AFHS_QTN_2023_00229-ORIANA.rar
- SHA256 db61dcd3f5c9c54b8e9cd4193bf855925452409083d0a937287f351e2ecc9546
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Folkeregistrene(1).exe
Resource
win7-20230712-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
Folkeregistrene(1).exe
Resource
win10v2004-20230703-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target AFHS_QTN_2023_00229-ORIANA.rar
- Size 453KB
- Sample230810-hjwtmsaf47
- SHA256 db61dcd3f5c9c54b8e9cd4193bf855925452409083d0a937287f351e2ecc9546
- MD5 bc8ebf9f39014db71b02f152ca9f5f51
- SHA1 1c3706ab990ca755f5d34c459ab8e01853b02d94
- SHA512 ccba5244c5128851dc2659b5e5365168793f9d68d8698a803ae0d21bf4fe4fa3a6032ca6a9775f41564122a24829cc940f34b7258eb300f35a3266329315ebe4
- SSDEEP 12288:qMcgRK2WvazUVnwH788Byanmw+YoG2+kg3z+0P5q:DfYHaz+G88JmcE6j7Pw
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- NSIS installer 2 IoCs
resource yara_rule static1/unpack001/Folkeregistrene(1).exe nsis_installer_1 static1/unpack001/Folkeregistrene(1).exe nsis_installer_2
File Explorer
-
AFHS_QTN_2023_00229-ORIANA.rar.rar 453KB
-
Folkeregistrene(1).exe.exe 483KB
Folkeregistrene(1).exe
- IMPHASH e9c0657252137ac61c1eeeba4c021000
- SHA256 e2c44f040b867623bf5bc9c9551265f134dc735562955b153b7cbe0b5165c600
- MD5 7e2aba390a87f2072a8825f25045550b
- SHA1 ba295f399408d70cfa41c9c14c82c900ba3bb842
- SHA512 a9852f68b683381dbb58e7440cd8aa8e75f79ffa74af89fe36a46e060d95d32c84e06242ee128992703100d42e033b4cd1170b8e499301bf4a7423155d830198
- SSDEEP 12288:rFJthQat+DpEdZP8DGE6TcpkjpAO7imdxAu:/QaYDpEdLLwejpl7iju
- MD5 SHA1 SHA512 SSDEEP
-
NSIS installer
PE Signature issue
Digest
33:69:41:f7:d7:02:6c:53:ea:a9:ac:8e:eb:c7:a4:33:6b:39:04:e1:8f:b5:66:f1:07:b6:f9:0a:73:ca:f3:61
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
OU=Ndhjlpsarbejders Zeuctocoelomic\ ,O=Mucocellulosic,L=Poulaines,ST=Centre-Val de Loire,C=FR,1.2.840.113549.1.9.1=#0c2046616e7461736966756c6440416c61726d74696c7374616e64656e652e557269
Chains
Aug 9, 2023
Subject
OU=Ndhjlpsarbejders Zeuctocoelomic\ ,O=Mucocellulosic,L=Poulaines,ST=Centre-Val de Loire,C=FR,1.2.840.113549.1.9.1=#0c2046616e7461736966756c6440416c61726d74696c7374616e64656e652e557269
Serial Number
4a:5f:be:aa:63:39:3c:9e:e4:61:d4:a8:52:60:1e:3b:87:24:71:50
Issuer
OU=Ndhjlpsarbejders Zeuctocoelomic\ ,O=Mucocellulosic,L=Poulaines,ST=Centre-Val de Loire,C=FR,1.2.840.113549.1.9.1=#0c2046616e7461736966756c6440416c61726d74696c7374616e64656e652e557269
Timespan
Mar 2, 2023 - Mar 1, 2026
Subject
CN=Certum Timestamp 2022,O=Asseco Data Systems S.A.,C=PL
Serial Number
2b:d4:ae:70:b9:d0:63:5b:2a:e9:84:c8:d6:74:aa:30
Issuer
CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 28, 2022 - Jul 27, 2033
Subject
CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL
Serial Number
e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87
Issuer
CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 19, 2021 - May 18, 2036
Subject
CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
Serial Number
1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27
Issuer
CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
May 31, 2021 - Sep 17, 2029
Minor OS version
Major OS version
Entry point
12907
Magic Number
267
Subsystem
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetTempPathA
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
SetEnvironmentVariableA
Sleep
GetTickCount
GetCommandLineA
lstrlenA
GetVersion
SetErrorMode
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GetWindowsDirectoryA
SetFileAttributesA
GetLastError
CreateDirectoryA
CreateProcessA
RemoveDirectoryA
CreateFileA
GetTempFileNameA
ReadFile
WriteFile
lstrcpyA
MoveFileExA
lstrcatA
GetSystemDirectoryA
GetProcAddress
GetExitCodeProcess
WaitForSingleObject
CompareFileTime
SetFileTime
GetFileAttributesA
SetCurrentDirectoryA
MoveFileA
GetFullPathNameA
GetShortPathNameA
SearchPathA
CloseHandle
lstrcmpiA
CreateThread
GlobalLock
lstrcmpA
DeleteFileA
FindFirstFileA
FindNextFileA
FindClose
SetFilePointer
GetPrivateProfileStringA
WritePrivateProfileStringA
MulDiv
MultiByteToWideChar
FreeLibrary
LoadLibraryExA
GetModuleHandleA
GlobalAlloc
GlobalFree
ExpandEnvironmentStringsA
user32
GetSystemMenu
SetClassLongA
EnableMenuItem
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
ScreenToClient
GetWindowRect
GetDlgItem
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
GetDC
ReleaseDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
EndDialog
RegisterClassA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
ExitWindowsEx
LoadImageA
CreateDialogParamA
SetTimer
SetWindowTextA
SetForegroundWindow
ShowWindow
SetWindowLongA
SendMessageTimeoutA
FindWindowExA
IsWindow
AppendMenuA
TrackPopupMenu
CreatePopupMenu
DrawTextA
EndPaint
DestroyWindow
wsprintfA
PostQuitMessage
gdi32
SelectObject
SetTextColor
SetBkMode
CreateFontIndirectA
CreateBrushIndirect
DeleteObject
GetDeviceCaps
SetBkColor
shell32
SHGetSpecialFolderLocation
ShellExecuteExA
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
SHFileOperationA
advapi32
AdjustTokenPrivileges
RegCreateKeyExA
RegOpenKeyExA
SetFileSecurityA
OpenProcessToken
LookupPrivilegeValueA
RegEnumValueA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegSetValueExA
RegQueryValueExA
RegEnumKeyA
comctl32
ImageList_Create
ImageList_AddMasked
ord17
ImageList_Destroy
ole32
OleUninitialize
OleInitialize
CoTaskMemFree
CoCreateInstance
Name
.text
Size
25KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
149KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
124KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
31KB
Virtual Size
30KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ