e0d35d2fe887cbe0b4de87f1be7d7a17.bin
- SHA256 1ccfac0d54e9252032fbe4ebb2d47f346fa479ebd24c9bc1cece585baa6283cf
Password
infected
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
1ae1583b2be5c21f228a0e925652c9f5013bddf699548ca39b02670576325010.exe
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
1ae1583b2be5c21f228a0e925652c9f5013bddf699548ca39b02670576325010.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
18 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20240215-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20240419-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target e0d35d2fe887cbe0b4de87f1be7d7a17.bin
- Size 439KB
- Sample240501-cb3pbsdd2y
- SHA256 1ccfac0d54e9252032fbe4ebb2d47f346fa479ebd24c9bc1cece585baa6283cf
- MD5 4ab3f09a4000c4b07185e2f37dd99716
- SHA1 cf28424f6a638ecb97a2cdda0235a147e3333180
- SHA512 54b5ba03eb4e3bceb3b2504b6e6c737ce7cb107ef27b15b0acd300369fd83d16ec7c2a1601b84eb5feb5bbae748b09b1ffa2a9668a3394bfef312851fcb321b0
- SSDEEP 12288:xbvjdRgI8n5m/h+rl3Z3pKkpvo7cdPFLXMtGXt:x3d8ncuUGvo7cdtjMtGXt
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/1ae1583b2be5c21f228a0e925652c9f5013bddf699548ca39b02670576325010.exe unpack002/$PLUGINSDIR/nsExec.dll - NSIS installer 2 IoCs
resource yara_rule static1/unpack001/1ae1583b2be5c21f228a0e925652c9f5013bddf699548ca39b02670576325010.exe nsis_installer_1 static1/unpack001/1ae1583b2be5c21f228a0e925652c9f5013bddf699548ca39b02670576325010.exe nsis_installer_2
File Explorer
-
e0d35d2fe887cbe0b4de87f1be7d7a17.bin.zip 439KB
-
1ae1583b2be5c21f228a0e925652c9f5013bddf699548ca39b02670576325010.exe.exe 563KB
-
$PLUGINSDIR/nsExec.dll.dll 6KB
-
Devenustate/Accorder/Uncoincidental/Incurvity.eft76KB
-
Overenstemmelse/Conferree/Emption/Metropolis/indhuggene.sex1KB
-
Overenstemmelse/Conferree/Emption/Metropolis/syringitis.sei2KB
-
Radiologist/Heptarchist/Microtine76.txt331B
-
Ringspinderne.Eks336KB
1ae1583b2be5c21f228a0e925652c9f5013bddf699548ca39b02670576325010.exe
- IMPHASH 5f0c714c36e6cc016b3a1f4bc86559e4
- SHA256 1ae1583b2be5c21f228a0e925652c9f5013bddf699548ca39b02670576325010
- MD5 e0d35d2fe887cbe0b4de87f1be7d7a17
- SHA1 b37f59b0ec54d6c40645837dbb3a18c954346601
- SHA512 9d20fd479a57ccf51c02830744f095b5dfa98707777a8f24968aa0f0e9ac2a4de4ae348831a001b00cae9d750b9372a85248fdd15570a44ca52b90f8cf451256
- SSDEEP 12288:8stfWr2z5t/dtpQBEd6XT9Pi8RzDm+EYRfT7d+:8st+r2z5J9Pd6XT9Pi85REYpT7d+
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
-
NSIS installer
Password
infected
Minor OS version
0
Major OS version
4
Entry point
13235
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
advapi32
RegCreateKeyExA
RegEnumKeyA
RegQueryValueExA
RegSetValueExA
RegCloseKey
RegDeleteValueA
RegDeleteKeyA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
SetFileSecurityA
RegOpenKeyExA
RegEnumValueA
shell32
SHGetFileInfoA
SHFileOperationA
SHGetPathFromIDListA
ShellExecuteExA
SHGetSpecialFolderLocation
SHBrowseForFolderA
ole32
IIDFromString
OleInitialize
OleUninitialize
CoCreateInstance
CoTaskMemFree
comctl32
ord17
ImageList_Create
ImageList_Destroy
ImageList_AddMasked
user32
SetClipboardData
CharPrevA
CallWindowProcA
PeekMessageA
DispatchMessageA
MessageBoxIndirectA
GetDlgItemTextA
SetDlgItemTextA
GetSystemMetrics
CreatePopupMenu
AppendMenuA
TrackPopupMenu
FillRect
EmptyClipboard
LoadCursorA
GetMessagePos
CheckDlgButton
SetWindowPos
SetCursor
GetSysColor
SetClassLongA
GetWindowLongA
IsWindowEnabled
GetWindowRect
GetSystemMenu
EnableMenuItem
RegisterClassA
ScreenToClient
EndDialog
GetClassInfoA
SystemParametersInfoA
CreateWindowExA
ExitWindowsEx
DialogBoxParamA
CharNextA
SetTimer
DestroyWindow
CreateDialogParamA
SetForegroundWindow
SetWindowTextA
PostQuitMessage
SendMessageTimeoutA
ShowWindow
wsprintfA
GetDlgItem
FindWindowExA
IsWindow
GetDC
SetWindowLongA
LoadImageA
InvalidateRect
ReleaseDC
EnableWindow
BeginPaint
SendMessageA
DefWindowProcA
DrawTextA
GetClientRect
EndPaint
IsWindowVisible
CloseClipboard
OpenClipboard
gdi32
SetBkMode
SetBkColor
GetDeviceCaps
CreateFontIndirectA
CreateBrushIndirect
DeleteObject
SetTextColor
SelectObject
kernel32
GetExitCodeProcess
WaitForSingleObject
GetProcAddress
GetSystemDirectoryA
WideCharToMultiByte
MoveFileExA
ReadFile
GetTempFileNameA
WriteFile
RemoveDirectoryA
CreateProcessA
CreateFileA
GetLastError
CreateThread
CreateDirectoryA
GlobalUnlock
GetDiskFreeSpaceA
GlobalLock
SetErrorMode
GetVersionExA
lstrcpynA
GetCommandLineA
GetTempPathA
lstrlenA
SetEnvironmentVariableA
ExitProcess
GetWindowsDirectoryA
GetCurrentProcess
GetModuleFileNameA
CopyFileA
GetTickCount
Sleep
GetFileSize
GetFileAttributesA
SetCurrentDirectoryA
SetFileAttributesA
GetFullPathNameA
GetShortPathNameA
MoveFileA
CompareFileTime
SetFileTime
SearchPathA
lstrcmpiA
lstrcmpA
CloseHandle
GlobalFree
GlobalAlloc
ExpandEnvironmentStringsA
LoadLibraryExA
FreeLibrary
lstrcpyA
lstrcatA
FindClose
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
SetFilePointer
GetModuleHandleA
FindNextFileA
FindFirstFileA
DeleteFileA
MulDiv
Name
.text
Size
25KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
149KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
56KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
193KB
Virtual Size
193KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=160, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
$PLUGINSDIR/nsExec.dll
- IMPHASH e269b6260a93a17ceff5184b3982ded8
- SHA256 10675f13abaee592f14382349aa35d82fb52aab4e27eef61d0c83dec1f6b73da
- MD5 5aa38904acdcc21a2fb8a1d30a72d92f
- SHA1 a9ce7d1456698921791db91347dba0489918d70c
- SHA512 f04740da561d7cd0dea5e839c9e1c339d4a3e63944d3566c94c921a3d170a69918a32dff3f3b43f13d55cc25a2dbb4c21104f062c324308ac5104179766402a3
- SSDEEP 96:AOBtEB2flLkatAthPZJoi9jpfW/er6cBbcB/NFyVOHd0+uHwEX:AhB2flXAVJtjf6cBbcB/N8Ved0PZ
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
4
Entry point
4231
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
advapi32
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
user32
wsprintfA
SendMessageA
CharNextA
OemToCharBuffA
FindWindowExA
CharNextExA
CharPrevA
kernel32
GetVersion
lstrcmpiA
lstrlenA
lstrcpynA
ExitProcess
Sleep
TerminateProcess
GlobalReAlloc
ReadFile
PeekNamedPipe
GetExitCodeProcess
WaitForSingleObject
GetTickCount
lstrcpyA
CreateProcessA
GetStartupInfoA
CreatePipe
CreateFileA
DeleteFileA
CopyFileA
GetCommandLineA
lstrcatA
CloseHandle
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
GlobalAlloc
GetTempFileNameA
GlobalFree
GetModuleHandleA
GetModuleFileNameA
GetProcAddress
GetCurrentProcess
Exec
ExecToLog
ExecToStack
Name
.text
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
434B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=44, id=1, productName=Unmarked objects,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=2, id=48, version=9044,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
Devenustate/Accorder/Uncoincidental/Incurvity.eft
- SHA256 02e8b4c4053f7f4352c533a46471ab963a86a8156267cdffeb74c0374d2c4c79
- MD5 465454d4effb2dd4458e8032988455d0
- SHA1 3afe548209cfe0721b65fbd2b4b6019354d0d59f
- SHA512 c4a6031758908fe6b48046ab25f88a8983e63c95a6d94542a4e8812d172009f72020a842ee92f42742f15665eaed3e20cd6cf3cd2f166b7ceb2306ffbcceef3d
- SSDEEP 1536:cbcsE1JLvUbYpjrIG+BeyZkMnLf8GvkVCG4Sn47Nqjd8FQ4X6g+0M4vY5ByetfAs:cb41xvGYBhKNZkMn7bvkYG4UE76gA5BT
- MD5 SHA1 SHA512 SSDEEP
Overenstemmelse/Conferree/Emption/Metropolis/indhuggene.sex
- SHA256 b71330891ecc7e46ae3bff434dcc8659b106415d0efc2c4d6e61811ac9f58d2f
- MD5 f4ce6c53ffb5533a5dab605e98eb4067
- SHA1 2d1a46b2cf7c902bdc6b5d6fda59e5ea899949ee
- SHA512 c47ba80c126da2a527cd090322786c3f0b58fb6c6f285275e60d0b95fae8804559c242ce8f35cf7a23753624f994b0ddcaf2dc19203b7237da3b0c45cf6934a9
- MD5 SHA1 SHA512
Overenstemmelse/Conferree/Emption/Metropolis/syringitis.sei
- SHA256 75b6002232106fa6ba35b5554270461e0431d11eea7d67adbad2651d19790a20
- MD5 65afa39b0e2935fd0f0eaae9934a09ec
- SHA1 6d7c896c9825809046862695877eb88c3248c6f8
- SHA512 732a14fcab8e7845b239930fdc3cc1bef2b08ab06b740d6931cdc2f352c7505bd5e26f6db820771089664bdd2ae9347b20e1bb769abb5c60a472b1240d35df6a
- MD5 SHA1 SHA512
Radiologist/Heptarchist/Microtine76.txt
- SHA256 d70b7e5a8fdc7ac864455470d282565fe41a3f0937d8f89a85d30bbb93b59f12
- MD5 7cb24dded50a9f89bb5d62f961802f20
- SHA1 2f21f643fa1501a90b01ce1702e53c32c0ef56fc
- SHA512 ef7758a566578eeabe3ad92047f01fbd4d38549d505d943ab1a2ae73bb5a077f53e9a36ab1d0bdd795f560d89ac86eb3aa3ba881aff1d942bb308ba5217f1675
- MD5 SHA1 SHA512
Ringspinderne.Eks
- SHA256 698751c6b65fa692eace874966db90257c8166210c739be6d00a35053a30f2fa
- MD5 3295c50e6679be9cda4405ea4aece7bb
- SHA1 6361360fef5d23ee39c4ea42ea48d00e5952ad9a
- SHA512 b21f13cecb5c481ca1d951847a4b54881b37c868ada0d54b39d2e784a7fc8acac7d56be1063c2090a053400fe0f149b5450d5afa840153f234ff3f08770bdcf6
- SSDEEP 6144:ZeChrURjiUMHwYlPDUqL+OOm+zYxwYmGjUTWdsDxu+DT:L2jiUGw2RLnS/Y5gWeE+/
- MD5 SHA1 SHA512 SSDEEP