Petya[.]zip | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Petya.zip
Size 131KB
Sample260808-a7r7cseq7s
SHA256 8555533c588510b0ba9c23ab92e61f74d43ffdaf2aea46f9a74864b777748736
MD5 c44027945e888d6a820dccbeb50e155c
SHA1 8ffcb066de084d982ec777abf07205ad9905d76f
SHA512 a48228d73738f6066e0c6836509d983edfdeb8a6a1561b42ea5c6e032886c55c8e9b2d58217b2dc1767c399400230a84125b003d8f230939360b1524b899091c
SSDEEP 3072:rOswiBFiVQNhEGnIOQVrvlW49duwVIepJtUxJrTvL/TYR:Dwi7euhEGIOCfxBUxZTPYR
TLSH
T11CD312761D85C02A7A18F731B67C17D9D3BFD48843E6146FA81AD722049B1CEB894FB4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/[email protected] (1).exe

File Explorer

Petya.zip

.zip 131KB
[email protected] (1).exe

.exe 225KB

Petya.zip

SHA256 8555533c588510b0ba9c23ab92e61f74d43ffdaf2aea46f9a74864b777748736
MD5 c44027945e888d6a820dccbeb50e155c
SHA1 8ffcb066de084d982ec777abf07205ad9905d76f
SHA512 a48228d73738f6066e0c6836509d983edfdeb8a6a1561b42ea5c6e032886c55c8e9b2d58217b2dc1767c399400230a84125b003d8f230939360b1524b899091c
SSDEEP 3072:rOswiBFiVQNhEGnIOQVrvlW49duwVIepJtUxJrTvL/TYR:Dwi7euhEGIOCfxBUxZTPYR
TLSH
T11CD312761D85C02A7A18F731B67C17D9D3BFD48843E6146FA81AD722049B1CEB894FB4
MD5 SHA1 SHA512 SSDEEP TLSH

[email protected] (1).exe

IMPHASH 1a63922d5931d1bb8ca5188313f78eaa
SHA256 26b4699a7b9eeb16e76305d843d4ab05e94d43f3201436927e13b3ebafa90739
MD5 af2379cc4d607a45ac44d62135fb7015
SHA1 39b6d40906c7f7f080e6befa93324dddadcbd9fa
SHA512 69899c47d0b15f92980f79517384e83373242e045ca696c6e8f930ff6454219bf609e0d84c2f91d25dfd5ef3c28c9e099c4a3a918206e957be806a1c2e0d3e99
SSDEEP 6144:DCyjXhd1mialK+qoNr8PxtZE6x5v+k6f:rjXhd8ZlKOrMZE6x5b6f
TLSH
T1FF349C2276E0847DFAB306378CFD36759ABDF9714931890B33C50A0E79605E1A63A763
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

94575

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

GoogleCrashHandler_unsigned.pdb

kernel32

GetCurrentThreadId GetStdHandle GetFileType GetStartupInfoW GetModuleFileNameW WriteFile QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW UnhandledExceptionFilter SetUnhandledExceptionFilter CreateEventW Sleep GetCurrentProcess TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetTickCount CreateSemaphoreW FreeLibrary LoadLibraryExW IsValidCodePage GetACP GetOEMCP GetCPInfo RtlUnwind LCMapStringW GetStringTypeW FlushFileBuffers GetConsoleCP GetConsoleMode SetStdHandle SetFilePointerEx WriteConsoleW CloseHandle CreateFileW SizeofResource LockResource LoadResource FindResourceW FindResourceExW LocalFree CreateDirectoryW DeleteFileW GetCurrentThread WaitForMultipleObjects LoadLibraryW WaitForSingleObject GetExitCodeProcess DuplicateHandle ReleaseMutex GetEnvironmentVariableW lstrcmpiW VirtualQuery GetTempPathW GetLocalTime OutputDebugStringA GetPrivateProfileIntW GetPrivateProfileStringW lstrcmpW lstrlenW SetFilePointer CreateMutexW InitializeCriticalSection TryEnterCriticalSection SetEvent ResetEvent GetFileAttributesExW SetLastError VerifyVersionInfoW VerSetConditionMask MoveFileExW GetFileTime ReadFile DeviceIoControl SetProcessWorkingSetSize OpenProcess CreateProcessW ReadProcessMemory lstrcpynW GlobalAlloc GlobalLock GlobalUnlock GlobalFree CreateThread DebugActiveProcess GetThreadContext DebugActiveProcessStop VirtualQueryEx GetProcessId GetSystemInfo ContinueDebugEvent WaitForDebugEvent WideCharToMultiByte MultiByteToWideChar GetModuleHandleExW ExitProcess IsProcessorFeaturePresent GetCommandLineW EncodePointer LeaveCriticalSection WaitNamedPipeW TransactNamedPipe SetNamedPipeHandleState RtlCaptureContext ReleaseSemaphore EnterCriticalSection OutputDebugStringW DeleteCriticalSection DecodePointer HeapSize GetProcAddress GetLastError RaiseException HeapDestroy InitializeCriticalSectionAndSpinCount GetProcessHeap GetModuleHandleW HeapFree IsDebuggerPresent GetUserDefaultLangID GetSystemDefaultLangID GetComputerNameExW GetOverlappedResult ConnectNamedPipe CreateNamedPipeW DisconnectNamedPipe UnregisterWait GetProcessTimes UnregisterWaitEx RegisterWaitForSingleObject VirtualProtect VirtualAlloc HeapAlloc RemoveDirectoryW HeapReAlloc

user32

SetClipboardData EmptyClipboard OpenClipboard GetProcessWindowStation CloseDesktop CloseClipboard CharUpperW CharLowerW PostThreadMessageW DispatchMessageW GetMessageW PeekMessageW EnumWindows IsWindowVisible GetWindowThreadProcessId SetThreadDesktop CreateWindowStationW CloseWindowStation GetThreadDesktop SetProcessWindowStation CreateDesktopW wvsprintfW wsprintfW MessageBoxW

advapi32

GetSecurityDescriptorSacl GetSecurityDescriptorDacl GetSecurityDescriptorGroup GetSecurityDescriptorOwner GetSecurityDescriptorControl GetLengthSid CopySid IsValidSid GetSidSubAuthority InitializeSid GetSidLengthRequired SetSecurityDescriptorDacl AddAce InitializeAcl GetAclInformation InitializeSecurityDescriptor MakeAbsoluteSD OpenProcessToken GetTokenInformation SetSecurityDescriptorOwner SetSecurityDescriptorGroup GetAce MakeSelfRelativeSD GetSecurityDescriptorLength EqualSid SetNamedSecurityInfoW ConvertStringSidToSidW OpenThreadToken RegQueryValueExW RegOpenKeyExW RegDeleteKeyW RegDeleteValueW RegCloseKey RegCreateKeyExW RegSetValueExW RegEnumKeyExW RegQueryInfoKeyW ConvertSidToStringSidW AllocateAndInitializeSid CheckTokenMembership FreeSid SetSecurityDescriptorSacl GetTraceLoggerHandle GetTraceEnableFlags GetTraceEnableLevel RegisterTraceGuidsW UnregisterTraceGuids TraceEvent SetTokenInformation

ole32

CoCreateGuid StringFromGUID2

shell32

SHGetFolderPathW

netapi32

NetApiBufferFree NetWkstaGetInfo

rpcrt4

UuidCreate

shlwapi

PathRemoveExtensionW PathRemoveFileSpecW PathStripPathW PathCanonicalizeW PathIsRelativeW SHQueryValueExW PathAppendW

userenv

UnloadUserProfile

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW