IW COD ZM[.]zip | Triage™

General

Target
IW COD ZM.zip
Size 388KB
Sample260620-cecbjscx9p
SHA256 a66231848450763e264241b96a11e03389985bb4cd05817e88c3cbf81031f9d7
MD5 21c3f7c20df842eef459405a60f21366
SHA1 8555cd684e61fa77347f8c51dd7663028a2dca78
SHA512 0b44c48f524c5a6e7cbdaba928edbd7d1e19f3f46c3cc21389d022ff74fc461ef85799008eca157ca84827065333d93604d41ee7cc374282d2f4330080a042b9
SSDEEP 12288:NFVXu74K0CQVFoTbpRJu8i/Kcam2zXpUSKkSwJX/Zd:hKxQwTNRJpiDam2zXpUTwVP
TLSH
T12D8423562F7783E16F74ADD376120A45EDD9F6283214AD60B018770BEF4C458DE4FA0A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/IW COD ZM/IWCodZM.exe

File Explorer

IW COD ZM.zip

.zip 388KB
IW COD ZM/IWCodZM.exe

.exe 448KB
IW COD ZM/hackoncod.com.txt

885B

IW COD ZM.zip

SHA256 a66231848450763e264241b96a11e03389985bb4cd05817e88c3cbf81031f9d7
MD5 21c3f7c20df842eef459405a60f21366
SHA1 8555cd684e61fa77347f8c51dd7663028a2dca78
SHA512 0b44c48f524c5a6e7cbdaba928edbd7d1e19f3f46c3cc21389d022ff74fc461ef85799008eca157ca84827065333d93604d41ee7cc374282d2f4330080a042b9
SSDEEP 12288:NFVXu74K0CQVFoTbpRJu8i/Kcam2zXpUSKkSwJX/Zd:hKxQwTNRJpiDam2zXpUTwVP
TLSH
T12D8423562F7783E16F74ADD376120A45EDD9F6283214AD60B018770BEF4C458DE4FA0A
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

IW COD ZM/IWCodZM.exe

SHA256 a22738e3ba713a9b12908ab583d43895175dc2216ee2515bb432d4215eced26d
MD5 0dca34820eeb015788af264d3994ac58
SHA1 75265b9951a5ee5f370f4c49843ae5dba893967c
SHA512 43c046eaee5bbca28731184949c10dd6e23da725da3a25d7f7b73f58695c2bbc9bb44b33710faca1fd61d9168609e06f825718358f69a33853e8062904adb363
SSDEEP 6144:XQYIEuR8/VIMfSEuR8/VIMfSEuR8/VIMfSEuR8/VIMf:AXZM6ZM6ZMKZM
TLSH
T1A5A4E0097BAD4C93E57954F11262809117B08812FB63CBC72CD225EF7EE9F60A642F4B
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\ryan\Documents\Visual Studio 2017\Projects\IWCodZM\IWCodZM\obj\Release\IWCodZM.pdb

Sharing