 2b7f1b102ebc42eb5524a1e689254ed31540c53f2e268e8506315aacf1ec103eecd36d7c3462011bd424ce664f348f2ae1c52345d071942c68bfa8cd62f7ab79
SSDEEP 6144:w7Tu21ldM1vm+M64qM0gcjcTY3BmzRlHvVI82njmRgAZR6hFd:wfc4qDgdTJnvVIjmRgAEX
TLSH
T1086423DF1C8D777BC4530970267B908225EA25629FA962AE0CE45FB0C8473FAD234B57
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

GoldenEye.exe

IMPHASH eadbe699c9f56194b9bbdf2dd7631233
SHA256 389a7d395492c2da6f8abf5a8a7c49c3482f7844f77fe681808c71e961bcae97
MD5 e3b7d39be5e821b59636d0fe7c2944cc
SHA1 00479a97e415e9b6a5dfb5d04f5d9244bc8fbe88
SHA512 8f977c60658063051968049245512b6aea68dd89005d0eefde26e4b2757210e9e95aabcef9aee173f57614b52cfbac924d36516b7bc7d3a5cc67daae4dee3ad5
SSDEEP 3072:iTAjnioLO7WpLyLNZMcPSK7BaZ0NwAWMGc0HfmY4KsyyOiy12KJ3I4YgTl:i6nrD0ZMcPBAL7c0fTHs+2sYXg
TLSH
T122448B0D7990E92EC4B222719A38E7D2FD3B79314F24919FB7C4695DACE08C19938B17
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

50212

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\src\ZoomIt\Release\ZoomIt.pdb

comctl32

ord17

winmm

PlaySoundA

gdiplus

GdipGetImageEncoders GdipGetImageEncodersSize GdipDrawImageRectRect GdipSetInterpolationMode GdipSetPixelOffsetMode GdipDeleteGraphics GdipCreateFromHDC GdipCreateHBITMAPFromBitmap GdipCreateBitmapFromFileICM GdipCreateBitmapFromFile GdipSaveImageToFile GdipDisposeImage GdipCloneImage GdiplusShutdown GdiplusStartup GdipFree GdipAlloc GdipCreateBitmapFromHBITMAP

msimg32

AlphaBlend

kernel32

GetTickCount FormatMessageA lstrcpynA CreateEventA GetModuleFileNameA CreateProcessA GetCommandLineA ExpandEnvironmentStringsA FindResourceA GetFileAttributesA DeleteFileA MultiByteToWideChar GetStringTypeW FatalAppExitA CreateSemaphoreW GetModuleHandleW TlsFree TlsSetValue TlsGetValue TlsAlloc TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter FreeEnvironmentStringsW GetEnvironmentStringsW GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter GetStartupInfoW MulDiv GetFileType GetConsoleMode GetConsoleCP WideCharToMultiByte RtlUnwind InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection HeapSize GetModuleFileNameW WriteFile GetStdHandle AreFileApisANSI GetModuleHandleExW ExitProcess GetProcessHeap GetCurrentThreadId SetLastError GetCPInfo GetOEMCP GetACP IsValidCodePage InterlockedDecrement InterlockedIncrement IsProcessorFeaturePresent IsDebuggerPresent DecodePointer EncodePointer HeapAlloc HeapFree Beep CloseHandle SizeofResource LoadResource Sleep WaitForSingleObject GetLastError SetThreadPriority GetCurrentThread GetExitCodeProcess GetCurrentProcess GetVersion LockResource GetCommandLineW GetModuleHandleA LoadLibraryA LocalFree LocalAlloc GetProcAddress GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW RaiseException GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW InterlockedExchange FreeLibrary LoadLibraryExW SetConsoleCtrlHandler OutputDebugStringW LoadLibraryW SetFilePointerEx HeapReAlloc SetStdHandle FlushFileBuffers WriteConsoleW CreateFileW ReadFile ReadConsoleW SetEndOfFile DeleteCriticalSection

user32

FindWindowW FindWindowA GetParent GetDesktopWindow GetWindowLongA SetRect FillRect GetSysColor ChildWindowFromPoint MapWindowPoints GetClipCursor ClipCursor GetCursorPos LoadIconA MessageBoxA GetWindowRect GetClientRect RedrawWindow InvalidateRect EndPaint BeginPaint ReleaseDC GetDC SetForegroundWindow GetForegroundWindow SetActiveWindow UpdateWindow ChangeDisplaySettingsExA SystemParametersInfoA EnumDisplaySettingsA SetCursorPos DrawTextA TrackPopupMenu InsertMenuA DestroyMenu CreatePopupMenu TranslateAcceleratorA LoadAcceleratorsA EnableWindow KillTimer SetTimer GetAsyncKeyState GetKeyState SetFocus EmptyClipboard SetClipboardData CloseClipboard OpenClipboard IsDlgButtonChecked CheckDlgButton GetDlgItemTextA SetDlgItemTextA DialogBoxParamA CreateDialogParamA BringWindowToTop IsWindowVisible SetWindowPos ShowWindow DestroyWindow CreateWindowExA RegisterClassA PostQuitMessage DefWindowProcA PostMessageA GetMessageExtraInfo UnregisterHotKey RegisterHotKey DispatchMessageA TranslateMessage GetMessageA LoadCursorA InflateRect GetSysColorBrush SetCursor SetWindowTextA GetDlgItem EndDialog DialogBoxIndirectParamA SendMessageA SetWindowLongA

gdi32

DeleteDC DeleteObject Ellipse GetStockObject LineTo Rectangle SelectObject CreateSolidBrush StretchBlt SetROP2 SetStretchBltMode SetTextColor GetObjectA MoveToEx Polygon CreatePen CreateFontIndirectA GetDeviceCaps StartDocA SetMapMode EndDoc StartPage EndPage BitBlt CreateBitmap CreateCompatibleBitmap CreateCompatibleDC SetBkMode CreateDCA

comdlg32

GetSaveFileNameA GetOpenFileNameA PrintDlgA ChooseFontA

advapi32

RegCreateKeyA RegOpenKeyExA RegDeleteValueA RegCreateKeyExA RegSetValueExA RegQueryValueExA RegCloseKey

shell32

ShellExecuteA Shell_NotifyIconA

ole32

CoInitialize