PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC_10.7z
- SHA256 0eaa6dd0dbecdcb8877516e71a86427d219665332b94f7fc86ff047d5ef62003
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe
Resource
win7-20240221-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
18 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240220-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240412-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20240412-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC_10.7z
- Size 427KB
- Sample240426-j6qftace69
- SHA256 0eaa6dd0dbecdcb8877516e71a86427d219665332b94f7fc86ff047d5ef62003
- MD5 43e367cdfea21bc79aa8630e23027df6
- SHA1 a078cd616b822b5f1feddd4190294344f55516b9
- SHA512 ebc083064f3cd7149f3d34a22bcd2ac9199b7a24a0bb30eff2ce31bc0e127aa8fafd982ab76eed180ab5911effe76cc8cfe2d605ab63604b8c7e70d48296ea6b
- SSDEEP 12288:u3C4SnWhGLVaSC3Moi6pBgi0r5ddRAUIPS:MCQG8Sr8eiiRbIPS
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack002/$PLUGINSDIR/System.dll unpack002/$PLUGINSDIR/nsExec.dll - NSIS installer 2 IoCs
resource yara_rule static1/unpack001/PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe nsis_installer_1 static1/unpack001/PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe nsis_installer_2
File Explorer
-
PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC_10.7z.7z 427KB
-
PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe.exe 753KB
-
$PLUGINSDIR/System.dll.dll 11KB
-
$PLUGINSDIR/nsExec.dll.dll 6KB
-
Fdrelandssanges/afproevningsstrategiernes.Ast5KB
-
Fdrelandssanges/dhourra.dei275KB
-
Pneumonolith.upl135KB
-
Regionalize/Trade199/Fremlg/Fruitstalk/fiskeriinteressernes.bnk184KB
-
Regionalize/Trade199/Fremlg/Fruitstalk/motleyest.hea76KB
-
Regionalize/Trade199/Fremlg/Fruitstalk/perivesical.cer277KB
-
Regionalize/Trade199/Fremlg/Fruitstalk/vanskabningers.txt494B
-
Semestret/Implantation/Hives/Wienervalsene/Milched.gri212KB
PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_DOC.exe
- IMPHASH b40f29cd171eb54c01b1dd2683c9c26b
- SHA256 8059dc704b71f1a978547729e4afdf62f0c834950758ca8bb6a25fa6fca0b03d
- MD5 dbe4440d32dc0b20dee76c192587ab33
- SHA1 d5c94559655c5fc5bc552fce62aad8673731a3bb
- SHA512 13eea3b51fce84b90b363de9b05f6e08fa0c082b67f0be91146f241ab49f7d421fec5d81b5507c6df396bdba21e71b6cef176f8a70a0d972c11cf2ad7d768efa
- SSDEEP 6144:9zZzl4awJ9Gal0ZcMGDTBRA5bASrGs/1iLJ0ca8EptqioUCaSniaVgkpmcqaw/c0:DaalkPhH8V/kLBa8CwioQAxjw/ar4vd
- MD5 SHA1 SHA512 SSDEEP
-
NSIS installer
PE Signature issue
Digest
3a:d9:80:c9:f4:d4:c7:1d:13:c0:22:88:04:a0:d7:ee:9a:72:37:ea:c5:d7:5c:5c:d5:b4:c2:07:a4:09:f4:ac
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Bakterielle,OU=Suingly Svagfrt Adresserne\ ,O=Bakterielle,L=Byron,ST=California,C=US,1.2.840.113549.1.9.1=#0c1c4475706c69636964656e746174614054726f6a616e736b65732e4865
Chains
Apr 23, 2024
Subject
CN=Bakterielle,OU=Suingly Svagfrt Adresserne\ ,O=Bakterielle,L=Byron,ST=California,C=US,1.2.840.113549.1.9.1=#0c1c4475706c69636964656e746174614054726f6a616e736b65732e4865
Serial Number
13:b4:7d:66:9a:ef:cd:34:15:fc:38:7a:13:a2:e4:cb:93:09:97:0a
Issuer
CN=Bakterielle,OU=Suingly Svagfrt Adresserne\ ,O=Bakterielle,L=Byron,ST=California,C=US,1.2.840.113549.1.9.1=#0c1c4475706c69636964656e746174614054726f6a616e736b65732e4865
Timespan
Jun 5, 2023 - Jun 4, 2026
Minor OS version
0
Major OS version
4
Entry point
12527
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
Sleep
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
CompareFileTime
SearchPathA
GetTickCount
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
SetEnvironmentVariableA
GetWindowsDirectoryA
SetFileAttributesA
lstrcmpiA
SetErrorMode
LoadLibraryA
lstrlenA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
CreateFileA
GetTempFileNameA
lstrcpyA
lstrcatA
GetSystemDirectoryA
GetVersion
GetProcAddress
WaitForSingleObject
SetFileTime
CloseHandle
GlobalFree
lstrcmpA
ExpandEnvironmentStringsA
GetExitCodeProcess
GlobalAlloc
GetModuleHandleA
LoadLibraryExA
GetCommandLineA
GetTempPathA
FreeLibrary
FindFirstFileA
FindNextFileA
DeleteFileA
SetFilePointer
ReadFile
FindClose
GetPrivateProfileStringA
WritePrivateProfileStringA
MulDiv
WriteFile
MultiByteToWideChar
user32
CreateWindowExA
EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
GetDC
SystemParametersInfoA
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
ReleaseDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
GetClassInfoA
DialogBoxParamA
CharNextA
ExitWindowsEx
DestroyWindow
CreateDialogParamA
SetTimer
GetDlgItem
wsprintfA
SetForegroundWindow
ShowWindow
IsWindow
LoadImageA
SetWindowLongA
SetClipboardData
EmptyClipboard
OpenClipboard
EndPaint
PostQuitMessage
FindWindowExA
SendMessageTimeoutA
SetWindowTextA
gdi32
SelectObject
SetBkMode
CreateFontIndirectA
SetTextColor
DeleteObject
GetDeviceCaps
CreateBrushIndirect
SetBkColor
shell32
SHGetSpecialFolderLocation
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
advapi32
RegCloseKey
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegEnumValueA
RegCreateKeyExA
RegSetValueExA
RegQueryValueExA
RegEnumKeyA
comctl32
ImageList_Create
ImageList_AddMasked
ImageList_Destroy
ord17
ole32
CoCreateInstance
CoTaskMemFree
OleInitialize
OleUninitialize
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
Name
.text
Size
23KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
3.6MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
112KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
425KB
Virtual Size
424KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=158, id=1, productName=Unmarked objects,
count=17, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=12, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
$PLUGINSDIR/System.dll
- IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
- SHA256 b9631423a50c666faf2cc6901c5a8d6eb2fecd306fdd2524256b7e2e37b251c2
- MD5 6ad39193ed20078aa1b23c33a1e48859
- SHA1 95e70e4f47aa1689cc08afbdaef3ec323b5342fa
- SHA512 78c89bb8c86f3b68e5314467eca4e8e922d143335081fa66b01d756303e1aec68ed01f4be7098dbe06a789ca32a0f31102f5ba408bc5ab28e61251611bb4f62b
- SSDEEP 96:qIsUxO9udx4qYp7AJb76BykUbQMtHUOA5Iv+RnsrqeXV+d1g2IW9t2c+cEwF9Fug:ZVL7ikJb76BQUoUm+RnyXVYO2RvHFug
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
9922
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
MultiByteToWideChar
GlobalFree
GlobalSize
lstrcpynA
lstrcpyA
GetProcAddress
VirtualFree
FreeLibrary
lstrlenA
LoadLibraryA
GetModuleHandleA
GlobalAlloc
WideCharToMultiByte
VirtualAlloc
VirtualProtect
GetLastError
user32
wsprintfA
ole32
StringFromGUID2
CLSIDFromString
Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc
Name
.text
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
835B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
104B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1024B
Virtual Size
584B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=14, version=7299,
count=19, id=1, productName=Unmarked objects,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=4, id=48, version=9044,
count=1, id=42, version=8803,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
$PLUGINSDIR/nsExec.dll
- IMPHASH 6b7d154c806f1e47db325229c300c6df
- SHA256 9a1a5c6f598247bfa52624cd793b9ef4fb85863cc9dfd69eb7ef671cacc906c9
- MD5 052a077ee8b519aadbcf29e6b5e710a4
- SHA1 b3ab29d0ebdbdca63e4dffd2fd2e6b9188ffae4b
- SHA512 cb11cba331b85122dcc2d57171ce20382af0a9fdf0a85a30155404d975901a313c9285eb9445e51979c6ec8416ccdf97fdeaf1bd2203c9395ad046a385a90009
- SSDEEP 96:Q7GUaYNwCLuGFctpiKFlYJ8hH4RVHpwdEeY3kRlDr6dMqqyVgNF38:aygp3FcHi0xhYMR8dMqJVgN
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4231
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetModuleHandleA
lstrlenA
GetExitCodeProcess
WaitForSingleObject
Sleep
TerminateProcess
GlobalReAlloc
GlobalUnlock
GlobalSize
lstrcpynA
ReadFile
PeekNamedPipe
GetTickCount
lstrcpyA
CreateProcessA
GetStartupInfoA
GetProcAddress
GlobalLock
DeleteFileA
lstrcmpiA
GetCurrentProcess
CloseHandle
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
CreateFileA
CopyFileA
GetTempFileNameA
GlobalFree
GlobalAlloc
GetModuleFileNameA
ExitProcess
GetCommandLineA
CreatePipe
GetVersionExA
lstrcatA
user32
SendMessageA
OemToCharBuffA
FindWindowExA
CharNextA
wsprintfA
CharPrevA
advapi32
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
Exec
ExecToLog
ExecToStack
Name
.text
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
458B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=47, id=1, productName=Unmarked objects,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=2, id=48, version=9044,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
Fdrelandssanges/afproevningsstrategiernes.Ast
- SHA256 4de56a16047544581f6b889a4d6b3b13699c0025115260a67453c2bfc301549f
- MD5 260152e4d0a2f6373cb25f1ae3a9aab2
- SHA1 0a089fbaf1a9c986dac0313900c2f4b43ac90a1a
- SHA512 a25f3f1410070af617cbc602e2379de4e5cc3b33a9d07dc14314ccd9a896937a6d66b12d7f6fb06f3eb94671d2b3de2a28b367fc6781982561673761ceb4c855
- SSDEEP 96:0smc7iVV4+i6p8k+4nvuflG87WhoDOeroI63XdnGkZh3:ewzk+wvufA8WhcrkZ3NGkZh3
- MD5 SHA1 SHA512 SSDEEP
Fdrelandssanges/dhourra.dei
- SHA256 9baab1cde953046954210f305136997005939f5eb8529dd51b2459034d0fbdfd
- MD5 e828786a178f23b7f56b9990a65ceea5
- SHA1 0ffe78218df805da550be16ee19e9946f39363b5
- SHA512 c4e5cbc49d03aa2c5e5eb2a2c9ad21cd9a375a98e686b5c3729c0b2b00a7ce5d7705e56f221f9b49538a433ccda12f1dd65ce97c0d4db9b1f9f8c8ac18a49ccc
- SSDEEP 768:oslLjhedzTOljJJZU1Buju3jmpZOzcqM4uYLjqTSL6C7obTtV3tkQuHtJ2vj+CXu:oOJJZDj7341Vonj5aCZ
- MD5 SHA1 SHA512 SSDEEP
Pneumonolith.upl
- SHA256 0d3a3ed7fea2a966434978158a8ef19cef6355491285bb8adf52515b67a5492c
- MD5 1872e6a44091d3d4b08720c52d334a6e
- SHA1 b5cea5b4c4b1c137723089f746b969f89d84b3af
- SHA512 915831066f678e14f331455353030713b9b9c745a04a275879eb9717403151a2da37987c73ae26ec8381e6eae984919a3d7875f0fc0d53db3a83df69581508a2
- SSDEEP 3072:Cc5JCyGs3xt/qeIiHZSiW9lm37do9ysGQGRcQPVinsSRnZNN:MLshlIA0Jvm37gy7fV7aZNN
- MD5 SHA1 SHA512 SSDEEP
Regionalize/Trade199/Fremlg/Fruitstalk/fiskeriinteressernes.bnk
- SHA256 a0d4f715188b1044c5f9876491f8cece5728d166da60b9514dd244ecf42f29f6
- MD5 04a03d1660020bed3ab9984bfaa2ef04
- SHA1 21cb45d775b5dc16caba3b80c3b458b3dbbcfb34
- SHA512 352260c7501e0751fb93845b7bddeca1bcc29dcfb745ccaa0a106556c2ca5787b0c64bccafdcc3ff2ff1ae0e428e03f8f6660aefbf03ebf99a5c0d7769c3beb9
- SSDEEP 768:5WINhheDhXPeDwAT/fXFKxz/nHTslCNCS6HKLs+SfWpHk6:LnFMplE6
- MD5 SHA1 SHA512 SSDEEP
Regionalize/Trade199/Fremlg/Fruitstalk/motleyest.hea
- SHA256 50b67542f8655d7110cd14285a6e8bfd3f238b3af26985d7f57c48f78a0bb646
- MD5 f18075570354f7c71286d7e633605ce6
- SHA1 1ce1b223eae5ae1bf61b72a4032953271a07c3cc
- SHA512 fe91ea361444335d3b67691cba1776a94d5bdba16359d507f1b6042a02f6f4c4a2b9ff8e45609759eaa51f94f17d47e28da7995bb123e9b742900dace917f018
- SSDEEP 384:OAC2dKLt1Lsw1d6OnQhcT+7ItGC3VVnxwZHr4WpJuHqLrJzE:5IYw1d6OnfT+8zWpJuIJz
- MD5 SHA1 SHA512 SSDEEP
Regionalize/Trade199/Fremlg/Fruitstalk/perivesical.cer
- SHA256 a91235c263f3c28790b391f6ead3ed10f674fbf7fc5e10a3640f9937902273e8
- MD5 fcf65b7d81e9b8f78ec8c24ca3092a8a
- SHA1 700291adfe86a3022d39e46e71d9e44e158c6f6d
- SHA512 c1f136d6c9cad6a9195da2690a8fcf2640a364dc6d636b2b8218c7022a59d2e99305ecdd201b614a92ce7ec4a955fc7c3389b7862bd25cacc531dfde3b2daef3
- SSDEEP 768:3ikksaRhO0tDtDHT4agsOypRJ5UVofBnhIOPNs28Bu7LYDRa5dv8Kn8GBrhGmVxr:FiRk48kL78Ka
- MD5 SHA1 SHA512 SSDEEP
Regionalize/Trade199/Fremlg/Fruitstalk/vanskabningers.txt
- SHA256 d7f13f88a63e6a8edb1dd1a5c194004a3fc24c870d2ac6013faf13afc6e77577
- MD5 19b947e1171ec056b5989798225e3080
- SHA1 c8703f1f4ae3a1a81924faf13f7305cba4aef6ca
- SHA512 e0e4878af414bd2845ed7a63aea844dad77bdad375d2bd6a2a69de9a8730571059bca5c7f937c2bd5205d13d92cfe8b22684214eb0ba673c9446f10debf24d25
- MD5 SHA1 SHA512
Semestret/Implantation/Hives/Wienervalsene/Milched.gri
- SHA256 a6ebb5155b1eb41cf2485f84e7fd89ecc3feb27b0ead2f11107495e662bc776f
- MD5 0cdac4cecc5709a94d54ccaed51945e0
- SHA1 da022c65989787e3c16c0fd4754feb55e2851d60
- SHA512 4d54f9d2cafa7e6d88ba394d17b4748d37adab57d0f18ac2d9162f4789d3ef3599cce94570195525699819acfbd8a56e44b15b2735382737675aba34bf663642
- SSDEEP 768:TxtDvwwKe7lLjmPR6s64AFEdo7QFOIZ8v6oS/88AGuh7Wz+dUa826EL6tqZscZGg:XgCj6kzuIT
- MD5 SHA1 SHA512 SSDEEP