extract-xiso-Win64_Release[.]zip

General

Target
extract-xiso-Win64_Release.zip
Size 22KB
Sample261014-cazw2set21
SHA256 fc891dfa72f08e3838a2f8b7ec34a8e4d61678da1cc8fee879677f00bf114ce3
MD5 41635d3cc94d623bb387375e7ebc0135
SHA1 e1484e88217fa5f00c8ed285ed9a08cba26f70be
SHA512 6e4251ed26439eac22d794ec130c16f034fb9188a99b5a6429f7b93dc58c8a06150394a495752f596247ac32be95bebae218dbb6797dce67c518837a78036809
SSDEEP 384:SJS+MZXD/rlL51TA4IOwWVQUVAkwaUI2/S4NSoiKbMsplK2mcbk1lhurR:xZXDDlVFA4IOw6/2/bNS2bMOAWGY
TLSH
T1F7A2D0509BA87744A2D28BF8A11E1F5448A08BE53B54ECFA011FFEC9F972C5D2468345
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/artifacts\extract-xiso.exe

File Explorer

extract-xiso-Win64_Release.zip

.zip 22KB
artifacts\LICENSE.TXT

3KB
artifacts\extract-xiso.exe

.exe 40KB

extract-xiso-Win64_Release.zip

SHA256 fc891dfa72f08e3838a2f8b7ec34a8e4d61678da1cc8fee879677f00bf114ce3
MD5 41635d3cc94d623bb387375e7ebc0135
SHA1 e1484e88217fa5f00c8ed285ed9a08cba26f70be
SHA512 6e4251ed26439eac22d794ec130c16f034fb9188a99b5a6429f7b93dc58c8a06150394a495752f596247ac32be95bebae218dbb6797dce67c518837a78036809
SSDEEP 384:SJS+MZXD/rlL51TA4IOwWVQUVAkwaUI2/S4NSoiKbMsplK2mcbk1lhurR:xZXDDlVFA4IOw6/2/bNS2bMOAWGY
TLSH
T1F7A2D0509BA87744A2D28BF8A11E1F5448A08BE53B54ECFA011FFEC9F972C5D2468345
MD5 SHA1 SHA512 SSDEEP TLSH

artifacts\extract-xiso.exe

IMPHASH 0b14ddd0aec06f4203a2aafb09789466
SHA256 7e97536f978735d586a2f78327aa337b9a19b3e364fa715316fb42d07d33e0b7
MD5 1261584fbc130e137c87e17e95214672
SHA1 06806cece0fee03f234ddb007355a8717a2e3486
SHA512 fb0c59442becb5648b1e055edeb32564594d8aef90451fef90b05e5a0ef5d1361786d23cd73ac086bf71f8f8988cc8e4580e468636d6ea8dae6c3748be914096
SSDEEP 768:djgyXIly7WotdbTVjHO1Agt+eYdyaeF7gsdT:djJXIly7Wo7V7O1rUeYdS
TLSH
T14F131745768840F9C5138136C936C61BD2B2B8B51735ABDF329CEB582F376E1963BA08
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

29072

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

vcruntime140

__current_exception __C_specific_handler memset memcmp strstr strchr __current_exception_context memcpy

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-runtime-l1-1-0

_initterm _seh_filter_exe _exit _configure_narrow_argv _get_initial_narrow_environment __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback _initialize_narrow_environment _set_app_type _errno _initialize_onexit_table _register_onexit_function _crt_atexit terminate strerror exit _initterm_e __p___argc

api-ms-win-crt-stdio-l1-1-0

_open _read _write __acrt_iob_func _close _lseeki64 fflush __p__commode _set_fmode __stdio_common_vfprintf _getcwd __stdio_common_vsprintf

api-ms-win-crt-filesystem-l1-1-0

_unlink _mkdir _chdir _stat64i32 _findclose _findfirst64i32 _findnext64i32 rename

api-ms-win-crt-heap-l1-1-0

free _set_new_mode malloc realloc

api-ms-win-crt-string-l1-1-0

_stricmp strcpy strncmp strlen strncpy _strdup

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

kernel32

GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetModuleHandleW QueryPerformanceCounter

Sharing