v3[.]0[.]zip | Triage™

General

Target
v3.0.zip
Size 478KB
Sample260909-bs7tyazgla
SHA256 a36efb5b8869fc6359f5e06d695b560f27212ce4d45b0d01d3eba12ca81b7595
MD5 67ce4c04ccaa27117448b30bc0749735
SHA1 85f9e02f605f70209d93f22aa22edafbcf876e42
SHA512 c3fb4a401823bc34cc62817e2c1b9893feb6dad372682246b395b36855174eb666ad9beb7fa276436be4ba5ae2820362032f468c720e30a1df84544b6c318209
SSDEEP 12288:xM1SUkFbIUv4SnAQPKTYNk/wm+iTcchv4xtHYc2OnZB:xMLkFEUv4t1cNk/wjibhv4b2On3
TLSH
T1B0A4239274B67D4EC055DFA88C8074CBE16E013D601A37D653A399C9B9A8036BF4BF17
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/utility.exe

File Explorer

v3.0.zip

.zip 478KB
Application.cmd

33B
certificate.txt

.js 194KB
utility.exe

.exe 742KB

v3.0.zip

SHA256 a36efb5b8869fc6359f5e06d695b560f27212ce4d45b0d01d3eba12ca81b7595
MD5 67ce4c04ccaa27117448b30bc0749735
SHA1 85f9e02f605f70209d93f22aa22edafbcf876e42
SHA512 c3fb4a401823bc34cc62817e2c1b9893feb6dad372682246b395b36855174eb666ad9beb7fa276436be4ba5ae2820362032f468c720e30a1df84544b6c318209
SSDEEP 12288:xM1SUkFbIUv4SnAQPKTYNk/wm+iTcchv4xtHYc2OnZB:xMLkFEUv4t1cNk/wjibhv4b2On3
TLSH
T1B0A4239274B67D4EC055DFA88C8074CBE16E013D601A37D653A399C9B9A8036BF4BF17
MD5 SHA1 SHA512 SSDEEP TLSH

utility.exe

IMPHASH 0d8f96525fa416afffa287da796d1f5e
SHA256 e227d47facf0e2f5b9e5c54a23a86b31272696b64bbbb9932a31fe06973677bd
MD5 7a59df9ee2ae38c391b60c001d8fef11
SHA1 a5fa49ca3da03fb01f2a96fa99521f263665f9ff
SHA512 8237b3fd2a41a08bfb8ca95060e1a7f8b030538d587746b1b050d1ce0f2a6f4898ff31e65243c97e6b343a8112159839cfa85f47ecffc20a621dac64cf947b7a
SSDEEP 12288:PFsr3uNFZnKsXrLdiu7c7nu86VDfU/+tZxMUJ4EBiSxsyYA:PFs4FZnKsrLdiCUMs/KiesyYA
TLSH
T184F4BF81B6D381F3D992117148B9A77A0E3D6D1007259CEB83D43AF68D346C0AF776AE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

383313

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\a\defold\defold\share\ext\luajit\tmp_win32\LuaJIT-3e223cb8a41cff3b92931acb846af7b67a5d2537\src\luajit.pdb

kernel32

RaiseException GetLastError SetLastError RtlUnwind GetProcAddress LoadLibraryExA VirtualAlloc VirtualFree VirtualQuery InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection WaitForSingleObject Sleep CreateThread FreeLibrary GetModuleFileNameA GetModuleHandleA GetModuleHandleExA FormatMessageA VirtualProtect UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW SetEndOfFile InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW EncodePointer SetConsoleCtrlHandler ExitProcess GetModuleHandleExW ReadFile CloseHandle DuplicateHandle CreateProcessW QueryPerformanceFrequency GetStdHandle WriteFile GetModuleFileNameW GetCommandLineA GetCommandLineW HeapAlloc HeapFree GetTempPathW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType FlushFileBuffers GetConsoleOutputCP GetConsoleMode GetFileSizeEx SetFilePointerEx ReadConsoleW DecodePointer GetExitCodeProcess GetFileAttributesExW CreatePipe CreateFileW GetTimeZoneInformation MultiByteToWideChar WideCharToMultiByte DeleteFileW MoveFileExW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetStringTypeW GetProcessHeap HeapSize HeapReAlloc WriteConsoleW

__swprintf_l __vswprintf_l _fprintf_l _fprintf_p _fprintf_p_l _fprintf_s_l _fscanf_l _fscanf_s_l _fwprintf_l _fwprintf_p _fwprintf_p_l _fwprintf_s_l _fwscanf_l _fwscanf_s_l _printf_l _printf_p _printf_p_l _printf_s_l _scanf_l _scanf_s_l _scprintf _scprintf_l _scprintf_p _scprintf_p_l _scwprintf _scwprintf_l _scwprintf_p _scwprintf_p_l _snprintf _snprintf_c _snprintf_c_l _snprintf_l _snprintf_s _snprintf_s_l _snscanf _snscanf_l _snscanf_s _snscanf_s_l _snwprintf _snwprintf_l _snwprintf_s _snwprintf_s_l _snwscanf _snwscanf_l _snwscanf_s _snwscanf_s_l _sprintf_l _sprintf_p _sprintf_p_l _sprintf_s_l _sscanf_l _sscanf_s_l _swprintf _swprintf_c _swprintf_c_l _swprintf_l _swprintf_p _swprintf_p_l _swprintf_s_l _swscanf_l _swscanf_s_l _vfprintf_l _vfprintf_p _vfprintf_p_l _vfprintf_s_l _vfscanf_l _vfscanf_s_l _vfwprintf_l _vfwprintf_p _vfwprintf_p_l _vfwprintf_s_l _vfwscanf_l _vfwscanf_s_l _vprintf_l _vprintf_p _vprintf_p_l _vprintf_s_l _vscanf_l _vscanf_s_l _vscprintf _vscprintf_l _vscprintf_p _vscprintf_p_l _vscwprintf _vscwprintf_l _vscwprintf_p _vscwprintf_p_l _vsnprintf _vsnprintf_c _vsnprintf_c_l _vsnprintf_l _vsnprintf_s _vsnprintf_s_l _vsnwprintf _vsnwprintf_l _vsnwprintf_s _vsnwprintf_s_l _vsnwscanf_l _vsnwscanf_s_l _vsprintf_l _vsprintf_p _vsprintf_p_l _vsprintf_s_l _vsscanf_l _vsscanf_s_l _vswprintf _vswprintf_c _vswprintf_c_l _vswprintf_l _vswprintf_p _vswprintf_p_l _vswprintf_s_l _vswscanf_l _vswscanf_s_l _vwprintf_l _vwprintf_p _vwprintf_p_l _vwprintf_s_l _vwscanf_l _vwscanf_s_l _wprintf_l _wprintf_p _wprintf_p_l _wprintf_s_l _wscanf_l _wscanf_s_l fprintf fprintf_s fscanf fscanf_s fwprintf fwprintf_s fwscanf fwscanf_s printf printf_s scanf scanf_s snprintf sprintf sprintf_s sscanf sscanf_s swprintf swprintf_s swscanf swscanf_s vfprintf vfprintf_s vfscanf vfscanf_s vfwprintf vfwprintf_s vfwscanf vfwscanf_s vprintf vprintf_s vscanf vscanf_s vsnprintf vsnprintf_s vsprintf vsprintf_s vsscanf vsscanf_s vswprintf vswprintf_s vswscanf vswscanf_s vwprintf vwprintf_s vwscanf vwscanf_s wprintf wprintf_s wscanf wscanf_s

Sharing