b6fdd6febf575b2a684edbe7ee79cdd289b7f1c6b29fbec7a0fb058fea8b6183
- SHA256 b6fdd6febf575b2a684edbe7ee79cdd289b7f1c6b29fbec7a0fb058fea8b6183
Password
infected
Static task
static1
Behavioral task
behavioral1
Sample
c384d26e83f585fbadd73e6cea441d1479d68de5bb647f775b506e5eab7f3230.exe
Resource
win7-20240221-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
c384d26e83f585fbadd73e6cea441d1479d68de5bb647f775b506e5eab7f3230.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral3
Sample
Graustark/resultalet/Unmeringued.ps1
Resource
win7-20231129-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral4
Sample
Graustark/resultalet/Unmeringued.ps1
Resource
win10v2004-20240412-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target b6fdd6febf575b2a684edbe7ee79cdd289b7f1c6b29fbec7a0fb058fea8b6183
- Size 566KB
- Sample240417-p5btxsga66
- SHA256 b6fdd6febf575b2a684edbe7ee79cdd289b7f1c6b29fbec7a0fb058fea8b6183
- MD5 a7fca6095823537e3363a6e81825ecd6
- SHA1 cbdf4940c0aa486487eb1832e31da77c082fe2fb
- SHA512 a6330e49878aac53dcc17c6f5c324da749d108dc9ac89eca130af0e8714fad9dbd3808e2f4f437288e1f6f90dda505c59800c389c71f6b13d3c70d15ca5a73d5
- SSDEEP 12288:ydUUTxiszH21aDkHiOmJGwlA/5wURlk7QECtO4:ydYswHtmkwl5n3EO4
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
File Explorer
-
b6fdd6febf575b2a684edbe7ee79cdd289b7f1c6b29fbec7a0fb058fea8b6183.zip 566KB
-
c384d26e83f585fbadd73e6cea441d1479d68de5bb647f775b506e5eab7f3230.exe.exe 647KB
-
Graustark/resultalet/Behandlingsmaal.sac333KB
-
Graustark/resultalet/Kliniklokalernes.sun392KB
-
Graustark/resultalet/Potatory.rea269KB
-
Graustark/resultalet/Reluktansernes.Ove71337KB
-
Graustark/resultalet/Unmeringued.Brd.ps1 60KB
-
Graustark/resultalet/teda.txt577B
c384d26e83f585fbadd73e6cea441d1479d68de5bb647f775b506e5eab7f3230.exe
- IMPHASH f4639a0b3116c2cfc71144b88a929cfd
- SHA256 c384d26e83f585fbadd73e6cea441d1479d68de5bb647f775b506e5eab7f3230
- MD5 90fda5c072fe00e8e737606add7f1276
- SHA1 68752dce786a29b815ec5454d4b4aa5f6bc73363
- SHA512 df854ac565c084d47bc20e738ee8f36cf040d33fc2b7cb7c8ab84a83b2d77308b522eccd81e23e576bb9f82bf1ea00a50f33435522d8d2070923de0a862a2512
- SSDEEP 12288:IgXRAvufNFTr7L6GJpk/0C+wEc80Qu8j4RmYxrqwDwmuu6TNxFu+b:jXRyUNJr7L5vBC5ummYxrPqu6hxFu+
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
56:e1:32:25:25:78:12:74:1e:8b:ee:60:c3:c7:51:ce:2e:07:6a:7a:be:2d:ff:8a:72:4c:cf:60:b3:ce:4a:a5
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=cradlefellow,OU=Minutise Fragtmnds\ ,O=cradlefellow,L=Macheren,ST=Grand Est,C=FR,1.2.840.113549.1.9.1=#0c24556e646572646972656b746f72696574405472616e6773767572646572696e67732e426f
Chains
Apr 3, 2024
Subject
CN=cradlefellow,OU=Minutise Fragtmnds\ ,O=cradlefellow,L=Macheren,ST=Grand Est,C=FR,1.2.840.113549.1.9.1=#0c24556e646572646972656b746f72696574405472616e6773767572646572696e67732e426f
Serial Number
06:d6:90:bd:a5:34:ca:ba:b3:52:03:d8:18:1c:4e:f4:e3:ec:bd:6a
Issuer
CN=cradlefellow,OU=Minutise Fragtmnds\ ,O=cradlefellow,L=Macheren,ST=Grand Est,C=FR,1.2.840.113549.1.9.1=#0c24556e646572646972656b746f72696574405472616e6773767572646572696e67732e426f
Timespan
Jan 26, 2024 - Jan 25, 2027
Subject
CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Issuer
CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 12, 2016 - Jan 11, 2031
Subject
CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Issuer
CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 23, 2017 - Mar 22, 2029
Minor OS version
0
Major OS version
4
Entry point
13564
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
advapi32
RegEnumValueW
RegEnumKeyW
RegQueryValueExW
RegSetValueExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
RegOpenKeyExW
RegCreateKeyExW
shell32
SHGetPathFromIDListW
SHBrowseForFolderW
SHGetFileInfoW
SHFileOperationW
ShellExecuteExW
ole32
CoCreateInstance
OleUninitialize
OleInitialize
IIDFromString
CoTaskMemFree
comctl32
ImageList_Destroy
ord17
ImageList_AddMasked
ImageList_Create
user32
MessageBoxIndirectW
GetDlgItemTextW
SetDlgItemTextW
CreatePopupMenu
AppendMenuW
TrackPopupMenu
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
IsWindowVisible
CallWindowProcW
GetMessagePos
CheckDlgButton
LoadCursorW
SetCursor
GetSysColor
SetWindowPos
GetWindowLongW
IsWindowEnabled
SetClassLongW
GetSystemMenu
EnableMenuItem
GetWindowRect
ScreenToClient
EndDialog
RegisterClassW
SystemParametersInfoW
CharPrevW
GetClassInfoW
DialogBoxParamW
CharNextW
ExitWindowsEx
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
FindWindowExW
IsWindow
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
ReleaseDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
GetClientRect
FillRect
DrawTextW
EndPaint
CharNextA
wsprintfA
DispatchMessageW
CreateWindowExW
PeekMessageW
GetSystemMetrics
gdi32
GetDeviceCaps
SetBkColor
SelectObject
DeleteObject
CreateBrushIndirect
CreateFontIndirectW
SetBkMode
SetTextColor
kernel32
lstrcmpiA
CreateFileW
GetTempFileNameW
RemoveDirectoryW
CreateProcessW
CreateDirectoryW
GetLastError
CreateThread
GlobalLock
GlobalUnlock
GetDiskFreeSpaceW
WideCharToMultiByte
lstrcpynW
lstrlenW
SetErrorMode
GetVersionExW
GetCommandLineW
GetTempPathW
GetWindowsDirectoryW
WriteFile
CopyFileW
ExitProcess
GetCurrentProcess
GetModuleFileNameW
GetFileSize
GetTickCount
Sleep
SetFileAttributesW
GetFileAttributesW
SetCurrentDirectoryW
MoveFileW
GetFullPathNameW
GetShortPathNameW
SearchPathW
CompareFileTime
SetFileTime
CloseHandle
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalFree
GlobalAlloc
GetModuleHandleW
LoadLibraryExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
lstrlenA
MultiByteToWideChar
ReadFile
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW
MulDiv
lstrcpyA
MoveFileExW
lstrcatW
GetSystemDirectoryW
GetProcAddress
GetModuleHandleA
GetExitCodeProcess
WaitForSingleObject
SetEnvironmentVariableW
Name
.text
Size
25KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
126KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
224KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
186KB
Virtual Size
186KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=163, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
Graustark/resultalet/Behandlingsmaal.sac
- SHA256 ded32062860db523c6436b432f22ee503f7706dccd75ba2825a4470d58c1412d
- MD5 f8c0fee8de3e2f93e8ea22388a77bb09
- SHA1 9bba5c653a1a83a35eb65cbca505c659c59662b5
- SHA512 2fcd5eb3bbc0bd881fc4c8e271b233851a2c1b39f8e6db7cd937005c1a1d0ac2f8c1219cbfaead1f70d13d3a7e1c8acb79297ad9efa8f3289591a022eb34338b
- SSDEEP 768:YYv2jfcXjveUx72Yj7X5I7TO8Cr6qgLE89h3R71p6qRfOU0Ane1k9M/qlvFNLxI:B5jnc3
- MD5 SHA1 SHA512 SSDEEP
Graustark/resultalet/Kliniklokalernes.sun
- SHA256 92cc335f5aaa5f481ed32b10f95853a4d478be368f9feddc20f6b7731923d066
- MD5 21d2ebdf40706ec8fc35650094126a9a
- SHA1 53519ec395f2e3fc49d97216fb54a9a0088a851f
- SHA512 b648c3934055358cb18dce32a8459e5475b82c8eac011528e7da4c4d1573d680672d275cfb78e6da26fb40ff72dfb31dd94c91611874d1a79e255b1b074abe4d
- SSDEEP 768:uPDccdaFpHi7QWY7vVTnSy0DwPh3PY0YVcf0aVr+LBgaP1mbQZk2hD+FyqYhyNBR:kTOnd1NOBp9
- MD5 SHA1 SHA512 SSDEEP
Graustark/resultalet/Potatory.rea
- SHA256 05d0f6c869793ef28ee232a704382092e71fa20b9b1a33d39de36c374967f903
- MD5 b140848a979aa1806772dab19a298710
- SHA1 7a7107a4839f01c3aa087212763e93ecd7904a21
- SHA512 a3cae2ce90c61b08143c47774dbe8eca90fbf748f986ca5f0ecbf140f29c57ea50093d12af65b0d565755d4a50f8202edc8fa8a828481c85791e30854c5aef9e
- SSDEEP 768:50QftKJWNEsYKIleNCcQySVfmGhwwFp7L9jRspT56:zhO7Q
- MD5 SHA1 SHA512 SSDEEP
Graustark/resultalet/Reluktansernes.Ove71
- SHA256 07eecf0b61af3a50e22d08856f08e23b6b7ed731bf1e8965525a3b9c39acff5b
- MD5 771717add10395b56c27056035a7f725
- SHA1 bfa26b09a632998866e235c13c9859b4d4984236
- SHA512 cb68c1e0553be1cceec312b487f794252b46393d767a079591dca246d2f7820bf55602613ecf621e315476f7c781b0d63db7deba1af4877b2a1446534b975d4d
- SSDEEP 6144:FAFgQ39889Ah6x5gR7+OlnOdxuqt7zR2cfrSG+GBvIzXn6VZ9fMF:G+Q3rCsx5UHa3R2gJIDy98
- MD5 SHA1 SHA512 SSDEEP
Graustark/resultalet/Unmeringued.Brd
- SHA256 8559f472b29a2d1de1124b1b2aa6d62558b1207a3910048d77b9bb07501e3733
- MD5 8418ca27cc3391358049989e80076a60
- SHA1 0ca1bae9dfabae917324af7337d1ed8c2b6001aa
- SHA512 b6ee3a45200b5f218520c38fbde6b6a30e4f2e847ea890ace3b37a38b14f2c26ee12f21c350052336c67ac725233f1e5b65b1d0b5a4343ef0fca50214b96c01f
- SSDEEP 1536:FNKL+KTusOLdVQxd5B+n51ZPsXb7VZcrq/qhgPqpba5Znn:FNsl9Ud2u1ZP87ViQSpyBn
- MD5 SHA1 SHA512 SSDEEP
Graustark/resultalet/teda.txt
- SHA256 420647e422b79e2daed389a252880cc5f8685a1a04c5ab6537c2712818284cbd
- MD5 5da9127f07e748b0da6767b10c087270
- SHA1 b3dd5a50677e6cc6c9923fdbe4fb4d3a1fd21707
- SHA512 0f6161b9f14c0633992593a4f0e86de3da3b56f975af1a25a59d6790ed590a934256807787967265968e299b1c32af8bc0a2ec2ca200713678028fc960049446
- MD5 SHA1 SHA512