566a9fbd642c4a82e90316c224cc095c.bin
- SHA256 176d66ca9e8acfeebeea7401bfe3b16d6b1e2b0165cb08ae47951353328cb2b9
Password
infected
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d4be2f3cfa3365cf4b7d567839a2d31f7d0683bcc39e3abd041f1cfbb6b6bbae.exe
Resource
win7-20231129-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
d4be2f3cfa3365cf4b7d567839a2d31f7d0683bcc39e3abd041f1cfbb6b6bbae.exe
Resource
win10v2004-20240419-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240419-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target 566a9fbd642c4a82e90316c224cc095c.bin
- Size 395KB
- Sample240502-bqp64sfa86
- SHA256 176d66ca9e8acfeebeea7401bfe3b16d6b1e2b0165cb08ae47951353328cb2b9
- MD5 4fe29a69e21d5327fbab249a96fb5447
- SHA1 a8dddef4ac3f9ff2c0ee3979244105be83bd7f7a
- SHA512 8d712fe2aadf55873f8b49c7c448dd8d80a5de01c5fed2356731b6f978199e600b859c8ca37ef5fae4d8a884cb4640f2ad4205b4a5a7fb265568e24cd4cd7adf
- SSDEEP 6144:xqY4QmC1+AjtaKS480zScmvfd30J90/VUrg6AvLV9PMXAw3ndA2A4AMIuOsvzzzI:aQ2KSB0ecKfd300/Vig6Up5MXZbAYTI
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/d4be2f3cfa3365cf4b7d567839a2d31f7d0683bcc39e3abd041f1cfbb6b6bbae.exe unpack002/$PLUGINSDIR/System.dll
File Explorer
-
566a9fbd642c4a82e90316c224cc095c.bin.zip 395KB
-
d4be2f3cfa3365cf4b7d567839a2d31f7d0683bcc39e3abd041f1cfbb6b6bbae.exe.exe 429KB
-
$PLUGINSDIR/System.dll.dll 11KB
-
Exemptible/Kommuneplanlov/Scuppler/Tegminal/punktvises.txt544B
-
commonly.rei2KB
-
isdkke.Shi380KB
d4be2f3cfa3365cf4b7d567839a2d31f7d0683bcc39e3abd041f1cfbb6b6bbae.exe
- IMPHASH e2a592076b17ef8bfb48b7e03965a3fc
- SHA256 d4be2f3cfa3365cf4b7d567839a2d31f7d0683bcc39e3abd041f1cfbb6b6bbae
- MD5 566a9fbd642c4a82e90316c224cc095c
- SHA1 bd2741e788f69eb3cb56f1cee3fad112838d740e
- SHA512 7e27ececc7f952f9231dfff21eda0211edd6a247d1d884c5ffc11af1d708735bc459d11b6ddd03fed7986f1605fd69beb9d3f782b1ab211f2c7f90f02c0928f5
- SSDEEP 6144:7pkXGh6tHk47x2IIjpLUJpJ0IgB9AvCF1RIJ+oBlGORmbrKydSBmpJ3PVF97/ENI:2ZHkkx2IIdLdPAvCjRIEZVxdSwb
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
4
Entry point
12960
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
SetCurrentDirectoryW
GetFileAttributesW
GetFullPathNameW
Sleep
GetTickCount
GetFileSize
GetModuleFileNameW
MoveFileW
SetFileAttributesW
GetCurrentProcess
ExitProcess
SetEnvironmentVariableW
GetWindowsDirectoryW
GetTempPathW
GetCommandLineW
GetVersion
SetErrorMode
lstrlenW
WaitForSingleObject
CopyFileW
CompareFileTime
GlobalLock
CreateThread
GetLastError
CreateDirectoryW
CreateProcessW
RemoveDirectoryW
lstrcmpiA
CreateFileW
GetTempFileNameW
WriteFile
lstrcpyA
lstrcpyW
MoveFileExW
lstrcatW
GetSystemDirectoryW
GetProcAddress
GetModuleHandleA
GlobalFree
GlobalAlloc
GetShortPathNameW
SearchPathW
lstrcmpiW
SetFileTime
CloseHandle
ExpandEnvironmentStringsW
lstrcmpW
GlobalUnlock
lstrcpynW
GetDiskFreeSpaceW
GetExitCodeProcess
FindFirstFileW
FindNextFileW
DeleteFileW
SetFilePointer
ReadFile
FindClose
MulDiv
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
GetPrivateProfileStringW
WritePrivateProfileStringW
FreeLibrary
LoadLibraryExW
GetModuleHandleW
user32
GetSystemMenu
SetClassLongW
IsWindowEnabled
EnableMenuItem
SetWindowPos
GetSysColor
GetWindowLongW
SetCursor
LoadCursorW
CheckDlgButton
GetMessagePos
LoadBitmapW
CallWindowProcW
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
wsprintfW
ScreenToClient
GetWindowRect
GetSystemMetrics
SetDlgItemTextW
GetDlgItemTextW
MessageBoxIndirectW
CharPrevW
CharNextA
wsprintfA
DispatchMessageW
PeekMessageW
GetDC
ReleaseDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
GetClientRect
FillRect
EndDialog
RegisterClassW
SystemParametersInfoW
CreateWindowExW
GetClassInfoW
DialogBoxParamW
CharNextW
ExitWindowsEx
DestroyWindow
LoadImageW
SetTimer
SetWindowTextW
PostQuitMessage
ShowWindow
GetDlgItem
IsWindow
SetWindowLongW
FindWindowExW
TrackPopupMenu
AppendMenuW
CreatePopupMenu
DrawTextW
EndPaint
CreateDialogParamW
SendMessageTimeoutW
SetForegroundWindow
gdi32
SelectObject
SetBkMode
CreateFontIndirectW
SetTextColor
DeleteObject
GetDeviceCaps
CreateBrushIndirect
SetBkColor
shell32
SHGetSpecialFolderLocation
SHGetPathFromIDListW
SHBrowseForFolderW
SHGetFileInfoW
ShellExecuteW
SHFileOperationW
advapi32
RegDeleteKeyW
SetFileSecurityW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegOpenKeyExW
RegEnumValueW
RegDeleteValueW
RegCloseKey
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW
RegEnumKeyW
comctl32
ImageList_AddMasked
ord17
ImageList_Destroy
ImageList_Create
ole32
OleUninitialize
OleInitialize
CoTaskMemFree
CoCreateInstance
Name
.text
Size
25KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
171KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
164KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
63KB
Virtual Size
63KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=166, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
$PLUGINSDIR/System.dll
- IMPHASH fc0224e99e736751432961db63a41b76
- SHA256 9b93c61c9d63ef8ec80892cc0e4a0877966dca9b0c3eb85555cebd2ddf4d6eed
- MD5 fc3772787eb239ef4d0399680dcc4343
- SHA1 db2fa99ec967178cd8057a14a428a8439a961a73
- SHA512 79e491ca4591a5da70116114b7fbb66ee15a0532386035e980c9dfe7afb59b1f9d9c758891e25bfb45c36b07afd3e171bac37a86c887387ef0e80b1eaf296c89
- SSDEEP 192:eS24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35OloSl:S8QIl975eXqlWBrz7YLOlo
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
4
Entry point
10183
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetModuleHandleW
GlobalFree
GlobalSize
lstrcpynW
lstrcpyW
GetProcAddress
WideCharToMultiByte
VirtualFree
FreeLibrary
lstrlenW
LoadLibraryW
GlobalAlloc
MultiByteToWideChar
VirtualAlloc
VirtualProtect
GetLastError
user32
wsprintfW
ole32
StringFromGUID2
CLSIDFromString
Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc
Name
.text
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
851B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
120B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1024B
Virtual Size
610B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=14, version=7299,
count=20, id=1, productName=Unmarked objects,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=4, id=48, version=9044,
count=1, id=42, version=8803,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
Exemptible/Kommuneplanlov/Scuppler/Tegminal/punktvises.txt
- SHA256 cbba33f96ff055859b169343328b75ae2fad53b3d3ae48089ccd543b5c002250
- MD5 50ea0194c78a995aae022457d1faf8d8
- SHA1 93d435493652740c806e092d470940aa0fb4edbb
- SHA512 83cfa56195261294787c4a63031e2b44337cca6c444d379de8fe3a8818b2d06ffe08cd199701a465350f02b85803bbc415389c765291be0101a951acb57c3009
- MD5 SHA1 SHA512
commonly.rei
- SHA256 84b482ffcabb6a83e69c1512cde3207534ea7af47939545a1e9bf2af8f0722a3
- MD5 571acaef34ef032230c2146e2e97736b
- SHA1 803c89551ddd44a70d50fdfa2e5e0fd7cec65c97
- SHA512 e823507b54ad5d227b1618cdb8f17024c71fe2c2ee09f98a0a8d845920ea0766d303270886be7461924a353ee33a7466ba1da8d21fd2cab02abe3961f282c65f
- MD5 SHA1 SHA512
isdkke.Shi
- SHA256 5f9583f799b501a918b2a19d961f7696559e325efe6b89c015d9f880abde4dc7
- MD5 fd68d5565d5e1d7b4e61c69af7463c9e
- SHA1 3335339e246e2837d235c2fb7020df2cebdbfd97
- SHA512 a3936f3760322a03f9ef7879d249082d0364363f79d2a0472fb70cba05959492cd2fd4a0983e69ef25ef508e4d0977447c6673c5770f619e7e40cc42cc9e7ff0
- SSDEEP 6144:OhsJOx2QH0JLCRBbDzszkw9+jP9MLnsViokJvShXKr9mVudMM4a4pZ3znwIAKN2z:5PpAtzi98PGbpVvxrwrMkRznwDKN22WN
- MD5 SHA1 SHA512 SSDEEP