isoautodl-windows-x64[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
isoautodl-windows-x64.zip
Size 2.9MB
Sample261030-ltakyays4j
SHA256 97a86550661633352da32d6564d86b450d955123bef78a7571a45af7bf5f1b6d
MD5 577efa195b881210e76118df54ca36eb
SHA1 b057fb0208e2ef0e90848391ce613748828c0d2d
SHA512 abf751b722e1a5ee594584662b44c58c53b9f469c1bce2ca487ee75edb22e67792a2e06108ba6782d6ad34bdba726b16949fbb83d3e6cdcfbe67e2513bfd84e6
SSDEEP 49152:9gg+km2UrK8TL2HcagtyNiNLj8JbSo1EWGHn9GfRpdJkkUiVxi1Ml8c7yw/hr7ax:9X+kyK8f2HlN08tS+Py9GckUiVAuleSW
TLSH
T104E53352255652439B72B5AAB3774E3E02772CA5E092ECC2736356CB5B34CAF3B10C36
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/bin/7za.exe
unpack001/bin/aria2c.exe

File Explorer

isoautodl-windows-x64.zip

.zip 2.9MB
bin/7za.exe

.exe 1.3MB
bin/aria2c.exe

.exe 5.4MB
get-with-aria2.cmd

.cmd .bat 1KB

isoautodl-windows-x64.zip

SHA256 97a86550661633352da32d6564d86b450d955123bef78a7571a45af7bf5f1b6d
MD5 577efa195b881210e76118df54ca36eb
SHA1 b057fb0208e2ef0e90848391ce613748828c0d2d
SHA512 abf751b722e1a5ee594584662b44c58c53b9f469c1bce2ca487ee75edb22e67792a2e06108ba6782d6ad34bdba726b16949fbb83d3e6cdcfbe67e2513bfd84e6
SSDEEP 49152:9gg+km2UrK8TL2HcagtyNiNLj8JbSo1EWGHn9GfRpdJkkUiVxi1Ml8c7yw/hr7ax:9X+kyK8f2HlN08tS+Py9GckUiVAuleSW
TLSH
T104E53352255652439B72B5AAB3774E3E02772CA5E092ECC2736356CB5B34CAF3B10C36
MD5 SHA1 SHA512 SSDEEP TLSH

bin/7za.exe

IMPHASH 42b887bc221756725e057690e24c7e42
SHA256 574bb90d17732f3cc4145fd4ba12d8f29b9d63400881c0e6fe3110c88b0485de
MD5 cfd95b9816f15eb24c5721814561ceb0
SHA1 b5ea2973090649b06be497bf8ba0606d37e1738a
SHA512 449f58426487f391bc2aad6097b1594715086cea1421369b6fb3a73e3339b03aa9571fc42871a9e68c7594640af0be6ab15201596f21ee6ca2d57bde72fdc793
SSDEEP 24576:fflhaJP/Hp18iHvgtFhRhABfzXRZ3bBWI7Lf:fraJ3HpaiHE0f3b
TLSH
T110551A66F9748275D0B3C0BAC6D29B9AEE713085173096C74289C76C3F17BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

957088

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

oleaut32

SysStringLen VariantClear VariantCopy SysAllocString SysFreeString SysAllocStringLen

user32

CharUpperW CharPrevExA

advapi32

OpenProcessToken SystemFunction036 GetFileSecurityW SetFileSecurityW RegOpenKeyExW AdjustTokenPrivileges LookupPrivilegeValueW RegQueryValueExW RegCloseKey

msvcrt

_exit _c_exit _XcptFilter _onexit __dllonexit ?terminate@@YAXXZ ??1type_info@@UEAA@XZ __C_specific_handler _beginthreadex realloc _purecall _isatty _get_osfhandle memset strlen _cexit wcscmp strcmp memmove fflush fputc fputs _iob fgetc free malloc memcmp __CxxFrameHandler _CxxThrowException memcpy exit __getmainargs __initenv _initterm __setusermatherr _commode _fmode __set_app_type wcsstr

kernel32

ResumeThread SetThreadAffinityMask CreateEventW SetEvent ResetEvent CreateSemaphoreW ReleaseSemaphore InitializeCriticalSection GetVersion MoveFileW WaitForSingleObject GetLargePageMinimum VirtualFree VirtualAlloc GetOEMCP LocalFileTimeToFileTime SetConsoleMode SetFileApisToOEM GetCommandLineW GetConsoleScreenBufferInfo SetConsoleCtrlHandler GetProcessTimes QueryPerformanceFrequency QueryPerformanceCounter DeleteCriticalSection SetProcessAffinityMask GetConsoleMode OpenEventW UnmapViewOfFile MapViewOfFile OpenFileMappingW WaitForMultipleObjects LeaveCriticalSection EnterCriticalSection GetSystemTimeAsFileTime FileTimeToDosDateTime DosDateTimeToFileTime IsProcessorFeaturePresent GetSystemInfo GetProcessAffinityMask GetModuleHandleA GlobalMemoryStatusEx FileTimeToLocalFileTime FileTimeToSystemTime CompareFileTime GetModuleHandleW GetProcAddress GetCurrentProcess GetDiskFreeSpaceExW GetDiskFreeSpaceW GetLastError MultiByteToWideChar WideCharToMultiByte FreeLibrary LoadLibraryW GetModuleFileNameW LocalFree FormatMessageW CloseHandle SetFileTime CreateFileW SetFileAttributesW RemoveDirectoryW MoveFileWithProgressW CreateHardLinkW CreateDirectoryW DeleteFileW SetCurrentDirectoryW GetCurrentDirectoryW GetTempPathW SetLastError GetCurrentProcessId GetTickCount GetCurrentThreadId GetFileInformationByHandle GetStdHandle FindClose FindFirstFileW FindNextFileW FindFirstStreamW FindNextStreamW GetFileAttributesW GetLogicalDriveStringsW DeviceIoControl GetFileSize SetFilePointer ReadFile WriteFile SetEndOfFile

bin/aria2c.exe

IMPHASH df08dc090f0f36e29933a24c29033049
SHA256 be2099c214f63a3cb4954b09a0becd6e2e34660b886d4c898d260febfe9d70c2
MD5 8c71b86bf407c05baf11e8d296b9c8b8
SHA1 6624ab8ca883c48f02c58250d4eee9e90098f4e4
SHA512 bb3fee727e40f8213f0a7d9808048e341295a684ecba6f4df52f1b07b528d7206ca41926b2433f4b63451565ad2854570fee976bc7051b629acd24fca6d0f507
SSDEEP 98304:jgRfP5jnFTyGZEWxSIBHVGT+t1ufqchZ:kRZDFTyGaHIJoWofqc
TLSH
T1F0463917E2A310ECC26BC170476BA273B932F81915307E7F79A8DB751F21E605A6DB24
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5360

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

AdjustTokenPrivileges CryptAcquireContextA CryptGenRandom CryptReleaseContext GetTokenInformation LookupPrivilegeValueA OpenProcessToken RegCloseKey RegEnumKeyExA RegOpenKeyExA RegQueryValueExA SystemFunction036

bcrypt

BCryptCloseAlgorithmProvider BCryptCreateHash BCryptDecrypt BCryptDeriveKey BCryptDestroyHash BCryptDestroyKey BCryptDestroySecret BCryptEncrypt BCryptExportKey BCryptFinalizeKeyPair BCryptFinishHash BCryptGenRandom BCryptGenerateKeyPair BCryptGetProperty BCryptHashData BCryptImportKey BCryptImportKeyPair BCryptOpenAlgorithmProvider BCryptSecretAgreement BCryptSetProperty BCryptSignHash BCryptVerifySignature

crypt32

CertCloseStore CertEnumCertificatesInStore CertFreeCertificateContext CryptDecodeObjectEx PFXImportCertStore PFXIsPFXBlob

iphlpapi

FreeMibTable GetAdaptersAddresses GetBestRoute2 GetUnicastIpAddressTable if_indextoname

kernel32

AreFileApisANSI CloseHandle CreateFileA CreateFileMappingA CreateFileMappingW CreateFileW CreateMutexW CreateProcessW CreateSemaphoreW DeleteCriticalSection DeleteFileA DeleteFileW DeviceIoControl EnterCriticalSection ExpandEnvironmentStringsA FlushFileBuffers FlushViewOfFile FormatMessageA FormatMessageW FreeLibrary GetCommandLineW GetConsoleMode GetConsoleScreenBufferInfo GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetDiskFreeSpaceA GetDiskFreeSpaceW GetEnvironmentVariableW GetFileAttributesA GetFileAttributesExW GetFileAttributesW GetFileSize GetFileSizeEx GetFullPathNameA GetFullPathNameW GetLastError GetModuleHandleW GetProcAddress GetProcessHeap GetStartupInfoA GetStdHandle GetSystemInfo GetSystemTime GetSystemTimeAsFileTime GetTempPathA GetTempPathW GetTickCount GetTimeZoneInformation GetVersionExA GetVersionExW GetWindowsDirectoryA HeapAlloc HeapCompact HeapCreate HeapDestroy HeapFree HeapReAlloc HeapSize HeapValidate InitializeCriticalSection IsDBCSLeadByteEx LeaveCriticalSection LoadLibraryA LoadLibraryW LocalFree LockFile LockFileEx MapViewOfFile MoveFileExW MultiByteToWideChar OpenProcess OutputDebugStringA OutputDebugStringW QueryPerformanceCounter RaiseException ReadFile ReleaseSemaphore RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetConsoleCtrlHandler SetConsoleTextAttribute SetEndOfFile SetFilePointer SetFilePointerEx SetFileTime SetFileValidData SetLastError SetUnhandledExceptionFilter Sleep SystemTimeToFileTime TlsAlloc TlsFree TlsGetValue TlsSetValue TryEnterCriticalSection UnlockFile UnlockFileEx UnmapViewOfFile VirtualProtect VirtualQuery WaitForSingleObject WaitForSingleObjectEx WideCharToMultiByte WriteConsoleW WriteFile

msvcrt

__C_specific_handler ___lc_codepage_func ___mb_cur_max_func __argv __getmainargs __initenv __iob_func __lconv_init __set_app_type __setusermatherr _acmdln _amsg_exit _assert _beginthreadex _cexit _commit _commode _difftime64 _endthreadex _errno _filelengthi64 _fileno _fmode _fstat64 _gmtime64 _initterm _localtime64 _lock _lseeki64 _onexit _setmode _stricmp _strnicmp _time64 _unlock _wfopen _wfsopen _wgetcwd _wgetenv _wmkdir _wopen _wrmdir _wsopen _wstat64 _wunlink abort acos asctime asin atan calloc cosh exit fclose feof ferror fflush fgetpos fgets fopen fprintf fputc fputs fread free fsetpos fwrite getc getenv getwc islower isspace isupper iswctype isxdigit ldiv localeconv log10 malloc memchr memcmp memcpy memmove memset perror putc putwc qsort raise realloc rewind setlocale setvbuf signal sinh strchr strcmp strcoll strcpy strcspn strerror strftime strlen strncat strncmp strncpy strrchr strspn strstr strtol strtoul strxfrm tan tanh tolower towlower towupper ungetc ungetwc vfprintf wcscoll wcsftime wcslen wcstombs wcsxfrm _tzname _write _tzset _strdup _read _open _isatty _fileno _fdopen _dup _close

secur32

AcceptSecurityContext AcquireCredentialsHandleW ApplyControlToken DecryptMessage DeleteSecurityContext EncryptMessage FreeContextBuffer FreeCredentialsHandle InitializeSecurityContextA QueryContextAttributesA

shell32

CommandLineToArgvW

ws2_32

WSASend freeaddrinfo getaddrinfo gethostname getnameinfo getservbyname getservbyport

wsock32

WSACleanup WSAGetLastError WSAStartup __WSAFDIsSet accept bind closesocket connect getpeername getsockname getsockopt htonl htons ioctlsocket listen ntohl ntohs recv recvfrom select send sendto setsockopt shutdown socket

Name

.text

Size

4.4MB

Virtual Size

4.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

31KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

526KB

Virtual Size

526KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

160KB

Virtual Size

160KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

258KB

Virtual Size

257KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

24KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

isoautodl-windows-x64.zip

bin/7za.exe

oleaut32

user32

advapi32

msvcrt

kernel32

generic

bin/aria2c.exe

advapi32

bcrypt

crypt32

iphlpapi

kernel32

msvcrt

secur32

shell32

ws2_32

wsock32

generic

get-with-aria2.cmd