0e5e0f9aaf9a0c0279d3c3455ecb2444748f7634b7c6e233c376df56af6f076c
- SHA256 0e5e0f9aaf9a0c0279d3c3455ecb2444748f7634b7c6e233c376df56af6f076c
Password
infected
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
REVISED_CONTRACTS_20240530_JPG.exe
Resource
win7-20240508-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
REVISED_CONTRACTS_20240530_JPG.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
17 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target 0e5e0f9aaf9a0c0279d3c3455ecb2444748f7634b7c6e233c376df56af6f076c
- Size 285KB
- Sample240530-sxbezaeb82
- SHA256 0e5e0f9aaf9a0c0279d3c3455ecb2444748f7634b7c6e233c376df56af6f076c
- MD5 25594dd444fbfc136bb92b27ae489cfd
- SHA1 7f975dca838dc4c4f0fc9924bd411585514e5e00
- SHA512 77b78b0759dd36dc6b30dced81449d9296fbddd3bd053c3ac8ecc19887ecd0e778feafce8b206aa4828d4b842d016db69de54280a8214ba4ceb62a8d9996b623
- SSDEEP 6144:b4wucqR7OR54NV+Con6iCq4lS31HN6ATCiFHWal:UEXcho8Jlo1wYmy
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack002/REVISED_CONTRACTS_20240530_JPG.bat unpack003/$PLUGINSDIR/System.dll
File Explorer
-
0e5e0f9aaf9a0c0279d3c3455ecb2444748f7634b7c6e233c376df56af6f076c.zip 285KB
-
REVISED_CONTRACTS_20240530_JPG.IMG.iso 1.2MB
-
REVISED_CONTRACTS_20240530_JPG.bat.exe 583KB
-
$PLUGINSDIR/System.dll.dll 11KB
-
Ausubo.Gub161KB
-
Malinstitution/forureningsbelastningernes.ill77KB
-
Malinstitution/semi.sla286KB
-
Malinstitution/unponderable.nap485KB
-
ceratitoidea.txt422B
-
dvrgekongens.hov36KB
REVISED_CONTRACTS_20240530_JPG.IMG
- SHA256 2257d944da170e137135312489c2f9f017741734df13956506848c2852641905
- MD5 b17dfc923f7ae9c631bac8b393b5994f
- SHA1 87ff5bc4951635d0b22a25f4c10510ffb3b14869
- SHA512 90f740bc64b71e2dc0f9c403e4ff7cfb18afedda72562c80af2c4b2865668916842d183d0821cc06ef1fce2cb52be9c8e81c3e7d95540a7fa44759440a6479e1
- SSDEEP 6144:TUjRwQGJaKitWD645y7qCjEXRF7PdrJNT/CcvuziDu7DkKlk:TqcS4IGCjEX/jNT/Cxwu8q
- MD5 SHA1 SHA512 SSDEEP
REVISED_CONTRACTS_20240530_JPG.bat
- IMPHASH e2a592076b17ef8bfb48b7e03965a3fc
- SHA256 1b6304388826ef0f3c826c75afbe4ff571562dae466726e8d25cc93afb22ffa0
- MD5 f41482940a8541117d885d640d8ef709
- SHA1 c70609efae644cdaede26edeb34215ba67a3ec94
- SHA512 c0e8486c399524d47b41e295fff87108ae95236bebd2c789d6048df3b7b93eaa05705e9a9e33dd4a039ae9313abe1810cdc29dac23cb2f4213e97a56012ead6d
- SSDEEP 6144:wUjRwQGJaKitWD645y7qCjEXRF7PdrJNT/CcvuziDu7DkKlke:wqcS4IGCjEX/jNT/Cxwu8qH
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
12906
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
SetCurrentDirectoryW
GetFileAttributesW
GetFullPathNameW
Sleep
GetTickCount
GetFileSize
GetModuleFileNameW
MoveFileW
SetFileAttributesW
GetCurrentProcess
ExitProcess
SetEnvironmentVariableW
GetWindowsDirectoryW
GetTempPathW
GetCommandLineW
GetVersion
SetErrorMode
lstrlenW
WaitForSingleObject
CopyFileW
CompareFileTime
GlobalLock
CreateThread
GetLastError
CreateDirectoryW
CreateProcessW
RemoveDirectoryW
lstrcmpiA
CreateFileW
GetTempFileNameW
WriteFile
lstrcpyA
lstrcpyW
MoveFileExW
lstrcatW
GetSystemDirectoryW
GetProcAddress
GetModuleHandleA
GlobalFree
GlobalAlloc
GetShortPathNameW
SearchPathW
lstrcmpiW
SetFileTime
CloseHandle
ExpandEnvironmentStringsW
lstrcmpW
GlobalUnlock
lstrcpynW
GetDiskFreeSpaceW
GetExitCodeProcess
FindFirstFileW
FindNextFileW
DeleteFileW
SetFilePointer
ReadFile
FindClose
MulDiv
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
GetPrivateProfileStringW
WritePrivateProfileStringW
FreeLibrary
LoadLibraryExW
GetModuleHandleW
user32
GetSystemMenu
SetClassLongW
IsWindowEnabled
EnableMenuItem
SetWindowPos
GetSysColor
GetWindowLongW
SetCursor
LoadCursorW
CheckDlgButton
GetMessagePos
LoadBitmapW
CallWindowProcW
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
wsprintfW
ScreenToClient
GetWindowRect
GetSystemMetrics
SetDlgItemTextW
GetDlgItemTextW
MessageBoxIndirectW
CharPrevW
CharNextA
wsprintfA
DispatchMessageW
PeekMessageW
GetDC
ReleaseDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
GetClientRect
FillRect
EndDialog
RegisterClassW
SystemParametersInfoW
CreateWindowExW
GetClassInfoW
DialogBoxParamW
CharNextW
ExitWindowsEx
DestroyWindow
LoadImageW
SetTimer
SetWindowTextW
PostQuitMessage
ShowWindow
GetDlgItem
IsWindow
SetWindowLongW
FindWindowExW
TrackPopupMenu
AppendMenuW
CreatePopupMenu
DrawTextW
EndPaint
CreateDialogParamW
SendMessageTimeoutW
SetForegroundWindow
gdi32
SelectObject
SetBkMode
CreateFontIndirectW
SetTextColor
DeleteObject
GetDeviceCaps
CreateBrushIndirect
SetBkColor
shell32
SHGetSpecialFolderLocation
SHGetPathFromIDListW
SHBrowseForFolderW
SHGetFileInfoW
ShellExecuteW
SHFileOperationW
advapi32
RegDeleteKeyW
SetFileSecurityW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegOpenKeyExW
RegEnumValueW
RegDeleteValueW
RegCloseKey
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW
RegEnumKeyW
comctl32
ImageList_AddMasked
ord17
ImageList_Destroy
ImageList_Create
ole32
OleUninitialize
OleInitialize
CoTaskMemFree
CoCreateInstance
Name
.text
Size
24KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
128KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
164KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
350KB
Virtual Size
350KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=166, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
$PLUGINSDIR/System.dll
- IMPHASH fc0224e99e736751432961db63a41b76
- SHA256 982c5fb7ada7d8c9bc3e419d1c35da6f05bc5dd845940c179af3a33d00a36a8b
- MD5 0ff2d70cfdc8095ea99ca2dabbec3cd7
- SHA1 10c51496d37cecd0e8a503a5a9bb2329d9b38116
- SHA512 cb5fc0b3194f469b833c2c9abf493fcec5251e8609881b7f5e095b9bd09ed468168e95dda0ba415a7d8d6b7f0dee735467c0ed8e52b223eb5359986891ba6e2e
- SSDEEP 192:eK24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35OlASl:u8QIl975eXqlWBrz7YLOlA
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
10183
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetModuleHandleW
GlobalFree
GlobalSize
lstrcpynW
lstrcpyW
GetProcAddress
WideCharToMultiByte
VirtualFree
FreeLibrary
lstrlenW
LoadLibraryW
GlobalAlloc
MultiByteToWideChar
VirtualAlloc
VirtualProtect
GetLastError
user32
wsprintfW
ole32
StringFromGUID2
CLSIDFromString
Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc
Name
.text
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
851B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
120B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1024B
Virtual Size
610B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=14, version=7299,
count=20, id=1, productName=Unmarked objects,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=4, id=48, version=9044,
count=1, id=42, version=8803,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
Ausubo.Gub
- SHA256 44eca4095f6190663407c40f33c423055539b73abf0638be0be13f8f1ead79ff
- MD5 07270d1602bead9384643551f5e72885
- SHA1 7c7b86f60b4e705ea1860f0b71e61d20af6e62ad
- SHA512 05774fd0e4b3d3dc0aaed61df43188d9a9fde43bae6853d3053e8e779d646ef2d2665c429866138e884a3ee81b97ec1117e766b47a704982501b368af86600bb
- SSDEEP 3072:xNNZJxU++IHbSAz4dioqWLs5pHXQJcUtMPcrD6UpgFcrxtnkmPMd5QhF:xJjU++IXzzFcqgJxtM0icgFEtk4P
- MD5 SHA1 SHA512 SSDEEP
Malinstitution/forureningsbelastningernes.ill
- SHA256 a9087a5ff6e230677fb76402198ce6cf469dd20d1972bce3d6b5d91b36aa77c0
- MD5 ac25bbeafac360d17c528cecd3986e13
- SHA1 9e48c5c7e97986f32f38a67db90b548f458d07d6
- SHA512 b2eeefa88635cf67509628d3249ad70bdd9f240c06dc068a941968d88b542e54bee7c05fa5b6b4f9304ad90993a1277668868f5e3a726efbc35215b3f6eceb27
- SSDEEP 96:PTIA7s7tkdjxleevoOMrNd+NDKyCO76Q/OjUGf9J12:bIA7gkdjxleevoNX4D976Q/OYeb2
- MD5 SHA1 SHA512 SSDEEP
Malinstitution/semi.sla
- SHA256 ee2061b9979172f0814b801eba0fa9360ad48a560c94b70dbc3e0a5d4c8dc52e
- MD5 abada6d613f5af4c7491660bc3530bd1
- SHA1 d3b20cbc1dc4512467233b07a6d9d7b496c480a9
- SHA512 bc36b5993b2544253482b5bbd7c5295391a0dc7bc5680086ecd0a369d762d96226845a911eadd68103246ea0ac9e07ee1724a061e9040b5c86a05795137e1af8
- SSDEEP 384:mvJGopx8zZtAZ6Gn1Q4a9fJ+odGiZZiO98UssUHUhadhTuNHD1ioAzdv1UNj2En9:tocxsu/4Oj4AlbN8PxODb9/7c
- MD5 SHA1 SHA512 SSDEEP
Malinstitution/unponderable.nap
- SHA256 c343207356c5c3293bd8aa091e3f8b175216ad6cefd9b22245384401fbd481ab
- MD5 6934ea29df9d418374036c83a07adb60
- SHA1 31081589bd4e74c1cd8b7f3964e52cecf45928d6
- SHA512 4d662066c478b4d23b6758ad5bdd678aa660414118812273832c1be2b6927c335eecd9eacfbe507006addb97c2926911ef12e51f3712a95136b803e944fe7a4b
- SSDEEP 768:C0R/HSSTAuTx7D7BMCGBDKuSxmzr9i+fVOIMXfxoJrhwp4h0fWsvrgzToWhb:UF
- MD5 SHA1 SHA512 SSDEEP
ceratitoidea.txt
- SHA256 71343258f0a719e276785f39d3ffcec1c396c35996a4f29214289950ecd21cde
- MD5 f9867a6794cf97f462cb9a827b2be04a
- SHA1 7c411fbb32a958b7888ca520220d0dfb12daf24f
- SHA512 b17d1e53a1eb2059d9c5d815a5b1f84e22d49b83234c826a0a8ec23e0415900e7703470c4cf7a84359f91198e0ba9d982c9636d020db6eacba1ae5f7ccbeafbd
- MD5 SHA1 SHA512
dvrgekongens.hov
- SHA256 5239dfdbd4420d6d39ed75b3776e7bb4ba3f82d9c1b6d83d1b377a5f3c837e00
- MD5 a10791db85688fa6c3a3128c9adeb057
- SHA1 46a48f1f5251f67fd8808e99989e76817d7a6cf8
- SHA512 7e81fb1bf6d50926c18304822fcfc60068242018d86282a3f284af1bc8358d1d06f9647f0eb4ed3e923b3ae382d121d056f095b5a7b0fbf0c3c1063bc96e99b4
- SSDEEP 48:DCzq2XcXBX7QB8oMw9AM8qtJDYhSU3nv3ARGmgxWaQ95w:DuXcBLc8oM0NtF8SU3YRKG
- MD5 SHA1 SHA512 SSDEEP