p[.]zip | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
p.zip
Size 699KB
Sample260814-pp6pcshg46
SHA256 078163d5c16f64caa5a14784323fd51451b8c831c73396b967b4e35e6879937b
MD5 24a648a48741b1ac809e47b9543c6f12
SHA1 3e2272b916da4be3c120d17490423230ab62c174
SHA512 b974ce956f2e922e92ca414d1bd6cc7bcb36bc44532b28b392f2a8052d6d47fd742841c4add6ec5c8283d28d7245b1704af34a523917e49cef007eef700a0b9a
SSDEEP 12288:LOO6oMlKDdwPDMlkw6Pph0lhSMXle+eO1HK+meynh5yRX3oRG72:LD9McwPDCkw6Bh0lhSMXlemqth5yRX3E
TLSH
T1B4E48D1172D18032E0B22A301AB89BB16A3E7D305F7595DF27D85A7E5E30AC1DA35B37
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

p.zip

.exe 699KB

p.zip

IMPHASH 1193bc223dad681f22f8248608cbb592
SHA256 078163d5c16f64caa5a14784323fd51451b8c831c73396b967b4e35e6879937b
MD5 24a648a48741b1ac809e47b9543c6f12
SHA1 3e2272b916da4be3c120d17490423230ab62c174
SHA512 b974ce956f2e922e92ca414d1bd6cc7bcb36bc44532b28b392f2a8052d6d47fd742841c4add6ec5c8283d28d7245b1704af34a523917e49cef007eef700a0b9a
SSDEEP 12288:LOO6oMlKDdwPDMlkw6Pph0lhSMXle+eO1HK+meynh5yRX3oRG72:LD9McwPDCkw6Bh0lhSMXlemqth5yRX3E
TLSH
T1B4E48D1172D18032E0B22A301AB89BB16A3E7D305F7595DF27D85A7E5E30AC1DA35B37
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

35:f4:a0:22:99:74:5d:2a:dd:26:8b:e6:eb:e6:8a:9d:bd:73:6f:54:ad:34:c8:ef:67:d3:83:f8:30:d2:f1:6f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 6, 2023

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

Major OS version

Entry point

106938

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\a\1\s\psexec\exe\Win32\Release\psexec.pdb

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

netapi32

NetServerEnum NetApiBufferFree

ws2_32

gethostname WSAStartup inet_ntoa gethostbyname

mpr

WNetCancelConnection2W WNetAddConnection2W

kernel32

SetFileAttributesW DuplicateHandle DisconnectNamedPipe SetNamedPipeHandleState TransactNamedPipe WaitNamedPipeW CreateEventW WaitForMultipleObjects GetCurrentProcessId GetFileTime GetExitCodeProcess ResumeThread GetVersion SetProcessAffinityMask CopyFileW ReadConsoleW SetConsoleCtrlHandler SetConsoleTitleW HeapReAlloc GetEnvironmentVariableW GetFileAttributesW ReadFile GetConsoleScreenBufferInfo MultiByteToWideChar VerifyVersionInfoW FormatMessageA FindResourceW SizeofResource LockResource LoadResource FreeLibrary GetSystemDirectoryW GetTickCount GetCurrentProcess Sleep WaitForSingleObject SetEvent CloseHandle WriteFile DeleteFileW CreateFileW VerSetConditionMask SetThreadGroupAffinity SetPriorityClass GetModuleFileNameW LocalFree SetEndOfFile LocalAlloc GetProcAddress GetModuleHandleW GetFileType GetCommandLineW GetStdHandle LoadLibraryExW GetVersionExW SetLastError GetComputerNameW GetLastError FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap WriteConsoleW HeapSize TerminateProcess RaiseException GetSystemInfo VirtualProtect VirtualQuery LoadLibraryExA WideCharToMultiByte GetStringTypeW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlUnwind InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree ExitProcess GetModuleHandleExW GetConsoleCP SetStdHandle CreateThread ExitThread FreeLibraryAndExitThread GetCommandLineA HeapAlloc HeapFree CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetConsoleOutputCP GetConsoleMode SetConsoleMode ReadConsoleInputW GetFileSizeEx SetFilePointerEx

comdlg32

PrintDlgW

advapi32

CreateProcessAsUserW CryptHashData CryptCreateHash CryptDecrypt CryptEncrypt CryptImportKey CryptExportKey CryptDestroyKey CryptDeriveKey CryptGenKey CryptReleaseContext CryptAcquireContextW StartServiceW QueryServiceStatus OpenServiceW OpenSCManagerW DeleteService CreateServiceW ControlService CloseServiceHandle OpenProcessToken LsaEnumerateAccountRights LsaOpenPolicy LsaClose LsaFreeMemory SetSecurityInfo GetSecurityInfo SetEntriesInAclW LookupPrivilegeValueW SetTokenInformation SetSecurityDescriptorDacl InitializeSecurityDescriptor InitializeAcl GetTokenInformation GetLengthSid GetAce FreeSid AllocateAndInitializeSid AddAce AddAccessAllowedAce RegSetValueExW RegQueryValueExW RegOpenKeyExW RegOpenKeyW RegCreateKeyW RegCloseKey