xzblib0_infected.zip
- SHA256 2bf2934a37722875b461e6561fcfc970d0a7cd2f9635f1c2350d5ecefc343053
Password
infected
Static task
static1
1 signatures
General
- Target xzblib0_infected.zip
- Size 10.6MB
- Sample260920-2vxpvsfl5s
- SHA256 2bf2934a37722875b461e6561fcfc970d0a7cd2f9635f1c2350d5ecefc343053
- MD5 e2ae2070882e771d24a9a2178a9442bf
- SHA1 b0b1e09d1c056ad0796fa9a1f09ba362fc02b415
- SHA512 9873183fe825543772dfa0f01d7b4602898dd570b4fc256501287715645bf40dc11cfbe9ae73698a35e9c5fccb9875173b18e3610967bf2717c9e74c25db194f
- SSDEEP 196608:cZ3yi35eSLNl52Wl+IHB8fpcjBJn215QJrMaNC+b+MjnQjGEPoPyo7:o3r1LNaWwIM2NtJCqd0SEPoPyo7
- TLSH T12AB6336A3876A566B163FA1CD889FCC6E5031204F2B552F017613988EEC7BDE45B1F83
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/xzblib0.dll
File Explorer
-
xzblib0_infected.zip.zip 10.6MB
-
xzblib0.dll.dll 11.7MB
xzblib0.dll
- IMPHASH 36918af5947fcc2eaadd832938103354
- SHA256 c67a1b2a7a79357e12d85dd51ebb7b54cf53087e45268b8daaaa7bc4147c3c40
- MD5 f20da3f165d0b00a95e2646f0325abe3
- SHA1 6b2503d6fda9f86f312fd6dd87f85755899d2e04
- SHA512 6cafc0d713e2e045bd72d4372d7d5b33f1040488ec7ad0fdd62a99c0b45298a1a34b5b44893bb2fb68946e8ed9a5efdfa00d46e5060dceb690549b7be97b09a6
- SSDEEP 196608:ktzlNvUqsLfeXITy/2nu6q8hqEjvOrKfwuvzVqp5CzsyxfQ0ucSdn4aPQPhkQQYP:e5NvdKWXIu/4uo2A+i40ucSiaYPGQQ5a
- TLSH T12FC623DE0BE552B8D0934610628A939A74C1E65D42FD0C3A3DDB2C06A71CD7A618EFF7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
6
Entry point
7412337
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
VirtualProtect
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
GetModuleHandleA
LoadLibraryA
GetProcAddress
vcruntime140
__C_specific_handler
api-ms-win-crt-runtime-l1-1-0
_execute_onexit_table
api-ms-win-crt-heap-l1-1-0
free
DllMain
Name
.text
Size
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
Virtual Size
612B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.aspr0
Size
Virtual Size
6.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.aspr1
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.aspr2
Size
11.7MB
Virtual Size
11.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
268B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
469B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ