1[.]2[.]3[.]zip | Triage™

General

Target
1.2.3.zip
Size 6.0MB
Sample260807-zekdgscl21
SHA256 f775a4a9362da02d9ad19436deb18b01a371ad9ab5ba337c4815a2d00dcfef04
MD5 ecfff26c6be50ed5b7ae0a457f590471
SHA1 ced23875b62e9ecbd2cb40a1cf00e837fe76cca2
SHA512 35cc9bf2178bfba6c04f8e2bd2875e23957768c1a37ae3b5ac0235d176ffbcc61f99749515fdd897d886a7beeb6cd5f07c33989500a9ecda308e27a5826aef3a
SSDEEP 196608:jhAtbukpGn9tkwhU4/+Z3Y5aLIgNXyFTpDwci4LjG:jhCb2HzNeIgNXyFm1Uq
TLSH
T1C8563389F2BD7C39B074636373B893E156DD428D9E1EA9048324A7CBC6479D2D82163B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/portal.exe

File Explorer

1.2.3.zip

.zip 6.0MB
CREDITS

64KB
LICENSE

1KB
portal.exe

.exe 16.3MB

1.2.3.zip

SHA256 f775a4a9362da02d9ad19436deb18b01a371ad9ab5ba337c4815a2d00dcfef04
MD5 ecfff26c6be50ed5b7ae0a457f590471
SHA1 ced23875b62e9ecbd2cb40a1cf00e837fe76cca2
SHA512 35cc9bf2178bfba6c04f8e2bd2875e23957768c1a37ae3b5ac0235d176ffbcc61f99749515fdd897d886a7beeb6cd5f07c33989500a9ecda308e27a5826aef3a
SSDEEP 196608:jhAtbukpGn9tkwhU4/+Z3Y5aLIgNXyFTpDwci4LjG:jhCb2HzNeIgNXyFm1Uq
TLSH
T1C8563389F2BD7C39B074636373B893E156DD428D9E1EA9048324A7CBC6479D2D82163B
MD5 SHA1 SHA512 SSDEEP TLSH

portal.exe

IMPHASH f0ea7b7844bbc5bfa9bb32efdcea957c
SHA256 13e7cb7f438cd5dc622f1a8780a3a156191f5a47a1a2a19e7c55673acc8536a1
MD5 c07316e03ba4595966523a44b28c1ef3
SHA1 cb54349156620ed84df83e14dc7e65a9bef35a20
SHA512 c604cd8b046d5f82fc4ab5188dd72a09de014b0f417dc230790712ecc3c7a9abc1a9614b51edb30e4c21ed42c38611fa083d01d168072a8fc2d218d900a2e112
SSDEEP 196608:SqYQZpGV6ydF8od2L1aZXcGQCozHsrnfOxchTat7KEn5CAzSlSaAo2:UQyyo
TLSH
T1D6072847F86550A8C59DD274CA36A262BB707C894B3037C76B60F7742F32BD49A7A360
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

6

Entry point

428448

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

Name

.text

Size

7.8MB

Virtual Size

7.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

7.6MB

Virtual Size

7.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

680KB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

178KB

Virtual Size

177KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

4B

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

1.2.3.zip

CREDITS

LICENSE

portal.exe

kernel32

generic

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

1.2.3.zip

CREDITS

LICENSE

portal.exe

kernel32

generic