341dab4037e9eff3fa0f34fb8382f30c.bin
- SHA256 ca8a7d9d1cec584d9c5ea4a02a19270929ec2fdb8819a21d94f7b6adcb870092
Password
infected
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
665b8dea01643cce577cc8cc6cc1677e78cbf4559b7c0fbd0446dee65970b4ea.exe
Resource
win7-20240221-en
windows7-x64
18 signatures
150 seconds
Behavioral task
behavioral2
Sample
665b8dea01643cce577cc8cc6cc1677e78cbf4559b7c0fbd0446dee65970b4ea.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
17 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target 341dab4037e9eff3fa0f34fb8382f30c.bin
- Size 460KB
- Sample240313-bmcfvagd2v
- SHA256 ca8a7d9d1cec584d9c5ea4a02a19270929ec2fdb8819a21d94f7b6adcb870092
- MD5 3baf028b4e099bcf5bbca47c7e8c94cd
- SHA1 823e426ff2febb5cd365cad014bbee6c4d1c3fd4
- SHA512 da93b826ff7f281993ec89122f6c27e55a6914a5dc03628d18465709757daef7f8c2530a5fffd01e53bd45ff8a0de9c385eaca2e925bab1822f43d34e4a01768
- SSDEEP 12288:HDiZAxMJdJua/y1kEH6dqK/p75978xolKw:HD5ej/a0qm7fBlKw
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/$PLUGINSDIR/System.dll
File Explorer
-
341dab4037e9eff3fa0f34fb8382f30c.bin.zip 460KB
-
665b8dea01643cce577cc8cc6cc1677e78cbf4559b7c0fbd0446dee65970b4ea.exe.exe 551KB
-
$PLUGINSDIR/System.dll.dll 11KB
-
Cynognathus/Testamentariskes/cothurnian.Ove162193KB
-
Hjfrekvensens/Omnipresently59.Pir189KB
-
Hjfrekvensens/anteclassical.bla67KB
-
Pinebank/Orthotropically.gre63KB
-
anvendelig.txt456B
-
taagebankernes.boo39KB
665b8dea01643cce577cc8cc6cc1677e78cbf4559b7c0fbd0446dee65970b4ea.exe
- IMPHASH b34f154ec913d2d2c435cbd644e91687
- SHA256 665b8dea01643cce577cc8cc6cc1677e78cbf4559b7c0fbd0446dee65970b4ea
- MD5 341dab4037e9eff3fa0f34fb8382f30c
- SHA1 9833559bcda07e6976364672f6b7c8bcef84571f
- SHA512 bd0d81ddde528f9987f749f9789d6a32300c7eef5d98593c4fc708d0352d0c8828982482894bd8ac9e768e320f4ba5fede2ecd8937a461dadad4015be2940f3d
- SSDEEP 6144:ImOP0pJkkuNjE241F13gyLWoz6XVasKvGSz7tvIPykUn5CRFaPyCoUtU7Hi8R55i:pkNE2cL3rKou+vGEZvx5CD1W4i83bWL
- MD5 SHA1 SHA512 SSDEEP
Password
infected
PE Signature issue
Digest
f1:ea:e8:4d:77:56:e4:29:07:ec:43:6a:6a:b9:5b:5a:e9:ec:30:6c:c1:f0:9f:1c:6a:19:ea:05:d0:f9:1f:a4
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Telenergy,OU=Oligodontous Hjhederne\ ,O=Telenergy,L=Chesterton Green,ST=England,C=GB,1.2.840.113549.1.9.1=#0c1c476f6b6b656e657340536e65646b65726d65737472656e652e52616e
Chains
Mar 11, 2024
PE Signature issue
Digest
00:49:2a:89:ef:5a:d5:a5:f0:36:2f:94:74:0c:00:20:ae:02:a7:e2
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Telenergy,OU=Oligodontous Hjhederne\ ,O=Telenergy,L=Chesterton Green,ST=England,C=GB,1.2.840.113549.1.9.1=#0c1c476f6b6b656e657340536e65646b65726d65737472656e652e52616e
Chains
Mar 11, 2024
Subject
CN=Telenergy,OU=Oligodontous Hjhederne\ ,O=Telenergy,L=Chesterton Green,ST=England,C=GB,1.2.840.113549.1.9.1=#0c1c476f6b6b656e657340536e65646b65726d65737472656e652e52616e
Serial Number
30:ac:18:00:b0:50:a2:50:14:56:29:a4:7a:f8:46:ad:e6:16:97:0a
Issuer
CN=Telenergy,OU=Oligodontous Hjhederne\ ,O=Telenergy,L=Chesterton Green,ST=England,C=GB,1.2.840.113549.1.9.1=#0c1c476f6b6b656e657340536e65646b65726d65737472656e652e52616e
Timespan
May 13, 2023 - May 12, 2026
Subject
CN=Telenergy,OU=Oligodontous Hjhederne\ ,O=Telenergy,L=Chesterton Green,ST=England,C=GB,1.2.840.113549.1.9.1=#0c1c476f6b6b656e657340536e65646b65726d65737472656e652e52616e
Serial Number
30:ac:18:00:b0:50:a2:50:14:56:29:a4:7a:f8:46:ad:e6:16:97:0a
Issuer
CN=Telenergy,OU=Oligodontous Hjhederne\ ,O=Telenergy,L=Chesterton Green,ST=England,C=GB,1.2.840.113549.1.9.1=#0c1c476f6b6b656e657340536e65646b65726d65737472656e652e52616e
Timespan
May 13, 2023 - May 12, 2026
Minor OS version
0
Major OS version
4
Entry point
13117
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
SetEnvironmentVariableW
SetFileAttributesW
Sleep
GetTickCount
GetFileSize
GetModuleFileNameW
GetCurrentProcess
CopyFileW
SetCurrentDirectoryW
GetFileAttributesW
GetWindowsDirectoryW
GetTempPathW
GetCommandLineW
GetVersion
SetErrorMode
lstrlenW
lstrcpynW
GetDiskFreeSpaceW
ExitProcess
GetShortPathNameW
CreateThread
GetLastError
CreateDirectoryW
CreateProcessW
RemoveDirectoryW
lstrcmpiA
CreateFileW
GetTempFileNameW
WriteFile
lstrcpyA
MoveFileExW
lstrcatW
GetSystemDirectoryW
GetProcAddress
GetModuleHandleA
GetExitCodeProcess
WaitForSingleObject
lstrcmpiW
MoveFileW
GetFullPathNameW
SetFileTime
SearchPathW
CompareFileTime
lstrcmpW
CloseHandle
ExpandEnvironmentStringsW
GlobalFree
GlobalLock
GlobalUnlock
GlobalAlloc
FindFirstFileW
FindNextFileW
DeleteFileW
SetFilePointer
ReadFile
FindClose
lstrlenA
MulDiv
MultiByteToWideChar
WideCharToMultiByte
GetPrivateProfileStringW
WritePrivateProfileStringW
FreeLibrary
LoadLibraryExW
GetModuleHandleW
user32
GetSystemMenu
SetClassLongW
EnableMenuItem
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongW
SetCursor
LoadCursorW
CheckDlgButton
GetMessagePos
LoadBitmapW
CallWindowProcW
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
ScreenToClient
GetWindowRect
GetDlgItem
GetSystemMetrics
SetDlgItemTextW
GetDlgItemTextW
MessageBoxIndirectW
CharPrevW
CharNextA
wsprintfA
DispatchMessageW
PeekMessageW
ReleaseDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
GetClientRect
FillRect
DrawTextW
EndDialog
RegisterClassW
SystemParametersInfoW
CreateWindowExW
GetClassInfoW
DialogBoxParamW
CharNextW
ExitWindowsEx
DestroyWindow
GetDC
SetTimer
SetWindowTextW
LoadImageW
SetForegroundWindow
ShowWindow
IsWindow
SetWindowLongW
FindWindowExW
TrackPopupMenu
AppendMenuW
CreatePopupMenu
EndPaint
CreateDialogParamW
SendMessageTimeoutW
wsprintfW
PostQuitMessage
gdi32
SelectObject
SetBkMode
CreateFontIndirectW
SetTextColor
DeleteObject
GetDeviceCaps
CreateBrushIndirect
SetBkColor
shell32
SHGetSpecialFolderLocation
ShellExecuteExW
SHGetPathFromIDListW
SHBrowseForFolderW
SHGetFileInfoW
SHFileOperationW
advapi32
AdjustTokenPrivileges
RegCreateKeyExW
RegOpenKeyExW
SetFileSecurityW
OpenProcessToken
LookupPrivilegeValueW
RegEnumValueW
RegDeleteKeyW
RegDeleteValueW
RegCloseKey
RegSetValueExW
RegQueryValueExW
RegEnumKeyW
comctl32
ImageList_Create
ImageList_AddMasked
ImageList_Destroy
ord17
ole32
OleUninitialize
OleInitialize
CoTaskMemFree
CoCreateInstance
Name
.text
Size
25KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
128KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
384KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
173KB
Virtual Size
173KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=165, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
$PLUGINSDIR/System.dll
- IMPHASH fc0224e99e736751432961db63a41b76
- SHA256 c2f405d7402f815d0c3fadd9a50f0bbbb1bab9aa38fe347823478a2587299448
- MD5 9625d5b1754bc4ff29281d415d27a0fd
- SHA1 80e85afc5cccd4c0a3775edbb90595a1a59f5ce0
- SHA512 dce52b640897c2e8dbfd0a1472d5377fa91fb9cf1aeff62604d014bccbe5b56af1378f173132abeb0edd18c225b9f8f5e3d3e72434aed946661e036c779f165b
- SSDEEP 192:eX24sihno00Wfl97nH6BenXwWobpWBTtvShJ5omi7dJWjOlqSlS:D8QIl972eXqlWBFSt273YOlqz
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
4
Entry point
10178
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetModuleHandleW
GlobalFree
GlobalSize
lstrcpynW
lstrcpyW
GetProcAddress
WideCharToMultiByte
VirtualFree
FreeLibrary
lstrlenW
LoadLibraryW
GlobalAlloc
MultiByteToWideChar
VirtualAlloc
VirtualProtect
GetLastError
user32
wsprintfW
ole32
StringFromGUID2
CLSIDFromString
Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc
Name
.text
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
851B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
120B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1024B
Virtual Size
608B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=14, version=7299,
count=20, id=1, productName=Unmarked objects,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=4, id=48, version=9044,
count=1, id=42, version=8803,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
Cynognathus/Testamentariskes/cothurnian.Ove162
- SHA256 c9567eeb909642f201700b00a207e557e5612e6e1951da059f1c55b99cceb89c
- MD5 10a4dded66f91db03e139cc084786d29
- SHA1 e795692981dedad08f325eb3f05aca663964ea3f
- SHA512 a13320fc44493e762a1775d392f2309c02b7dcb03f1eb5177b2a9fdace080da88bf53a09ef1ae37863e1a9dc9948f4b4e673ccbb442b7d8d80082951738e700c
- SSDEEP 3072:EAKsMmGRDgxZPDjYu2xSiOTYXJYyWqYahR3c+RWJAw0RnoCcDys1/crmE:EA/9iIf12v4Y2zahR34Aw0Rn691/cB
- MD5 SHA1 SHA512 SSDEEP
Hjfrekvensens/Omnipresently59.Pir
- SHA256 5545ca532fe65b780e36ddf459170317e2d5a5a7af110231e61220cad1ce0b46
- MD5 54520208ab90dc8284f3b24463a1d4a9
- SHA1 5c78bb6799726dd1fc969fc34e53955d21f27995
- SHA512 7848d2d88b46d00fca229869c711731b42726fc7a27a68008d988e424f1f1e71e0071fc51e7a1763f8407ce6924bf25eb0e38f6c71e377a41746a6df8131059f
- SSDEEP 3072:uLY1brdAcfmIi583m88NWBkCMyCYVpZeYYtwjLCPEU31X:eY1bzmIi+3mtXC31VpgjOjzM5
- MD5 SHA1 SHA512 SSDEEP
Hjfrekvensens/anteclassical.bla
- SHA256 af85480e7117494a6a88db68b9a2bb88174171ffcc59a33e199436edc7c88c5a
- MD5 f5428f8a9d4ab89cc1669292ee6f4ce2
- SHA1 2a6e3161ff2aa837c87abe8bb1d9ffe54be9d662
- SHA512 ae5b2888e3aa314ac1ceb1187032429490561d046e9eb765fda32626f9a6e4ebe2cf66d899cde39a6e83238f552c701ecdd8b4439a0a5121ad38648fde256f5c
- SSDEEP 1536:Nwg2Q2jM5RN69GxMCf6/tdB7r8xg7RrQYaYy7MtT:ug2Q2Y5RN69GLf6/tbPYkRsYaYyYtT
- MD5 SHA1 SHA512 SSDEEP
Pinebank/Orthotropically.gre
- SHA256 3cb5929d0236e6b8a1273aba6325785eae21422221570fd995213b23a47f2d29
- MD5 6ae555e81977706184aaab912abb0283
- SHA1 2a6839814df4130104b7a050edfdb782c831260e
- SHA512 4eb6e40be08712b4091fded69fb300c1f6056aa9ee2a609e075c9a9e4057f625e6f9ab257ee0fb0821005b797cb0804e5a99b2d00efd1696e2ee1ff8283c0c6f
- SSDEEP 1536:ge/AHiteDFOU/FajJ5yyXJAVfGL7rKYtrkt:mme5H/F7yXJ57r1trkt
- MD5 SHA1 SHA512 SSDEEP
anvendelig.txt
- SHA256 0e175df6824b25dbe89cd713f35f23f426a39b7b27223e0bb3fc4686e9f99372
- MD5 e4154224c0d928542fab352d1aedf67b
- SHA1 bdfd97d05d116707a8b5c34428d874813bfbd42c
- SHA512 791fa20fca12bdf67ca511bba9357844cbd4a10dec98531456c3587633ed78ea9bce3f71878a7d902da825909b3cf8c673c8276ab577a3d603d83580fa09a19f
- MD5 SHA1 SHA512
taagebankernes.boo
- SHA256 736171b8978a1eefb836ed4d1dc133ee074e99d2ebac12a5c748a2b7e20d77f2
- MD5 085905abf2f56cf68f3947a4f7d4d749
- SHA1 3e82396b2f51d54db4365458cd82eb6bc2487173
- SHA512 9caae6630dce3ee81a0639a3db537081936ea90dc0e2f502125a42a65388147ba6183767f748fa0470d3ffffb07b7123784fbe6af21a2ba33c77180ff56f19ea
- SSDEEP 768:GTo9yVMAcK97HpL2k/SjoAqCLFYmmJdEjuR02Q6aierGPfapl0Yr:sMYgk/CZqCLFjmJdYD2RaN6k5r
- MD5 SHA1 SHA512 SSDEEP