95477703e789e6182096a09bc98853e0a70b680a4f19fa2bf86cbb9280e8ec5a[.]zip

General

Target
95477703e789e6182096a09bc98853e0a70b680a4f19fa2bf86cbb9280e8ec5a.zip
Size 281KB
Sample260804-qd545axwes
SHA256 dd8fd96d17a879db1c99064e2a3dcb696d73e0fea1fe9c8e0b0a265f2744dbe3
MD5 a9cb516f4f1ce4bcb685d78976957923
SHA1 d943beacd6cd67fe7efdaa20aac6de27c2e4ea21
SHA512 a2f45b8f62738ecf91dd563c805cd861fed81771ab84e9b8af3e14140a1c4586c255aa30c256147c339db09ac1c84261e3752815d0a1112681f65ff05f47e0d6
SSDEEP 6144:G6kUDpypUHFkncDGqaSG/GigKqulCWsTFZQ:G+ySCneHG+v1yCWs5+
TLSH
T1075423D17A9928749295706E99210AEAC11DCD8AF4A18EFB5C82CC075F8F60F2D1C9FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/95477703e789e6182096a09bc98853e0a70b680a4f19fa2bf86cbb9280e8ec5a

File Explorer

95477703e789e6182096a09bc98853e0a70b680a4f19fa2bf86cbb9280e8ec5a.zip

.zip 281KB
95477703e789e6182096a09bc98853e0a70b680a4f19fa2bf86cbb9280e8ec5a

.exe 540KB

95477703e789e6182096a09bc98853e0a70b680a4f19fa2bf86cbb9280e8ec5a.zip

SHA256 dd8fd96d17a879db1c99064e2a3dcb696d73e0fea1fe9c8e0b0a265f2744dbe3
MD5 a9cb516f4f1ce4bcb685d78976957923
SHA1 d943beacd6cd67fe7efdaa20aac6de27c2e4ea21
SHA512 a2f45b8f62738ecf91dd563c805cd861fed81771ab84e9b8af3e14140a1c4586c255aa30c256147c339db09ac1c84261e3752815d0a1112681f65ff05f47e0d6
SSDEEP 6144:G6kUDpypUHFkncDGqaSG/GigKqulCWsTFZQ:G+ySCneHG+v1yCWs5+
TLSH
T1075423D17A9928749295706E99210AEAC11DCD8AF4A18EFB5C82CC075F8F60F2D1C9FD
MD5 SHA1 SHA512 SSDEEP TLSH

95477703e789e6182096a09bc98853e0a70b680a4f19fa2bf86cbb9280e8ec5a

IMPHASH 1a8b89eabff16813a95a07099bb597bf
SHA256 95477703e789e6182096a09bc98853e0a70b680a4f19fa2bf86cbb9280e8ec5a
MD5 9f801240af1124b66defcd4b4ae63f2a
SHA1 1ff0c089c5a3b93e95c337e7644119c7bd7133c6
SHA512 8f37cb77a87385a334061a93bcc3c5eacb55d4659fd75510543c8133546df9f284d4ad20ecff15792cce2c098d144fd8f039e4d804bfefee508fd18e07a539d9
SSDEEP 6144:4Rgt24H6VNb9i6AWzcwZb8s+aq0rw5IHEfPB81nO33TsTVQwbBy32SSBjaO9mrms:4g8MsNb9i9uHbqww5IkfSY29mCc6w
TLSH
T12FC47C56FA8512F8D06AC1B483465633B9357C890B35BDFF06D466322E3AAE06F3DB14
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

321116

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

E:\1 Projects\rust\megazord_xi-1\Windows\x86_64-pc-windows-msvc\release\deps\megazord.pdb

bcrypt

BCryptGenRandom

advapi32

SystemFunction036

kernel32

ReadFile Sleep MoveFileExW GetProcessHeap HeapAlloc GetLastError SetFilePointerEx CloseHandle ReleaseSRWLockExclusive HeapFree HeapReAlloc SwitchToThread AddVectoredExceptionHandler SetThreadStackGuarantee GetSystemInfo GetLogicalDriveStringsA FindClose QueryPerformanceCounter SetLastError GetFinalPathNameByHandleW FindFirstFileW WaitForSingleObject AcquireSRWLockExclusive GetModuleHandleA GetProcAddress GetCurrentThread TryAcquireSRWLockExclusive GetStdHandle GetConsoleMode MultiByteToWideChar WriteConsoleW GetCurrentDirectoryW WaitForSingleObjectEx LoadLibraryA CreateMutexA GetCurrentProcess ReleaseMutex GetEnvironmentVariableW RtlLookupFunctionEntry GetModuleHandleW FormatMessageW GetModuleFileNameW GetCommandLineW CreateFileW GetFileInformationByHandle GetFileInformationByHandleEx GetFullPathNameW FindNextFileW GetEnvironmentStringsW FreeEnvironmentStringsW CompareStringOrdinal GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetFileAttributesW DuplicateHandle GetCurrentProcessId CreateNamedPipeW CreateThread ReadFileEx SleepEx WriteFileEx WaitForMultipleObjects GetOverlappedResult GetExitCodeProcess CreateEventW CancelIo ExitProcess QueryPerformanceFrequency GetSystemTimeAsFileTime RtlCaptureContext AcquireSRWLockShared ReleaseSRWLockShared SetConsoleMode WakeAllConditionVariable GetConsoleScreenBufferInfo SetConsoleTextAttribute GetConsoleOutputCP FlushFileBuffers HeapSize GetCurrentThreadId InitializeSListHead RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent RtlUnwindEx EncodePointer RaiseException EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW RtlPcToFileHeader WriteFile TerminateProcess GetModuleHandleExW GetCommandLineA FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCPInfo WideCharToMultiByte SetEnvironmentVariableW SetStdHandle GetFileType GetStringTypeW CompareStringW LCMapStringW

ntdll

NtWriteFile RtlNtStatusToDosError NtReadFile

Sharing