ccla2[.]zip | Triage™

General

Target
ccla2.zip
Size 859KB
Sample261027-dbe4psaz5p
SHA256 a835eec034c5531a9a23f7c4c0f35331d7c3efe817d84993cb1081f0c82d7a2e
MD5 10cac24fdd50ffcd2fcfd5f120e9996a
SHA1 618c93121f59ca2553315fc3baca85dd3b477b34
SHA512 66276ba9513727b1a34e011414e77214da7c3b556b23382e2b6cc0110e5ea6ae92fa06d08fb40dd1a71c29c5ee31c0ec08b87c1d18b2f13635dca51e1c020ef2
SSDEEP 24576:Og5n4+6EJsddX2adtiI9VMHqfQLon8j38SpbVl:Z5J6qsdBryI9mqfcon8jRphl
TLSH
T1AD1523BC51F3419B6C0E69B7629243E8801FA87EEFF7FBC8368234EA51466755C6460C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Setup.exe

File Explorer

ccla2.zip

.zip 859KB
Setup.exe

.exe 893KB

ccla2.zip

SHA256 a835eec034c5531a9a23f7c4c0f35331d7c3efe817d84993cb1081f0c82d7a2e
MD5 10cac24fdd50ffcd2fcfd5f120e9996a
SHA1 618c93121f59ca2553315fc3baca85dd3b477b34
SHA512 66276ba9513727b1a34e011414e77214da7c3b556b23382e2b6cc0110e5ea6ae92fa06d08fb40dd1a71c29c5ee31c0ec08b87c1d18b2f13635dca51e1c020ef2
SSDEEP 24576:Og5n4+6EJsddX2adtiI9VMHqfQLon8j38SpbVl:Z5J6qsdBryI9mqfcon8jRphl
TLSH
T1AD1523BC51F3419B6C0E69B7629243E8801FA87EEFF7FBC8368234EA51466755C6460C
MD5 SHA1 SHA512 SSDEEP TLSH

Setup.exe

IMPHASH 6c6e8576f6d86b0e67e45f26ef4de96d
SHA256 57d2dc96bedd504680c1526b354bd925b2fa2ba0ce7ce9f4b0157081776dd6f2
MD5 793e2325b692dc349b4616496ddac434
SHA1 e8a9856ddc95242871e9142f184dfe854a498ebe
SHA512 7b3d030ace1a8dc5bb1387cd3c7bdd6a728c0fc2c2ed39d7dadbd28d3f9b944141b1c2e457d8b3a11988e16e06a2ab3ee25cd83d12eb2be2b48d2ac1c12d0811
SSDEEP 24576:aGin++MsJsATY9jti3pouf8HqiWmxon8lRYS3R9Bn:ar/MysATn37Uqp4on8lv3Rn
TLSH
T10415232829E281FBD44B15B2157597AC871BDCBB4672CACBAB43788D9C77BD24D3420C
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

29088

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

_lopen FindFirstFileA lstrlenA lstrcpyA GetWindowsDirectoryA lstrcatA RemoveDirectoryA FindNextFileA DeleteFileA lstrcmpA SetFileAttributesA _lread FindClose _lcreat LoadLibraryA GetProcAddress FreeLibrary GetVersionExA GetLastError GetCurrentProcess _llseek GetModuleFileNameA GlobalFree GlobalAlloc SetFileTime DosDateTimeToFileTime LocalFileTimeToFileTime GetLocalTime UnhandledExceptionFilter FreeEnvironmentStringsA HeapReAlloc _hread _hwrite CreateDirectoryA GetTimeZoneInformation GetSystemTime _lclose FileTimeToSystemTime FileTimeToLocalFileTime GetDriveTypeA GetModuleHandleA GetStartupInfoA GetCommandLineA GetVersion ExitProcess GetCPInfo GetACP GetOEMCP WideCharToMultiByte TerminateProcess GetFullPathNameA GetCurrentDirectoryA RtlUnwind HeapFree FreeEnvironmentStringsW GetEnvironmentStrings GetEnvironmentStringsW SetHandleCount GetStdHandle GetFileType HeapDestroy HeapCreate VirtualFree SetEnvironmentVariableA VirtualAlloc WriteFile HeapAlloc MultiByteToWideChar LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW CompareStringA CompareStringW

user32

LoadIconA wsprintfA ExitWindowsEx MessageBoxA

advapi32

AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken

Sharing