ab49c5ba806d4b3aef68b4a70c2ebb261f4b7cd6e74f3ec838c9d59aacf969c5.z
- SHA256 ab49c5ba806d4b3aef68b4a70c2ebb261f4b7cd6e74f3ec838c9d59aacf969c5
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Purchase Order PO05232024.exe
Resource
win7-20240508-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
Purchase Order PO05232024.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20240215-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target ab49c5ba806d4b3aef68b4a70c2ebb261f4b7cd6e74f3ec838c9d59aacf969c5.z
- Size 354KB
- Sample240524-p4tcksdf2t
- SHA256 ab49c5ba806d4b3aef68b4a70c2ebb261f4b7cd6e74f3ec838c9d59aacf969c5
- MD5 bdf1ae28f8c5cb98e37b85749c82898b
- SHA1 bae851bacae6fbaedf70e1f9a8446612c0ce241c
- SHA512 6e7639217f4e6913209d68cb9fac48a16d8799a8676091f53fb70e433fffbe53f65f46934ed276dc9278467a91dfa23a07a452ada1c54c9e11e0280b1e4a236a
- SSDEEP 6144:N6LcWLDbWTPB37z1CpBuBIz3BOOayIDHUCcJoGsYeA0lNCyHN4mExWNNAXe+:N6LcWLDoaNz3k0vJo+WNFHN4TxXr
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack002/$PLUGINSDIR/System.dll unpack002/$PLUGINSDIR/nsExec.dll
File Explorer
-
ab49c5ba806d4b3aef68b4a70c2ebb261f4b7cd6e74f3ec838c9d59aacf969c5.z.rar 354KB
-
Purchase Order PO05232024.exe.exe 701KB
-
$PLUGINSDIR/System.dll.dll 11KB
-
$PLUGINSDIR/nsExec.dll.dll 6KB
-
Bfferne/Thesmothetae.Rig11283KB
-
Bfferne/redischarged.txt442B
-
Bfferne/trimklapper.mis774KB
-
Lignone55.gra580KB
-
Sindbilledes.Sli53195KB
Purchase Order PO05232024.exe
- IMPHASH e2a592076b17ef8bfb48b7e03965a3fc
- SHA256 dd39d251c8d31fdcd410940c7e3a6b1ec76c62b341c60810215da5434d2cb52a
- MD5 818e095a728bb7fde8d34c3276c01e15
- SHA1 5bc32d174f3dc493312b330d01ceb55e58127f4c
- SHA512 3f65fe9b8b0755ae9faad6cd7028fae580e09401de2eb988814292458c256c21ea01ba1e481ecd28c7c8615b0457405b32744be7190bdae58846c300c9ef3672
- SSDEEP 12288:bvp1DrAkngRmfxs7u//fARGujCxyIG1TxHhsS14P6bu4:TnDrA/mfWu/gnjNdNhd14CV
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
7a:08:c5:ef:5a:b6:aa:b8:86:bd:a3:ae:7d:78:15:ab:c8:e4:3b:f7:4c:87:7c:b8:37:0f:62:3a:0a:bb:95:db
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Nonrectangular,OU=kaw Oprulnings\ ,O=Nonrectangular,L=Honolulu,ST=Hawaii,C=US,1.2.840.113549.1.9.1=#0c11456d62657a7a6c654041636964732e536d
Chains
May 23, 2024
PE Signature issue
Digest
aa:fa:ba:aa:2a:28:ca:8c:e2:51:ca:7f:fb:b1:52:1f:1d:3f:a1:97
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Nonrectangular,OU=kaw Oprulnings\ ,O=Nonrectangular,L=Honolulu,ST=Hawaii,C=US,1.2.840.113549.1.9.1=#0c11456d62657a7a6c654041636964732e536d
Chains
May 23, 2024
Subject
CN=Nonrectangular,OU=kaw Oprulnings\ ,O=Nonrectangular,L=Honolulu,ST=Hawaii,C=US,1.2.840.113549.1.9.1=#0c11456d62657a7a6c654041636964732e536d
Serial Number
5b:56:55:d4:6a:ba:5a:c8:38:0e:00:3d:d4:fe:63:ae:f8:af:8a:32
Issuer
CN=Nonrectangular,OU=kaw Oprulnings\ ,O=Nonrectangular,L=Honolulu,ST=Hawaii,C=US,1.2.840.113549.1.9.1=#0c11456d62657a7a6c654041636964732e536d
Timespan
Mar 25, 2024 - Mar 25, 2027
Subject
CN=Nonrectangular,OU=kaw Oprulnings\ ,O=Nonrectangular,L=Honolulu,ST=Hawaii,C=US,1.2.840.113549.1.9.1=#0c11456d62657a7a6c654041636964732e536d
Serial Number
5b:56:55:d4:6a:ba:5a:c8:38:0e:00:3d:d4:fe:63:ae:f8:af:8a:32
Issuer
CN=Nonrectangular,OU=kaw Oprulnings\ ,O=Nonrectangular,L=Honolulu,ST=Hawaii,C=US,1.2.840.113549.1.9.1=#0c11456d62657a7a6c654041636964732e536d
Timespan
Mar 25, 2024 - Mar 25, 2027
Minor OS version
0
Major OS version
4
Entry point
12960
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
SetCurrentDirectoryW
GetFileAttributesW
GetFullPathNameW
Sleep
GetTickCount
GetFileSize
GetModuleFileNameW
MoveFileW
SetFileAttributesW
GetCurrentProcess
ExitProcess
SetEnvironmentVariableW
GetWindowsDirectoryW
GetTempPathW
GetCommandLineW
GetVersion
SetErrorMode
lstrlenW
WaitForSingleObject
CopyFileW
CompareFileTime
GlobalLock
CreateThread
GetLastError
CreateDirectoryW
CreateProcessW
RemoveDirectoryW
lstrcmpiA
CreateFileW
GetTempFileNameW
WriteFile
lstrcpyA
lstrcpyW
MoveFileExW
lstrcatW
GetSystemDirectoryW
GetProcAddress
GetModuleHandleA
GlobalFree
GlobalAlloc
GetShortPathNameW
SearchPathW
lstrcmpiW
SetFileTime
CloseHandle
ExpandEnvironmentStringsW
lstrcmpW
GlobalUnlock
lstrcpynW
GetDiskFreeSpaceW
GetExitCodeProcess
FindFirstFileW
FindNextFileW
DeleteFileW
SetFilePointer
ReadFile
FindClose
MulDiv
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
GetPrivateProfileStringW
WritePrivateProfileStringW
FreeLibrary
LoadLibraryExW
GetModuleHandleW
user32
GetSystemMenu
SetClassLongW
IsWindowEnabled
EnableMenuItem
SetWindowPos
GetSysColor
GetWindowLongW
SetCursor
LoadCursorW
CheckDlgButton
GetMessagePos
LoadBitmapW
CallWindowProcW
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
wsprintfW
ScreenToClient
GetWindowRect
GetSystemMetrics
SetDlgItemTextW
GetDlgItemTextW
MessageBoxIndirectW
CharPrevW
CharNextA
wsprintfA
DispatchMessageW
PeekMessageW
GetDC
ReleaseDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
GetClientRect
FillRect
EndDialog
RegisterClassW
SystemParametersInfoW
CreateWindowExW
GetClassInfoW
DialogBoxParamW
CharNextW
ExitWindowsEx
DestroyWindow
LoadImageW
SetTimer
SetWindowTextW
PostQuitMessage
ShowWindow
GetDlgItem
IsWindow
SetWindowLongW
FindWindowExW
TrackPopupMenu
AppendMenuW
CreatePopupMenu
DrawTextW
EndPaint
CreateDialogParamW
SendMessageTimeoutW
SetForegroundWindow
gdi32
SelectObject
SetBkMode
CreateFontIndirectW
SetTextColor
DeleteObject
GetDeviceCaps
CreateBrushIndirect
SetBkColor
shell32
SHGetSpecialFolderLocation
SHGetPathFromIDListW
SHBrowseForFolderW
SHGetFileInfoW
ShellExecuteW
SHFileOperationW
advapi32
RegDeleteKeyW
SetFileSecurityW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegOpenKeyExW
RegEnumValueW
RegDeleteValueW
RegCloseKey
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW
RegEnumKeyW
comctl32
ImageList_AddMasked
ord17
ImageList_Destroy
ImageList_Create
ole32
OleUninitialize
OleInitialize
CoTaskMemFree
CoCreateInstance
Name
.text
Size
25KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
171KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
204KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
428KB
Virtual Size
427KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=166, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
$PLUGINSDIR/System.dll
- IMPHASH fc0224e99e736751432961db63a41b76
- SHA256 982c5fb7ada7d8c9bc3e419d1c35da6f05bc5dd845940c179af3a33d00a36a8b
- MD5 0ff2d70cfdc8095ea99ca2dabbec3cd7
- SHA1 10c51496d37cecd0e8a503a5a9bb2329d9b38116
- SHA512 cb5fc0b3194f469b833c2c9abf493fcec5251e8609881b7f5e095b9bd09ed468168e95dda0ba415a7d8d6b7f0dee735467c0ed8e52b223eb5359986891ba6e2e
- SSDEEP 192:eK24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35OlASl:u8QIl975eXqlWBrz7YLOlA
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
10183
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetModuleHandleW
GlobalFree
GlobalSize
lstrcpynW
lstrcpyW
GetProcAddress
WideCharToMultiByte
VirtualFree
FreeLibrary
lstrlenW
LoadLibraryW
GlobalAlloc
MultiByteToWideChar
VirtualAlloc
VirtualProtect
GetLastError
user32
wsprintfW
ole32
StringFromGUID2
CLSIDFromString
Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc
Name
.text
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
851B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
120B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1024B
Virtual Size
610B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=14, version=7299,
count=20, id=1, productName=Unmarked objects,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=4, id=48, version=9044,
count=1, id=42, version=8803,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
$PLUGINSDIR/nsExec.dll
- IMPHASH 0b75f1007d3cc8e457970ae3e3fd53c3
- SHA256 ee052fd5141bf769b841846170aabf0d7c2bb922c74c623c3f109344534f7a70
- MD5 01e76fe9d2033606a48d4816bd9c2d9d
- SHA1 e46d8a9ed4d5da220c81baf5f1fdb94708e9aba2
- SHA512 62ef7095d1bf53354c20329c2ce8546c277aa0e791839c8a24108a01f9483a953979259e0ad04dbcab966444ee7cdd340f8c9557bc8f98e9400794f2751dc7e0
- SSDEEP 96:J7fhfKaGgchPzxK6bq+pKX6D8ZLidGgmkN738:HbGgGPzxeX6D8ZyGgmkN
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4231
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetModuleHandleW
MultiByteToWideChar
lstrlenA
GetExitCodeProcess
WaitForSingleObject
Sleep
TerminateProcess
GlobalReAlloc
GlobalUnlock
GlobalSize
lstrcpynW
ReadFile
PeekNamedPipe
GetTickCount
CreateProcessW
GetStartupInfoW
CreatePipe
GetProcAddress
lstrcpyW
DeleteFileW
lstrcmpiW
GetCurrentProcess
lstrcatW
CloseHandle
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
CreateFileW
CopyFileW
GetTempFileNameW
GlobalFree
GlobalAlloc
GetModuleFileNameW
ExitProcess
GetCommandLineW
GlobalLock
GetVersion
lstrlenW
user32
SendMessageW
FindWindowExW
CharNextW
wsprintfW
CharPrevW
advapi32
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
Exec
ExecToLog
ExecToStack
Name
.text
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
448B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=46, id=1, productName=Unmarked objects,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=2, id=48, version=9044,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
Bfferne/Thesmothetae.Rig112
- SHA256 8947f76f00e5db4d7321abecdaeafc55c74395a3bc08cb35e4df83bc059ec953
- MD5 614673d411c58aa981c207a004046213
- SHA1 5b1010f2a12f593dbd04bfdc68921a8c570e98ea
- SHA512 3d72278e2e62079074e676832b17ded012d4e9f668bad2f60d33fdc0397b4fdbded6e0e08a7ecee00c38850e3ce040c65c128758eb6742856217a2be75108f25
- SSDEEP 1536:TLw8QJAcnzvzreqYnZPKTUEcYTtVp37jPR:3NUtVr
- MD5 SHA1 SHA512 SSDEEP
Bfferne/redischarged.txt
- SHA256 f505a76ee510656617589119be40fd9233af4fe1b593f82d285a6a34c8a7b21f
- MD5 54eff8a07ff643e09b36ec2459f15cbb
- SHA1 6186156e525f9bec16b71d7944b0718702ef226a
- SHA512 c2ece824a3442732a8c13f9b2629ed07d630ec2633611d9029eb1b3a5570e9a90dd19f834c88775ef4e73dccf0b034e71f45ea6ee90845a38fafab2e4ee8dc99
- MD5 SHA1 SHA512
Bfferne/trimklapper.mis
- SHA256 d802c2bbdda9ebad65a946ede1964bcc6e516825bb306ae2ec3910a846f23fc0
- MD5 fa97d041f05f0bac7ab4b52d9b9b4a6c
- SHA1 9b0c51f695c046d689eabcf346a2a77a24a43d07
- SHA512 147ab6160954d3effb57d2fa57064c8ae526924c1057699572a2f0f8997044456ee50a6d714e9c1fb01591eee37a01252e296874ff66b8a93f1dc0d318d032c6
- SSDEEP 768:LBNjNEXQEI9tobFsxGREVx8zi9e9TawOJF:l
- MD5 SHA1 SHA512 SSDEEP
Lignone55.gra
- SHA256 f2131f0fe2a13f926670cfbca00a163629df3fc516ecf4ba31d0a7cbccaf0815
- MD5 6d55a4161e1afe85331f3df53b0411a6
- SHA1 5ffb406e8e1b68b234c2e4889e7b5777ae274594
- SHA512 f4ce7b7869089f1103246d004e5665af97ce279b6fe1fb69d98b97c98a007a31207a04a13224b68a0ea5c96d5e1d680438b19ca80fab1177960eda71b5bdbe40
- SSDEEP 384:r+5+iiV0lvQuK5JcFgRh4e0ONWrjnv2gVzCgOgiAb4imxZS:XiVKLKChPQvtnWS
- MD5 SHA1 SHA512 SSDEEP
Sindbilledes.Sli53
- SHA256 800d55f4201a0ccf594196155fac26c72558e4418948e07c02e05e74da83fd14
- MD5 30b271a4a902d3c947d555a5f9db7d0a
- SHA1 c3ce06fad05c5ed4fecc874a00c4eee1d0b1829f
- SHA512 90213eade230f9b0295873b5f8a555f791c543b9b9e980c8d320ff0e051b6d8a945ae9e78fbd071548c34775cb0f3920d7023bfdbf1182ad50af0eb6527f51db
- SSDEEP 3072:vssChmlrYDRXREdkKy4iRIf4b7XfL+/XVAt7iKg/BtvMCso8q+0SNX:vohcyhvKy4AIfQ7XjxAV6Cso8qMNX
- MD5 SHA1 SHA512 SSDEEP