07052024_0829_06052024_PO 4500906426.rar
- SHA256 2c955d2914ebfcfbea0aed745268f6a09df71e2f5974c97cf1395dfa5cbc28ae
Password
infected
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Bordbns.exe
Resource
win7-20231129-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
Bordbns.exe
Resource
win10v2004-20240419-en
windows10-2004-x64
18 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target 07052024_0829_06052024_PO 4500906426.rar
- Size 313KB
- Sample240507-kdnxysbd59
- SHA256 2c955d2914ebfcfbea0aed745268f6a09df71e2f5974c97cf1395dfa5cbc28ae
- MD5 ce7e0b59d8802d7b602cd5d9afcdb151
- SHA1 e21bc79acd8ae5354af98d875f96e26d3bff1bff
- SHA512 ecd98537774c0ecab5790967a04dc1135334032d968fd62d1df1aa31726c9c3c7aa7cda3ee1c69f9d7c1be23948a793b59f983d3d3481d9179cd5a4ff8b6abec
- SSDEEP 6144:sHHvt74V1HvL2VVPbPtYAuY86aqFCVTFGt5wPJfVhy7L:svmVhEbGAuF/MCVTZJfVhQL
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/$PLUGINSDIR/System.dll - NSIS installer 2 IoCs
resource yara_rule static1/unpack001/Bordbns.exe nsis_installer_1 static1/unpack001/Bordbns.exe nsis_installer_2
File Explorer
-
07052024_0829_06052024_PO 4500906426.rar.rar 313KB
-
Bordbns.exe.exe 415KB
-
$PLUGINSDIR/System.dll.dll 11KB
-
Aragonspath.txt621B
-
Tandemmernes.Sma197KB
-
cambrics.reb1KB
-
fodboldbanernes.Kor114KB
-
formuerettens.twa1KB
-
gudfars.tat2KB
-
instructors.cha1KB
-
librettoerne.ven1KB
Bordbns.exe
- IMPHASH b78ecf47c0a3e24a6f4af114e2d1f5de
- SHA256 b1ab36e342ada65f2ba8ebc069b3e6ab1c51c0a092e09addb8f3408cf8fbdf8a
- MD5 fb5601dbb8729e3c028897e81f8a6561
- SHA1 6c8f48c6fa37b84c11f477dfc1699e1f4d19cc08
- SHA512 c412e4d4ed38459b2ba3a7a01b15825c0dc5b7e7b230b1bff4f279183b72ec8bd3b73de0e256ddc6b1251afee8bdb626b49d6e24ca56efeb1390be0bca946870
- SSDEEP 6144:nyINO+ZYJH4Zbnqd5+yDKi9h8jRp7UWTvr3+KgerLQ82MbB7FPpHJkx:3FCJH4N9yD9hMvUWTvr3+KgALQ8/NJi
- MD5 SHA1 SHA512 SSDEEP
-
NSIS installer
Password
infected
PE Signature issue
Digest
e1:5f:71:4a:74:18:79:ef:94:b1:de:f1:1c:1b:38:d5:97:c4:04:e2:f7:c9:ea:b7:72:f4:47:33:b7:fc:66:f2
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Libelist,OU=Usufruit Juleller\ ,O=Libelist,L=Struthers,ST=Scotland,C=GB,1.2.840.113549.1.9.1=#0c1c4f766572656c6567616e7440436f6e7465726d696e6f75732e536b61
Chains
May 3, 2024
PE Signature issue
Digest
01:01:17:eb:d6:82:c1:bf:28:0f:5e:a5:15:a1:71:ae:7b:23:7e:70
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Libelist,OU=Usufruit Juleller\ ,O=Libelist,L=Struthers,ST=Scotland,C=GB,1.2.840.113549.1.9.1=#0c1c4f766572656c6567616e7440436f6e7465726d696e6f75732e536b61
Chains
May 3, 2024
Subject
CN=Libelist,OU=Usufruit Juleller\ ,O=Libelist,L=Struthers,ST=Scotland,C=GB,1.2.840.113549.1.9.1=#0c1c4f766572656c6567616e7440436f6e7465726d696e6f75732e536b61
Serial Number
4f:69:27:90:f4:aa:ca:74:69:2e:d4:40:be:0c:65:1e:d1:50:c9:35
Issuer
CN=Libelist,OU=Usufruit Juleller\ ,O=Libelist,L=Struthers,ST=Scotland,C=GB,1.2.840.113549.1.9.1=#0c1c4f766572656c6567616e7440436f6e7465726d696e6f75732e536b61
Timespan
Dec 28, 2023 - Dec 27, 2026
Subject
CN=Libelist,OU=Usufruit Juleller\ ,O=Libelist,L=Struthers,ST=Scotland,C=GB,1.2.840.113549.1.9.1=#0c1c4f766572656c6567616e7440436f6e7465726d696e6f75732e536b61
Serial Number
4f:69:27:90:f4:aa:ca:74:69:2e:d4:40:be:0c:65:1e:d1:50:c9:35
Issuer
CN=Libelist,OU=Usufruit Juleller\ ,O=Libelist,L=Struthers,ST=Scotland,C=GB,1.2.840.113549.1.9.1=#0c1c4f766572656c6567616e7440436f6e7465726d696e6f75732e536b61
Timespan
Dec 28, 2023 - Dec 27, 2026
Minor OS version
0
Major OS version
4
Entry point
12672
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
SetEnvironmentVariableA
Sleep
GetTickCount
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
GetFileAttributesA
SetFileAttributesA
GetWindowsDirectoryA
GetTempPathA
GetCommandLineA
lstrlenA
GetVersion
SetErrorMode
lstrcpynA
ExitProcess
GetFullPathNameA
GlobalLock
CreateThread
GetLastError
CreateDirectoryA
CreateProcessA
RemoveDirectoryA
CreateFileA
GetTempFileNameA
ReadFile
WriteFile
lstrcpyA
MoveFileExA
lstrcatA
GetSystemDirectoryA
GetProcAddress
CloseHandle
SetCurrentDirectoryA
MoveFileA
CompareFileTime
GetShortPathNameA
SearchPathA
lstrcmpiA
SetFileTime
lstrcmpA
ExpandEnvironmentStringsA
GlobalUnlock
GetDiskFreeSpaceA
GlobalFree
FindFirstFileA
FindNextFileA
DeleteFileA
SetFilePointer
GetPrivateProfileStringA
FindClose
MultiByteToWideChar
FreeLibrary
MulDiv
WritePrivateProfileStringA
LoadLibraryExA
GetModuleHandleA
GetExitCodeProcess
WaitForSingleObject
GlobalAlloc
user32
ScreenToClient
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
PostQuitMessage
GetWindowRect
EnableMenuItem
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
ReleaseDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndDialog
RegisterClassA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
ExitWindowsEx
GetDC
CreateDialogParamA
SetTimer
GetDlgItem
SetWindowLongA
SetForegroundWindow
LoadImageA
IsWindow
SendMessageTimeoutA
FindWindowExA
OpenClipboard
TrackPopupMenu
AppendMenuA
EndPaint
DestroyWindow
wsprintfA
ShowWindow
SetWindowTextA
gdi32
SelectObject
SetBkMode
CreateFontIndirectA
SetTextColor
DeleteObject
GetDeviceCaps
CreateBrushIndirect
SetBkColor
shell32
SHGetSpecialFolderLocation
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
advapi32
RegDeleteKeyA
SetFileSecurityA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegOpenKeyExA
RegEnumValueA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA
RegSetValueExA
RegQueryValueExA
RegEnumKeyA
comctl32
ImageList_Create
ImageList_AddMasked
ImageList_Destroy
ord17
ole32
OleUninitialize
OleInitialize
CoTaskMemFree
CoCreateInstance
Name
.text
Size
24KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
3.6MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
196KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
161KB
Virtual Size
160KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=159, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=12, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
$PLUGINSDIR/System.dll
- IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
- SHA256 fa4ab1d6f79fd677433a31ada7806373a789d34328da46ccb0449bbf347bd73e
- MD5 3f176d1ee13b0d7d6bd92e1c7a0b9bae
- SHA1 fe582246792774c2c9dd15639ffa0aca90d6fd0b
- SHA512 0a69124819b7568d0dea4e9e85ce8fe61c7ba697c934e3a95e2dcfb9f252b1d9da7faf8774b6e8efd614885507acc94987733eba09a2f5e7098b774dfc8524b6
- SSDEEP 192:OPtkumJX7zB22kGwfy0mtVgkCPOsX1un:/702k5qpdsXQn
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
4
Entry point
9995
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
MultiByteToWideChar
GlobalFree
GlobalSize
lstrcpynA
lstrcpyA
GetProcAddress
VirtualFree
FreeLibrary
lstrlenA
LoadLibraryA
GetModuleHandleA
GlobalAlloc
WideCharToMultiByte
VirtualAlloc
VirtualProtect
GetLastError
user32
wsprintfA
ole32
StringFromGUID2
CLSIDFromString
Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc
Name
.text
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
851B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
104B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1024B
Virtual Size
608B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=14, version=7299,
count=19, id=1, productName=Unmarked objects,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=4, id=48, version=9044,
count=1, id=42, version=8803,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
Aragonspath.txt
- SHA256 2e56dc8612cc97bf7a6bf4efc14480cdbc3d56af2ed8df18ef54e0882509701c
- MD5 85496a03852e001a8373b1c949de3801
- SHA1 10fc15070efe0bf4461bb8c95ccc5a5a4c2fcb44
- SHA512 71cc130461ede5ac09fe3fb610e8041aca99ff8906180e7759909901ca13858289472806cbde1e6eb7808b7939189790b2b6882dc2c72155f022df6cd88d944e
- MD5 SHA1 SHA512
Tandemmernes.Sma
- SHA256 932aa39fcfe7d945cb1b7c21c615e6778b0f1f48c429b86a2cd2df3274a74212
- MD5 1f24705daee8603b8d60f276e0cc1be0
- SHA1 7b6d90df02d15368478466efbc07266d2165b8c8
- SHA512 94c707d078caa464eac8a7f8d93e215d5f258840f4ee4560dab5bb1b3de19b34b13a6d2881c54a3ec050f0bc238bdc0ac50cab62f764d22ef91d9c40d906660d
- SSDEEP 3072:1v8KG9Veq8JF7xmyHEG4gOPJEE3ECZqiOXFfTPwWBQSjpkNFeJl0HngqdWTSZ9Vf:1zeVF83xEEKMiOXFTpBm19RXW2
- MD5 SHA1 SHA512 SSDEEP
cambrics.reb
- SHA256 bc1d9684c776ca490944b1df273d09de2f6d14739f43de15697d4641ef276332
- MD5 2d6feaa1f83349c9528084b0e5349256
- SHA1 96d29af9d634c59317c822572e169e553e0d4631
- SHA512 bdfc7b7d08b23c5577da19cfdc97ca84cef11aad9f2bb1491b6ff98316c3c37c743396a8b793d03782a1e2605741f3c266165b1ce316fbd695e07101b7120ccd
- MD5 SHA1 SHA512
fodboldbanernes.Kor
- SHA256 04f069845642ae2f81c1ed669c4ab7f466f716e0ac22e6ee7ad937ee2dd8f273
- MD5 713622e9b625f807905ceab21f3d19a1
- SHA1 47d7bf8c2575a24410cef93b618b651d67a940d0
- SHA512 1a68897ed3f7a73a2e5559594fe0323c4ab41ef65451800a9c492808efdb8ca73fe6ffa0bd5bc5fecb6f6b73f5d32f08eb8aed70b732e37e3ab365003f0c1c8a
- SSDEEP 3072:oLGaMdQFcbmdiLDua4LPLEYpzp+pbxteO:oiSO2wwLxlpeeO
- MD5 SHA1 SHA512 SSDEEP
formuerettens.twa
- SHA256 032d9f554a3029d2f4c6608bac49da736e7a52912abd276028aa374916cb1a8c
- MD5 033211c6a4f10b0bcb249bd30770cb7d
- SHA1 f772d9a75adee19d7034f28e24afca26cb1e1651
- SHA512 ccba8d95418e8cf75857b980c563b2e72e719062c8fc2945d22cda8d612004176c6193a0f51972176a23a25a4f8d69ba048e32c3ffcd99a06187b114ed9ddcb9
- MD5 SHA1 SHA512
gudfars.tat
- SHA256 31536a7279bd7499597ba2385da73b67b01a1647f3ba994ba25cd7cfb532452d
- MD5 fed717d3cb21adadeeef1b60f1b5845c
- SHA1 b6d6ce948f482d740586dfcddf316aebd8a6ed1b
- SHA512 8e05fe41eaef107283f2d7fb5575db9876a5f85c3a8a304ce916fbab2212378b8ec88f2bdf91c897939eae7e1eca9ad6468aca5c33379e2d03f65175e1dc9ec0
- MD5 SHA1 SHA512
instructors.cha
- SHA256 8829e429c8de49c9ffb86988fd7cdf1d179c095ff3a0013ea5af03e46e73b36d
- MD5 15ebbe8429b9e4c21920657e4c322fa9
- SHA1 ca3160a9a01997d88dcc89c2dfb4cda1333a05ee
- SHA512 dd3be3b88f42f1693c7a7c7dd07f9613b3d81368b988b7bf79696d102fc86c5dd49d1534ce77e394c634e01277f398b353543147ab78e9176c4b7126bba52390
- MD5 SHA1 SHA512
librettoerne.ven
- SHA256 7ec9a8e2c37a4402f3e35d63821bd7676345ae7ece2adeb9f4494f6645608d68
- MD5 fdeb16a9c3a30711f900ffdafbe10b00
- SHA1 7cdbfaa23bb48f829e4acebc225e703392204c00
- SHA512 f0124fb6aaeb61ce2e89f20cc229f743cbbfcab72b4e7623f465bbbe8c0eb28e9522a9abb78af3ab0f1141f4798e642a5f1a17f0b024baff730907f0f0889a2c
- MD5 SHA1 SHA512