zarplata[.]rar | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
zarplata.rar
Size 57KB
Sample260720-plplnsct61
SHA256 4575d9b9401dd26817d9c2b11153164c39d81d145181fb8abeee0e5900d808b4
MD5 d0ad3fdde42652117dbfdccb7ace7ec9
SHA1 91a19e14a50e7428aa983f1b5fbc3d7ff45a45cb
SHA512 ad71b21b1f032370f412552fbc59a67323d7eecbf7e50db095a5fd669058f1d42f1fddc5030e6cebcc0f2cb2f91662c17627f36c44a89ffd41cbc542d9a50e66
SSDEEP 1536:B0ENe0tVbo8o46Q0zNYmq0WC5OyYh2ZEQL:KweB8yrz61C5OpfA
TLSH
T1234312626FC25CFC913ED857A127524C12F30560BE7AEB7928DA01B0B7C3B68544EB4B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Zarplata.exe

File Explorer

zarplata.rar

.rar 57KB
Zarplata.exe

.exe 136KB

zarplata.rar

SHA256 4575d9b9401dd26817d9c2b11153164c39d81d145181fb8abeee0e5900d808b4
MD5 d0ad3fdde42652117dbfdccb7ace7ec9
SHA1 91a19e14a50e7428aa983f1b5fbc3d7ff45a45cb
SHA512 ad71b21b1f032370f412552fbc59a67323d7eecbf7e50db095a5fd669058f1d42f1fddc5030e6cebcc0f2cb2f91662c17627f36c44a89ffd41cbc542d9a50e66
SSDEEP 1536:B0ENe0tVbo8o46Q0zNYmq0WC5OyYh2ZEQL:KweB8yrz61C5OpfA
TLSH
T1234312626FC25CFC913ED857A127524C12F30560BE7AEB7928DA01B0B7C3B68544EB4B
MD5 SHA1 SHA512 SSDEEP TLSH

Zarplata.exe

IMPHASH 23348d6f41830cd3e2026dcdc6c36ae4
SHA256 bee12a4f8c2226ed7e1cb9b4cd4005564b6efcd082add3b4aff48d0f8e28d8b5
MD5 459656999ac2b9ec7ac88da55dc34243
SHA1 6199107d3262ad374cdc8fa342d320784000b6f6
SHA512 944fdcd6a9966d621088b4a3013495b0e41f388ad1e2eb2c1a853721e1f9a1f48045b4435300044b8d163af7f9409b22dab5256fd56fc0f1cd97526033095dd1
SSDEEP 3072:Qluft345h8WZFGAmG2DZM2Bln6ZPykKhaXUtg0vS3n:qu10GqFpGTSZHkoUhv
TLSH
T1C8D36B0276D5C4F2E5B726300AF6EBB5B7B5FD704B368627A354CB6E1D362014A2E312
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

9872

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

RaiseException HeapFree ExitProcess TerminateProcess HeapSize HeapReAlloc GetCPInfo GetCommandLineA HeapAlloc UnhandledExceptionFilter FreeEnvironmentStringsA FreeEnvironmentStringsW GetEnvironmentStrings GetEnvironmentStringsW SetHandleCount GetStdHandle GetFileType HeapDestroy HeapCreate GetACP GetOEMCP GetStartupInfoA GetModuleHandleA GetProcessVersion GetProcAddress IsBadReadPtr IsBadWritePtr IsBadCodePtr GetStringTypeA GetStringTypeW GetLocaleInfoA GetLocaleInfoW CompareStringA CompareStringW SetEnvironmentVariableA SetStdHandle InterlockedDecrement RtlUnwind GetLocalTime GetSystemTime GetTimeZoneInformation SetErrorMode GlobalGetAtomNameA GlobalAddAtomA GetModuleFileNameA GetFullPathNameA GetVolumeInformationA FindFirstFileA FindClose FlushFileBuffers SetFilePointer WriteFile GetCurrentProcess WritePrivateProfileStringA lstrcpyA GetVersionExA MultiByteToWideChar WideCharToMultiByte InterlockedIncrement SetUnhandledExceptionFilter LoadLibraryA CloseHandle FreeLibrary VirtualAlloc GlobalFlags GlobalAlloc GlobalDeleteAtom lstrlenA TlsGetValue LocalReAlloc TlsSetValue EnterCriticalSection GlobalReAlloc LeaveCriticalSection GlobalHandle DeleteCriticalSection TlsAlloc InitializeCriticalSection LocalFree LocalAlloc lstrcpynA GetLastError SetLastError MulDiv LCMapStringA LCMapStringW VirtualFree GetCurrentThreadId FindResourceA lstrcatA GetVersion LockResource LoadResource lstrcmpA GlobalFree GlobalUnlock GlobalLock GetCurrentThread lstrcmpiA

user32

PostQuitMessage GetMenuCheckMarkDimensions SetCursor MessageBoxA GetCursorPos LoadBitmapA ShowOwnedPopups ValidateRect GetMessageA GetDC ReleaseDC BeginPaint EndPaint TranslateMessage TabbedTextOutA GrayStringA GetClassNameA PtInRect ClientToScreen GetDesktopWindow LoadCursorA GetSysColorBrush DestroyMenu FindWindowA InvalidateRect DrawTextA ReleaseCapture WindowFromPoint LoadStringA CharUpperA SetRectEmpty LoadAcceleratorsA TranslateAcceleratorA LoadMenuA SetMenu ReuseDDElParam UnpackDDElParam BringWindowToTop GetNextDlgTabItem EndDialog GetActiveWindow CreateDialogIndirectParamA PostMessageA UpdateWindow SendDlgItemMessageA SystemParametersInfoA MapWindowPoints GetSysColor PeekMessageA DispatchMessageA IsWindow SetFocus AdjustWindowRectEx ModifyMenuA GetMenuState BeginDeferWindowPos CopyRect ScrollWindow SetScrollInfo SetScrollRange GetScrollPos SetScrollPos GetTopWindow IsWindowEnabled IsChild GetCapture WinHelpA wsprintfA GetClassInfoA RegisterClassA GetMenuItemCount GetSubMenu GetMenuItemID GetMenu GetDlgItem GetWindowTextA GetDlgCtrlID GetKeyState DefWindowProcA DestroyWindow CreateWindowExA SetWindowsHookExA CallNextHookEx SetPropA UnhookWindowsHookEx GetLastActivePopup GetForegroundWindow SetForegroundWindow GetPropA CallWindowProcA RemovePropA GetMessageTime GetMessagePos GetWindow GetWindowLongA SetWindowLongA SetWindowPos RegisterWindowMessageA IsIconic GetSystemMetrics DrawIcon SendMessageA LoadIconA EnableWindow GetParent GetClientRect GetWindowRect ScreenToClient SetRect IntersectRect OffsetRect CheckMenuItem EnableMenuItem ShowWindow MoveWindow SetWindowTextA IsDialogMessageA SetMenuItemBitmaps EqualRect DeferWindowPos GetFocus SetActiveWindow EndDeferWindowPos ShowScrollBar IsWindowVisible UnregisterClassA

gdi32

SetBkColor CreateBitmap DeleteDC SaveDC RestoreDC SelectObject GetStockObject SetMapMode SetViewportOrgEx OffsetViewportOrgEx SetViewportExtEx ScaleViewportExtEx SetWindowExtEx ScaleWindowExtEx GetClipBox SetTextColor DeleteObject GetDeviceCaps PtVisible RectVisible TextOutA ExtTextOutA Escape GetObjectA

winspool.drv

DocumentPropertiesA ClosePrinter OpenPrinterA

advapi32

RegCloseKey RegSetValueExA RegCreateKeyExA RegOpenKeyExA RegQueryValueExA

shell32

DragFinish DragQueryFileA

comctl32

ord17 ImageList_Destroy