files[.]dat_pw_infected[.]zip

General

Target
files.dat_pw_infected.zip
Size 639KB
Sample260727-rh63nathph
SHA256 20e87568a8e76e978628971e97b0ba2a26738daff176f4912d98405c5ae79f22
MD5 b4b567865290484dd4bb4e9df3ca81f3
SHA1 cc42744e03dd037e3c5f23e8e92602aaafe2b218
SHA512 7674065dd71c792021becdd912b7f1e2adee37a91ec862ecc832d7f9a6fe9d931618034c56f6658d36196cd67ad355ec14abfdca0e843bfc2605501c37de1812
SSDEEP 12288:TBy9KAnGIOub9OlziTxqsQLijHqnTN+7fW3jKm4oScZ/fIUSS5l4xdcfObnzS:U99Gxx0dBQOqnTg7fnm4YINVxqfOjzS
TLSH
T15DD433944FB04EAD30750E9086B578AC7CC56BC952D4D937B211DAFAECB4F10A36263E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/files.dat

File Explorer

files.dat_pw_infected.zip

.zip 639KB
files.dat

.exe 707KB

files.dat_pw_infected.zip

SHA256 20e87568a8e76e978628971e97b0ba2a26738daff176f4912d98405c5ae79f22
MD5 b4b567865290484dd4bb4e9df3ca81f3
SHA1 cc42744e03dd037e3c5f23e8e92602aaafe2b218
SHA512 7674065dd71c792021becdd912b7f1e2adee37a91ec862ecc832d7f9a6fe9d931618034c56f6658d36196cd67ad355ec14abfdca0e843bfc2605501c37de1812
SSDEEP 12288:TBy9KAnGIOub9OlziTxqsQLijHqnTN+7fW3jKm4oScZ/fIUSS5l4xdcfObnzS:U99Gxx0dBQOqnTg7fnm4YINVxqfOjzS
TLSH
T15DD433944FB04EAD30750E9086B578AC7CC56BC952D4D937B211DAFAECB4F10A36263E
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

files.dat

IMPHASH b1cc42ed0fd679fe2cb573579ca5ab58
SHA256 7a1c82e264258470d14ca345ea1a9b6fc34fa19b393a92077a01be5f1ad08f47
MD5 55d21b2c272a5d6b9f54fa9ed82bf9eb
SHA1 32464cba823cd9b7e94e4fa1a32a8f2344b0f33b
SHA512 1b68d0c61367717529be4a3aa347bb69d3e21de7a89b10e8b0aa54d40af988cc0cc8e63298ba595a93c3372aca3770ace1eee2780a59238d0948499dbb4be725
SSDEEP 12288:3XikbkgaISKVHNJhk2X4hGeHJ3ZWpZaw+ovKE88agUZ+Z00KvxHbeQiHhYfNx9nj:3Xi6kgaINVHLhk2XeH2xPHXUZf0IeQs8
TLSH
T16AF402123AF1C13BE1420532CEC9ABF6A1F2E2580F21885773D51B2D3EBD985D635B69
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

0

Major OS version

4

Entry point

115186

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

oleaut32

SysAllocString VariantClear SysFreeString

user32

CharUpperA CharNextA CharUpperW

msvcrt

_controlfp __set_app_type __p__fmode __p__commode _adjust_fdiv __setusermatherr _initterm __getmainargs __p___initenv exit _XcptFilter _exit _onexit __dllonexit ?terminate@@YAXXZ ??1type_info@@UAE@XZ _except_handler3 _beginthreadex memset memcpy fputc fputs fflush fgetc fclose _iob free malloc memmove _purecall memcmp _CxxThrowException __CxxFrameHandler

kernel32

GetModuleFileNameA InitializeCriticalSection ResetEvent SetEvent CreateEventA WaitForSingleObject VirtualFree VirtualAlloc DeleteCriticalSection WaitForMultipleObjects EnterCriticalSection LeaveCriticalSection FileTimeToSystemTime SetEndOfFile WriteFile ReadFile SetFilePointer GetFileSize CreateFileA FindFirstFileW FindFirstFileA FindClose GetFullPathNameW GetFullPathNameA lstrlenA DeleteFileW DeleteFileA CreateDirectoryW CreateDirectoryA MoveFileW GetCommandLineW SetFileApisToOEM SetConsoleCtrlHandler FileTimeToLocalFileTime GetVersionExA GetConsoleMode SetConsoleMode GetStdHandle MultiByteToWideChar WideCharToMultiByte GetLastError AreFileApisANSI GetModuleFileNameW LocalFree FormatMessageA FormatMessageW CloseHandle SetFileTime CreateFileW SetLastError SetFileAttributesA RemoveDirectoryA MoveFileA SetFileAttributesW RemoveDirectoryW

Resubmissions

Sharing