ad7275c0ffea115d2fa48c1f343698a4290e777f057bc64a493b4b37ac2bac53
- SHA256 ad7275c0ffea115d2fa48c1f343698a4290e777f057bc64a493b4b37ac2bac53
Password
infected
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8e9fea5458c969eaf662771d87e2e9d2487e904e5dbeea5d90fc7e44369c3f95.exe
Resource
win7-20240221-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
8e9fea5458c969eaf662771d87e2e9d2487e904e5dbeea5d90fc7e44369c3f95.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral3
Sample
Paleolimnology/ansgningsfristernes/Dishonorables/Sweety64.ps1
Resource
win7-20240221-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral4
Sample
Paleolimnology/ansgningsfristernes/Dishonorables/Sweety64.ps1
Resource
win10v2004-20240226-en
windows10-2004-x64
12 signatures
150 seconds
General
- Target ad7275c0ffea115d2fa48c1f343698a4290e777f057bc64a493b4b37ac2bac53
- Size 466KB
- Sample240417-p18cbsfg69
- SHA256 ad7275c0ffea115d2fa48c1f343698a4290e777f057bc64a493b4b37ac2bac53
- MD5 4d21eba5cbe19db2d6410a2c4c4952a6
- SHA1 afeacc5d0a52d4885ba7158acb377be9da92eb28
- SHA512 d8952fd88849a1f522c3618d2f70a9e38c7b6c43b050fe73bba6632ba9fefe33682d534c8a00e33c3b544947157a0a98932a370c9bc59c473d7de7c9c823374b
- SSDEEP 12288:cFGsA/k8cx7XoDDpe3HZQoIFGX6hfAVCS5X9BaTXQ:hN/QqDQeFgkBaaU
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/8e9fea5458c969eaf662771d87e2e9d2487e904e5dbeea5d90fc7e44369c3f95.exe
File Explorer
-
ad7275c0ffea115d2fa48c1f343698a4290e777f057bc64a493b4b37ac2bac53.zip 466KB
-
8e9fea5458c969eaf662771d87e2e9d2487e904e5dbeea5d90fc7e44369c3f95.exe.exe 593KB
-
Paleolimnology/ansgningsfristernes/Dishonorables/Sweety64.Sch.ps1 61KB
-
Paleolimnology/ansgningsfristernes/Dishonorables/Villainies.tra332KB
-
Paleolimnology/ansgningsfristernes/Dishonorables/chip.ops48KB
-
Paleolimnology/ansgningsfristernes/Dishonorables/kaffetid.her62KB
-
Paleolimnology/ansgningsfristernes/Dishonorables/lagerpladsbehovenes.txt411B
8e9fea5458c969eaf662771d87e2e9d2487e904e5dbeea5d90fc7e44369c3f95.exe
- IMPHASH 7ed0d71376e55d58ab36dc7d3ffda898
- SHA256 8e9fea5458c969eaf662771d87e2e9d2487e904e5dbeea5d90fc7e44369c3f95
- MD5 3cb7a144c3a7d35a77044c167749f84d
- SHA1 23e83390e052b0ce98e5446768a18cf06669b57d
- SHA512 09b7b80dcea62ad01e7338ff2ff37f24938457994f93658ddc9d10c4b8b847da7dc67f6f647821ced3ad4f2277f291ffc7510ade550001f30d88327bf8ae4035
- SSDEEP 6144:LoGzI1X9PZVheNA+ff0RUt3vCKIH2nqoejh4q/tjkshlTqleM97CtzrwalKI8J2x:LbSnhe2eGUt/jnqrZ1hlTpMVklxVtqev
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
12799
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
CompareFileTime
SearchPathW
SetFileTime
CloseHandle
GetShortPathNameW
MoveFileW
SetCurrentDirectoryW
GetFileAttributesW
GetLastError
GetFullPathNameW
CreateDirectoryW
Sleep
GetTickCount
GetFileSize
GetModuleFileNameW
GetCurrentProcess
CopyFileW
ExitProcess
SetEnvironmentVariableW
GetWindowsDirectoryW
GetTempPathW
SetFileAttributesW
ExpandEnvironmentStringsW
LoadLibraryW
lstrlenW
lstrcpynW
GetDiskFreeSpaceW
GlobalUnlock
GlobalLock
CreateThread
CreateProcessW
RemoveDirectoryW
lstrcmpiA
CreateFileW
GetTempFileNameW
lstrcpyA
lstrcpyW
lstrcatW
GetSystemDirectoryW
GetVersion
GetProcAddress
LoadLibraryA
GetModuleHandleA
GetModuleHandleW
lstrcmpiW
lstrcmpW
WaitForSingleObject
GlobalFree
GlobalAlloc
LoadLibraryExW
GetExitCodeProcess
FreeLibrary
WritePrivateProfileStringW
SetErrorMode
GetCommandLineW
GetPrivateProfileStringW
FindFirstFileW
FindNextFileW
DeleteFileW
SetFilePointer
ReadFile
FindClose
MulDiv
MultiByteToWideChar
WriteFile
lstrlenA
WideCharToMultiByte
user32
EndDialog
ScreenToClient
GetWindowRect
RegisterClassW
EnableMenuItem
GetSystemMenu
SetClassLongW
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongW
SetCursor
LoadCursorW
CheckDlgButton
GetMessagePos
LoadBitmapW
CallWindowProcW
IsWindowVisible
CloseClipboard
SetClipboardData
wsprintfW
CreateWindowExW
SystemParametersInfoW
AppendMenuW
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextW
GetDlgItemTextW
MessageBoxIndirectW
CharPrevW
CharNextA
wsprintfA
DispatchMessageW
PeekMessageW
ReleaseDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
GetClientRect
FillRect
DrawTextW
GetClassInfoW
DialogBoxParamW
CharNextW
ExitWindowsEx
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
GetDC
SetWindowLongW
LoadImageW
SendMessageTimeoutW
FindWindowExW
EmptyClipboard
OpenClipboard
TrackPopupMenu
EndPaint
ShowWindow
GetDlgItem
IsWindow
SetForegroundWindow
gdi32
SelectObject
SetBkMode
CreateFontIndirectW
SetTextColor
DeleteObject
GetDeviceCaps
CreateBrushIndirect
SetBkColor
shell32
SHGetSpecialFolderLocation
SHGetPathFromIDListW
SHBrowseForFolderW
SHGetFileInfoW
ShellExecuteW
SHFileOperationW
advapi32
RegCloseKey
RegOpenKeyExW
RegDeleteKeyW
RegDeleteValueW
RegEnumValueW
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW
RegEnumKeyW
comctl32
ImageList_Create
ImageList_AddMasked
ImageList_Destroy
ord17
ole32
CoCreateInstance
CoTaskMemFree
OleInitialize
OleUninitialize
version
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
Name
.text
Size
23KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
128KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
136KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
175KB
Virtual Size
175KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=166, id=1, productName=Unmarked objects,
count=17, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
Paleolimnology/ansgningsfristernes/Dishonorables/Sweety64.Sch
- SHA256 b3f8b29f9da552c657a02fbadad0745e365ea1d548fe22ddbfb3e9450eb29837
- MD5 e5c2dca2119f3e664238f0f51539dbb5
- SHA1 24fc5d8ac634d19acafbf78852482014c052f996
- SHA512 458178c3e2f344a9f28a505c870667d5f3387c7cdd0b6cde22ff428e460b2d433f2653b7516fc5698837e41a635e31f2f59564a33631e938b0801749c6f7b7a6
- SSDEEP 1536:wOnRUJt1Yo/oPn0xI1lp85xiLpcdL/mJf7RUw++4:eJt1Yoh+zgwpKKJdb4
- MD5 SHA1 SHA512 SSDEEP
Paleolimnology/ansgningsfristernes/Dishonorables/Villainies.tra
- SHA256 059a2053042b469979f5755161c39bd951d44b697fb74286b33a36f2f59d7591
- MD5 eb365e5cf4a8ec7a8d968bc1792b4e4d
- SHA1 89c52f3670452362ff4da8f23de870c0ef01bb82
- SHA512 fa76a7fb167595d605ab78665403e2a2bace07da26bbe601093d553980c53cd46a6b624f888ce184059a021dccdf59fb36e20ae234bb20c1dca61906c1ba49b1
- SSDEEP 6144:SEvDGzBylhaOWG/u5mIunaQyskcbpyJuTOJGU17v0z4FFioq:tvD4ByIBuna8kcboJsOYU17MzQFg
- MD5 SHA1 SHA512 SSDEEP
Paleolimnology/ansgningsfristernes/Dishonorables/chip.ops
- SHA256 df1f4d3a7f2bfd589355e66359a8c1a782a577523953fcd302d57d1a00470266
- MD5 788fa2101e84dfbde9c2adfdefd6b2f5
- SHA1 562e5eba24c8ea52e96a5d170d66a35652c2262a
- SHA512 0fcd51f67beaa9e6d042ca0dd8b02e4ecc5aa28e61e6832881d19dae07112b5ddaa1e0565aa6d2ec09f623b7fb9e0e0b14ab13ee17a6cdcfeaab19f03c488971
- SSDEEP 768:Eqbg+EO+gZT3JLnp3rhoIuzf+xJolp/gFS4hqGfRvXhR7D1HSCb8oQj1hsE:5bg+5T513Mf+g34FBhvRvFtgQE
- MD5 SHA1 SHA512 SSDEEP
Paleolimnology/ansgningsfristernes/Dishonorables/kaffetid.her
- SHA256 675f1db8e4ada4696330fa6708715a9d8c7410d207494c09c4fa1151e1a3002b
- MD5 d1e2faac60d62135673a925e6b7c7930
- SHA1 ddf35d22ee59c11879379e669fdc140b9356d081
- SHA512 a26df10fa59efdfc02c2e8cc80e029ed5b4d0c859116ce2746422a31a15f5233d26ced2323365a9cab0eeb484342f2292f0b307ed6e71ad7f78d039f59bdb4b4
- SSDEEP 1536:YoCdwi65C0LIIWO/zCUiaaAfVZGHAAJvrFf3K1:YBT50L1/zbfV4HAADI
- MD5 SHA1 SHA512 SSDEEP
Paleolimnology/ansgningsfristernes/Dishonorables/lagerpladsbehovenes.txt
- SHA256 3e9c636b881832d9eb5a9d823b3857b847cc1758baa86f2304cba4473cb78fbd
- MD5 89dc065c10d94d8f6f5d3bbbdfd9063b
- SHA1 0d7643e650f75f7e35fcb65208535e0d0e1fe075
- SHA512 0fb659aaf4fe4f15422b0b68aec5a0bc3d52fd8a67cafb00bc9b5b37c336031abf53c82198674dbbf0f6a79fa1dacd776086a6bad770e4777db05ee96bbc4916
- MD5 SHA1 SHA512