eb369711e9bbefe9e465819967bbc0ee8642df394d8fdb09079704fdf4660aa6
- SHA256 eb369711e9bbefe9e465819967bbc0ee8642df394d8fdb09079704fdf4660aa6
Password
infected
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c52c6d6ea2de4840848a63dca6946a7242d7a2c5f918afe41f271c6aecf3a0af.exe
Resource
win7-20240215-en
windows7-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
c52c6d6ea2de4840848a63dca6946a7242d7a2c5f918afe41f271c6aecf3a0af.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
17 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240508-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target eb369711e9bbefe9e465819967bbc0ee8642df394d8fdb09079704fdf4660aa6
- Size 268KB
- Sample240518-j9hkdabe51
- SHA256 eb369711e9bbefe9e465819967bbc0ee8642df394d8fdb09079704fdf4660aa6
- MD5 0e3524d5470b0a7eea460a5e8d0f99e9
- SHA1 ee1cf000244435c4d2dfca223387d7ae39138c89
- SHA512 1bb43d43f5c65ff2f5126d7e9794aafdbe60d508d2bdee97e6de3d9fadd41dea6450baced528de9f65e371185d615497292dedd98af2c2f8a9be773086c5d116
- SSDEEP 6144:zu19v79eYKFfbmJmDPexnExQpOeEvxtZdLZiffoQNvjf8ts0spYXpjrd:Qv79nKj7LexCQpOeGdYfIpvd
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/c52c6d6ea2de4840848a63dca6946a7242d7a2c5f918afe41f271c6aecf3a0af.exe unpack002/$PLUGINSDIR/System.dll
File Explorer
-
eb369711e9bbefe9e465819967bbc0ee8642df394d8fdb09079704fdf4660aa6.zip 268KB
-
c52c6d6ea2de4840848a63dca6946a7242d7a2c5f918afe41f271c6aecf3a0af.exe.exe 362KB
-
$PLUGINSDIR/System.dll.dll 11KB
-
Dispapalize.ker4KB
-
Hitchhiking/syrnende.bok1KB
-
Nyskabe/Skyggekabinet.txt316B
-
Prostatitic.Aff226KB
-
Taagebankernes/intrapetiolar.boo2KB
c52c6d6ea2de4840848a63dca6946a7242d7a2c5f918afe41f271c6aecf3a0af.exe
- IMPHASH e2a592076b17ef8bfb48b7e03965a3fc
- SHA256 c52c6d6ea2de4840848a63dca6946a7242d7a2c5f918afe41f271c6aecf3a0af
- MD5 c268abdde91ae0e28f2272d2606a3d9b
- SHA1 30e15b4bc40192f98af5b2cb088b8e2a79af89f2
- SHA512 8da341163b4ecddc92cb2570d904c7d73d93fbee1af47d64a528cd0277ef90a1a99fd807be0159aef9224fea87c04951115db9f6d1e8ab07272070934ab53a31
- SSDEEP 6144:FspNjlsoBNb6ClODxve4lHxQ10MI6YI1uv7jQqwmLrvQizxGOLbN70MI:FcACYDDQ10M7cTUftMxJtI
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
13108
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
SetCurrentDirectoryW
GetFileAttributesW
GetFullPathNameW
Sleep
GetTickCount
GetFileSize
GetModuleFileNameW
MoveFileW
SetFileAttributesW
GetCurrentProcess
ExitProcess
SetEnvironmentVariableW
GetWindowsDirectoryW
GetTempPathW
GetCommandLineW
GetVersion
SetErrorMode
lstrlenW
WaitForSingleObject
CopyFileW
CompareFileTime
GlobalLock
CreateThread
GetLastError
CreateDirectoryW
CreateProcessW
RemoveDirectoryW
lstrcmpiA
CreateFileW
GetTempFileNameW
WriteFile
lstrcpyA
lstrcpyW
MoveFileExW
lstrcatW
GetSystemDirectoryW
GetProcAddress
GetModuleHandleA
GlobalFree
GlobalAlloc
GetShortPathNameW
SearchPathW
lstrcmpiW
SetFileTime
CloseHandle
ExpandEnvironmentStringsW
lstrcmpW
GlobalUnlock
lstrcpynW
GetDiskFreeSpaceW
GetExitCodeProcess
FindFirstFileW
FindNextFileW
DeleteFileW
SetFilePointer
ReadFile
FindClose
MulDiv
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
GetPrivateProfileStringW
WritePrivateProfileStringW
FreeLibrary
LoadLibraryExW
GetModuleHandleW
user32
GetSystemMenu
SetClassLongW
IsWindowEnabled
EnableMenuItem
SetWindowPos
GetSysColor
GetWindowLongW
SetCursor
LoadCursorW
CheckDlgButton
GetMessagePos
LoadBitmapW
CallWindowProcW
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
wsprintfW
ScreenToClient
GetWindowRect
GetSystemMetrics
SetDlgItemTextW
GetDlgItemTextW
MessageBoxIndirectW
CharPrevW
CharNextA
wsprintfA
DispatchMessageW
PeekMessageW
GetDC
ReleaseDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
GetClientRect
FillRect
EndDialog
RegisterClassW
SystemParametersInfoW
CreateWindowExW
GetClassInfoW
DialogBoxParamW
CharNextW
ExitWindowsEx
DestroyWindow
LoadImageW
SetTimer
SetWindowTextW
PostQuitMessage
ShowWindow
GetDlgItem
IsWindow
SetWindowLongW
FindWindowExW
TrackPopupMenu
AppendMenuW
CreatePopupMenu
DrawTextW
EndPaint
CreateDialogParamW
SendMessageTimeoutW
SetForegroundWindow
gdi32
SelectObject
SetBkMode
CreateFontIndirectW
SetTextColor
DeleteObject
GetDeviceCaps
CreateBrushIndirect
SetBkColor
shell32
SHGetSpecialFolderLocation
SHGetPathFromIDListW
SHBrowseForFolderW
SHGetFileInfoW
ShellExecuteW
SHFileOperationW
advapi32
RegDeleteKeyW
SetFileSecurityW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegOpenKeyExW
RegEnumValueW
RegDeleteValueW
RegCloseKey
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW
RegEnumKeyW
comctl32
ImageList_AddMasked
ord17
ImageList_Destroy
ImageList_Create
ole32
OleUninitialize
OleInitialize
CoTaskMemFree
CoCreateInstance
Name
.text
Size
25KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
171KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
220KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
103KB
Virtual Size
102KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=166, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
$PLUGINSDIR/System.dll
- IMPHASH fc0224e99e736751432961db63a41b76
- SHA256 bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb
- MD5 17ed1c86bd67e78ade4712be48a7d2bd
- SHA1 1cc9fe86d6d6030b4dae45ecddce5907991c01a0
- SHA512 0cbed521e7d6d1f85977b3f7d3ca7ac34e1b5495b69fd8c7bfa1a846baf53b0ecd06fe1ad02a3599082ffacaf8c71a3bb4e32dec05f8e24859d736b828092cd5
- SSDEEP 192:eY24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35Ol+Sl:E8QIl975eXqlWBrz7YLOl+
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
10183
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetModuleHandleW
GlobalFree
GlobalSize
lstrcpynW
lstrcpyW
GetProcAddress
WideCharToMultiByte
VirtualFree
FreeLibrary
lstrlenW
LoadLibraryW
GlobalAlloc
MultiByteToWideChar
VirtualAlloc
VirtualProtect
GetLastError
user32
wsprintfW
ole32
StringFromGUID2
CLSIDFromString
Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc
Name
.text
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
851B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
120B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1024B
Virtual Size
610B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=14, version=7299,
count=20, id=1, productName=Unmarked objects,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=4, id=48, version=9044,
count=1, id=42, version=8803,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
Dispapalize.ker
- SHA256 0b1a966454acea8ff8b95a47117be87c69a63ce706130b94db92f396e1cf66fc
- MD5 11b7ab9c63072e1ab2bc8a9773ad2c8e
- SHA1 e6dfb78c873365db5fc3f99459cea61cf22eb454
- SHA512 b5c233ebd43237db92aab0d3f707679fdf2a5888612fde98c499c42105dd8cd2a0f0aa2199e520a17c469afcd998e7d1bf261d05158fb092ae75f89781e98cad
- SSDEEP 96:448j+sX3arrbaPgOnEBTFF4mOWeeeT3mhkDFEm+tnhfhf:448jba+g5F6We9IKFYlhhf
- MD5 SHA1 SHA512 SSDEEP
Hitchhiking/syrnende.bok
- SHA256 9edc6bbdda4a379c3b41df87769ef89e6e4442aca810b52996733f1c61a47dd0
- MD5 147dc85c6791f2673270d72e4a687506
- SHA1 5d210862b480fb98303ddc7e15bcb65f8be1db26
- SHA512 2ba464220ba2ff3306b669d4d8a5bec4f28c4d420e0633c5938ee07100ac4a60d2021ec05d2abafb9aae73c2b5aac89a58eb079ef3e8d730044e71625d49be08
- MD5 SHA1 SHA512
Nyskabe/Skyggekabinet.txt
- SHA256 dd5330f5b165cb86e3a525b9a4abd44d7daf17694322838a75765f4d339f9c20
- MD5 db2140a44f51378ad4a11c82a5a3b8c1
- SHA1 0d6eef1bb1ceecdec26110297299b0a1294c1782
- SHA512 acedaaedcaf3bce932b15649c970185105edc4becfd02cf0ace5eff2b6da340af4dc7e3bca28fb6bd02c1d4c80f129e9db7d33d28eb0c8cb3e790ec761f4df4a
- MD5 SHA1 SHA512
Prostatitic.Aff
- SHA256 8850290e3eb08ffba97c20e4b28f020fdcac1948e5e1bf993456570c89e8eb4c
- MD5 b2ee5c5af55f92a545b90b7247654cf5
- SHA1 9ec63a2e71f4be386e49375e521cde31f97266f1
- SHA512 032c1187ec9ad3125c875fc58b5c236feb01847b4287fa24d06895e8ef35fb15e7fc00c3d26943fdc69cafa12c7a344156d1bc1f8c40702d7e20858b4ecf3f6a
- SSDEEP 6144:NNJTv1jTNX8FAUiNF8Cjlj9A62voPeQwRmBkyU:hTv1jh8an/hjlZwoPlRkL
- MD5 SHA1 SHA512 SSDEEP
Taagebankernes/intrapetiolar.boo
- SHA256 b97cff1fe1b1dbae6f985491f35a04756f401f2d7f3932c6d85a3ca347c9d489
- MD5 65ede306b44b37b106ed871a3363c362
- SHA1 64f0abcf8c91b0a8e2821272052a9aca77164649
- SHA512 005dc6d7fbaae36140443d7613817ec96f1412f3e6541775ed31b9c30636094d3a93d714e7be9803cb63097eea25ee95862c34a1ec695f957964bc2e2cf01e8d
- MD5 SHA1 SHA512