f95174647e182ccf8bb5a1c126b0653b.bin
- SHA256 36efcad87536f553e4e1e7d8b47b427e1c397d1f6f1fa08c750d76066e2df73f
Password
infected
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
011caacd4092482d3f605c5381abf6d692fd1e8a4ed6e56f32fac804e68130cc.exe
Resource
win7-20240221-en
windows7-x64
19 signatures
150 seconds
Behavioral task
behavioral2
Sample
011caacd4092482d3f605c5381abf6d692fd1e8a4ed6e56f32fac804e68130cc.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
19 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20231129-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target f95174647e182ccf8bb5a1c126b0653b.bin
- Size 373KB
- Sample240517-d51bqsfe41
- SHA256 36efcad87536f553e4e1e7d8b47b427e1c397d1f6f1fa08c750d76066e2df73f
- MD5 e54ad777264d9ac1408d7d39ece54956
- SHA1 3b43ad1f5d4650b9f1b942793fa432d30e2fe945
- SHA512 5c230a38d39e54556414817d1c98ab9a2fd42a7d33226b588b90ed9b9f2372540391f470507a025bfdfcda656dab852367fcfb6261e4f2c9c8cd63ea00ab8a69
- SSDEEP 6144:6E8CLa6BNBbS/5HzQM3VrJODJjYkiv3W06Ky0gpBtEfA2+tc1Pz/v8c4j6/jCBuV:6TKtXBbQh3VJONYWv0gpsARStGYjCwkS
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/$PLUGINSDIR/System.dll
File Explorer
-
f95174647e182ccf8bb5a1c126b0653b.bin.zip 373KB
-
011caacd4092482d3f605c5381abf6d692fd1e8a4ed6e56f32fac804e68130cc.exe.exe 389KB
-
$PLUGINSDIR/System.dll.dll 11KB
-
Brugerantallenes/Rats104.dew226KB
-
Brugerantallenes/Reservationsdatos78.hel315KB
-
Brugerantallenes/Trvarefabrikken/draisene.mon54KB
-
Brugerantallenes/Trvarefabrikken/rascette.txt387B
-
Brugerantallenes/Trvarefabrikken/skaret.laa204KB
-
Brugerantallenes/callityping.cor236KB
-
Centralstyrelsen.Fde372KB
011caacd4092482d3f605c5381abf6d692fd1e8a4ed6e56f32fac804e68130cc.exe
- IMPHASH 1f23f452093b5c1ff091a2f9fb4fa3e9
- SHA256 011caacd4092482d3f605c5381abf6d692fd1e8a4ed6e56f32fac804e68130cc
- MD5 f95174647e182ccf8bb5a1c126b0653b
- SHA1 14f9da6f82d336ead2ee37120a1eb5424a371321
- SHA512 ce27c2ed0ef70a272644b0df6a39642f6da6eb715eff776a92ed56c14b6b529c9ac585b8f243cd088c5b66ab3867b82b202d1aadca757818475723cb6d42e2c9
- SSDEEP 6144:2Iw3irX/vBB4D4SGRit4IUMxwFcAnIIgyaZin6cQIBXAWg4C5MBwIIgv/y9q4:trwDfki2ww2kINyCO8IBX/FC5MEgvU
- MD5 SHA1 SHA512 SSDEEP
Password
infected
PE Signature issue
Digest
7c:70:74:e7:5f:f3:3f:74:fc:cf:21:ff:cf:9d:91:ed:53:1f:28:81:5e:dd:c0:d5:90:b2:56:c9:94:0a:db:4c
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Testversion,OU=Rewear Genesiacal Peritrochal\ ,O=Testversion,L=Wilton,ST=Iowa,C=US,1.2.840.113549.1.9.1=#0c164772736e696e6765724054656f7269626f67732e466e
Chains
May 14, 2024
PE Signature issue
Digest
c7:9f:6f:4d:b9:19:5a:a3:bf:7f:49:69:1f:6c:b3:b4:ee:d6:ed:48
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Testversion,OU=Rewear Genesiacal Peritrochal\ ,O=Testversion,L=Wilton,ST=Iowa,C=US,1.2.840.113549.1.9.1=#0c164772736e696e6765724054656f7269626f67732e466e
Chains
May 16, 2024
Subject
CN=Testversion,OU=Rewear Genesiacal Peritrochal\ ,O=Testversion,L=Wilton,ST=Iowa,C=US,1.2.840.113549.1.9.1=#0c164772736e696e6765724054656f7269626f67732e466e
Serial Number
7e:7b:51:15:d6:b4:55:c6:9a:dc:77:cb:da:65:e3:a3:f3:8d:76:ed
Issuer
CN=Testversion,OU=Rewear Genesiacal Peritrochal\ ,O=Testversion,L=Wilton,ST=Iowa,C=US,1.2.840.113549.1.9.1=#0c164772736e696e6765724054656f7269626f67732e466e
Timespan
Dec 29, 2023 - Dec 28, 2026
Subject
CN=Testversion,OU=Rewear Genesiacal Peritrochal\ ,O=Testversion,L=Wilton,ST=Iowa,C=US,1.2.840.113549.1.9.1=#0c164772736e696e6765724054656f7269626f67732e466e
Serial Number
7e:7b:51:15:d6:b4:55:c6:9a:dc:77:cb:da:65:e3:a3:f3:8d:76:ed
Issuer
CN=Testversion,OU=Rewear Genesiacal Peritrochal\ ,O=Testversion,L=Wilton,ST=Iowa,C=US,1.2.840.113549.1.9.1=#0c164772736e696e6765724054656f7269626f67732e466e
Timespan
Dec 29, 2023 - Dec 28, 2026
Subject
CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Issuer
CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 12, 2016 - Jan 11, 2031
Subject
CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Issuer
CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 23, 2017 - Mar 22, 2029
Minor OS version
0
Major OS version
4
Entry point
13449
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
ExitProcess
SetFileAttributesW
Sleep
GetTickCount
CreateFileW
GetFileSize
GetModuleFileNameW
GetCurrentProcess
SetCurrentDirectoryW
GetFileAttributesW
SetEnvironmentVariableW
GetWindowsDirectoryW
GetTempPathW
GetCommandLineW
GetVersion
SetErrorMode
lstrlenW
lstrcpynW
CopyFileW
GetShortPathNameW
GlobalLock
CreateThread
GetLastError
CreateDirectoryW
CreateProcessW
RemoveDirectoryW
lstrcmpiA
GetTempFileNameW
WriteFile
lstrcpyA
MoveFileExW
lstrcatW
GetSystemDirectoryW
GetProcAddress
GetModuleHandleA
GetExitCodeProcess
WaitForSingleObject
lstrcmpiW
MoveFileW
GetFullPathNameW
SetFileTime
SearchPathW
CompareFileTime
lstrcmpW
CloseHandle
ExpandEnvironmentStringsW
GlobalFree
GlobalUnlock
GetDiskFreeSpaceW
GlobalAlloc
FindFirstFileW
FindNextFileW
DeleteFileW
SetFilePointer
ReadFile
FindClose
lstrlenA
MulDiv
MultiByteToWideChar
WideCharToMultiByte
GetPrivateProfileStringW
WritePrivateProfileStringW
FreeLibrary
LoadLibraryExW
GetModuleHandleW
user32
GetSystemMenu
SetClassLongW
EnableMenuItem
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongW
SetCursor
LoadCursorW
CheckDlgButton
GetMessagePos
LoadBitmapW
CallWindowProcW
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
ScreenToClient
GetWindowRect
GetDlgItem
GetSystemMetrics
SetDlgItemTextW
GetDlgItemTextW
MessageBoxIndirectW
CharPrevW
CharNextA
wsprintfA
DispatchMessageW
PeekMessageW
ReleaseDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
GetClientRect
FillRect
DrawTextW
EndDialog
RegisterClassW
SystemParametersInfoW
CreateWindowExW
GetClassInfoW
DialogBoxParamW
CharNextW
ExitWindowsEx
DestroyWindow
GetDC
SetTimer
SetWindowTextW
LoadImageW
SetForegroundWindow
ShowWindow
IsWindow
SetWindowLongW
FindWindowExW
TrackPopupMenu
AppendMenuW
CreatePopupMenu
EndPaint
CreateDialogParamW
SendMessageTimeoutW
wsprintfW
PostQuitMessage
gdi32
SelectObject
SetBkMode
CreateFontIndirectW
SetTextColor
DeleteObject
GetDeviceCaps
CreateBrushIndirect
SetBkColor
shell32
SHGetSpecialFolderLocation
ShellExecuteExW
SHGetPathFromIDListW
SHBrowseForFolderW
SHGetFileInfoW
SHFileOperationW
advapi32
AdjustTokenPrivileges
RegCreateKeyExW
RegOpenKeyExW
SetFileSecurityW
OpenProcessToken
LookupPrivilegeValueW
RegEnumValueW
RegDeleteKeyW
RegDeleteValueW
RegCloseKey
RegSetValueExW
RegQueryValueExW
RegEnumKeyW
comctl32
ImageList_Create
ImageList_AddMasked
ImageList_Destroy
ord17
ole32
OleUninitialize
OleInitialize
CoTaskMemFree
CoCreateInstance
Name
.text
Size
25KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
128KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
244KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=165, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
$PLUGINSDIR/System.dll
- IMPHASH fc0224e99e736751432961db63a41b76
- SHA256 c2f405d7402f815d0c3fadd9a50f0bbbb1bab9aa38fe347823478a2587299448
- MD5 9625d5b1754bc4ff29281d415d27a0fd
- SHA1 80e85afc5cccd4c0a3775edbb90595a1a59f5ce0
- SHA512 dce52b640897c2e8dbfd0a1472d5377fa91fb9cf1aeff62604d014bccbe5b56af1378f173132abeb0edd18c225b9f8f5e3d3e72434aed946661e036c779f165b
- SSDEEP 192:eX24sihno00Wfl97nH6BenXwWobpWBTtvShJ5omi7dJWjOlqSlS:D8QIl972eXqlWBFSt273YOlqz
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
4
Entry point
10178
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetModuleHandleW
GlobalFree
GlobalSize
lstrcpynW
lstrcpyW
GetProcAddress
WideCharToMultiByte
VirtualFree
FreeLibrary
lstrlenW
LoadLibraryW
GlobalAlloc
MultiByteToWideChar
VirtualAlloc
VirtualProtect
GetLastError
user32
wsprintfW
ole32
StringFromGUID2
CLSIDFromString
Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc
Name
.text
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
851B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
120B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1024B
Virtual Size
608B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=14, version=7299,
count=20, id=1, productName=Unmarked objects,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=4, id=48, version=9044,
count=1, id=42, version=8803,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
Brugerantallenes/Rats104.dew
- SHA256 842041666efc05d8d2b3cf54c70ddb823fd0e4bc0d50a3e35a61c1493530d45e
- MD5 e6fe8d667a41c20ee685d480c18caf3d
- SHA1 ecce019f1a8f9a4a012947d9873a49e2c4609a68
- SHA512 bc8941dfc0bbbf1748167f3264b1be3fef100e326f3611e573ecb6067f246b52eceffa51754966e514392533627d15645676db647e531c6a7f5e51d73d0356a5
- SSDEEP 96:7LffjCz8esMXDTuee9BQsS16HoubNw+qTSDI:7TjCzpsqDTNe9BxS16IutqTSDI
- MD5 SHA1 SHA512 SSDEEP
Brugerantallenes/Reservationsdatos78.hel
- SHA256 5b7197254c64d14f564819b4027342e4857bdbb08185aebee7b4756b0b32c2b3
- MD5 e3d33daa0cc2f827f295af216c99045f
- SHA1 bd16ff9f6b177df287f0c871bf892a1228ced168
- SHA512 b222119a84bde53ab6299782be709c9c55ef909f6b9ff426ffc8947c2ce96827f725ee5d10e82b995a8529a85aa6e17c94a4be884b9a1cbc5bbb6f42e5b2c00c
- SSDEEP 192:KWMSAxozoTR1nSYEQ+9H/3fh8QtzOCj7:KWMSAxozoTR1nSYEQ+9H/3fh8QtzNP
- MD5 SHA1 SHA512 SSDEEP
Brugerantallenes/Trvarefabrikken/draisene.mon
- SHA256 6a67e36f9a8e854b7df8857567ceb85e6118b6c63068ec035c22e0d748bd1c74
- MD5 1ec0830fd344891eff83f59f22b097e7
- SHA1 5b2fe14a3c9ed8db77097ef8eef9b09c18aa441b
- SHA512 205f584c7b9ed96b05c7c0603bb661b32fa08e184cba467a5bd4e9cb439acc269107714901faee4bdf0a1ed428a381ce048f1aa75335482650543d0a917ef3b2
- SSDEEP 24:irC+rqRif86vLvgYJQTljRxYBNkKi1q8bu6xJie0ykm0mhlnp8ZH5u:irq68KvlJ4TYtD6u6TZ5jp8ls
- MD5 SHA1 SHA512 SSDEEP
Brugerantallenes/Trvarefabrikken/rascette.txt
- SHA256 1ba1d1840d6229b880086580a4877643ee9a04872055d9f7613e41d2555c4f34
- MD5 06055f8abb1c16682bf5088326de7fd7
- SHA1 d7236a7712d3a46aafb151c927b19c32e5ace3cd
- SHA512 e0db50da98ef9b11cb0a10c2e6558a22723d9ee1ed0fe23751d8250030d15cc567ff1e069dd5dc4d459882b3a8fe99ae673e5154ad642d53c1e8817bd1847ab9
- MD5 SHA1 SHA512
Brugerantallenes/Trvarefabrikken/skaret.laa
- SHA256 2c21707ade96da7a73e1cfd3c9f54b63b147aff34c8e3cb406ca73f73bfd8385
- MD5 8afd352b0c1f2152031235a73921b553
- SHA1 6b3ccf71b9f389810fe9a503809d41304ceaa5df
- SHA512 820c2270aa74cb9fa46d11df3577b163d5ae21fa41f80db3b7f74a8d9a26da72ea3a6b777899416c67d77916305f5180620709c1b6df575e3ea40e15c520c0c4
- SSDEEP 48:xocBEromvp/7kBzq9eceMIcjbgSVuIk0eMCXbndGbe7BJVOlN6gxQFKaUgB+B1bX:xBBEroup/ABz0Ze5Puk0WXf96tc+B1
- MD5 SHA1 SHA512 SSDEEP
Brugerantallenes/callityping.cor
- SHA256 6eadcd7622b75205a073b090560362d45eccc6eea0714ccfe139313a09b95ae2
- MD5 cb66c7b9952aeabcf876cdf986a1dc05
- SHA1 04af8fd11f312e84bec48c34772c37a6bf66f436
- SHA512 a6a667f5e67ef257f42cb90195f0d7405fbdff6d0ea6b3345380d429036ac816e791062ae48e748fa5e97e02324da5b8b66158fc3a7426d0b6eebc39c87e321f
- SSDEEP 96:7TzsepDmL5b7wQBYb7DUa4rNI11UR8tsb1rAdkPD5:7TYepSL9wCYbuBmWR8tsb1rAdkPD5
- MD5 SHA1 SHA512 SSDEEP
Centralstyrelsen.Fde
- SHA256 a2495e9473ff88d36471b83e35d138edd537ddd2e95fec64c8ddede539dcea32
- MD5 9659507b65ed701cf4080d62536901a2
- SHA1 8130dc284ae272d32470bebb1cfc2f453e8d120f
- SHA512 5f77ab95450646ad1e0e1460ae7181fca5dc7422460aaa4abbaab1212419f078dab8611f0f5a676658ed922b390b31587d2ca95ebbed55ecb3d76159f97f6b9f
- SSDEEP 6144:k8HxIDzLo4i+Nqdcsfv/H5PXqtoVO9YptmasJ6Y6SNEIaRh1ZgesaR:rHKzLo4iWqBXJ+oVO9MmaBSKI4hh
- MD5 SHA1 SHA512 SSDEEP