f611a512d65053f68baee97be8cbda5e0539fe061032466a1937c9a1659c2791.img
- SHA256 f611a512d65053f68baee97be8cbda5e0539fe061032466a1937c9a1659c2791
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
SCAN.AWB.exe
Resource
win7-20240508-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
SCAN.AWB.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target f611a512d65053f68baee97be8cbda5e0539fe061032466a1937c9a1659c2791.img
- Size 1.2MB
- Sample240522-rzckdaee78
- SHA256 f611a512d65053f68baee97be8cbda5e0539fe061032466a1937c9a1659c2791
- MD5 26913acdbbcc1b40d947d0cf8142cfb7
- SHA1 1bf254ba735f08665f68f5614ed80c06effea582
- SHA512 28290754f6245ba5c5b380064767aa6ad494b67210b8cee24b247741e9da604522454792e1842772ba76b57de0cdc27d768199492a2d458323d6acc36effe123
- SSDEEP 12288:PeCLyNx2qdIzjxxtdH7JZOqBhg5F0y/7dncz+kOILaw/mD+Ksj:PebNwqaz9jB7JZTEFT5mL41
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack003/$PLUGINSDIR/System.dll
File Explorer
-
f611a512d65053f68baee97be8cbda5e0539fe061032466a1937c9a1659c2791.img.iso 1.2MB
-
out.iso.iso 1.2MB
-
SCAN.AWB.exe.exe 570KB
-
$PLUGINSDIR/System.dll.dll 11KB
-
Endostylar.Naa369KB
-
Innovating.lis154KB
-
Kroketkuglerne157.txt391B
-
averagen.ran154KB
-
disburdens.cir263KB
-
kilns.hjk119KB
-
peise.mil160KB
-
tudehornets.unc124KB
out.iso
- SHA256 f611a512d65053f68baee97be8cbda5e0539fe061032466a1937c9a1659c2791
- MD5 26913acdbbcc1b40d947d0cf8142cfb7
- SHA1 1bf254ba735f08665f68f5614ed80c06effea582
- SHA512 28290754f6245ba5c5b380064767aa6ad494b67210b8cee24b247741e9da604522454792e1842772ba76b57de0cdc27d768199492a2d458323d6acc36effe123
- SSDEEP 12288:PeCLyNx2qdIzjxxtdH7JZOqBhg5F0y/7dncz+kOILaw/mD+Ksj:PebNwqaz9jB7JZTEFT5mL41
- MD5 SHA1 SHA512 SSDEEP
SCAN.AWB.exe
- IMPHASH b34f154ec913d2d2c435cbd644e91687
- SHA256 7ea4b0492d4bd06af8088ed24374001cabe43bac4a8477c9d4c16428ebe7d511
- MD5 acf130a10b41446bb89bf89e630c7fa3
- SHA1 93ab6a6eb407f475f3c5eea4fb2426339f6e1619
- SHA512 7336f5cf39695dc457f90b8056d3fa19317725427f2f7efdcc826d9dd93bb287d8188ecd3a771f7a92d1cf8a9c5aafb9ffbc71698d6e48ba01b87e6625f85965
- SSDEEP 12288:9eCLyNx2qdIzjxxtdH7JZOqBhg5F0y/7dncz+kOILaw/mD+Ksjo:9ebNwqaz9jB7JZTEFT5mL41T
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
e2:d1:9b:54:4d:c4:6f:83:70:09:62:52:ef:5f:23:2e:6a:63:57:64:54:81:f4:7f:b7:ff:1d:48:7d:ba:50:94
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Instinktives,OU=lurks Astersenes Fremkaldervske\ ,O=Instinktives,L=Leigh,ST=England,C=GB,1.2.840.113549.1.9.1=#0c1a46696e6561626c65404b616d627265676e65727336312e4b6f6d
Chains
May 16, 2024
PE Signature issue
Digest
18:e6:cb:25:f2:5b:44:1e:7c:d8:18:6d:e4:33:54:d1:09:5a:58:68
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Instinktives,OU=lurks Astersenes Fremkaldervske\ ,O=Instinktives,L=Leigh,ST=England,C=GB,1.2.840.113549.1.9.1=#0c1a46696e6561626c65404b616d627265676e65727336312e4b6f6d
Chains
May 16, 2024
Subject
CN=Instinktives,OU=lurks Astersenes Fremkaldervske\ ,O=Instinktives,L=Leigh,ST=England,C=GB,1.2.840.113549.1.9.1=#0c1a46696e6561626c65404b616d627265676e65727336312e4b6f6d
Serial Number
10:a7:18:e5:13:e8:a7:86:e6:2a:c0:85:ab:52:92:0b:9b:7b:95:8c
Issuer
CN=Instinktives,OU=lurks Astersenes Fremkaldervske\ ,O=Instinktives,L=Leigh,ST=England,C=GB,1.2.840.113549.1.9.1=#0c1a46696e6561626c65404b616d627265676e65727336312e4b6f6d
Timespan
Jun 20, 2023 - Jun 19, 2026
Subject
CN=Instinktives,OU=lurks Astersenes Fremkaldervske\ ,O=Instinktives,L=Leigh,ST=England,C=GB,1.2.840.113549.1.9.1=#0c1a46696e6561626c65404b616d627265676e65727336312e4b6f6d
Serial Number
10:a7:18:e5:13:e8:a7:86:e6:2a:c0:85:ab:52:92:0b:9b:7b:95:8c
Issuer
CN=Instinktives,OU=lurks Astersenes Fremkaldervske\ ,O=Instinktives,L=Leigh,ST=England,C=GB,1.2.840.113549.1.9.1=#0c1a46696e6561626c65404b616d627265676e65727336312e4b6f6d
Timespan
Jun 20, 2023 - Jun 19, 2026
Minor OS version
0
Major OS version
4
Entry point
13171
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
SetEnvironmentVariableW
SetFileAttributesW
Sleep
GetTickCount
GetFileSize
GetModuleFileNameW
GetCurrentProcess
CopyFileW
SetCurrentDirectoryW
GetFileAttributesW
GetWindowsDirectoryW
GetTempPathW
GetCommandLineW
GetVersion
SetErrorMode
lstrlenW
lstrcpynW
GetDiskFreeSpaceW
ExitProcess
GetShortPathNameW
CreateThread
GetLastError
CreateDirectoryW
CreateProcessW
RemoveDirectoryW
lstrcmpiA
CreateFileW
GetTempFileNameW
WriteFile
lstrcpyA
MoveFileExW
lstrcatW
GetSystemDirectoryW
GetProcAddress
GetModuleHandleA
GetExitCodeProcess
WaitForSingleObject
lstrcmpiW
MoveFileW
GetFullPathNameW
SetFileTime
SearchPathW
CompareFileTime
lstrcmpW
CloseHandle
ExpandEnvironmentStringsW
GlobalFree
GlobalLock
GlobalUnlock
GlobalAlloc
FindFirstFileW
FindNextFileW
DeleteFileW
SetFilePointer
ReadFile
FindClose
lstrlenA
MulDiv
MultiByteToWideChar
WideCharToMultiByte
GetPrivateProfileStringW
WritePrivateProfileStringW
FreeLibrary
LoadLibraryExW
GetModuleHandleW
user32
GetSystemMenu
SetClassLongW
EnableMenuItem
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongW
SetCursor
LoadCursorW
CheckDlgButton
GetMessagePos
LoadBitmapW
CallWindowProcW
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
ScreenToClient
GetWindowRect
GetDlgItem
GetSystemMetrics
SetDlgItemTextW
GetDlgItemTextW
MessageBoxIndirectW
CharPrevW
CharNextA
wsprintfA
DispatchMessageW
PeekMessageW
ReleaseDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
GetClientRect
FillRect
DrawTextW
EndDialog
RegisterClassW
SystemParametersInfoW
CreateWindowExW
GetClassInfoW
DialogBoxParamW
CharNextW
ExitWindowsEx
DestroyWindow
GetDC
SetTimer
SetWindowTextW
LoadImageW
SetForegroundWindow
ShowWindow
IsWindow
SetWindowLongW
FindWindowExW
TrackPopupMenu
AppendMenuW
CreatePopupMenu
EndPaint
CreateDialogParamW
SendMessageTimeoutW
wsprintfW
PostQuitMessage
gdi32
SelectObject
SetBkMode
CreateFontIndirectW
SetTextColor
DeleteObject
GetDeviceCaps
CreateBrushIndirect
SetBkColor
shell32
SHGetSpecialFolderLocation
ShellExecuteExW
SHGetPathFromIDListW
SHBrowseForFolderW
SHGetFileInfoW
SHFileOperationW
advapi32
AdjustTokenPrivileges
RegCreateKeyExW
RegOpenKeyExW
SetFileSecurityW
OpenProcessToken
LookupPrivilegeValueW
RegEnumValueW
RegDeleteKeyW
RegDeleteValueW
RegCloseKey
RegSetValueExW
RegQueryValueExW
RegEnumKeyW
comctl32
ImageList_Create
ImageList_AddMasked
ImageList_Destroy
ord17
ole32
OleUninitialize
OleInitialize
CoTaskMemFree
CoCreateInstance
Name
.text
Size
25KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
171KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
172KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
150KB
Virtual Size
150KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=165, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
$PLUGINSDIR/System.dll
- IMPHASH fc0224e99e736751432961db63a41b76
- SHA256 f004c568d305cd95edbd704166fcd2849d395b595dff814bcc2012693527ac37
- MD5 8b3830b9dbf87f84ddd3b26645fed3a0
- SHA1 223bef1f19e644a610a0877d01eadc9e28299509
- SHA512 d13cfd98db5ca8dc9c15723eee0e7454975078a776bce26247228be4603a0217e166058ebadc68090afe988862b7514cb8cb84de13b3de35737412a6f0a8ac03
- SSDEEP 192:ex24sihno00Wfl97nH6BenXwWobpWBTtvShJ5omi7dJWjOlESlS:h8QIl972eXqlWBFSt273YOlEz
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
10178
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetModuleHandleW
GlobalFree
GlobalSize
lstrcpynW
lstrcpyW
GetProcAddress
WideCharToMultiByte
VirtualFree
FreeLibrary
lstrlenW
LoadLibraryW
GlobalAlloc
MultiByteToWideChar
VirtualAlloc
VirtualProtect
GetLastError
user32
wsprintfW
ole32
StringFromGUID2
CLSIDFromString
Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc
Name
.text
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
851B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
120B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1024B
Virtual Size
608B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=14, version=7299,
count=20, id=1, productName=Unmarked objects,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=4, id=48, version=9044,
count=1, id=42, version=8803,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
Endostylar.Naa
- SHA256 2f030c807d77dc46856f25914ace9c0c2f9abbaf29e8c42fa96b90e9cc90f2f9
- MD5 c81125e7af767c8bcffaab1891fe3bea
- SHA1 a76f606a93789a2769522dcf12d25df895cdb969
- SHA512 a5d9558ffbf17f28f3100034fbabbe124f5338c2602ea047bc7ff710a7c7397a9fad41722185a771fde8688e6875ec737a640e0394d12c29eeeddf179d31c05e
- SSDEEP 6144:6YMqs/YgKSZ/cRQkeZTIz12odMUvxyQU7zQ:sqQFXZpoOUvxVU7zQ
- MD5 SHA1 SHA512 SSDEEP
Innovating.lis
- SHA256 75ccd008e1a69820aae8f4101e0de4f1afe7c5bf716064f8b1ab9971b07b2bf3
- MD5 f91551bdf1393e09d826147759c4413b
- SHA1 6fcae1d51182e751d92b192d111a5df1bfc49a23
- SHA512 c3d3938e2d20d1cffcf09a6d6be5a2047c80fcc1280057a12d985836d2726b334eb62cdfdd03f0c6801d69dec8835433f6938a8b40ed1e3bd0d17d48a2c67a37
- SSDEEP 48:eg5TwWl5jMFpJ1KLiVeRDMId7gAqFIpkMcqzTeY3S:plnjspJ1zqMc+epkdqmY
- MD5 SHA1 SHA512 SSDEEP
Kroketkuglerne157.txt
- SHA256 f4ca3a37fe051975bff1adbf2dc22e2946ec126d7dd5624079debc9609f49539
- MD5 d89c6da17c5f6d4fd8ac629dd7303170
- SHA1 2fbd3842e57f051db3d9f0e3a2f1fe6311d1de78
- SHA512 0c59a4e3f4d8541e4ad4de3d3f49d598a49b5cad78f4d9913b1527017abb62c85393e3ad68fdde62b0a7655272f90522ac45a5abc9a7c32d5b07ee4eae39b65d
- MD5 SHA1 SHA512
averagen.ran
- SHA256 f5d7654cfae68e15741f55e1ab217682e842f467e81ab034e34304fe8a776a9c
- MD5 f10888a30533c85b13d62ff5faad397c
- SHA1 7a4bac4ed11cd20ef8e48bc1ec30653466d1e405
- SHA512 b4030ffcef4d78a128377c26af7423406cf7ff8334e5d15628389f5277764a45b2dc0b010ca45a770149b0ef1ca6345b661c4541e5db6aa297c12d714bdfa823
- SSDEEP 1536:xmi4Lg5OqEH3BhzZW+fO/Rg/fJ/gSPTch4i+Xn6sviEwYEaS3BKJx/Oj3zo:xV4LgTEHRhzZsgGychU67Ejzmbzo
- MD5 SHA1 SHA512 SSDEEP
disburdens.cir
- SHA256 99828a214a3ab3b6f12d58439008d19a7e97e8f647e0b9ab3f0c41b6401f5b83
- MD5 29227d74ba8dd873f539c72e1919becd
- SHA1 28da2f783240b4db23a3c83033406935781d7419
- SHA512 056548e992fbeb16b08968b3e0db4009cdb79e188533fe561525ffa36020b611418bcd0a2dfdd8300b15af20ed966d4fe2a038698231e0960a800462eec71011
- SSDEEP 96:SXbGJ1CGZONke9aNefFKNynsQhigwLpx22480y6dcNiv:SXbGJMGZ8k6aU96yns0Fwtx224nJoQ
- MD5 SHA1 SHA512 SSDEEP
kilns.hjk
- SHA256 f6f9496a01f66574738d60abd2aeb4d38d1b6598c054d8e1a705ed4aa867147a
- MD5 1d08600aa38681acae10d50171b1cb1f
- SHA1 b3d078e84ca88055d6561313f07e45299f80575e
- SHA512 d42076e1a13f67d1eb92b1a49f8ec20896010628681a7855450790f1e6cb0396210daab6197848856715785de93d324fadd877bafaad779fba015700b3c1c979
- SSDEEP 48:5a54exhYLkK/AaqCOaboRVWvCNkg9o3ZuI27IfBpY0X:5a5zYQamYvyPW3ZuI2SX
- MD5 SHA1 SHA512 SSDEEP
peise.mil
- SHA256 5f62b7ed8b3c8d7cc33103405fa77c6d55aa52754f13a176739b29066c9af2a6
- MD5 d49856b034c0bf7f2dafb49692960dd9
- SHA1 f7bb1dae3de79738dd22f25a4ecf04dbfd72cf43
- SHA512 b2e97bdc020b4c29747918d3bd4496edd4f5f2130c62d36bbaa2ea53ec5ac989191035aeb6ba8202877a0661bda5090e8ada0fe309d50634ea233cba51da0c72
- SSDEEP 48:aoURcBMQ/DxSk/vPVIAboN42j0Hc/4k8wFqpa5BxC31EtPs8fazOLF20yQPdtrZe:aom16PrvLHczTaYKE9Xim9dQ0FvIA
- MD5 SHA1 SHA512 SSDEEP
tudehornets.unc
- SHA256 4f508e6eb8076a44036d969ccf418e66bbc5cf057b85ff9c5a984c054ebb070a
- MD5 5c024949503e7d702fd469bfd5211d15
- SHA1 9481c0c4ba754c9df102a09ba09ed1ee9fcb6c3d
- SHA512 d5c80c01761897ae702d0eab0fd7470b83ababf255066e804cbbc1bb96e3170b28e8334753343782abfc501cc10a7dca112017b5e688b95fb275bf9560db7608
- SSDEEP 48:Plh5CW788/FSqMRI8fU/P9UMYaH7qmbLb:Nh5h788/QqMOoePZHumb
- MD5 SHA1 SHA512 SSDEEP