CommandeComposante
DeclareProxy
GeneralParam
LibereMutex
Overview
overview
10Static
static
8Presences\...IC.rtf
windows7-x64
4Presences\...IC.rtf
windows10-2004-x64
Presences\...es.exe
windows7-x64
10Presences\...es.exe
windows10-2004-x64
10Presences\...on.doc
windows7-x64
4Presences\...on.doc
windows10-2004-x64
1Presences\...AJ.exe
windows7-x64
10Presences\...AJ.exe
windows10-2004-x64
10Presences\...el.doc
windows7-x64
4Presences\...el.doc
windows10-2004-x64
1Presences\...ts.doc
windows7-x64
4Presences\...ts.doc
windows10-2004-x64
1Presences\...ge.rtf
windows7-x64
4Presences\...ge.rtf
windows10-2004-x64
1Presences\...te.rtf
windows7-x64
4Presences\...te.rtf
windows10-2004-x64
1Presences\...if.exe
windows7-x64
7Presences\...if.exe
windows10-2004-x64
7Presences\...15.exe
windows7-x64
7Presences\...15.exe
windows10-2004-x64
7Presences\...es.exe
windows7-x64
7Presences\...es.exe
windows10-2004-x64
7Presences\...al.bat
windows7-x64
1Presences\...al.bat
windows10-2004-x64
1Presences\...au.bat
windows7-x64
1Presences\...au.bat
windows10-2004-x64
1Presences\...RO.bat
windows7-x64
1Presences\...RO.bat
windows10-2004-x64
1Presences\...ns.rtf
windows7-x64
4Presences\...ns.rtf
windows10-2004-x64
1Presences\...es.exe
windows7-x64
10Presences\...es.exe
windows10-2004-x64
10Behavioral task
behavioral1
Sample
Presences\EnteteDossier_HLI_Presences_ERIC.rtf
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
Presences\EnteteDossier_HLI_Presences_ERIC.rtf
Resource
win10v2004-20231023-en
Behavioral task
behavioral3
Sample
Presences\Exe\HLI_Presences.exe
Resource
win7-20231023-en
Behavioral task
behavioral4
Sample
Presences\Exe\HLI_Presences.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral5
Sample
Presences\Exe\HLI_Presences_Administration.doc
Resource
win7-20231020-en
Behavioral task
behavioral6
Sample
Presences\Exe\HLI_Presences_Administration.doc
Resource
win10v2004-20231020-en
Behavioral task
behavioral7
Sample
Presences\Exe\HLI_Presences_MAJ.exe
Resource
win7-20231020-en
Behavioral task
behavioral8
Sample
Presences\Exe\HLI_Presences_MAJ.exe
Resource
win10v2004-20231020-en
Behavioral task
behavioral9
Sample
Presences\Exe\HLI_Presences_Manuel.doc
Resource
win7-20231023-en
Behavioral task
behavioral10
Sample
Presences\Exe\HLI_Presences_Manuel.doc
Resource
win10v2004-20231025-en
Behavioral task
behavioral11
Sample
Presences\Exe\Liste_Droits.doc
Resource
win7-20231023-en
Behavioral task
behavioral12
Sample
Presences\Exe\Liste_Droits.doc
Resource
win10v2004-20231023-en
Behavioral task
behavioral13
Sample
Presences\Exe\ModelesExcel\CWT_BasPage.rtf
Resource
win7-20231025-en
Behavioral task
behavioral14
Sample
Presences\Exe\ModelesExcel\CWT_BasPage.rtf
Resource
win10v2004-20231025-en
Behavioral task
behavioral15
Sample
Presences\Exe\ModelesExcel\CWT_Entete.rtf
Resource
win7-20231025-en
Behavioral task
behavioral16
Sample
Presences\Exe\ModelesExcel\CWT_Entete.rtf
Resource
win10v2004-20231025-en
Behavioral task
behavioral17
Sample
Presences\Exe\_Install\HLI_Presences_Modif.exe
Resource
win7-20231023-en
Behavioral task
behavioral18
Sample
Presences\Exe\_Install\HLI_Presences_Modif.exe
Resource
win10v2004-20231020-en
Behavioral task
behavioral19
Sample
Presences\Exe\_Install\Install_ODBC_HF_V15.exe
Resource
win7-20231023-en
Behavioral task
behavioral20
Sample
Presences\Exe\_Install\Install_ODBC_HF_V15.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral21
Sample
Presences\Exe\_Install\Install_Presences.exe
Resource
win7-20231023-en
Behavioral task
behavioral22
Sample
Presences\Exe\_Install\Install_Presences.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral23
Sample
Presences\Exe\_Install\WDMODFIC_Local.bat
Resource
win7-20231020-en
Behavioral task
behavioral24
Sample
Presences\Exe\_Install\WDMODFIC_Local.bat
Resource
win10v2004-20231023-en
Behavioral task
behavioral25
Sample
Presences\Exe\_Install\WDMODFIC_Reseau.bat
Resource
win7-20231020-en
Behavioral task
behavioral26
Sample
Presences\Exe\_Install\WDMODFIC_Reseau.bat
Resource
win10v2004-20231023-en
Behavioral task
behavioral27
Sample
Presences\Exe\_Install\WDMODFIC_VOSTRO.bat
Resource
win7-20231025-en
Behavioral task
behavioral28
Sample
Presences\Exe\_Install\WDMODFIC_VOSTRO.bat
Resource
win10v2004-20231023-en
Behavioral task
behavioral29
Sample
Presences\Exe\_Versions.rtf
Resource
win7-20231023-en
Behavioral task
behavioral30
Sample
Presences\Exe\_Versions.rtf
Resource
win10v2004-20231020-en
Behavioral task
behavioral31
Sample
Presences\Exe_Maj_Postes\HLI_Presences.exe
Resource
win7-20231020-en
Behavioral task
behavioral32
Sample
Presences\Exe_Maj_Postes\HLI_Presences.exe
Resource
win10v2004-20231020-en
Target
9ed6073c47e90cf622bf022e74e96d68c140702869dc071c7c14f8fbaa4ad08c.zip.zip
Size
66.5MB
MD5
d697f13198f9e5a53f027bd54d144046
SHA1
2b2f682a329ba106a0ce995caeeefc829b3e8b4c
SHA256
6b35d2fdd8fba267ee755f424060bc2829e6f772e28df0c0a4ddfc30b3a57646
SHA512
de1e87595db94cdc650bed794088ddfe4815f1fb1e5783ba735bcf9844c0c1f4fa98feda2c5b5850f08de7876521a54fe19a69427774aca23c7def1c969fe66c
SSDEEP
1572864:xNWd/7O41twceB5sRtdK1FMd8hUK7UEKpUMktYNsqpR8u0l0nVoNuD:xNcRusZuhUK7h3Dfqph0CnN
resource | yara_rule |
---|---|
static1/unpack002/Presences\Exe\Liste_Droits.doc | office_xlm_macros |
resource | yara_rule |
---|---|
static1/unpack002/Presences\Exe\HLI_Presences_MAJ.exe | upx |
Checks for missing Authenticode signature.
resource |
---|
unpack002/Presences\Exe\HLI_Presences.exe |
unpack002/Presences\Exe\HLI_Presences_MAJ.exe |
unpack002/Presences\Exe\_Install\HLI_Presences_Modif.exe |
unpack002/Presences\Exe\_Install\Install_ODBC_HF_V15.exe |
unpack002/Presences\Exe\_Install\Install_Presences.exe |
unpack002/Presences\Exe_Maj_Postes\HLI_Presences.exe |
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
??1type_info@@UAE@XZ
_except_handler3
_onexit
__dllonexit
isdigit
_snprintf
strncpy
vsprintf
_mbclen
_mbsinc
memcmp
wcscpy
_ismbcspace
realloc
_mbctoupper
_mbspbrk
_mbsrchr
_makepath
_stati64
memmove
_mbsstr
wcscat
wcschr
_mbschr
memchr
_vsnprintf
rand
wcslen
_mbsnbcpy
_mbsnbicmp
sprintf
atoi
strcat
strcpy
_mbscmp
strncmp
_mbsicmp
memcpy
_stricmp
gmtime
time
strlen
free
malloc
memset
??3@YAXPAX@Z
??2@YAPAXI@Z
__CxxFrameHandler
_CxxThrowException
FreeLibrary
RaiseException
GetSystemDefaultLangID
CreateThread
TerminateThread
ResumeThread
CreateProcessA
InterlockedExchange
ReleaseSemaphore
CreateSemaphoreA
MultiByteToWideChar
CompareStringA
WritePrivateProfileStringA
GetCurrentThreadId
TlsFree
TlsAlloc
VirtualProtect
VirtualQuery
TlsGetValue
TlsSetValue
GetFullPathNameA
FindNextFileA
SetFileAttributesA
GetFileAttributesA
FindClose
FindFirstFileA
CreateDirectoryA
CopyFileA
MoveFileA
DeleteFileA
CreateFileA
FileTimeToSystemTime
FileTimeToLocalFileTime
SetLastError
SetErrorMode
SetEndOfFile
FlushFileBuffers
UnlockFileEx
LockFileEx
GetVersion
UnlockFile
LockFile
SetFilePointer
WriteFile
WideCharToMultiByte
GetDriveTypeA
GetVolumeInformationA
GetLogicalDriveStringsA
GetFileInformationByHandle
lstrlenA
LocalAlloc
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
CreateMailslotA
ExpandEnvironmentStringsA
GetLocalTime
GetComputerNameA
GetProfileStringA
ReadFile
GetExitCodeProcess
GetMailslotInfo
Sleep
GetPrivateProfileStringA
GetPrivateProfileIntA
ExitProcess
GetCommandLineA
LocalFree
GetModuleFileNameA
GetLastError
CreateFileMappingA
CloseHandle
MapViewOfFile
UnmapViewOfFile
GetVersionExA
GetModuleHandleA
GetProcAddress
CreateEventA
GetStartupInfoA
MulDiv
LoadLibraryA
SetEvent
FormatMessageA
FindResourceA
LoadResource
LockResource
FreeResource
GetTempPathA
GetTempFileNameA
OpenFileMappingA
CreateMutexA
WaitForSingleObject
ReleaseMutex
GetCurrentProcessId
CommandeComposante
DeclareProxy
GeneralParam
LibereMutex
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
??1type_info@@UAE@XZ
_except_handler3
_onexit
__dllonexit
isdigit
_snprintf
strncpy
vsprintf
_mbclen
_mbsinc
memcmp
wcscpy
_ismbcspace
realloc
_mbctoupper
_mbspbrk
_mbsrchr
_makepath
_stati64
memmove
_mbsstr
wcscat
wcschr
_mbschr
memchr
_vsnprintf
rand
wcslen
_mbsnbcpy
_mbsnbicmp
sprintf
atoi
strcat
strcpy
_mbscmp
strncmp
_mbsicmp
memcpy
_stricmp
gmtime
time
strlen
free
malloc
memset
??3@YAXPAX@Z
??2@YAPAXI@Z
__CxxFrameHandler
_CxxThrowException
FreeLibrary
RaiseException
GetSystemDefaultLangID
CreateThread
TerminateThread
ResumeThread
CreateProcessA
InterlockedExchange
ReleaseSemaphore
CreateSemaphoreA
MultiByteToWideChar
CompareStringA
WritePrivateProfileStringA
GetCurrentThreadId
TlsFree
TlsAlloc
VirtualProtect
VirtualQuery
TlsGetValue
TlsSetValue
GetFullPathNameA
FindNextFileA
SetFileAttributesA
GetFileAttributesA
FindClose
FindFirstFileA
CreateDirectoryA
CopyFileA
MoveFileA
DeleteFileA
CreateFileA
FileTimeToSystemTime
FileTimeToLocalFileTime
SetLastError
SetErrorMode
SetEndOfFile
FlushFileBuffers
UnlockFileEx
LockFileEx
GetVersion
UnlockFile
LockFile
SetFilePointer
WriteFile
WideCharToMultiByte
GetDriveTypeA
GetVolumeInformationA
GetLogicalDriveStringsA
GetFileInformationByHandle
lstrlenA
LocalAlloc
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
CreateMailslotA
ExpandEnvironmentStringsA
GetLocalTime
GetComputerNameA
GetProfileStringA
ReadFile
GetExitCodeProcess
GetMailslotInfo
Sleep
GetPrivateProfileStringA
GetPrivateProfileIntA
ExitProcess
GetCommandLineA
LocalFree
GetModuleFileNameA
GetLastError
CreateFileMappingA
CloseHandle
MapViewOfFile
UnmapViewOfFile
GetVersionExA
GetModuleHandleA
GetProcAddress
CreateEventA
GetStartupInfoA
MulDiv
LoadLibraryA
SetEvent
FormatMessageA
FindResourceA
LoadResource
LockResource
FreeResource
GetTempPathA
GetTempFileNameA
OpenFileMappingA
CreateMutexA
WaitForSingleObject
ReleaseMutex
GetCurrentProcessId
CommandeComposante
DeclareProxy
GeneralParam
LibereMutex
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ