9814f9d8a8b129d745d74d3069da69aaf4187146327cb615108e9ed1b5d3c58e[.]zip

General

Target
9814f9d8a8b129d745d74d3069da69aaf4187146327cb615108e9ed1b5d3c58e.zip
Size 783KB
Sample261101-hpcb7ahs5w
SHA256 78687d0c848d1f936fba1604b08f0b82171ed4876c703a36a03ae25798f9adfd
MD5 73f96814086ca7ef0198959ef7efecb5
SHA1 effac0ae143893755c2977fe68cd4e88b5a3c36e
SHA512 343066c0efaba102c8cbd60061754adceaeac1077b8139887ed51484c49c886de3e0a6e2bb853e842bd22b94cab21a5cc20f1e81f38b4a489e4ba423e93d6380
SSDEEP 24576:qZRgFNrIKEOyAjPIC55FM+svPoJU2rnrmBmC6YShizp:qZRgHIuySzPLryBmBep
TLSH
T10805337C90BBF7321C40CDAB4BE421AD931B3AD0AD422ADE5A1E354BC4BD379C4AD564
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/9814f9d8a8b129d745d74d3069da69aaf4187146327cb615108e9ed1b5d3c58e.exe

File Explorer

9814f9d8a8b129d745d74d3069da69aaf4187146327cb615108e9ed1b5d3c58e.zip

.zip 783KB
9814f9d8a8b129d745d74d3069da69aaf4187146327cb615108e9ed1b5d3c58e.exe

.exe 895KB

9814f9d8a8b129d745d74d3069da69aaf4187146327cb615108e9ed1b5d3c58e.zip

SHA256 78687d0c848d1f936fba1604b08f0b82171ed4876c703a36a03ae25798f9adfd
MD5 73f96814086ca7ef0198959ef7efecb5
SHA1 effac0ae143893755c2977fe68cd4e88b5a3c36e
SHA512 343066c0efaba102c8cbd60061754adceaeac1077b8139887ed51484c49c886de3e0a6e2bb853e842bd22b94cab21a5cc20f1e81f38b4a489e4ba423e93d6380
SSDEEP 24576:qZRgFNrIKEOyAjPIC55FM+svPoJU2rnrmBmC6YShizp:qZRgHIuySzPLryBmBep
TLSH
T10805337C90BBF7321C40CDAB4BE421AD931B3AD0AD422ADE5A1E354BC4BD379C4AD564
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

9814f9d8a8b129d745d74d3069da69aaf4187146327cb615108e9ed1b5d3c58e.exe

IMPHASH e3b6e7113c1fc5203c1761beebcb7533
SHA256 9814f9d8a8b129d745d74d3069da69aaf4187146327cb615108e9ed1b5d3c58e
MD5 4536297338323c00783fdceabf8d36bf
SHA1 7ad1bf03b480ebd2b85b2bc5be4b9140b0ce6d4d
SHA512 1d416a6057b6eb228a09b0865741e1a203c795a9e6da98c4a7318c38aa4c5de086619177434034e11996d5e4a3856e3b0d6cea33a888ef7d02d06474ed9d7582
SSDEEP 24576:cpujQRfL2Zsfeik9HV+Ovkd4pBWLv01oqc1cTfOAf:cpbDYIk91/pIL0cYf
TLSH
T1F1151212B0C38477D2A12535063DB5708AB9FE300E39DB9B7BC8C26B5E1A5D1EB39706
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

0

Major OS version

5

Entry point

22767

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\User\Desktop\Windows-classic-samples-master\Windows-classic-samples-master\Samples\Security\SecretAgreementWithPersistedKeys\cpp\Release\SecretAgreementWithPersistedKeys.pdb

ncrypt

NCryptOpenStorageProvider NCryptOpenKey NCryptDeleteKey NCryptCreatePersistedKey NCryptSetProperty NCryptFinalizeKey NCryptExportKey BCryptOpenAlgorithmProvider BCryptGenerateKeyPair BCryptFinalizeKeyPair BCryptExportKey NCryptImportKey NCryptSecretAgreement NCryptDeriveKey BCryptImportKeyPair BCryptSecretAgreement BCryptDeriveKey NCryptFreeObject BCryptDestroyKey BCryptCloseAlgorithmProvider BCryptDestroySecret

kernel32

CreateFileA GetLocaleInfoW SetStdHandle WriteConsoleW GetConsoleOutputCP WriteConsoleA InitializeCriticalSectionAndSpinCount LoadLibraryA IsValidLocale EnumSystemLocalesA GetStringTypeW GetStringTypeA GetLocaleInfoA LoadLibraryExA HeapFree HeapAlloc GetProcessHeap FreeConsole ExitProcess GetUserDefaultLCID TlsAlloc Sleep InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection InterlockedIncrement InterlockedDecrement GetSystemTimeAsFileTime RaiseException RtlUnwind TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetLastError LCMapStringA WideCharToMultiByte MultiByteToWideChar LCMapStringW GetCPInfo GetModuleHandleW GetProcAddress TlsGetValue TlsSetValue TlsFree SetLastError GetCurrentThreadId WriteFile GetStdHandle GetModuleFileNameA GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId VirtualAlloc HeapReAlloc GetConsoleCP GetConsoleMode FlushFileBuffers ReadFile SetFilePointer CloseHandle HeapSize GetACP GetOEMCP IsValidCodePage

advapi32

CryptAcquireContextA

Resubmissions

Sharing