doox tools[.]zip | Triage™

General

Target
doox tools.zip
Size 243KB
Sample260713-plhhcsa17v
SHA256 75e5d61ee4ebcd77c21cc4c361cf497f4131936e563df51530a602115270cda2
MD5 73615075daebba4410def9444268b6d1
SHA1 9ce3562422b0ab52ec2d1367e9edfbad3df58ddc
SHA512 07b2a741255b557ec9dc8feac6c3dc53dfae93ff42cb3812e7693f3f5b25b20003c9b4faaf4b617522c642ded1aa3f4ac2dd49b66dbb21ccec242036d4889dfc
SSDEEP 6144:RLDp5Din4GOlZu8kx/2pmdVTHN5QcDfFb3iQOGhhUWHAHi:pDwQO/2gj5QUQOh7AHi
TLSH
T1C73412388A81BDF7E59DE1301BE52112FE5EC50C09A3241A73FAD94BBC4737B491BA16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/doox tools/doxxtools.exe

File Explorer

doox tools.zip

.zip 243KB
doox tools/doxxtools.exe

.exe 1.1MB

doox tools.zip

SHA256 75e5d61ee4ebcd77c21cc4c361cf497f4131936e563df51530a602115270cda2
MD5 73615075daebba4410def9444268b6d1
SHA1 9ce3562422b0ab52ec2d1367e9edfbad3df58ddc
SHA512 07b2a741255b557ec9dc8feac6c3dc53dfae93ff42cb3812e7693f3f5b25b20003c9b4faaf4b617522c642ded1aa3f4ac2dd49b66dbb21ccec242036d4889dfc
SSDEEP 6144:RLDp5Din4GOlZu8kx/2pmdVTHN5QcDfFb3iQOGhhUWHAHi:pDwQO/2gj5QUQOh7AHi
TLSH
T1C73412388A81BDF7E59DE1301BE52112FE5EC50C09A3241A73FAD94BBC4737B491BA16
MD5 SHA1 SHA512 SSDEEP TLSH

doox tools/doxxtools.exe

IMPHASH 73f461c771aef77ec43d53a0c54f0c8d
SHA256 fc50dffa216a44e519f089cc71f8f6e715dc10ca4ff6e7de9a92f53f6b6ed002
MD5 05452517ff8bc4af5f2e1bf9fd38fe6c
SHA1 bd7b58ff9b5b12e8902cc0710bb5757bedc2089e
SHA512 3ad1858d706810f8b1b427c83aef887f2a3c7cec0ecdd1a3aac98a79531babcb6dc18f2d03402681698329b72b4ce4f8971112d1dd2baafa24cd2d85672e9004
SSDEEP 12288:3Z+OE4MmD6/Oyspc5EEBBBHGBgzGerwGdvPqItNquB:3cb4M06WpoPrwGvP3f5
TLSH
T19E357C83EBE381D8C156C8B5535BF137F9627C8E4A157196ABC41E633E67B64E22CB00
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

4096

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

468KB

Virtual Size

467KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

625KB

Virtual Size

625KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.CRT

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

1024B

Virtual Size

700B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

doox tools.zip

doox tools/doxxtools.exe

ntdll

kernel32

advapi32

crypt32

ws2_32

generic

Sharing

General

Malware Config

Signatures

File Explorer

doox tools.zip

doox tools/doxxtools.exe

ntdll

kernel32

advapi32

crypt32

ws2_32

generic