NewOrder[.]rar | Triage™

General

Target
NewOrder.rar
Size 635KB
Sample231120-h3slbsed44
SHA256 5965e49e180fcf64d8d3eda9f389d1e1a2f4399020d16172be15afcaabff061d
MD5 ac8381672ad36961f2300d13db8e1754
SHA1 c9b21ec1223e98fe2999d94c7c76e85aeb2897e1
SHA512 0dee7db85f74fe26c5c07a64d5608c7addc96fb5c406af599a35cb10ce7d829a701adaa6e17137d71255f99ded16c2afdc39cd769d796a3a2d0ae3d230c471dc
SSDEEP 12288:sDDHC9jMNpX3zaVYIMDR7tdtrC+RxkPox6chCSkTqee1Lhgswx:eC9jMnnzoYh7tdtrCoWwnpMAY
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/NewOrder.exe

File Explorer

NewOrder.rar

.rar 635KB
NewOrder.exe

.exe 735KB

NewOrder.rar

SHA256 5965e49e180fcf64d8d3eda9f389d1e1a2f4399020d16172be15afcaabff061d
MD5 ac8381672ad36961f2300d13db8e1754
SHA1 c9b21ec1223e98fe2999d94c7c76e85aeb2897e1
SHA512 0dee7db85f74fe26c5c07a64d5608c7addc96fb5c406af599a35cb10ce7d829a701adaa6e17137d71255f99ded16c2afdc39cd769d796a3a2d0ae3d230c471dc
SSDEEP 12288:sDDHC9jMNpX3zaVYIMDR7tdtrC+RxkPox6chCSkTqee1Lhgswx:eC9jMnnzoYh7tdtrCoWwnpMAY
MD5 SHA1 SHA512 SSDEEP

NewOrder.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 e49df0f66eb42b10494df1c1c8518fe9ab49b30df38b148c2158149d52a11b91
MD5 422bfd2d85dd5bee8004526fa012df6a
SHA1 0b06633d868e7fcf22d0532d2bf97f40a61ffe73
SHA512 fe5b82b7769fa3afb8d3617aab515be587d14637da26a1ddaf449fb48123e9d0a46399011498d224d84033c78ebab9727688c7a7a07d4cb23a94b8caa9657a16
SSDEEP 12288:vjN61h61EWGy6ZbRjXUtxX7LXM3Q7H4C/6GhuOTNLItGvB+WGe35dM5mbp7z2atS:gY7GDZoX7LXCQ7H4o6GhJXBZ2
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

742782

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

NewOrder.rar

NewOrder.exe

mscoree

dotnet

Sharing

General

Malware Config

Signatures

File Explorer

NewOrder.rar

NewOrder.exe

mscoree

dotnet