version[.]zip | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
version.zip
Size 10.1MB
Sample261104-yr5phsef24
SHA256 b7579a7e1c0d532efb53a124bc7ad3f4bd3d6504f925950e577be37345f859a7
MD5 68b20acfb18af679d591f307ee5bf58e
SHA1 5ba596baf8f5bee4a0802df6aa3c9323adc58ae7
SHA512 5f73a983e034d4d90bed585b34b78a355ea7e130e47d712407345bb1db89a33e82acf58ef7a3c5d7417047adb67f364a594a36fbb3cf1be5d3f44f9a6c446bbf
SSDEEP 196608:O0rxZ5SgkVFSYpbqqvC39dNTxZdOtX1D/V8wovLzRz3VUMoGQqWDvoTyxZCp:O0rxZ5SZVFdI8Ivq1/V8HxV6G3WDdUp
TLSH
T111B633EB2E6326DB5FFF6913C0704BE7729218CA15838E976E580974DBABC1530DC990
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Madium-Module.dll
unpack001/Madium.exe

File Explorer

version.zip

.zip 10.1MB
Madium-Module.dll

.dll 10.2MB
Madium.exe

.exe 15.0MB
version.txt

5B

version.zip

SHA256 b7579a7e1c0d532efb53a124bc7ad3f4bd3d6504f925950e577be37345f859a7
MD5 68b20acfb18af679d591f307ee5bf58e
SHA1 5ba596baf8f5bee4a0802df6aa3c9323adc58ae7
SHA512 5f73a983e034d4d90bed585b34b78a355ea7e130e47d712407345bb1db89a33e82acf58ef7a3c5d7417047adb67f364a594a36fbb3cf1be5d3f44f9a6c446bbf
SSDEEP 196608:O0rxZ5SgkVFSYpbqqvC39dNTxZdOtX1D/V8wovLzRz3VUMoGQqWDvoTyxZCp:O0rxZ5SZVFdI8Ivq1/V8HxV6G3WDdUp
TLSH
T111B633EB2E6326DB5FFF6913C0704BE7729218CA15838E976E580974DBABC1530DC990
MD5 SHA1 SHA512 SSDEEP TLSH

Madium-Module.dll

IMPHASH 0f72cf7cf7276b7777cf80ceef029709
SHA256 2b427102f1cc97c298f4ec52d645f5a5ec61b3e51cca35f7381d46f90c5c0985
MD5 a0174daff8f54438c53332c53a966031
SHA1 a5e434319c10fa9389d3d2d80982cd1083795553
SHA512 8bac4ebeb826cb0596d2c4a39201a49ca9310580aede572677f5513ae16a070d949eabf6941f129ec961e07e9d4cc97ff3f4cc6bda6bbe7940b95bfac4f9ecfa
SSDEEP 98304:qZTEHz+69NupF37u1u4vNNwvhMwCIfxtzibX9hVY1NH6ZIhtygTrw:uTEy2ukNwvhMjIfxtzibPKvaZ+jrw
TLSH
T151B69E6AB6A501ACD83BC038C6578E23EBB1B4961731A7EF059056792F77BE0173E350
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6327696

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

ntdll

NtWriteFile RtlPcToFileHeader RtlUnwindEx VerSetConditionMask RtlNtStatusToDosError RtlUnwind

kernel32

GetFileSizeEx DeleteFileW SetStdHandle SetEndOfFile GetSystemTimePreciseAsFileTime GetModuleHandleA LocalFree CloseHandle FlushFileBuffers SetConsoleCtrlHandler GetFileInformationByHandle GetDriveTypeW GetFileInformationByHandleEx MoveFileExW AreFileApisANSI FindFirstFileExW GetVolumeInformationA GetFullPathNameW GetFinalPathNameByHandleW SetFileInformationByHandle GlobalFree GetFileAttributesExW WriteConsoleW FreeLibrary GetConsoleOutputCP Sleep ReadConsoleW ReadConsoleA SetConsoleMode GetConsoleMode GetSystemTimeAsFileTime GetFileType GetStdHandle GetSystemDirectoryA FindNextFileW FindFirstFileW FindClose GetSystemTime SetFileCompletionNotificationModes GetTickCount64 SetLastError GetLastError GetHandleInformation GetTickCount GetLocalTime GetProcAddress SetFilePointerEx InterlockedFlushSList FlsAlloc FlsGetValue FlsSetValue FlsFree CreateThread ExitThread FreeLibraryAndExitThread ReadFile ExitProcess PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetTimeZoneInformation IsProcessorFeaturePresent GetModuleFileNameW IsDebuggerPresent UnhandledExceptionFilter CreateThreadpoolWork SubmitThreadpoolWork CloseThreadpoolWork CreateFileW WriteFile GetCurrentProcess TerminateProcess GetModuleHandleExW GlobalAlloc GlobalUnlock GlobalLock VirtualAlloc GetCurrentThreadId GetEnvironmentVariableA QueryPerformanceCounter QueryPerformanceFrequency OutputDebugStringA MultiByteToWideChar WideCharToMultiByte LoadLibraryA GetLocaleInfoA IsDBCSLeadByte InitializeCriticalSection LeaveCriticalSection DeleteCriticalSection GetCurrentProcessId TlsAlloc TlsGetValue TlsSetValue TlsFree FormatMessageA CreateIoCompletionPort GetQueuedCompletionStatusEx InitializeSRWLock ReleaseSRWLockExclusive InitializeSListHead AcquireSRWLockExclusive AcquireSRWLockShared InitOnceExecuteOnce GetModuleHandleW VirtualProtect VirtualFree SwitchToFiber DeleteFiber CreateFiberEx SystemTimeToFileTime ReleaseSemaphore WaitForSingleObject GetExitCodeThread CreateSemaphoreA GetEnvironmentVariableW GetACP ConvertFiberToThread ConvertThreadToFiberEx GetProcessHeap HeapFree HeapReAlloc GetCurrentDirectoryW RtlCaptureContext RtlLookupFunctionEntry WaitForSingleObjectEx lstrlenW CreateMutexA ReleaseMutex RtlVirtualUnwind HeapAlloc FormatMessageW InitializeCriticalSectionEx CompareFileTime MoveFileExA SleepEx VerifyVersionInfoW WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW LoadLibraryExW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW IsValidCodePage GetOEMCP GetCommandLineA GetLocaleInfoEx CreateDirectoryW CreateFile2 GetCommandLineW GetEnvironmentStringsW GetStartupInfoW SetUnhandledExceptionFilter GetCPInfo ReleaseSRWLockShared RaiseException EncodePointer DecodePointer SetEnvironmentVariableW HeapSize GetStringTypeW EnterCriticalSection FreeEnvironmentStringsW LCMapStringEx CompareStringEx TryAcquireSRWLockExclusive

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

bcrypt

BCryptGenRandom

advapi32

CryptAcquireContextA RegOpenKeyExA RegQueryValueExA DeregisterEventSource RegisterEventSourceW ReportEventW CryptAcquireContextW CryptReleaseContext CryptGenRandom CryptDestroyKey CryptSetHashParam CryptGetProvParam CryptGetUserKey CryptExportKey CryptDecrypt CryptCreateHash CryptDestroyHash CryptSignHashW CryptHashData CryptGetHashParam RegCloseKey CryptEnumProvidersW

user32

WindowFromPoint ReleaseDC SetWindowLongA SetWindowLongW LoadCursorA MonitorFromWindow GetMonitorInfoA EnumDisplayMonitors ScreenToClient GetProcessWindowStation GetUserObjectInformationW MessageBoxW GetDC SetForegroundWindow IsWindowUnicode ReleaseCapture SetCapture GetCursorPos SetCursor SetCursorPos AdjustWindowRectEx GetCapture GetKeyState SetFocus GetPropA IsIconic SetWindowPos SetLayeredWindowAttributes ShowWindow DestroyWindow IsChild CreateWindowExW RegisterClassExW DefWindowProcW GetMessageExtraInfo TrackMouseEvent GetKeyboardLayout GetClipboardData SetWindowLongPtrA CallWindowProcA EmptyClipboard SetClipboardData CloseClipboard OpenClipboard ClientToScreen GetClientRect GetForegroundWindow GetSystemMetrics MapVirtualKeyA mouse_event keybd_event MessageBoxA GetWindowThreadProcessId EnumWindows GetWindowTextA BringWindowToTop SetPropA GetWindowLongW

gdi32

GetDeviceCaps

shell32

SHGetKnownFolderPath ShellExecuteW

ole32

CoTaskMemFree

imm32

ImmReleaseContext ImmSetCompositionWindow ImmSetCandidateWindow ImmGetContext

d3dcompiler_47

D3DCompile

crypt32

CertOpenStore CertCloseStore CertOpenSystemStoreA CertGetIntendedKeyUsage CertGetEnhancedKeyUsage CertOpenSystemStoreW CertGetCertificateContextProperty CertFreeCertificateContext CertDuplicateCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore

ws2_32

bind closesocket listen send setsockopt accept connect recv recvfrom sendto htonl htons ntohs select WSAStartup WSACleanup getaddrinfo freeaddrinfo socket inet_ntop WSAIoctl WSASocketA WSASetLastError inet_addr inet_ntoa gethostbyaddr gethostbyname getservbyport getservbyname shutdown WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAEventSelect WSAResetEvent WSAWaitForMultipleEvents __WSAFDIsSet inet_pton ioctlsocket getpeername getsockname getsockopt WSAGetLastError

Name

.text

Size

6.5MB

Virtual Size

6.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.4MB

Virtual Size

2.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

974KB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

318KB

Virtual Size

318KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

74KB

Virtual Size

74KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Madium.exe

IMPHASH fab7884061ecf1fe3f624341e2276d27
SHA256 edaf6676fe03d0a552f07d7fd438f34d8fe79612c80a365cb42fba679bbea530
MD5 bb9f911b6b7c613bd00c34e0595ac224
SHA1 f36e89aa7dc47d4da77b70f04a853ae5d2abd07f
SHA512 77f139b49b10a17348923f9e0442055ba23aeaae4f412a3f180152e8f324f5d05ff3358ae0bc12b7b8286f379bec974fd41a984eef8c98d0cb032f3d6c48f120
SSDEEP 98304:mrIWZS8bcjmxyhAs8qPC3Pf3JMApcQ1nqj3I/JW+kAX42+PKdILdlhXpGR5o:mEW3bc7vC3XJMsJhBAKdIdB
TLSH
T183F607217B5A99ACC05BC47483478A725A7570CB0B35B9FF448492383FAABF52F38359
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

9750124

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Madium.pdb

kernel32

GetCurrentProcess GetModuleHandleW GetUserDefaultUILanguage LCIDToLocaleName CreateJobObjectW AssignProcessToJobObject GetLastError SetInformationJobObject QueryFullProcessImageNameW CreateToolhelp32Snapshot Process32FirstW Process32NextW GetCurrentThreadId InitializeCriticalSectionEx EncodePointer OpenProcess FlsSetValue FlsGetValue FlsAlloc RaiseException RtlPcToFileHeader RtlUnwindEx SetUnhandledExceptionFilter InitializeSListHead GetSystemTimeAsFileTime SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive DeleteCriticalSection TerminateProcess FlsFree CloseHandle DuplicateHandle SetHandleInformation FreeLibrary LoadLibraryExW HeapFree GetProcessHeap SetFileTime GetModuleFileNameW FindNextFileW RtlLookupFunctionEntry RtlCaptureContext GetProcessId GetExitCodeProcess GetSystemInfo QueryPerformanceCounter GetSystemTimePreciseAsFileTime WriteFileEx CreateProcessW GetWindowsDirectoryW GetSystemDirectoryW CompareStringOrdinal FreeEnvironmentStringsW SleepEx ReadFileEx WaitForMultipleObjects CreateThread WaitForSingleObject SetWaitableTimer CreateWaitableTimerExW SetFileInformationByHandle LoadLibraryExA OutputDebugStringW HeapAlloc OutputDebugStringA GetStdHandle WriteConsoleW MultiByteToWideChar ReleaseMutex FormatMessageW CancelIo CreateMutexA QueryPerformanceFrequency ExitProcess GetTempPathW GetFullPathNameW SetThreadStackGuarantee GetCurrentProcessId FindClose FindFirstFileExW DeleteFileW CreateEventW SwitchToThread WaitForSingleObjectEx GetFileInformationByHandleEx GetFinalPathNameByHandleW CreateDirectoryW MoveFileExW CreatePipe CreateIoCompletionPort PostQueuedCompletionStatus GetQueuedCompletionStatusEx GetOverlappedResult ReadFile WideCharToMultiByte HeapReAlloc GetEnvironmentVariableW SetFileCompletionNotificationModes GetFileAttributesW CreateFileW GetFileInformationByHandle GetConsoleMode GetCommandLineW AddVectoredExceptionHandler lstrlenW LoadLibraryA LoadLibraryW GetConsoleOutputCP GetModuleHandleA RtlVirtualUnwind SetEnvironmentVariableW Sleep GetEnvironmentStringsW GetCurrentDirectoryW SetLastError GetCurrentThread GetProcAddress

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

user32

DispatchMessageW SendMessageW LoadCursorW SetWindowPos EnumWindows AdjustWindowRectEx CreateWindowExW IsWindow RegisterTouchWindow RegisterClassExW GetMessageA DispatchMessageA EnumChildWindows IsIconic InvalidateRgn SetCursorPos InvalidateRect TranslateMessage GetActiveWindow GetForegroundWindow AdjustWindowRect GetWindowThreadProcessId IsWindowVisible MapVirtualKeyW GetMessageW DefWindowProcW FlashWindowEx ChangeDisplaySettingsExW SetWindowPlacement GetWindowPlacement TranslateAcceleratorW GetCursorPos PostThreadMessageW ValidateRect SetCursor GetUpdateRect UpdateWindow ClientToScreen GetClientRect GetWindowLongW MonitorFromWindow ScreenToClient PostMessageW MonitorFromRect GetMonitorInfoW GetSystemMetrics FillRect SystemParametersInfoW TrackMouseEvent DestroyWindow PeekMessageW RedrawWindow GetTouchInputInfo CloseTouchInputHandle GetSystemMenu ShowCursor GetMenu EnableMenuItem GetClipCursor ClipCursor RegisterRawInputDevices ReleaseCapture SetCapture MsgWaitForMultipleObjectsEx RegisterWindowMessageA SetParent MapWindowPoints GetWindow SetFocus ShowWindow ReleaseDC EnableWindow IsWindowEnabled GetWindowRect SetWindowLongPtrW GetParent GetWindowLongPtrW SetPropW FindWindowExW SetWindowRgn IsProcessDPIAware GetDC SetWindowDisplayAffinity SetWindowLongW DrawTextW GetWindowDC OffsetRect GetMenuBarInfo DestroyMenu CheckMenuItem RemoveMenu CreatePopupMenu CreateMenu SetMenuItemInfoW AppendMenuW InsertMenuW TrackPopupMenu PostQuitMessage CreateAcceleratorTableW DestroyAcceleratorTable DrawMenuBar SetMenu DrawIconEx GetMenuItemInfoW CreateIcon GetKeyboardLayout ToUnicodeEx GetKeyState GetAsyncKeyState GetKeyboardState MapVirtualKeyExW GetRawInputData SetWindowTextW GetWindowTextW GetWindowTextLengthW SendInput SetForegroundWindow DestroyIcon EnumDisplayMonitors MonitorFromPoint SystemParametersInfoA

advapi32

OpenProcessToken GetTokenInformation RegQueryValueExW RegCloseKey EventUnregister RegGetValueW RegOpenKeyExW EventRegister SystemFunction036 EventWriteTransfer EventSetInformation

shell32

ShellExecuteW DragFinish SHAppBarMessage SHGetKnownFolderPath ShellExecuteExW ILCreateFromPathW ILFree SHOpenFolderAndSelectItems DragQueryFileW

bcryptprimitives

ProcessPrng

ntdll

RtlGetVersion RtlNtStatusToDosError NtReadFile NtCreateFile NtCancelIoFileEx NtDeviceIoControlFile NtOpenFile NtCreateNamedPipeFile NtWriteFile

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressSingle WakeByAddressAll

ole32

OleInitialize CoCreateFreeThreadedMarshaler CoInitializeEx CoCreateInstance CoInitialize RevokeDragDrop CoTaskMemAlloc RegisterDragDrop CoTaskMemFree CoUninitialize

comctl32

DefSubclassProc TaskDialogIndirect RemoveWindowSubclass SetWindowSubclass

gdi32

CreateDIBSection SelectObject CreateSolidBrush BitBlt SetBkMode SetTextColor DeleteDC CreateRectRgn CombineRgn GetDeviceCaps DeleteObject CreateCompatibleDC

dwmapi

DwmGetWindowAttribute DwmEnableBlurBehindWindow DwmSetWindowAttribute

shlwapi

SHCreateMemStream

oleaut32

SysFreeString GetErrorInfo SysStringLen SetErrorInfo

ws2_32

WSAStartup closesocket recv WSASend send getsockname getpeername getsockopt accept setsockopt ioctlsocket connect WSACleanup WSAIoctl WSASocketW bind listen shutdown WSAGetLastError socket freeaddrinfo getaddrinfo

bcrypt

BCryptGenRandom

api-ms-win-crt-math-l1-1-0

__setusermatherr pow roundf trunc floor round

api-ms-win-crt-string-l1-1-0

wcslen _wcsicmp strcpy_s wcscmp wcsncat

api-ms-win-crt-convert-l1-1-0

_ultow_s _wtoi wcstol

api-ms-win-crt-runtime-l1-1-0

__p___argv _initialize_narrow_environment __p___argc _cexit _c_exit _register_thread_local_exe_atexit_callback _seh_filter_exe _set_app_type exit abort _configure_narrow_argv _initialize_onexit_table terminate _crt_atexit _exit _get_initial_narrow_environment _initterm _initterm_e _register_onexit_function

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free _set_new_mode malloc _callnewh calloc

Name

.text

Size

9.5MB

Virtual Size

9.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

4.9MB

Virtual Size

4.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

14KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

529KB

Virtual Size

529KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.taubndl

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

64KB

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

56KB

Virtual Size

55KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

version.zip

Madium-Module.dll

ntdll

kernel32

bcryptprimitives

api-ms-win-core-synch-l1-2-0

bcrypt

advapi32

user32

gdi32

shell32

ole32

imm32

d3dcompiler_47

crypt32

ws2_32

generic

Madium.exe

kernel32

version

user32

advapi32

shell32

bcryptprimitives

ntdll

api-ms-win-core-synch-l1-2-0

ole32

comctl32

gdi32

dwmapi

shlwapi

oleaut32

ws2_32

bcrypt

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic

version.txt