DATASHEET_Quote Required.iso
- SHA256 b0222d4e56f9fcd1e24ff96b509da67357e2e899d21c5088a0800aff9df18202
-
NSIS installer
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
DATASHEET_Quote Required.exe
Resource
win7-20240221-en
windows7-x64
20 signatures
150 seconds
Behavioral task
behavioral2
Sample
DATASHEET_Quote Required.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
19 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240419-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target DATASHEET_Quote Required.iso
- Size 426KB
- Sample240502-qws8aacb26
- SHA256 b0222d4e56f9fcd1e24ff96b509da67357e2e899d21c5088a0800aff9df18202
- MD5 2e57e9d369cc5797ea7b345f1eeb22af
- SHA1 44e52c1dde5dc60733dbfc01bc1d59f33a05fbe8
- SHA512 c92b608e5375d0ee3e2bb87268f2bff33aa874ee3cda58a711ad06714c8a243c78b5fe792b5745f7926324a8d2b7958a3b8b9517849b0fe9a94d61785919eabb
- SSDEEP 6144:AcQ9zIITdbWCYoZjp2D210jNiIwUv5PGqJe+kmX/SZB3pH2ybSnYOD69Y7Q:wwCYsjpu210jNnlGqJolIyUYOu9Y
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack003/$PLUGINSDIR/System.dll - NSIS installer 3 IoCs
resource yara_rule sample nsis_installer_2 static1/unpack002/DATASHEET_Quote Required.exe nsis_installer_1 static1/unpack002/DATASHEET_Quote Required.exe nsis_installer_2
File Explorer
-
DATASHEET_Quote Required.iso.iso 426KB
-
out.iso.iso 426KB
-
DATASHEET_Quote Required.exe.exe 364KB
-
$PLUGINSDIR/System.dll.dll 11KB
-
Bedmmelseskomite158/Weiselbergite153/Grundliniers.Bar9KB
-
Bedmmelseskomite158/Weiselbergite153/delkorallen.txt379B
-
Bedmmelseskomite158/Weiselbergite153/intellektualistiske.vol1KB
-
Tlperagtigt/Relumining.brn286KB
out.iso
- SHA256 b0222d4e56f9fcd1e24ff96b509da67357e2e899d21c5088a0800aff9df18202
- MD5 2e57e9d369cc5797ea7b345f1eeb22af
- SHA1 44e52c1dde5dc60733dbfc01bc1d59f33a05fbe8
- SHA512 c92b608e5375d0ee3e2bb87268f2bff33aa874ee3cda58a711ad06714c8a243c78b5fe792b5745f7926324a8d2b7958a3b8b9517849b0fe9a94d61785919eabb
- SSDEEP 6144:AcQ9zIITdbWCYoZjp2D210jNiIwUv5PGqJe+kmX/SZB3pH2ybSnYOD69Y7Q:wwCYsjpu210jNnlGqJolIyUYOu9Y
- MD5 SHA1 SHA512 SSDEEP
-
NSIS installer
DATASHEET_Quote Required.exe
- IMPHASH 59a4a44a250c4cf4f2d9de2b3fe5d95f
- SHA256 037afb04ecb79c472588e6f1b3571abb8903af2fc86f1a8ca2e2acb63c14335b
- MD5 25727be97a9ff477eaf9f5ede2517d4a
- SHA1 66de55b95e1f19b9c626e35126e9c6dbac8680b0
- SHA512 f1ecad4f78ddab2d5dcd0ba863f97b17e68e25f6369b0532cf12353f067beec6e358c9acdf82ed84eb7fba19acc55e7085369082757e8a6a18fa1b15e435015a
- SSDEEP 6144:BcQ9zIITdbWCYoZjp2D210jNiIwUv5PGqJe+kmX/SZB3pH2ybSnYOD69Y7Qh:BwCYsjpu210jNnlGqJolIyUYOu9YW
- MD5 SHA1 SHA512 SSDEEP
-
NSIS installer
PE Signature issue
Digest
62:f2:16:e7:c2:3d:c6:bb:15:fc:6d:d8:9d:6e:0f:0d:e9:45:06:b4:80:1e:21:ed:53:21:24:45:48:90:f0:65
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Joshia,OU=Golcondas Isoabnormal Cyaniders\ ,O=Joshia,L=Blaine,ST=Ohio,C=US,1.2.840.113549.1.9.1=#0c104f73626f75726e654054616b742e486a
Chains
May 2, 2024
Subject
CN=Joshia,OU=Golcondas Isoabnormal Cyaniders\ ,O=Joshia,L=Blaine,ST=Ohio,C=US,1.2.840.113549.1.9.1=#0c104f73626f75726e654054616b742e486a
Serial Number
27:a6:ae:07:9a:c3:39:17:2d:a6:2e:00:8e:da:ea:f6:3f:f5:e1:f2
Issuer
CN=Joshia,OU=Golcondas Isoabnormal Cyaniders\ ,O=Joshia,L=Blaine,ST=Ohio,C=US,1.2.840.113549.1.9.1=#0c104f73626f75726e654054616b742e486a
Timespan
Mar 27, 2024 - Mar 27, 2027
Subject
CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Issuer
CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 12, 2016 - Jan 11, 2031
Subject
CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Issuer
CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 23, 2017 - Mar 22, 2029
Minor OS version
0
Major OS version
4
Entry point
12823
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetTickCount
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
SearchPathA
GetShortPathNameA
CreateFileA
GetFileSize
GetModuleFileNameA
ReadFile
GetCurrentProcess
CopyFileA
ExitProcess
SetEnvironmentVariableA
Sleep
CloseHandle
GetCommandLineA
SetErrorMode
LoadLibraryA
lstrlenA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
GetTempFileNameA
lstrcpyA
lstrcatA
GetSystemDirectoryA
GetVersion
GetProcAddress
GlobalAlloc
CompareFileTime
SetFileTime
ExpandEnvironmentStringsA
lstrcmpiA
lstrcmpA
WaitForSingleObject
GlobalFree
GetExitCodeProcess
GetModuleHandleA
GetTempPathA
GetWindowsDirectoryA
LoadLibraryExA
FindFirstFileA
FindNextFileA
DeleteFileA
SetFilePointer
WriteFile
FindClose
WritePrivateProfileStringA
MultiByteToWideChar
MulDiv
GetPrivateProfileStringA
FreeLibrary
user32
CreateWindowExA
EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
GetDC
SystemParametersInfoA
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
ReleaseDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
GetClassInfoA
DialogBoxParamA
CharNextA
ExitWindowsEx
DestroyWindow
CreateDialogParamA
SetTimer
GetDlgItem
wsprintfA
SetForegroundWindow
ShowWindow
IsWindow
LoadImageA
SetWindowLongA
SetClipboardData
EmptyClipboard
OpenClipboard
EndPaint
PostQuitMessage
FindWindowExA
SendMessageTimeoutA
SetWindowTextA
gdi32
SelectObject
SetBkMode
CreateFontIndirectA
SetTextColor
DeleteObject
GetDeviceCaps
CreateBrushIndirect
SetBkColor
shell32
SHGetSpecialFolderLocation
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
advapi32
RegCloseKey
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegEnumValueA
RegCreateKeyExA
RegSetValueExA
RegQueryValueExA
RegEnumKeyA
comctl32
ImageList_Create
ImageList_AddMasked
ImageList_Destroy
ord17
ole32
CoCreateInstance
CoTaskMemFree
OleInitialize
OleUninitialize
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
Name
.text
Size
23KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
105KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
68KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
84KB
Virtual Size
83KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=158, id=1, productName=Unmarked objects,
count=17, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
$PLUGINSDIR/System.dll
- IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
- SHA256 b7ccb923387cc346731471b20fc3df1ead13ec8c2e3147353c71bb0bd59bc8b1
- MD5 6f5257c0b8c0ef4d440f4f4fce85fb1b
- SHA1 b6ac111dfb0d1fc75ad09c56bde7830232395785
- SHA512 a3cc27f1efb52fb8ecda54a7c36ada39cefeabb7b16f2112303ea463b0e1a4d745198d413eebb3551e012c84a20dcdf4359e511e51bc3f1a60b13f1e3bad1aa8
- SSDEEP 96:zPDYcJ+nx4vVp76JX7zBlkCg21Fxz4THxtrqw1at0JgwLEjo+OB3yUVCdl/wNj+y:zPtkuWJX7zB3kGwfy0nyUVsxCjOM61u
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
-
NSIS installer
Minor OS version
0
Major OS version
4
Entry point
9999
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
MultiByteToWideChar
GlobalFree
GlobalSize
lstrcpynA
lstrcpyA
GetProcAddress
VirtualFree
FreeLibrary
lstrlenA
LoadLibraryA
GetModuleHandleA
GlobalAlloc
WideCharToMultiByte
VirtualAlloc
VirtualProtect
GetLastError
user32
wsprintfA
ole32
StringFromGUID2
CLSIDFromString
Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc
Name
.text
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
851B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
104B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1024B
Virtual Size
610B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=14, version=7299,
count=19, id=1, productName=Unmarked objects,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=4, id=48, version=9044,
count=1, id=42, version=8803,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
Bedmmelseskomite158/Weiselbergite153/Grundliniers.Bar
- SHA256 c0a0d07061de3c5de1279d0009c027ddbc9ac635f4301ed4fccd8588feb07805
- MD5 95c5900744eb2a2aa1ce2b7bda71d74c
- SHA1 70101c3be903bf36b62652d8f21b9942d560812f
- SHA512 b0a27f9e412205a86ab2ab39e25671722987beea81ac0b71235a75a955001bef45bec660f8f0cd9246ec3baa38b2f8e5c3c0b531b07d0800e2baf137c4f653fd
- SSDEEP 192:niD5V2bcWoFQO+a2IL3C/6pmop6cGMeWGCxMYeAB:iio2O+tm3coEctefCxMtAB
- MD5 SHA1 SHA512 SSDEEP
-
NSIS installer
Bedmmelseskomite158/Weiselbergite153/delkorallen.txt
- SHA256 e81d10aeadc1d5e722479e467100bb1ab7d53853b54fa1c8d1753d0d0d058020
- MD5 8a984f7616b446e3e097aab82dc08b62
- SHA1 39ff662a0e39c75f8f1d01b69ad4aa774c63d05d
- SHA512 9d73f60d9edc466350d70a54edf968ca773caa9ac82a2374bcd1426a1998e46462bc53d21c0bf987eb6d106931a3bd3e9d72aab7c0ad438d494e41f658d015b8
- MD5 SHA1 SHA512
-
NSIS installer
Bedmmelseskomite158/Weiselbergite153/intellektualistiske.vol
- SHA256 ab7fd77d65e0c85e03e1249aaa42ccca9a611b6a03ea8237bca7460e87bcc999
- MD5 f9235913481923d5f4e6741cf81dfd31
- SHA1 28aee828a2bf7b484559c80061d01da76e5c80cc
- SHA512 99ad0d07954064c4a903744d666796c11adc29ce8533493b25041be6b1fec5d60ff7353a75d3ea0a4c872082bc36f7b697e359897a5e388a07d60085d6f9a4db
- MD5 SHA1 SHA512
-
NSIS installer
Tlperagtigt/Relumining.brn
- SHA256 3943f9ff3b171c8f37dbcad7138b0f7d725191d71c2755501880abcb0cc81cfc
- MD5 396fb5cbee90574ccaf95ddb324c05ec
- SHA1 24cec38f8e20dcb0ab19ac65299147093f3369ad
- SHA512 72ab11fcc7f749c689d204f198d2dcb9815be6e713abf550f535abe2ea8599c0226e7359d1a00ce182ba7317316b9285d6edd272e8cf7afe8880b44d4ee6ef2b
- SSDEEP 6144:tltYs2StAtKJP2G8Rtr3uMqUyjElqaYGYSYP+CYQLft5EJ22lK:tlzqTB1hy44qoFBcJ22Y
- MD5 SHA1 SHA512 SSDEEP
-
NSIS installer