归档.zip
- SHA256 2d0803da378945217771e18c93acd9cdfae8c4d17755b11f047deac7d091382d
Static task
static1
1 signatures
General
- Target 归档.zip
- Size 430KB
- Sample260723-vsja5a1yev
- SHA256 2d0803da378945217771e18c93acd9cdfae8c4d17755b11f047deac7d091382d
- MD5 9c4d2ca88e1d21cba9be7bc32ab4138b
- SHA1 19d29864a920bebfd28933dfdcfe32e5307cb455
- SHA512 6f7c269e39d0e058aebcd6744de5285e10ccc0ed7ee64e94bc55be70f1493172973e64ded5ff11c9a35a8b63dfb62a4762d41db23a76b366d002dfcd7551513c
- SSDEEP 12288:ik3okDnaxVGUhyYyV3PmCThPREufMAgh2I5Dg6Vn:ukkcPBeCThpE+MhhLDg4
- TLSH T167942347792F8CC9D98B6F9533631338B4B027C82B1CAD8EBE6059AC44F275257B6613
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/weixin.exe
File Explorer
-
归档.zip.zip 430KB
-
__MACOSX/._config.ini253B
-
__MACOSX/._weixin.exe253B
-
config.ini14KB
-
weixin.exe.exe 1.1MB
__MACOSX/._config.ini
- SHA256 5e121d83f306a780e78c1f66ec97771f0d8b5eaf4a5060055430f1cfba13d0df
- MD5 0dbb146612a1d2e952807ff2800a26ca
- SHA1 5c16994dab8dcc8c9dffdf42b529d72e3c1ea325
- SHA512 5c26d970c2277b8a0066ea4153c22b853bb5aca1a7406bb7e84cbd3c2b24ef55657e53e4e3cbf5990611d925560ede98c2b7a93d284c00ca9341df67ac3d1bc4
- TLSH T19CD0223080A24BE1D01AA27842E22824B27528B4CA534100B24D4882072AA04B39834A
- MD5 SHA1 SHA512 TLSH
__MACOSX/._weixin.exe
- SHA256 9343bda1a10ec243b49b0718deae8a86ed794907ffd217519a2d835f5a18b6d6
- MD5 0fdb6be4596b38113159c5ba86e21a21
- SHA1 b32699b1815b61680f48931bdb040fbd000dbe12
- SHA512 445fa0b0e98038f4948953aa1ce6355a32aba77215fa0b49822ff16902558057b8fb75f6bdb06a51cc1953b25f867f592d8658512907fa911f06f6e643b34d39
- TLSH T10FD0C074A0F39F60D01582780BE3DCB2F07518AACF570200326C4CC30328704B3E036A
- MD5 SHA1 SHA512 TLSH
config.ini
- SHA256 28a505c850fccee5f69a1f718f5c59caeebcc65260fb2a21e5bc5af17eb480ca
- MD5 403dc51442cc42a2d52d780b6ac5abff
- SHA1 010d7b419f2d91b5c3031ecd4ed0b93cdbad55dc
- SHA512 cf771501462415e03107dba0ed926aba0a1d2e43f7ca5c0b9ebc76b07dc98883241d1951e47fa7da80719336c82f2e5464ed8ff0d14d23778fbd5029491aa567
- SSDEEP 384:Bi2Tph9G7ZjNVPJaUB+k/0ABHCltvTWHD1s+:BPlG7ZJSUIKpBHCltQDq+
- TLSH T1C662E1CFD0692688076A30D855D6EAEB709173F4DE7683CA9083254D8190F1EF6C52CB
- MD5 SHA1 SHA512 SSDEEP TLSH
weixin.exe
- IMPHASH 4a9d8fca37b1a5c0bfd9c36968d5986c
- SHA256 b43ab12932d93f08f0ad7c6722f842e394ecf5d2b9e54b9fe93a83029765e1dd
- MD5 99e73a842b27dc0951342b87e0a13fae
- SHA1 39284e41a83b13f54321fe82f35027d7a467f43e
- SHA512 6088dc0d7ba49ee778fb40e864435dcafbfabbb8b9e6c09ec16cec2d62b45a0cdb365d211add051c610410538295c34dc4aca4c3fa5b685845191345204d538c
- SSDEEP 24576:swdIfMAlBaoSgWtMARLwZKTvP4z5XTsih5X/jQsAaq:swdIfMAioktMLZKTvP4z5Dsih5X/jQs
- TLSH T18D455B0762E815E4E973AA3C8B7607C9E775BD053B20D6CF06E092951F2F6E13A7A311
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
399192
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\AppModelSamples\Samples\ChatAppShare\x64\Release\ShareApp.pdb
kernel32
GetFileSizeEx
TerminateProcess
GetModuleFileNameW
WaitForSingleObject
CreateFileW
GetFileAttributesW
Sleep
GetLastError
OutputDebugStringW
CloseHandle
GetProcAddress
GetCurrentPackageFullName
CreateProcessW
GetModuleHandleW
GetExitCodeProcess
GetTickCount
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
GetCurrentProcessId
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
SetLastError
InterlockedFlushSList
CreateEventW
SetEvent
LoadLibraryW
FormatMessageW
RtlUnwind
WriteConsoleW
ReadConsoleW
ReadFile
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
HeapSize
SetFilePointerEx
GetProcessHeap
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
GetTimeZoneInformation
HeapReAlloc
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
GetTempPathW
SetConsoleCtrlHandler
GetFileType
GetCurrentThread
HeapAlloc
HeapFree
GetModuleHandleExW
ExitProcess
WriteFile
InterlockedPushEntrySList
GetStdHandle
LoadLibraryExW
FreeLibrary
RtlUnwindEx
RtlPcToFileHeader
RaiseException
TlsFree
user32
PostQuitMessage
FindWindowExW
ShowWindow
CreateWindowExW
KillTimer
SendMessageW
TranslateMessage
SetTimer
GetMessageW
DispatchMessageW
GetWindowThreadProcessId
GetWindowTextW
RegisterClassExW
DefWindowProcW
shell32
ShellExecuteW
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
WideCharToMultiByte
GetStringTypeW
CompareStringEx
api-ms-win-core-localization-l1-2-0
LCMapStringEx
GetLocaleInfoEx
FormatMessageA
GetCPInfo
api-ms-win-core-synch-l1-1-0
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
api-ms-win-core-util-l1-1-0
EncodePointer
DecodePointer
api-ms-win-core-heap-l2-1-0
LocalFree
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
UnhandledExceptionFilter
api-ms-win-core-processthreads-l1-1-0
GetStartupInfoW
GetCurrentProcess
GetCurrentThreadId
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
ole32
CoInitializeEx
CoCreateFreeThreadedMarshaler
oleaut32
SysStringLen
SysAllocString
SysFreeString
GetErrorInfo
SetErrorInfo
Name
.text
Size
826KB
Virtual Size
825KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
161KB
Virtual Size
160KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
13KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
39KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
119KB
Virtual Size
118KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=259, version=30795,
count=160, id=261, version=30795,
count=16, id=260, version=30795,
count=26, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=10, id=259, version=34321,
count=16, id=260, version=34321,
count=81, id=261, version=34321,
count=11, id=257, version=30795,
count=133, id=1, productName=Unmarked objects,
count=3, id=265, version=34440,
count=1, id=255, version=34440,
count=1, id=151,
count=1, id=258, version=34440,