Shipment Documentation-REF GZARX019-10-22[.]bat[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Shipment Documentation-REF GZARX019-10-22.bat.exe
Size 332KB
Sample221024-ld6y7sffh3
SHA256 82a31318a931319c6478e3d03d14e95e73e5e989fd4f7636114b44cd30d1dfca
MD5 4c7cd039067e1e9306162f460dbb900c
SHA1 b19e288f36c2e76663fc7bb6b4b4d9140d7ead50
SHA512 df9911a16d88218560e0cc34c8853a09b680595d3fa14168a550d97075f3d647c6f5c9ac33a0a824cdd0cb048946150140ca09f90ffc11cdb0966101116c2ba2
SSDEEP 6144:UCIo2HHRd1LeRiv2TUMiTBWZa1FrV2wzmhojgClOQHQ2JL:WHHRre0M6okrV20mho3lH
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

NSIS installer 2 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

File Explorer

Shipment Documentation-REF GZARX019-10-22.bat.exe

.exe 332KB

Shipment Documentation-REF GZARX019-10-22.bat.exe

IMPHASH e160ef8e55bb9d162da4e266afd9eef3
SHA256 82a31318a931319c6478e3d03d14e95e73e5e989fd4f7636114b44cd30d1dfca
MD5 4c7cd039067e1e9306162f460dbb900c
SHA1 b19e288f36c2e76663fc7bb6b4b4d9140d7ead50
SHA512 df9911a16d88218560e0cc34c8853a09b680595d3fa14168a550d97075f3d647c6f5c9ac33a0a824cdd0cb048946150140ca09f90ffc11cdb0966101116c2ba2
SSDEEP 6144:UCIo2HHRd1LeRiv2TUMiTBWZa1FrV2wzmhojgClOQHQ2JL:WHHRre0M6okrV20mho3lH
MD5 SHA1 SHA512 SSDEEP

windows x86

NSIS installer

installer

PE Signature issue

Digest

81:fe:f8:20:a3:51:90:1b:80:ed:60:f5:9d:8b:40:cf:28:c1:e7:8b:1f:a5:77:17:22:67:28:14:45:7d:86:51

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

PE Signature issue

Digest

e2:e6:bd:9e:8b:ef:ae:45:98:77:2a:fc:ea:06:e9:f9:51:d9:34:3f

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Subject

OU=Fremtidssikker lnsystems\ ,O=Vicente,L=Bountiful,ST=Utah,C=US,1.2.840.113549.1.9.1=#0c18466c6167646167656e404b616c646572733230362e556e6f

Serial Number

6b:12:29:1e:77:22:0d:3d

Issuer

OU=Fremtidssikker lnsystems\ ,O=Vicente,L=Bountiful,ST=Utah,C=US,1.2.840.113549.1.9.1=#0c18466c6167646167656e404b616c646572733230362e556e6f

Timespan

Oct 17, 2022 - Oct 16, 2025

Subject

OU=Fremtidssikker lnsystems\ ,O=Vicente,L=Bountiful,ST=Utah,C=US,1.2.840.113549.1.9.1=#0c18466c6167646167656e404b616c646572733230362e556e6f

Serial Number

6b:12:29:1e:77:22:0d:3d

Issuer

OU=Fremtidssikker lnsystems\ ,O=Vicente,L=Bountiful,ST=Utah,C=US,1.2.840.113549.1.9.1=#0c18466c6167646167656e404b616c646572733230362e556e6f

Timespan

Oct 17, 2022 - Oct 16, 2025

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 23, 2017 - Mar 22, 2029

Minor OS version

Major OS version

Entry point

12472

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetTickCount GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA SearchPathA GetShortPathNameA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess SetEnvironmentVariableA GetWindowsDirectoryA GetTempPathA Sleep CloseHandle LoadLibraryA lstrlenA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA ReadFile lstrcpyA lstrcatA GetSystemDirectoryA GetVersion GetProcAddress GlobalAlloc CompareFileTime SetFileTime ExpandEnvironmentStringsA lstrcmpiA lstrcmpA WaitForSingleObject GlobalFree GetExitCodeProcess GetModuleHandleA SetErrorMode GetCommandLineA LoadLibraryExA FindFirstFileA FindNextFileA DeleteFileA SetFilePointer WriteFile FindClose WritePrivateProfileStringA MultiByteToWideChar MulDiv GetPrivateProfileStringA FreeLibrary

user32

CreateWindowExA EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard GetDC SystemParametersInfoA RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx DestroyWindow CreateDialogParamA SetTimer GetDlgItem wsprintfA SetForegroundWindow ShowWindow IsWindow LoadImageA SetWindowLongA SetClipboardData EmptyClipboard OpenClipboard EndPaint PostQuitMessage FindWindowExA SendMessageTimeoutA SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA

advapi32

RegCloseKey RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegEnumValueA RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

CoCreateInstance CoTaskMemFree OleInitialize OleUninitialize

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA