dossier sans titre.zip
- SHA256 cbb3d29bd096c89cdc055bb25bb8c067d426f65c328d88f62d5db71dac58bdf0
General
- Target dossier sans titre.zip
- Size 604KB
- Sample260815-23gzdaab45
- SHA256 cbb3d29bd096c89cdc055bb25bb8c067d426f65c328d88f62d5db71dac58bdf0
- MD5 a0eb8a054aeec1d0fc45df294282ad68
- SHA1 22c1dd69f8aa4dac1aad2e2c3d1cedf73cfbd8de
- SHA512 a39c08953c3c097a46b5c5cec905940bdebe47c362d9e8f72e720ec0ae13e1a92c4d8fb0c51889ceeef99618be14250530d7a5787c9669ad4576f0847765c3b8
- SSDEEP 12288:cyGL1cFnNfolVPN3L2lkK2JKxE/34JjhrKzHkXb20q9CvZh57FJjq2VkUYj:cyGL1cFnNsX3aOJpysHp0ACZ7jVs
- TLSH T1DFD4238D89991C17BF2853602A590776021707D3CEEF08E2FADD7613C623786B997EA4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/dossier sans titre/Goodhertz_KeyGen.exe - NSIS installer 1 IoCs
resource yara_rule static1/unpack001/dossier sans titre/Goodhertz_KeyGen.exe nsis_installer_2
File Explorer
-
dossier sans titre.zip.zip 604KB
-
__MACOSX/dossier sans titre/._Goodhertz_KeyGen.exe255B
-
__MACOSX/dossier sans titre/._challenge.ghz3220B
-
dossier sans titre/Goodhertz_KeyGen.exe.exe 669KB
-
dossier sans titre/challenge.ghz3509B
__MACOSX/dossier sans titre/._Goodhertz_KeyGen.exe
- SHA256 97c2a387b78c1428a4599d0102073f65e54efb965b7be04cc219716517bd3d94
- MD5 730d0bb5e0e1f40144ed1711799c9865
- SHA1 734bda80031c82a7257c4c125e0c2c8d1c5dc312
- SHA512 8ddb476609509c176449c023b7433e69015281dfe584d59c71d193c772be0287353b833c05a5c3a8bd04cd413133d15faa2c3ce71a10f2729145b92745d6f2cc
- TLSH T159D022A061920090E49853F90993B5D0B2B24C25E24303207CECC6C20B2060073703AA
- MD5 SHA1 SHA512 TLSH
__MACOSX/dossier sans titre/._challenge.ghz3
- SHA256 06f8f1fd6f57539e8f926c3f13c0e9c8298cae20cfa12bc970074ddc915029eb
- MD5 28c0f0f629f4acbefbef5f9748bc89f1
- SHA1 fe1daa58bcc2bbfb07db296b2d92f4d29d6b933d
- SHA512 cef7cfafe81eb40375cf7791b1017591298d5b20fcbb26660a63bf88853bac4debb21a42a5088ab59fa741536ec1e2e045a42d2e6a5dc567850b64338f221c96
- TLSH T158D012B091041144EAD3C1F9068112F5F23CBC36C39212B2778E8A840704E20FFF8A15
- MD5 SHA1 SHA512 TLSH
dossier sans titre/Goodhertz_KeyGen.exe
- IMPHASH 099c0646ea7282d232219f8807883be0
- SHA256 991d59b3ae3ad0e42d7837cb3515479499dfbf2251eb67de647f079e842b390a
- MD5 9f8f96ae6768c343836d83a388ac2629
- SHA1 e252d5c43fe92570ef189c686afb05e044f49da7
- SHA512 1b44b6638f7cb6438084b54c95a7582289f5ebf1c17d1f72ae915f7bcd9bf9b1bfa880814a9ed35cb52503d4427d2b74a7934f90978e6e6980442e33ea657cc7
- SSDEEP 12288:4c9t2SllRl5pN3j2lkKeJut+/34JvhjKzHknb20qzKvZV5tZJHi2V87YC:4cLNB3CmJHG6H30YKJtrVe
- TLSH T1F4E4234AF9D408E7E926437015AB8B32233B7F918ABB0597B7D97F355533343601BA82
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
-
NSIS installer
Minor OS version
0
Major OS version
4
Entry point
12860
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetTickCount
CreateFileA
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
SetFileTime
GetTempPathA
GetCommandLineA
SetErrorMode
LoadLibraryA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
GetVersion
CloseHandle
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GetModuleHandleA
LoadLibraryExA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
MulDiv
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetWindowsDirectoryA
user32
EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
DestroyWindow
CreateDialogParamA
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
OpenClipboard
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
ShowWindow
gdi32
SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject
shell32
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation
advapi32
RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA
comctl32
ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create
ole32
CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
Name
.text
Size
23KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
107KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
137KB
Virtual Size
137KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=155, id=1, productName=Unmarked objects,
count=17, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
dossier sans titre/challenge.ghz3
- SHA256 0a2a69d0ae0ca7a1b01bf66544feeea7fc445e64e8d5d8178d15b9aedea5b88e
- MD5 b7251517364c4d537e95eda68bdc947b
- SHA1 efe3485b5e0f3d215640195a2da92b544ab4b007
- SHA512 2beaa857e049532af05eea3d6c5d8f88b153453784f91bbf3af17cba093fcaac0807ff9e7f0dcd2949e76d707f0000ea7848e915c857e0adcd2bda0006bf5702
- TLSH T178F00E37001D0E323F861B5A2B7CA296502A6448CB02399E004D56FBA6D8641ADCCD3A
- MD5 SHA1 SHA512 TLSH