Desktop[.]zip | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Desktop.zip
Size 870KB
Sample260720-1mp5daft4n
SHA256 f137876c0ce4947f50ec320e274fc9c59177486b78f21045d1c9a27f520b3c2e
MD5 df47b7c338a18cae97b99be34396f057
SHA1 a552bbd541b0ae52d6456153ed43383554bf558c
SHA512 08b9480f918e82aec09267b0abe500e586da1906da716bdadf995742544c1096bd097fe19a77adf6bed65980985a8cbe386609740f3b0726bd449e436c2abb6f
SSDEEP 24576:/sJ2Oh3RKJOCK0AvWB0xtxLEmfOcaMVB3tHHN1VB/5BfmqUi:EJ2Oh3R+OfTvPx0mfNaitNxzfmvi
TLSH
T1951523609E9208B8F2B2FF7CB5834DE4DD073E55354A19C2A3356517E427E88A3F06A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/gc.dll

File Explorer

Desktop.zip

.zip 870KB
gc.dll

.dll 5.6MB
run.bat

19B

Desktop.zip

SHA256 f137876c0ce4947f50ec320e274fc9c59177486b78f21045d1c9a27f520b3c2e
MD5 df47b7c338a18cae97b99be34396f057
SHA1 a552bbd541b0ae52d6456153ed43383554bf558c
SHA512 08b9480f918e82aec09267b0abe500e586da1906da716bdadf995742544c1096bd097fe19a77adf6bed65980985a8cbe386609740f3b0726bd449e436c2abb6f
SSDEEP 24576:/sJ2Oh3RKJOCK0AvWB0xtxLEmfOcaMVB3tHHN1VB/5BfmqUi:EJ2Oh3R+OfTvPx0mfNaitNxzfmvi
TLSH
T1951523609E9208B8F2B2FF7CB5834DE4DD073E55354A19C2A3356517E427E88A3F06A7
MD5 SHA1 SHA512 SSDEEP TLSH

gc.dll

IMPHASH 0b5c5659cbf56f68ad96d88107958893
SHA256 1c135ee1c61b00156ad234569d9f65f5e50d524b8dba862abe45af8f67d1a216
MD5 556c72794c0a97dafc7ff64c852758b8
SHA1 77a4dd72d0a3ac1b30879a811921b8c8603432be
SHA512 6152b3cafba18f12d4ae10b38268b18aa37d0112dc9b0c4557cecf51ce1c69530373d128643fc6968da4bb21529f012ef08eb599c7aa080de7b9afe670e385d6
SSDEEP 12288:1VlIO75akPbR3p8qFcQBPsPxQAq8d/nDJEDzmpfPkFPxjuYX1t+hL+6Ug5t8t8JV:VQIBWQuYX24/SJz3fw
TLSH
T1A346D8B3775B8A62DA78457E15CCB379BB9DAF306178ADAE81B404C0170362474B8D8F
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5040

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

Name

.text

Size

642KB

Virtual Size

641KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

3.7MB

Virtual Size

3.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

68B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

44B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Desktop.zip

gc.dll

kernel32

msvcrt

generic

run.bat