Malware-1.zip
- SHA256 e7c0423181e5bb52799713c8d002d452cf49c4fb74ba76f5538a1f853784f40f
Static task
static1
1 signatures
General
- Target Malware-1.zip
- Size 234KB
- Sample261015-2vgzeattbv
- SHA256 e7c0423181e5bb52799713c8d002d452cf49c4fb74ba76f5538a1f853784f40f
- MD5 9b8edbb284914e55f87b0d67f2591f35
- SHA1 c9acf982b1263168f48114c1061ba024e727cb41
- SHA512 bb7b159ecf81ae55c25547c77cd995817ef72b030efcd27cfc92aa7259c9501d696f740635fc04966cdecbccd59128e991d9e0bca1f46b75251617961ad382e1
- SSDEEP 6144:+KRr2YO5w+l6fXZpvrLfQUJiZJGdnzdyCYqDU:+mql5w+c/3nZiGdnzdTnU
- TLSH T1D734236AA23F78676B1396FE209B31934C0042C533786244EB23D9D4CFAE9EE52F4457
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/alcompat.dll unpack001/pos.exe
File Explorer
-
Malware-1.zip.zip 234KB
-
__MACOSX/._alcompat.dll276B
-
__MACOSX/._run_pos_install.bat163B
-
alcompat.dll.dll 438KB
-
pos.exe.exe 119KB
-
run_pos_install.bat.bat 997B
__MACOSX/._alcompat.dll
- SHA256 be09e41162771f057a7f0f8f5e8b9fc9b555f55445e91a750b0dc554f8674f41
- MD5 6c0daf9c82d7c20f1c92d8ef3a175345
- SHA1 c3b9651665ab2ad4a96e1283d0a0423fab622387
- SHA512 33e0e1066241c4a1371664bf4b1d07c02d38d88486352ca5e5c32b706b916377835bf1c05bd9fc843d15ecb48e5bd02f6cfdee74b173ecf7010e1700c021ec10
- TLSH T18FD08C740300264BC01783F4448238606B2620BE57920A13728EF0000700E623EB4A6A
- MD5 SHA1 SHA512 TLSH
__MACOSX/._run_pos_install.bat
- SHA256 b1d02657b5c88c205162b1e51d98fbd08559cc4520244f4f126dc72667192ff5
- MD5 800ce1bb140446407f88f1007c2117e1
- SHA1 66fc841dd2565fa7f0c2d1b70c24d21e784aba64
- SHA512 09f1d53ee938fe3ad9c3ca72e86b9cc40d20cb4b4c99550ba53f270c52c117039260f19696585de6429b0f00afb2b58b83123d1a3e2727c862f157ce3e5f9918
- TLSH T10BC012A459D0C3B0C51841345A833D16B3E5453591731722710D85841740314679020A
- MD5 SHA1 SHA512 TLSH
alcompat.dll
- IMPHASH 31d833fbf6b2de9a2b0d31caa11a632c
- SHA256 e02e39f6c06f23f448c483cab0c4cad7be0b65522133bd34994aab9a6fb6cae9
- MD5 e36cf4e2fa6fa9ba4bd853d9b7768ef4
- SHA1 c00227a408c219363135185228ee7d69efd80512
- SHA512 5cd195c06a6493170db3bd7eee9dc2ad9eb273f1ff7f127bdba29209c149004291764302df78b77ea65be2c6c1a68d299873ce9e14a01bafa25507b5ea00f4bb
- SSDEEP 6144:0b8sX8fCVA3nOfJ9e+NtldAJvlcHy7oJcZ1F85PXZ9vHT:q8o8KiyLeF6H68dZ9vHT
- TLSH T109A47CA2FBD61CA6E62641384DDBD369333DB6E026419B17493962300F17ED0BF99783
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4624
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
advapi32
AdjustTokenPrivileges
GetUserNameA
LookupPrivilegeValueA
OpenProcessToken
RegCloseKey
RegCreateKeyExA
RegDeleteValueA
RegEnumKeyExA
RegEnumValueA
RegOpenKeyExA
RegQueryValueExA
crypt32
CryptBinaryToStringA
CryptStringToBinaryA
gdi32
BitBlt
CreateCompatibleBitmap
CreateCompatibleDC
CreateDCA
CreateDIBSection
DeleteDC
DeleteObject
GetDIBits
GetDeviceCaps
SelectObject
iphlpapi
GetAdaptersInfo
GetIpNetTable
kernel32
CloseHandle
CopyFileA
CreateDirectoryA
CreateFileA
CreateProcessA
CreateThread
CreateToolhelp32Snapshot
DeleteCriticalSection
DeleteFileA
DisableThreadLibraryCalls
EnterCriticalSection
ExitProcess
ExpandEnvironmentStringsA
FindClose
FindFirstFileA
FindNextFileA
FreeLibrary
GetCPInfo
GetComputerNameA
GetConsoleWindow
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetFileAttributesA
GetFileSize
GetLastError
GetLocalTime
GetModuleFileNameA
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetSystemInfo
GetTempPathA
GetTickCount
GlobalMemoryStatusEx
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
MultiByteToWideChar
OpenProcess
Process32FirstW
Process32NextW
QueryPerformanceCounter
QueryPerformanceFrequency
ReadFile
ReadProcessMemory
SetFileAttributesA
Sleep
TlsGetValue
VirtualProtect
VirtualQuery
VirtualQueryEx
WaitForSingleObject
WideCharToMultiByte
WriteFile
lstrcmpiW
lstrcpynW
mfplat
MFCreateMemoryBuffer
MFCreateSample
msvcrt
___lc_codepage_func
___mb_cur_max_func
__iob_func
_amsg_exit
_errno
_initterm
_lock
_snprintf
_strdup
_unlink
_unlock
abort
atoi
calloc
fclose
fopen
fprintf
fputc
fputs
fputwc
fread
free
fseek
fwprintf
ftell
getenv
localeconv
malloc
memcpy
memset
rand
realloc
srand
strcat
strchr
strcmp
strcpy
strerror
strlen
strncat
strncmp
strncpy
strstr
system
towlower
vfprintf
wcslen
wcsstr
ole32
CoCreateInstance
CoInitializeEx
CreateStreamOnHGlobal
oleaut32
VariantClear
VariantInit
shell32
SHGetFolderPathA
user32
CallNextHookEx
CloseDesktop
CreateDesktopA
GetDC
GetSystemMetrics
GetThreadDesktop
OpenDesktopA
ReleaseDC
SendInput
SetThreadDesktop
ShowWindow
winhttp
WinHttpAddRequestHeaders
WinHttpCloseHandle
WinHttpConnect
WinHttpOpen
WinHttpOpenRequest
WinHttpQueryDataAvailable
WinHttpReadData
WinHttpReceiveResponse
WinHttpSendRequest
WinHttpSetOption
WinHttpSetTimeouts
ws2_32
WSACleanup
WSAIoctl
WSAStartup
bind
closesocket
connect
gethostbyname
gethostname
htonl
htons
inet_addr
inet_ntoa
ioctlsocket
recv
select
socket
EdgeUpdateMain
Name
.text
Size
81KB
Virtual Size
80KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
192B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
207KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
512B
Virtual Size
80B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
220B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/4
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/19
Size
89KB
Virtual Size
89KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/31
Size
15KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/45
Size
43KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/57
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/70
Size
1024B
Virtual Size
567B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/81
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/97
Size
45KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/113
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
pos.exe
- IMPHASH 9b995989e12f45dfaa75a13f47fc12eb
- SHA256 9575f4bdad3bb6b68c78111ac88fb9a95b006c8dc6757c9851e374a5cbc2d901
- MD5 fd98a3e22c165f76533b112dd23ed011
- SHA1 de04bd0507bf7abeb6a4dcd7208389ac1f7f79e6
- SHA512 dca3038a3185ec6d2fb2e4d73db69c281df9bc774a0cb5c20737f362c2f3f0d940df32c08163e584d8e67f4893aef9b1f4d9a13898ea6e4583cad89f19ef87ed
- SSDEEP 3072:zh1G8i9HN/p1768WL7YCdn4Od9uYxI6++Zlu3MS9DsOj9NPA2Fc9SXpc:zq8WHpe8TC3Y6zuTrVpc
- TLSH T1F7C38D2074D1C072D4B729321974D6B24F6DFD300E64AEEB738416BA5F701D1AA39EAB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
7242
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\ez\Source\Repos\ccgen\Release\ccgen.pdb
kernel32
VirtualAlloc
Sleep
SystemTimeToFileTime
GetConsoleWindow
GetSystemTime
WriteConsoleW
ReadConsoleW
ReadFile
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
RaiseException
GetStdHandle
WriteFile
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
HeapAlloc
HeapFree
CompareStringW
LCMapStringW
GetFileType
CloseHandle
GetTimeZoneInformation
MultiByteToWideChar
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
GetStringTypeW
GetProcessHeap
GetFileAttributesExW
CreateFileW
FlushFileBuffers
GetConsoleCP
GetConsoleMode
GetFileSizeEx
SetFilePointerEx
HeapSize
HeapReAlloc
SetEndOfFile
DecodePointer
user32
ShowWindow
Name
.text
Size
84KB
Virtual Size
84KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
26KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=26213,
count=164, id=261, version=26213,
count=18, id=260, version=26213,
count=2, id=199, version=41118,
count=36, id=261, version=26706,
count=17, id=260, version=26706,
count=20, id=259, version=26706,
count=5, id=257, version=26213,
count=89, id=1, productName=Unmarked objects,
count=2, id=264, version=27030,
count=1, id=255, productName=VS2017 v15.9.11 build 27030, version=27030,
count=1, id=258, productName=VS2017 v15.9.11 build 27030, version=27030,
run_pos_install.bat
- SHA256 0323b97c0d0f469688e471c6332ea5ded470a715bca9fe1b721bfa0484046782
- MD5 5939af413fade15d3e6bcba6caf801b0
- SHA1 a65fb4b4d72846ea11a1c604de03c2021317e8d1
- SHA512 879442aad4f8c18003e51237cdae0556a976a21f5622672cb2d2fd64919bf827463cd194f73aec20d23cf5ed1ed72ce9ae7cf2ddb425a0181e2f2c8768b84d2c
- TLSH T1A311AB073FDACF3796A45CC33EA91252B91AC11F910C99D970A442507F0A1AE6DFC6ED
- MD5 SHA1 SHA512 TLSH