c755c5c682da599ba12036dd608b866d.bin
- SHA256 c796791e1223fd1f78f0e49cdbd17971613db5e669ff3531dcafcc36d5adb02b
Password
infected
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
PO_450038969222222.exe
Resource
win7-20240220-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
PO_450038969222222.exe
Resource
win10v2004-20240419-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20231129-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target c755c5c682da599ba12036dd608b866d.bin
- Size 382KB
- Sample240428-cbex9sdf25
- SHA256 c796791e1223fd1f78f0e49cdbd17971613db5e669ff3531dcafcc36d5adb02b
- MD5 94277058d1544fba4f8178256966533c
- SHA1 1a8d4599df0ac0040175ffa68b7049b86ff8ba29
- SHA512 7f32e0dcb45d9a0a8d1ee5dd835e82510fdb834a828432bc6545d61d5137d0377cb5f91fdcb9cd1f45d7ecbb177f300a534fa642d8557f6d26f8f9a673881793
- SSDEEP 6144:zjrbATD24d4nh5XfBqrKWcFU0CyV8hvvwUo4soCrOKm/5ki6OqDku4flVK1OMIqt:HrkX24oh59UTa8hQMCrOKmKiyDbMYOMH
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack002/PO_450038969222222.exe unpack003/$PLUGINSDIR/System.dll - NSIS installer 2 IoCs
resource yara_rule static1/unpack002/PO_450038969222222.exe nsis_installer_1 static1/unpack002/PO_450038969222222.exe nsis_installer_2
File Explorer
-
c755c5c682da599ba12036dd608b866d.bin.zip 382KB
-
45a95817d50c64f2340c481541ba837e2f13263d0ff6db4396ab16914279439a.img.iso 1.2MB
-
PO_450038969222222.exe.exe 624KB
-
$PLUGINSDIR/System.dll.dll 11KB
-
Akkumulerendes/Hjrners133.txt530B
-
Drugshop.Pok420KB
-
Sesammens/dummying/princelings.bar2KB
-
soutenr/Autoschediastic/Nskvrdiges/Filantroper.ove2KB
-
soutenr/Autoschediastic/Nskvrdiges/Homothallic137.dup45KB
45a95817d50c64f2340c481541ba837e2f13263d0ff6db4396ab16914279439a.img
- SHA256 45a95817d50c64f2340c481541ba837e2f13263d0ff6db4396ab16914279439a
- MD5 c755c5c682da599ba12036dd608b866d
- SHA1 ab473b32f99051d69b5b07dab5317412d0af760e
- SHA512 867941dab88fb989f3794bca7bd8ee0f1033510f2156851a466ead1f824ebd6238d0a8a6b897255652fd8ea877584fcde35ceafc50774a5bcc685e2a0a5ecf7c
- SSDEEP 6144:Rz27B8gj9StARX5mdUP49xHcZYDbTECOpckKhaITOYFog9qg6cOTmsYQa9cW3B+u:pIXp49FGYDcnGd73qq2TY4CBH
- MD5 SHA1 SHA512 SSDEEP
Password
infected
PO_450038969222222.exe
- IMPHASH b78ecf47c0a3e24a6f4af114e2d1f5de
- SHA256 c48ee19744cf5c99735454ecdfc48e5c0943e44c175481725d62a104b140826b
- MD5 acefcf62c3b1562fccbc6b09bd635e46
- SHA1 59d2672f9874c68861850e7b7854653aa51107af
- SHA512 e0b5197fd71e6ca578ef7518e254bdfa06b207598372d12646ea3c79bfa6c45859ed809bd744007f2edee2b5bc9f6ba606dcffebdb80bb5e5382181b30e68ec9
- SSDEEP 6144:5z27B8gj9StARX5mdUP49xHcZYDbTECOpckKhaITOYFog9qg6cOTmsYQa9cW3B+u:hIXp49FGYDcnGd73qq2TY4CBH
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
-
NSIS installer
Password
infected
Minor OS version
0
Major OS version
4
Entry point
12559
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
SetEnvironmentVariableA
Sleep
GetTickCount
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
GetFileAttributesA
SetFileAttributesA
GetWindowsDirectoryA
GetTempPathA
GetCommandLineA
lstrlenA
GetVersion
SetErrorMode
lstrcpynA
ExitProcess
GetFullPathNameA
GlobalLock
CreateThread
GetLastError
CreateDirectoryA
CreateProcessA
RemoveDirectoryA
CreateFileA
GetTempFileNameA
ReadFile
WriteFile
lstrcpyA
MoveFileExA
lstrcatA
GetSystemDirectoryA
GetProcAddress
CloseHandle
SetCurrentDirectoryA
MoveFileA
CompareFileTime
GetShortPathNameA
SearchPathA
lstrcmpiA
SetFileTime
lstrcmpA
ExpandEnvironmentStringsA
GlobalUnlock
GetDiskFreeSpaceA
GlobalFree
FindFirstFileA
FindNextFileA
DeleteFileA
SetFilePointer
GetPrivateProfileStringA
FindClose
MultiByteToWideChar
FreeLibrary
MulDiv
WritePrivateProfileStringA
LoadLibraryExA
GetModuleHandleA
GetExitCodeProcess
WaitForSingleObject
GlobalAlloc
user32
ScreenToClient
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
PostQuitMessage
GetWindowRect
EnableMenuItem
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
ReleaseDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndDialog
RegisterClassA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
ExitWindowsEx
GetDC
CreateDialogParamA
SetTimer
GetDlgItem
SetWindowLongA
SetForegroundWindow
LoadImageA
IsWindow
SendMessageTimeoutA
FindWindowExA
OpenClipboard
TrackPopupMenu
AppendMenuA
EndPaint
DestroyWindow
wsprintfA
ShowWindow
SetWindowTextA
gdi32
SelectObject
SetBkMode
CreateFontIndirectA
SetTextColor
DeleteObject
GetDeviceCaps
CreateBrushIndirect
SetBkColor
shell32
SHGetSpecialFolderLocation
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
advapi32
RegDeleteKeyA
SetFileSecurityA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegOpenKeyExA
RegEnumValueA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA
RegSetValueExA
RegQueryValueExA
RegEnumKeyA
comctl32
ImageList_Create
ImageList_AddMasked
ImageList_Destroy
ord17
ole32
OleUninitialize
OleInitialize
CoTaskMemFree
CoCreateInstance
Name
.text
Size
24KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
149KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
72KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
267KB
Virtual Size
266KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=159, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
$PLUGINSDIR/System.dll
- IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
- SHA256 4c86b238e64ecfaabe322a70fd78db229a663ccc209920f3385596a6e3205f78
- MD5 375e8a08471dc6f85f3828488b1147b3
- SHA1 1941484ac710fc301a7d31d6f1345e32a21546af
- SHA512 5ba29db13723ddf27b265a4548606274b850d076ae1f050c64044f8ccd020585ad766c85c3e20003a22f356875f76fb3679c89547b0962580d8e5a42b082b9a8
- SSDEEP 192:MPtkumJX7zB22kGwfy0mtVgkCPOs91un:9702k5qpds9Qn
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
4
Entry point
9995
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
MultiByteToWideChar
GlobalFree
GlobalSize
lstrcpynA
lstrcpyA
GetProcAddress
VirtualFree
FreeLibrary
lstrlenA
LoadLibraryA
GetModuleHandleA
GlobalAlloc
WideCharToMultiByte
VirtualAlloc
VirtualProtect
GetLastError
user32
wsprintfA
ole32
StringFromGUID2
CLSIDFromString
Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc
Name
.text
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
851B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
104B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1024B
Virtual Size
608B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=14, version=7299,
count=19, id=1, productName=Unmarked objects,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=4, id=48, version=9044,
count=1, id=42, version=8803,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
Akkumulerendes/Hjrners133.txt
- SHA256 4ee060346428f790c5326b3b1fac19834543b9d4dfaa932afc5ccfa5aed645ee
- MD5 7c8c74a1071f35a3e51307389ce95dc4
- SHA1 f3fbe7a0961de881f05fdb21aa374648bc8a9542
- SHA512 39484c9cde71e529daf7c641fa490164ca79d6b94781b861e90cba891e94cbd6fd96f214c52cf0071eaa8a7e929fd08309323f8ffe9716bab7e7ef3815d84538
- MD5 SHA1 SHA512
Drugshop.Pok
- SHA256 4b1fa345723beb2162ba36fa1e5e41e6e9c8ca76325f526199fb93f4f2038c1a
- MD5 5434562e0001779f6337c583eefe364c
- SHA1 ddf94bdfcf95e38701d7f45ad765b0a3293cc525
- SHA512 ceff248deeec44c97fe7e7c5f5c4c5b3ed7f19f4e984e59109181eeaadb9be448b9fe5f8c35d09053da384f314d3f5984cbeb973cd1c8b9ea60644b49f673a29
- SSDEEP 6144:Rv4HAYAd6aGpCwLa+ih2LE0W0vAICRRt4WlLbyJbDEK7cylhr7adP:Rv4gZd6xI4O0v1IRPXIrIWadP
- MD5 SHA1 SHA512 SSDEEP
Sesammens/dummying/princelings.bar
- SHA256 af3c4ebf9d8448367fd6cee7b235f7cb0ee0ccecdb52019a2f1829587d309d26
- MD5 e434936393a7fd7565eda222b947c90e
- SHA1 dcc61c436d4c63b2bf00982503c509f727f58ab6
- SHA512 eb5c3caae13647803f4f3eb18246a37eb53504f84e451dc6f4b2c698ad756d62b8cda6ce8049b15af34c4a31dd0fd1860b54c9123d313abc2dd8bb276344982c
- MD5 SHA1 SHA512
soutenr/Autoschediastic/Nskvrdiges/Filantroper.ove
- SHA256 648d1f41365179f4b758244a68206d606737da1759b46ee528ec7d0fa52a1121
- MD5 c8167c1894b7a1b86f47d0b94c9c5232
- SHA1 ddea2ea111dc7fa03d64f630a2f87b05b5b69e32
- SHA512 7d695be9927f1969860d7a92086d1a062ce962df3b60ab01287d1c73bc9a8314ff898343f4a836948f486eb4ec771b9482df75c8696a39717e08194b062c0a8e
- MD5 SHA1 SHA512
soutenr/Autoschediastic/Nskvrdiges/Homothallic137.dup
- SHA256 a5fc0eb927227a0d9b46be0dec567caf0f403d8809549ee55632bef33fe3235c
- MD5 60c0d33d49a5550ed446611237f8e536
- SHA1 ea48ebf99aa65b8c4033be908ef2a19365583e64
- SHA512 948378306a014305d945a44e24899659018fbbf3c52ed06eed9ea61a00e688b0c5bde26c8bd7e825fb8a25a6c88312b9af7f4b0b1648a86eaafaa611c23d0423
- SSDEEP 768:cvGhIT5sz8XQ3Lg6vc7mQNJQuaOc82KFLY0BwF+AyemfD:cvGt8XJ6CZKuJhigJD7
- MD5 SHA1 SHA512 SSDEEP