ccla3[.]zip | Triage™

General

Target
ccla3.zip
Size 894KB
Sample261027-dbf11aaz5q
SHA256 369ceb24931488eaecd0186e78c9c57d782e0d3554d915ddf17cdd3598ba1f9d
MD5 201c547980897617631b57e8b4bdca30
SHA1 e5cb242a6194c27b538191e1db689b535b03e5c2
SHA512 2c6d7b88b68385ec2a73afc88955d980aadb0e3fe2fe3a2cb6ca1b76eacd4dde2422276fb33d499a891277a9a16b57cd438d70a7e6464e647cb56238bec5de97
SSDEEP 24576:z3g9YkWgcy3Ptiya7AVZTw/T7WBmXon8tdYeJR9ssasuqaf:Tzkr9AF7wTESBOon8t5JR6s5W
TLSH
T1341533AC60B744CD381E28E7335047E81D37BAEEFE515F81126A759F71D69CAC600E2A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Setup.exe

File Explorer

ccla3.zip

.zip 894KB
Setup.exe

.exe 929KB

ccla3.zip

SHA256 369ceb24931488eaecd0186e78c9c57d782e0d3554d915ddf17cdd3598ba1f9d
MD5 201c547980897617631b57e8b4bdca30
SHA1 e5cb242a6194c27b538191e1db689b535b03e5c2
SHA512 2c6d7b88b68385ec2a73afc88955d980aadb0e3fe2fe3a2cb6ca1b76eacd4dde2422276fb33d499a891277a9a16b57cd438d70a7e6464e647cb56238bec5de97
SSDEEP 24576:z3g9YkWgcy3Ptiya7AVZTw/T7WBmXon8tdYeJR9ssasuqaf:Tzkr9AF7wTESBOon8t5JR6s5W
TLSH
T1341533AC60B744CD381E28E7335047E81D37BAEEFE515F81126A759F71D69CAC600E2A
MD5 SHA1 SHA512 SSDEEP TLSH

Setup.exe

IMPHASH 6c6e8576f6d86b0e67e45f26ef4de96d
SHA256 0b5d646c34390e9600d9fdfe58494290fcf9feadda84455f242dc632d2385d79
MD5 566c0ff7f666b77ae7cd1785dd190b50
SHA1 fc87883462319ac604c94614309d73899f3c7dfc
SHA512 7674446f9a7ee9c905d30300d7440a0b23955980039b285a6dc9d9337686ee14e4c471c58113efff3929c8363a592ffe26243c4ed2cbeca2da4e5ebecb1e45b2
SSDEEP 24576:aGZFgUWYcy2OxssGti3TouIFZTwXcDWmxon8lRYS3R9sQCOaY:avUR9/s23BiT964on8lv3R6c
TLSH
T12D15231835E585FFE44B08B211650BB4CA3FEEAF5E318FCA5B53788D65B3AD24630119
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

29088

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

_lopen FindFirstFileA lstrlenA lstrcpyA GetWindowsDirectoryA lstrcatA RemoveDirectoryA FindNextFileA DeleteFileA lstrcmpA SetFileAttributesA _lread FindClose _lcreat LoadLibraryA GetProcAddress FreeLibrary GetVersionExA GetLastError GetCurrentProcess _llseek GetModuleFileNameA GlobalFree GlobalAlloc SetFileTime DosDateTimeToFileTime LocalFileTimeToFileTime GetLocalTime UnhandledExceptionFilter FreeEnvironmentStringsA HeapReAlloc _hread _hwrite CreateDirectoryA GetTimeZoneInformation GetSystemTime _lclose FileTimeToSystemTime FileTimeToLocalFileTime GetDriveTypeA GetModuleHandleA GetStartupInfoA GetCommandLineA GetVersion ExitProcess GetCPInfo GetACP GetOEMCP WideCharToMultiByte TerminateProcess GetFullPathNameA GetCurrentDirectoryA RtlUnwind HeapFree FreeEnvironmentStringsW GetEnvironmentStrings GetEnvironmentStringsW SetHandleCount GetStdHandle GetFileType HeapDestroy HeapCreate VirtualFree SetEnvironmentVariableA VirtualAlloc WriteFile HeapAlloc MultiByteToWideChar LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW CompareStringA CompareStringW

user32

LoadIconA wsprintfA ExitWindowsEx MessageBoxA

advapi32

AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken

Sharing