sample[.]rar | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
sample.rar
Size 308KB
Sample260804-g7d33ashqc
SHA256 2c3ff95a24801bcd067e5b91076302be1e149ac95225172d8f326cdb8c324557
MD5 62d52fd340bdcadca053888b91b2ba7b
SHA1 87f562a68963b3336239780c60393f8ad20f3756
SHA512 f98be85cfdecdce3355be27fb5596ec87772aefd0e6305c0491581d7a32b512e214c373dc74800a8994803b7794fed1ba674c0e888ae88220478df7ead7d3bb2
SSDEEP 6144:pIXt1hRO0BGauUcgtosOuaUZPYFLvyNEPbMLN3+AWsUz:id1hR/0UhXOqZPYFLvHPiVdWNz
TLSH
T19764234778982DAF3FD990A34C090EBAC1A3B34195DFF94B15B81D845BC629E7FC1168
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/e1b9beb4617a720d55afaec364941bb18ea2c456a8b06b30a736f0cbb5c297e8

File Explorer

sample.rar

.rar 308KB
e1b9beb4617a720d55afaec364941bb18ea2c456a8b06b30a736f0cbb5c297e8

.exe 664KB

sample.rar

SHA256 2c3ff95a24801bcd067e5b91076302be1e149ac95225172d8f326cdb8c324557
MD5 62d52fd340bdcadca053888b91b2ba7b
SHA1 87f562a68963b3336239780c60393f8ad20f3756
SHA512 f98be85cfdecdce3355be27fb5596ec87772aefd0e6305c0491581d7a32b512e214c373dc74800a8994803b7794fed1ba674c0e888ae88220478df7ead7d3bb2
SSDEEP 6144:pIXt1hRO0BGauUcgtosOuaUZPYFLvyNEPbMLN3+AWsUz:id1hR/0UhXOqZPYFLvHPiVdWNz
TLSH
T19764234778982DAF3FD990A34C090EBAC1A3B34195DFF94B15B81D845BC629E7FC1168
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

e1b9beb4617a720d55afaec364941bb18ea2c456a8b06b30a736f0cbb5c297e8

IMPHASH 376583ef03e4007760fb1259334fc710
SHA256 e1b9beb4617a720d55afaec364941bb18ea2c456a8b06b30a736f0cbb5c297e8
MD5 2eb5d76180ce7b3241b281fa79ab3483
SHA1 06293dea80e39c7eb7ee2bdb00d60b58d932fa8a
SHA512 35f553c76fc67afb88a6a090fcbad6af3e2faae154c9c84bd869714194012525a2d42b76dad855805f107a37c351f0de08fd9a03d8ddc1dd400d64640d81b90b
SSDEEP 12288:DTyjXW+48qWywrU4kGFezOAVuJ5PIGww7F5DO3HYffS:fIXW/8yw1ez54lIYF5SXYHS
TLSH
T1AEE49E26F68740F7E95120B054BADB725939BA39073A5AD3BBE03D391E201C17A3D35E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

503252

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

wsock32

WSACleanup inet_addr gethostbyname gethostname WSAStartup

winmm

mixerSetControlDetails waveOutGetVolume joyGetPosEx mixerGetControlDetailsA mixerOpen mixerGetDevCapsA mixerGetLineControlsA waveOutSetVolume mixerClose mciSendStringA joyGetDevCapsA mixerGetLineInfoA

version

VerQueryValueA GetFileVersionInfoA GetFileVersionInfoSizeA

comctl32

ImageList_ReplaceIcon ImageList_AddMasked ord17 ImageList_GetIconSize ImageList_Create ImageList_Destroy ord6

kernel32

CreateProcessA GetFileAttributesA MultiByteToWideChar WideCharToMultiByte GetExitCodeProcess WriteProcessMemory ReadProcessMemory GetCurrentProcessId OpenProcess TerminateProcess SetPriorityClass SetLastError GetEnvironmentVariableA GetLocalTime GetDateFormatA GetTimeFormatA SetErrorMode GetDiskFreeSpaceA SetVolumeLabelA CreateFileA DeviceIoControl GetDriveTypeA GetVolumeInformationA CreateDirectoryA ReadFile GetACP WriteFile GlobalSize DeleteFileA SetFileAttributesA LocalFileTimeToFileTime SetFileTime GetSystemTime GetComputerNameA GetWindowsDirectoryA GetTempPathA GetFullPathNameA GetShortPathNameA LoadLibraryA FreeLibrary EnterCriticalSection LeaveCriticalSection VirtualProtect CompareStringA RemoveDirectoryA CopyFileA OutputDebugStringA FormatMessageA GetPrivateProfileStringA GetPrivateProfileSectionA GetPrivateProfileSectionNamesA WritePrivateProfileStringA WritePrivateProfileSectionA SetEndOfFile GetFileType SetFilePointerEx GetFileSizeEx SystemTimeToFileTime FileTimeToSystemTime GetFileSize EnumResourceNamesA LoadLibraryExA FindResourceA LoadResource LockResource SizeofResource LCMapStringW TlsFree TlsSetValue TlsGetValue TlsAlloc IsValidCodePage GetOEMCP GetCPInfo GetStartupInfoW HeapSetInformation GetCommandLineA HeapQueryInformation HeapSize InterlockedIncrement InterlockedDecrement HeapFree HeapReAlloc ExitProcess GetModuleHandleW HeapAlloc SetUnhandledExceptionFilter IsDebuggerPresent GetStdHandle GetModuleFileNameW HeapCreate InitializeCriticalSectionAndSpinCount MoveFileA Beep SetEnvironmentVariableA FileTimeToLocalFileTime FindClose FindNextFileA FindFirstFileA GetSystemTimeAsFileTime MulDiv GetModuleFileNameA DeleteCriticalSection GetVersionExA GetLastError CreateMutexA CloseHandle GetExitCodeThread SetThreadPriority CreateThread lstrcmpiA GetCurrentThreadId GlobalUnlock GlobalFree GlobalAlloc GlobalLock GetModuleHandleA GetProcAddress GetCurrentDirectoryA InitializeCriticalSection SetCurrentDirectoryA Sleep GetTickCount LoadLibraryW GetLocaleInfoW SetHandleCount IsProcessorFeaturePresent GetStringTypeW GetUserDefaultLCID UnhandledExceptionFilter GetLocaleInfoA EnumSystemLocalesA IsValidLocale RaiseException RtlUnwind GetConsoleCP GetConsoleMode FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter SetFilePointer FlushFileBuffers WriteConsoleW SetStdHandle GetProcessHeap CreateFileW GetCurrentProcess VirtualQuery

user32

GetMenuItemCount GetMenuItemID GetSubMenu GetMenuStringA IsWindowEnabled ExitWindowsEx SetMenu FlashWindow MapWindowPoints RedrawWindow UpdateWindow GetMessagePos GetClassLongA DefDlgProcA CallWindowProcA CheckRadioButton IntersectRect PtInRect AppendMenuA SetMenuDefaultItem RemoveMenu SetMenuItemInfoA IsMenu CreateMenu CreatePopupMenu SetMenuInfo DestroyMenu TrackPopupMenuEx CreateIconIndirect GetDesktopWindow CopyImage LookupIconIdFromDirectoryEx CreateIconFromResourceEx GetWindow BringWindowToTop GetTopWindow GetWindowRect GetClientRect SystemParametersInfoA AdjustWindowRectEx DrawTextA SetRect GetIconInfo SetWindowTextA GetCursor CheckMenuItem MessageBoxA SetClipboardViewer LoadAcceleratorsA DrawIconEx GetDC EnableMenuItem GetMenu CreateWindowExA LoadCursorA LoadImageA ChangeClipboardChain DestroyIcon DestroyWindow IsCharAlphaA MapVirtualKeyA GetKeyNameTextA VkKeyScanExA GetWindowTextA mouse_event WindowFromPoint GetSystemMetrics keybd_event SetKeyboardState GetKeyboardState GetCursorPos PostMessageW GetAsyncKeyState AttachThreadInput SendInput UnregisterHotKey RegisterHotKey PostQuitMessage SendMessageTimeoutA UnhookWindowsHookEx SetWindowsHookExA PostThreadMessageA IsCharUpperA IsCharLowerA IsCharAlphaNumericA ToAsciiEx GetKeyboardLayout CallNextHookEx CharLowerA OpenClipboard GetClipboardData ClientToScreen GetCaretPos EnumClipboardFormats MessageBeep SetDlgItemTextA GetDlgItem SendDlgItemMessageA DialogBoxParamA SetForegroundWindow DefWindowProcA IsWindowVisible FillRect GetClipboardFormatNameA CloseClipboard SetClipboardData EmptyClipboard PostMessageA FindWindowA EndDialog IsWindow DispatchMessageA TranslateMessage GetSysColorBrush GetSysColor RegisterWindowMessageA IsIconic IsZoomed EnumWindows GetWindowTextLengthA EnableWindow InvalidateRect SetWindowPos SetWindowRgn SetFocus SetActiveWindow EnumChildWindows MoveWindow ReleaseDC GetQueueStatus TranslateAcceleratorA ShowWindow CountClipboardFormats SetWindowLongA ScreenToClient IsDialogMessageA SendMessageA GetWindowLongA GetKeyState KillTimer PeekMessageA GetFocus GetClassNameA GetWindowThreadProcessId GetForegroundWindow GetMessageA SetTimer GetParent GetDlgCtrlID CharUpperA IsClipboardFormatAvailable RegisterClassExA

gdi32

GetClipRgn FillRgn GetClipBox SetBkMode EnumFontFamiliesExA CreateDIBSection GdiFlush GetPixel ExcludeClipRect SetTextColor BitBlt CreateCompatibleBitmap GetSystemPaletteEntries GetDIBits CreateCompatibleDC CreatePolygonRgn CreateRectRgn CreateRoundRectRgn CreateEllipticRgn DeleteDC GetObjectA GetTextMetricsA GetTextFaceA SelectObject GetStockObject CreateDCA CreateSolidBrush GetDeviceCaps SetBkColor DeleteObject CreateFontA

comdlg32

GetOpenFileNameA GetSaveFileNameA

advapi32

RegDeleteKeyA RegSetValueExA RegCreateKeyExA RegQueryValueExA AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken CloseServiceHandle UnlockServiceDatabase LockServiceDatabase OpenSCManagerA GetUserNameA RegEnumKeyExA RegEnumValueA RegQueryInfoKeyA RegOpenKeyExA RegCloseKey RegConnectRegistryA RegDeleteValueA

shell32

DragQueryPoint SHFileOperationA SHGetPathFromIDListA SHBrowseForFolderA SHGetDesktopFolder SHGetMalloc ShellExecuteExA Shell_NotifyIconA DragFinish DragQueryFileA ExtractIconA

ole32

OleInitialize OleUninitialize CoInitialize CoCreateInstance CoUninitialize CLSIDFromString CoGetObject StringFromGUID2 CreateStreamOnHGlobal

oleaut32

SafeArrayUnlock SafeArrayGetElemsize SafeArrayPtrOfIndex SafeArrayLock SafeArrayGetDim SafeArrayGetLBound SafeArrayGetUBound SysAllocString VariantChangeType VariantClear SafeArrayCreate SysFreeString SysStringLen GetActiveObject SafeArrayDestroy OleLoadPicture