18356217AC83924E[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
18356217AC83924E.zip
Size 26.5MB
Sample260816-m6vbjswejc
SHA256 5b0b5aebb1c9827e83c2b3efd8e9efef3828093750cac52d467da0a8be8c610b
MD5 925cd2397335907bebef8928a3bc471a
SHA1 e033ff3f168dd6aa0ac826e0e5c49203131236f3
SHA512 9107c368d6e1a8e02283dbadd17551fdeb308cb302fe21789b0ba29909b405dc2ec113aba8bc10d4f479c795b21f04be6518744ffdd307ab8d420064c1fa9aa8
SSDEEP 786432:60bakOvySDs3kWzPmnQpsQVzq+OEjJDJmfYJ9ymqWD:S44QGQVzJdYf9nWD
TLSH
T18E5733788063B028ECDC09B4B2C78EA6F650C16666E7CD6B8797F97B636D87034F6441
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/75cc72a837e7f277be2f45df167230d087c94784b1500b0847ce848553f407cc

File Explorer

18356217AC83924E.zip

.zip 26.5MB
75cc72a837e7f277be2f45df167230d087c94784b1500b0847ce848553f407cc

.exe 32.1MB

18356217AC83924E.zip

SHA256 5b0b5aebb1c9827e83c2b3efd8e9efef3828093750cac52d467da0a8be8c610b
MD5 925cd2397335907bebef8928a3bc471a
SHA1 e033ff3f168dd6aa0ac826e0e5c49203131236f3
SHA512 9107c368d6e1a8e02283dbadd17551fdeb308cb302fe21789b0ba29909b405dc2ec113aba8bc10d4f479c795b21f04be6518744ffdd307ab8d420064c1fa9aa8
SSDEEP 786432:60bakOvySDs3kWzPmnQpsQVzq+OEjJDJmfYJ9ymqWD:S44QGQVzJdYf9nWD
TLSH
T18E5733788063B028ECDC09B4B2C78EA6F650C16666E7CD6B8797F97B636D87034F6441
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

75cc72a837e7f277be2f45df167230d087c94784b1500b0847ce848553f407cc

IMPHASH ac37a2ffbc264b406ade9d2a31cc1935
SHA256 75cc72a837e7f277be2f45df167230d087c94784b1500b0847ce848553f407cc
MD5 598c9b19c00b737df37c22c64f934648
SHA1 e36b84107f730957cf2e39a7c020fb2848532941
SHA512 3875150cf74e490eedb26c09930b12f2cbc94438129a226ff30962148b78e6a68e25eb6623e7d10a5267a32f730aceddb82593009e783ebfc6f8009b8786189e
SSDEEP 393216:OuciGhye7VUIA6waWyUBp0+G3RBYh39+8JUHTY19B5m558mPh35i2B:Ou6hyUVXzwOK2ohN+ReH5m5yuqq
TLSH
T1627712C628E151FDC742C639D2861BFAD1C9388A9E7A952FBFC644023530D46CDE6E36
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

36384057

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

Sleep

user32

GetForegroundWindow

advapi32

RegOpenKeyExW

shell32

ShellExecuteA

ole32

CoCreateInstance

d3dcompiler_47

D3DCompile

api-ms-win-mm-time-l1-1-0

timeBeginPeriod

imm32

ImmSetCompositionWindow

dwmapi

DwmExtendFrameIntoClientArea

msvcp140

??Bios_base@std@@QEBA_NXZ

wininet

InternetSetOptionA

winmm

PlaySoundA

d3d11

D3D11CreateDeviceAndSwapChain

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memset

api-ms-win-crt-stdio-l1-1-0

_set_fmode

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-heap-l1-1-0

free

api-ms-win-crt-convert-l1-1-0

strtoull

api-ms-win-crt-runtime-l1-1-0

__p___argv

api-ms-win-crt-string-l1-1-0

_stricmp

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func

api-ms-win-crt-filesystem-l1-1-0

_lock_file

api-ms-win-crt-math-l1-1-0

acosf

oleaut32

SetErrorInfo

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

Name

.text

Size

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

164KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.. X

Size

Virtual Size

20.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.!3^

Size

1024B

Virtual Size

536B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.+57

Size

32.1MB

Virtual Size

32.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

18356217AC83924E.zip

75cc72a837e7f277be2f45df167230d087c94784b1500b0847ce848553f407cc

kernel32

user32

advapi32

shell32

ole32

d3dcompiler_47

api-ms-win-mm-time-l1-1-0

imm32

dwmapi

msvcp140

wininet

winmm

d3d11

vcruntime140_1

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-math-l1-1-0

oleaut32

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-winrt-l1-1-0

generic