portfolio_harvard_3[.]4[.]zip

General

Target
portfolio_harvard_3.4.zip
Size 475KB
Sample261113-pc26eaad74
SHA256 f3b5209f72dd7ab4d57ac3fd752f8bf6194334f9d4cca764c2611a673fa4291a
MD5 c000b7de91ca11ef2d008e38955d6744
SHA1 82f4c40fad16c5f17d5f3a9237d3a58f0573a09b
SHA512 81d56bc5e8310cd474259aebd1c93393ca6f7823289f009da08610c179fefc0cac18f66c1c6f3e8de0d0af57b6185d2ad0905f9863c414ddcd68f3fb1ce8b00b
SSDEEP 12288:kr06MUv4SnAQPKTYNk/wm+iTcchv4xtHYc2OnZa:kr06MUv4t1cNk/wjibhv4b2On4
TLSH
T188A4238274716D06D096CFBDD4C1AACAD06E023D35263BE5A39294CABD940367F9BF13
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/util.exe

File Explorer

portfolio_harvard_3.4.zip

.zip 475KB
Application.cmd

25B
cert.txt

.js 177KB
util.exe

.exe 742KB

portfolio_harvard_3.4.zip

SHA256 f3b5209f72dd7ab4d57ac3fd752f8bf6194334f9d4cca764c2611a673fa4291a
MD5 c000b7de91ca11ef2d008e38955d6744
SHA1 82f4c40fad16c5f17d5f3a9237d3a58f0573a09b
SHA512 81d56bc5e8310cd474259aebd1c93393ca6f7823289f009da08610c179fefc0cac18f66c1c6f3e8de0d0af57b6185d2ad0905f9863c414ddcd68f3fb1ce8b00b
SSDEEP 12288:kr06MUv4SnAQPKTYNk/wm+iTcchv4xtHYc2OnZa:kr06MUv4t1cNk/wjibhv4b2On4
TLSH
T188A4238274716D06D096CFBDD4C1AACAD06E023D35263BE5A39294CABD940367F9BF13
MD5 SHA1 SHA512 SSDEEP TLSH

util.exe

IMPHASH 0d8f96525fa416afffa287da796d1f5e
SHA256 e227d47facf0e2f5b9e5c54a23a86b31272696b64bbbb9932a31fe06973677bd
MD5 7a59df9ee2ae38c391b60c001d8fef11
SHA1 a5fa49ca3da03fb01f2a96fa99521f263665f9ff
SHA512 8237b3fd2a41a08bfb8ca95060e1a7f8b030538d587746b1b050d1ce0f2a6f4898ff31e65243c97e6b343a8112159839cfa85f47ecffc20a621dac64cf947b7a
SSDEEP 12288:PFsr3uNFZnKsXrLdiu7c7nu86VDfU/+tZxMUJ4EBiSxsyYA:PFs4FZnKsrLdiCUMs/KiesyYA
TLSH
T184F4BF81B6D381F3D992117148B9A77A0E3D6D1007259CEB83D43AF68D346C0AF776AE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

383313

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\a\defold\defold\share\ext\luajit\tmp_win32\LuaJIT-3e223cb8a41cff3b92931acb846af7b67a5d2537\src\luajit.pdb

kernel32

RaiseException GetLastError SetLastError RtlUnwind GetProcAddress LoadLibraryExA VirtualAlloc VirtualFree VirtualQuery InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection WaitForSingleObject Sleep CreateThread FreeLibrary GetModuleFileNameA GetModuleHandleA GetModuleHandleExA FormatMessageA VirtualProtect UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW SetEndOfFile InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW EncodePointer SetConsoleCtrlHandler ExitProcess GetModuleHandleExW ReadFile CloseHandle DuplicateHandle CreateProcessW QueryPerformanceFrequency GetStdHandle WriteFile GetModuleFileNameW GetCommandLineA GetCommandLineW HeapAlloc HeapFree GetTempPathW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType FlushFileBuffers GetConsoleOutputCP GetConsoleMode GetFileSizeEx SetFilePointerEx ReadConsoleW DecodePointer GetExitCodeProcess GetFileAttributesExW CreatePipe CreateFileW GetTimeZoneInformation MultiByteToWideChar WideCharToMultiByte DeleteFileW MoveFileExW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetStringTypeW GetProcessHeap HeapSize HeapReAlloc WriteConsoleW

__swprintf_l __vswprintf_l _fprintf_l _fprintf_p _fprintf_p_l _fprintf_s_l _fscanf_l _fscanf_s_l _fwprintf_l _fwprintf_p _fwprintf_p_l _fwprintf_s_l _fwscanf_l _fwscanf_s_l _printf_l _printf_p _printf_p_l _printf_s_l _scanf_l _scanf_s_l _scprintf _scprintf_l _scprintf_p _scprintf_p_l _scwprintf _scwprintf_l _scwprintf_p _scwprintf_p_l _snprintf _snprintf_c _snprintf_c_l _snprintf_l _snprintf_s _snprintf_s_l _snscanf _snscanf_l _snscanf_s _snscanf_s_l _snwprintf _snwprintf_l _snwprintf_s _snwprintf_s_l _snwscanf _snwscanf_l _snwscanf_s _snwscanf_s_l _sprintf_l _sprintf_p _sprintf_p_l _sprintf_s_l _sscanf_l _sscanf_s_l _swprintf _swprintf_c _swprintf_c_l _swprintf_l _swprintf_p _swprintf_p_l _swprintf_s_l _swscanf_l _swscanf_s_l _vfprintf_l _vfprintf_p _vfprintf_p_l _vfprintf_s_l _vfscanf_l _vfscanf_s_l _vfwprintf_l _vfwprintf_p _vfwprintf_p_l _vfwprintf_s_l _vfwscanf_l _vfwscanf_s_l _vprintf_l _vprintf_p _vprintf_p_l _vprintf_s_l _vscanf_l _vscanf_s_l _vscprintf _vscprintf_l _vscprintf_p _vscprintf_p_l _vscwprintf _vscwprintf_l _vscwprintf_p _vscwprintf_p_l _vsnprintf _vsnprintf_c _vsnprintf_c_l _vsnprintf_l _vsnprintf_s _vsnprintf_s_l _vsnwprintf _vsnwprintf_l _vsnwprintf_s _vsnwprintf_s_l _vsnwscanf_l _vsnwscanf_s_l _vsprintf_l _vsprintf_p _vsprintf_p_l _vsprintf_s_l _vsscanf_l _vsscanf_s_l _vswprintf _vswprintf_c _vswprintf_c_l _vswprintf_l _vswprintf_p _vswprintf_p_l _vswprintf_s_l _vswscanf_l _vswscanf_s_l _vwprintf_l _vwprintf_p _vwprintf_p_l _vwprintf_s_l _vwscanf_l _vwscanf_s_l _wprintf_l _wprintf_p _wprintf_p_l _wprintf_s_l _wscanf_l _wscanf_s_l fprintf fprintf_s fscanf fscanf_s fwprintf fwprintf_s fwscanf fwscanf_s printf printf_s scanf scanf_s snprintf sprintf sprintf_s sscanf sscanf_s swprintf swprintf_s swscanf swscanf_s vfprintf vfprintf_s vfscanf vfscanf_s vfwprintf vfwprintf_s vfwscanf vfwscanf_s vprintf vprintf_s vscanf vscanf_s vsnprintf vsnprintf_s vsprintf vsprintf_s vsscanf vsscanf_s vswprintf vswprintf_s vswscanf vswscanf_s vwprintf vwprintf_s vwscanf vwscanf_s wprintf wprintf_s wscanf wscanf_s

Sharing