e5dda4e7dc6b95830c066b519383e71abd4fb0a2340c0def898f635d9cfa13e7[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
e5dda4e7dc6b95830c066b519383e71abd4fb0a2340c0def898f635d9cfa13e7.zip
Size 1.0MB
Sample260722-dwxjgsvthy
SHA256 aa79f8953f68480040e54d4ecc3923fee5402d0028fe2ed59602624cc6fe5b80
MD5 9df23484ecde81a743a676df688f594e
SHA1 a47997e4415f6f56572aed3f0272611fed571694
SHA512 84249d7bdaa451c6f32c32ed144a56eb5c27eac1e038a631e224b07ce0ca4dc37f8c0ba976a9eed8cb75cd390fafdebafe35694e5e7f6aa5c25fc0da0ddcd59f
SSDEEP 24576:SPZEbYYAbHeRS+s3GRLms2gcy+esB2RfIsWZQpmVpc:SPik569R6ZEM2mFxrc
TLSH
T1863533E9C7EBEC1712B4FE761645758217DBB7D238639E9AA013ECD798203506F88807
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/e5dda4e7dc6b95830c066b519383e71abd4fb0a2340c0def898f635d9cfa13e7.exe

File Explorer

e5dda4e7dc6b95830c066b519383e71abd4fb0a2340c0def898f635d9cfa13e7.zip

.zip 1.0MB
e5dda4e7dc6b95830c066b519383e71abd4fb0a2340c0def898f635d9cfa13e7.exe

.exe 2.1MB

e5dda4e7dc6b95830c066b519383e71abd4fb0a2340c0def898f635d9cfa13e7.zip

SHA256 aa79f8953f68480040e54d4ecc3923fee5402d0028fe2ed59602624cc6fe5b80
MD5 9df23484ecde81a743a676df688f594e
SHA1 a47997e4415f6f56572aed3f0272611fed571694
SHA512 84249d7bdaa451c6f32c32ed144a56eb5c27eac1e038a631e224b07ce0ca4dc37f8c0ba976a9eed8cb75cd390fafdebafe35694e5e7f6aa5c25fc0da0ddcd59f
SSDEEP 24576:SPZEbYYAbHeRS+s3GRLms2gcy+esB2RfIsWZQpmVpc:SPik569R6ZEM2mFxrc
TLSH
T1863533E9C7EBEC1712B4FE761645758217DBB7D238639E9AA013ECD798203506F88807
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

e5dda4e7dc6b95830c066b519383e71abd4fb0a2340c0def898f635d9cfa13e7.exe

IMPHASH 46d844d880996af2766416e3e2079244
SHA256 e5dda4e7dc6b95830c066b519383e71abd4fb0a2340c0def898f635d9cfa13e7
MD5 24f1c6fbb6cd28d53117bfbef3e9ec08
SHA1 056db76657f3108c8db03a33c59db1fa8ee1cd14
SHA512 ab1594509ddc48b3fe848d29dc4cedaa05eeab0703d98a3a18883ce1e474cb3a73b9427f9411184d82810ae9b6a9d037d15953329a0a7a26ce26561fd751c4d8
SSDEEP 49152:W0ao7zY6iUSzvEHTf1PLudGRSY3yOZ2S+oeATrfK:WqeY3yOZ2S+oeATrfK
TLSH
T1D2A5AE19E3D812A8E167DA74CB51A332D6B178534771E19F0A99D70A2F73E908F3B312
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1119036

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

AdjustTokenPrivileges DeregisterEventSource LookupPrivilegeValueW OpenProcessToken RegCloseKey RegCreateKeyExW RegQueryValueExW RegSetValueExW RegisterEventSourceW ReportEventW

bcrypt

BCryptGenRandom

kernel32

EncodePointer FlsFree CloseHandle CloseThreadpoolWork CreateDirectoryW CreateEventExW CreateFileW CreateProcessW CreateThread CreateThreadpoolWork DeleteCriticalSection DuplicateHandle EnterCriticalSection ExpandEnvironmentStringsW FindClose FindFirstFileW FindNextFileW FormatMessageW FreeLibrary GetCPInfo GetConsoleOutputCP GetCurrentProcess GetCurrentProcessId GetCurrentProcessorNumberEx GetCurrentThread GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesW GetFileSize GetLastError GetModuleFileNameW GetModuleHandleA GetProcAddress GetProcessId GetStdHandle GetSystemDirectoryW GetThreadPriority GetTickCount64 InitializeConditionVariable InitializeCriticalSection IsDebuggerPresent IsWow64Process K32EnumProcessModulesEx K32EnumProcesses K32GetModuleBaseNameW K32GetModuleFileNameExW K32GetModuleInformation LeaveCriticalSection LoadLibraryA LoadLibraryExW LocalAlloc LocalFree MultiByteToWideChar OpenProcess QueryPerformanceCounter QueryPerformanceFrequency RaiseFailFastException ReadFile ResetEvent ResumeThread SetEvent SetLastError SetThreadErrorMode SetThreadPriority Sleep SleepConditionVariableCS SubmitThreadpoolWork VirtualAlloc VirtualFree WaitForMultipleObjectsEx WaitForSingleObject WakeConditionVariable WideCharToMultiByte WriteFile FlushProcessWriteBuffers WaitForSingleObjectEx AddVectoredExceptionHandler GetModuleHandleW RtlVirtualUnwind RtlCaptureContext RtlRestoreContext VerSetConditionMask FlsAlloc FlsGetValue FlsSetValue CreateEventW SwitchToThread GetCurrentThreadId SuspendThread GetThreadContext SetThreadContext FlushInstructionCache VirtualProtect CreateMemoryResourceNotification QueryInformationJobObject GetModuleHandleExW GetProcessAffinityMask VerifyVersionInfoW InitializeContext GetEnabledXStateFeatures LocateXStateFeature SetXStateFeaturesMask VirtualQuery GetSystemTimeAsFileTime InitializeCriticalSectionEx SleepEx DebugBreak GlobalMemoryStatusEx GetSystemInfo GetLogicalProcessorInformation GetLogicalProcessorInformationEx GetLargePageMinimum VirtualUnlock VirtualAllocExNuma IsProcessInJob GetNumaHighestNodeNumber GetProcessGroupAffinity K32GetProcessMemoryInfo RaiseException RtlPcToFileHeader RtlUnwindEx SetUnhandledExceptionFilter InitializeSListHead

ole32

CoCreateGuid CoWaitForMultipleHandles CoGetApartmentType CoInitializeEx CoTaskMemFree CoUninitialize

api-ms-win-crt-math-l1-1-0

__setusermatherr ceil

api-ms-win-crt-heap-l1-1-0

malloc _set_new_mode _callnewh calloc free

api-ms-win-crt-string-l1-1-0

strlen strcmp strcpy_s _stricmp

api-ms-win-crt-convert-l1-1-0

strtoull

vcruntime140

memset memcpy _purecall memmove

api-ms-win-crt-runtime-l1-1-0

_crt_atexit _register_onexit_function terminate _seh_filter_exe _set_app_type abort _configure_wide_argv _initialize_wide_environment _initialize_onexit_table _initterm _initterm_e exit _exit __p___argc __p___wargv _cexit _c_exit _get_initial_wide_environment _register_thread_local_exe_atexit_callback

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale