f579edd805e453530c0270302be936df4bd4c259aef4d4de41b546fdba34e77e[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
f579edd805e453530c0270302be936df4bd4c259aef4d4de41b546fdba34e77e.zip
Size 3.3MB
Sample260820-xfwrsstdlc
SHA256 6539fcf3c8165f4b53251e835551e56df69248407ea77034cde53202004b9454
MD5 37aa3a85ffd3da8e14d79a5cd6a90f7e
SHA1 2ff5de94f20da23bbc5be35a6265e4ee3aa85f53
SHA512 ce5453c33a0df0da3393b2e868fac4c3ccef0f056ae13ebea7ad20d6c8bb9c136e2b5cb013ed9278da2a0365ce8b821225bd11d09605c57ac7029aafa61db7df
SSDEEP 49152:ZWFsKBFluoYd64lOaetsaMYJ8G6Pn/HkJPkUPCfQMHSMY73pv0VTxJLJYdZ:ZON0wuHjrP/HkJPkACoiSx50JLqZ
TLSH
T104F5333ECC20A0FC655ABB71BF15EDE26390B6BDEE3C5AF6A3418364589F4870D10598
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/f579edd805e453530c0270302be936df4bd4c259aef4d4de41b546fdba34e77e

File Explorer

f579edd805e453530c0270302be936df4bd4c259aef4d4de41b546fdba34e77e.zip

.zip 3.3MB
f579edd805e453530c0270302be936df4bd4c259aef4d4de41b546fdba34e77e

.exe 7.1MB

f579edd805e453530c0270302be936df4bd4c259aef4d4de41b546fdba34e77e.zip

SHA256 6539fcf3c8165f4b53251e835551e56df69248407ea77034cde53202004b9454
MD5 37aa3a85ffd3da8e14d79a5cd6a90f7e
SHA1 2ff5de94f20da23bbc5be35a6265e4ee3aa85f53
SHA512 ce5453c33a0df0da3393b2e868fac4c3ccef0f056ae13ebea7ad20d6c8bb9c136e2b5cb013ed9278da2a0365ce8b821225bd11d09605c57ac7029aafa61db7df
SSDEEP 49152:ZWFsKBFluoYd64lOaetsaMYJ8G6Pn/HkJPkUPCfQMHSMY73pv0VTxJLJYdZ:ZON0wuHjrP/HkJPkACoiSx50JLqZ
TLSH
T104F5333ECC20A0FC655ABB71BF15EDE26390B6BDEE3C5AF6A3418364589F4870D10598
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

f579edd805e453530c0270302be936df4bd4c259aef4d4de41b546fdba34e77e

IMPHASH e1d3f5c185f94ae43d4d31901280e63e
SHA256 f579edd805e453530c0270302be936df4bd4c259aef4d4de41b546fdba34e77e
MD5 182d678228e3d8e0148952b48abc34d2
SHA1 8cc917167531147ae3443867891dceeab72e29c8
SHA512 cb32a3f0e5f226b37c0669f611cac1a3bbab61e0e7adc8703fd5c492a3ed33b0f6e4fd103fbb46347cb7e22753963e5ecaae12bc7915697969d0c7f026bb3deb
SSDEEP 98304:ZEHWBFfEbW6MlFRxbd07BFLTpQVlfon+:YWTEzinZ07TLTeVlfu
TLSH
T155765B03F69581E8C0AEC578C35A9737EB72B88D4534B2AB5BE44B122F26F605F0D749
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

5564236

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

heyo.pdb

bcryptprimitives

ProcessPrng

kernel32

GetProcessTimes GetSystemTimes GlobalMemoryStatusEx GetComputerNameExW SetFilePointerEx InitializeSListHead SwitchToThread DeleteFileW GetLastError SetFileInformationByHandle FlushFileBuffers GetTickCount GetSystemTime GetSystemTimeAsFileTime FreeLibrary GetFileSize LockFileEx UnlockFile DeleteFileA CreateFileA GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA GetTempPathA GetFileAttributesW CreateMutexW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile GetDiskFreeSpaceW AreFileApisANSI CloseHandle OpenProcess FindClose FindNextFileW SetLastError LocalFree GetModuleHandleA GetProcAddress LoadLibraryExA FormatMessageW GetProcessHeap HeapFree GetCommandLineW GetModuleFileNameW CopyFileExW AddVectoredExceptionHandler HeapReAlloc SetThreadStackGuarantee GetCurrentThread lstrlenW GetConsoleMode GetFileType RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetCurrentDirectoryW LoadLibraryA WideCharToMultiByte MultiByteToWideChar HeapAlloc GetEnvironmentVariableW QueryPerformanceFrequency GetModuleHandleW QueryPerformanceCounter SetConsoleMode SetConsoleTextAttribute ReadProcessMemory GetConsoleScreenBufferInfo VirtualQueryEx GetOverlappedResult K32GetPerformanceInfo WriteFile PostQueuedCompletionStatus ReadFile GetFinalPathNameByHandleW GetQueuedCompletionStatusEx CreateIoCompletionPort SetFileCompletionNotificationModes CancelIoEx GetSystemInfo GetTempPathW ExitProcess Sleep MapViewOfFile CreateFileMappingW FormatMessageA SystemTimeToFileTime HeapDestroy HeapCompact LoadLibraryW FlushViewOfFile OutputDebugStringW HeapSize HeapValidate UnmapViewOfFile OutputDebugStringA HeapCreate RaiseException InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection GetProcessIoCounters CreateFileW GetFileInformationByHandle CreateDirectoryW GetCurrentThreadId WaitForSingleObjectEx GetCurrentProcess GetSystemTimePreciseAsFileTime GetCurrentProcessId GetFileInformationByHandleEx FindFirstFileExW SetFileTime GetFullPathNameW CreateThread SetHandleInformation CreateMutexA ReleaseMutex WriteConsoleW WaitForSingleObject GetStdHandle GetConsoleOutputCP SetUnhandledExceptionFilter

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WakeByAddressSingle WaitOnAddress

ws2_32

setsockopt WSACleanup getpeername accept listen bind freeaddrinfo getsockopt ioctlsocket getsockname WSAGetLastError connect closesocket recv WSAStartup WSAIoctl WSASocketW WSASend shutdown send getaddrinfo

advapi32

RegQueryValueExW RegCloseKey GetUserNameW GetTokenInformation CopySid OpenProcessToken GetLengthSid RegOpenKeyExW IsValidSid SystemFunction036

ntdll

NtQueryInformationProcess NtReadFile RtlGetVersion NtQuerySystemInformation NtCancelIoFileEx RtlNtStatusToDosError NtDeviceIoControlFile NtCreateFile NtWriteFile

oleaut32

GetErrorInfo SysStringLen SysFreeString

crypt32

CryptUnprotectData

shell32

CommandLineToArgvW SHGetKnownFolderPath

ole32

CoTaskMemFree

bcrypt

BCryptGenRandom

psapi

GetModuleFileNameExW

pdh

PdhAddEnglishCounterW PdhCloseQuery PdhRemoveCounter PdhGetFormattedCounterValue PdhOpenQueryA PdhCollectQueryData

powrprof

CallNtPowerInformation

vcruntime140

memset strchr strrchr __CxxFrameHandler3 memcmp memcpy __current_exception_context __current_exception __C_specific_handler memmove memchr

api-ms-win-crt-string-l1-1-0

strcmp wcslen strlen strcspn strncmp strspn

api-ms-win-crt-math-l1-1-0

pow __setusermatherr _dclass fabs log

api-ms-win-crt-heap-l1-1-0

_set_new_mode _msize realloc free malloc

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-runtime-l1-1-0

_endthreadex _beginthreadex _seh_filter_exe terminate _crt_atexit _register_onexit_function _set_app_type _configure_narrow_argv _initialize_narrow_environment _get_initial_narrow_environment _initterm _initialize_onexit_table _initterm_e exit _exit _register_thread_local_exe_atexit_callback __p___argc __p___argv _cexit _c_exit

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale