6b70b3711d067ff306ef0b6880aa9b75.bin
- SHA256 04b8e1297c96a4e1cacb63d2fa2bacfb2f03aec3e4ac052d202e96c1553aa61d
Password
infected
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
7f83f1ace73c0eb3543fd3e15924ecfc69d174e0ad30298b917b74e65a605eb2.exe
Resource
win7-20240221-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
7f83f1ace73c0eb3543fd3e15924ecfc69d174e0ad30298b917b74e65a605eb2.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240419-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target 6b70b3711d067ff306ef0b6880aa9b75.bin
- Size 458KB
- Sample240601-cqcfpafb53
- SHA256 04b8e1297c96a4e1cacb63d2fa2bacfb2f03aec3e4ac052d202e96c1553aa61d
- MD5 7a8c7297c8422390506e7a850bdc658d
- SHA1 e4510d6aa0748c64f2e945e46dfe36d9d9679199
- SHA512 d9cc925cf867d8b1fba11d3c59bb87a906bf5b72dfa2a34ba0ce070970ed5a7ded2aa15cf8acac6a31707f4fad0b757b4d4cba731e412765161abf81147bdc05
- SSDEEP 12288:m3J3uO9Z8KE/08xo7gtiogGK+lkHFJ41MFW5l8m:eJ3Tr8KE/qEbQJjm
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/$PLUGINSDIR/System.dll - NSIS installer 2 IoCs
resource yara_rule static1/unpack001/7f83f1ace73c0eb3543fd3e15924ecfc69d174e0ad30298b917b74e65a605eb2.exe nsis_installer_1 static1/unpack001/7f83f1ace73c0eb3543fd3e15924ecfc69d174e0ad30298b917b74e65a605eb2.exe nsis_installer_2
File Explorer
-
6b70b3711d067ff306ef0b6880aa9b75.bin.zip 458KB
-
7f83f1ace73c0eb3543fd3e15924ecfc69d174e0ad30298b917b74e65a605eb2.exe.exe 542KB
-
$PLUGINSDIR/System.dll.dll 12KB
-
Chott151.pro627KB
-
Periskopers.Kru323KB
-
Sponsible.gum1.2MB
-
aromatiseres.kny1.0MB
-
contraproposal.ber675KB
-
overelaborates.txt465B
7f83f1ace73c0eb3543fd3e15924ecfc69d174e0ad30298b917b74e65a605eb2.exe
- IMPHASH 671f2a1f8aee14d336bab98fea93d734
- SHA256 7f83f1ace73c0eb3543fd3e15924ecfc69d174e0ad30298b917b74e65a605eb2
- MD5 6b70b3711d067ff306ef0b6880aa9b75
- SHA1 3e6adcc2187d08da0e22cb8442bf432d4543dbcb
- SHA512 91d01e9792613c96037df699f65f508478c151cf47b71461f71d22fcb9df294b49c28085a5479270b0a592747a9af335e132615fbf997ae61e245e2ec381bc04
- SSDEEP 12288:AKdIoOp22GL4aC98Xxt9zdzJJmnIprf+r:AKdIlpspWoT3zmI7K
- MD5 SHA1 SHA512 SSDEEP
-
NSIS installer
Password
infected
PE Signature issue
Digest
5a:86:4d:e9:9a:a0:eb:50:55:21:cc:78:75:12:b8:04:b7:b5:96:7e:bc:62:43:4a:b1:da:35:5a:94:ed:a6:59
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Supinumer,OU=Hortensiaers Newstand\ ,O=Supinumer,L=Askham,ST=England,C=GB,1.2.840.113549.1.9.1=#0c165a616d616e67393840416d70686967616d31352e6162
Chains
May 23, 2024
PE Signature issue
Digest
7b:1c:b9:b8:bd:88:3a:59:db:d7:0c:1f:d7:4a:9d:ca:8e:73:72:49
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Supinumer,OU=Hortensiaers Newstand\ ,O=Supinumer,L=Askham,ST=England,C=GB,1.2.840.113549.1.9.1=#0c165a616d616e67393840416d70686967616d31352e6162
Chains
May 23, 2024
Subject
CN=Supinumer,OU=Hortensiaers Newstand\ ,O=Supinumer,L=Askham,ST=England,C=GB,1.2.840.113549.1.9.1=#0c165a616d616e67393840416d70686967616d31352e6162
Serial Number
7a:91:9a:65:cf:b6:26:42:93:57:df:7e:72:1d:15:b3:50:3b:74:ff
Issuer
CN=Supinumer,OU=Hortensiaers Newstand\ ,O=Supinumer,L=Askham,ST=England,C=GB,1.2.840.113549.1.9.1=#0c165a616d616e67393840416d70686967616d31352e6162
Timespan
Jul 13, 2023 - Jul 12, 2026
Subject
CN=Supinumer,OU=Hortensiaers Newstand\ ,O=Supinumer,L=Askham,ST=England,C=GB,1.2.840.113549.1.9.1=#0c165a616d616e67393840416d70686967616d31352e6162
Serial Number
7a:91:9a:65:cf:b6:26:42:93:57:df:7e:72:1d:15:b3:50:3b:74:ff
Issuer
CN=Supinumer,OU=Hortensiaers Newstand\ ,O=Supinumer,L=Askham,ST=England,C=GB,1.2.840.113549.1.9.1=#0c165a616d616e67393840416d70686967616d31352e6162
Timespan
Jul 13, 2023 - Jul 12, 2026
Minor OS version
0
Major OS version
4
Entry point
13218
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
advapi32
RegEnumValueA
RegEnumKeyA
RegQueryValueExA
RegSetValueExA
RegCloseKey
RegDeleteValueA
RegDeleteKeyA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegOpenKeyExA
RegCreateKeyExA
shell32
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
SHFileOperationA
ShellExecuteExA
ole32
OleUninitialize
OleInitialize
IIDFromString
CoCreateInstance
CoTaskMemFree
comctl32
ImageList_Destroy
ord17
ImageList_AddMasked
ImageList_Create
user32
SetDlgItemTextA
GetSystemMetrics
CreatePopupMenu
AppendMenuA
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
IsWindowVisible
CallWindowProcA
GetMessagePos
CheckDlgButton
LoadCursorA
SetCursor
GetSysColor
SetWindowPos
GetWindowLongA
IsWindowEnabled
SetClassLongA
GetSystemMenu
EnableMenuItem
GetWindowRect
ScreenToClient
EndDialog
RegisterClassA
SystemParametersInfoA
CreateWindowExA
GetDlgItemTextA
DialogBoxParamA
CharNextA
ExitWindowsEx
DestroyWindow
CreateDialogParamA
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
ReleaseDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
MessageBoxIndirectA
CharPrevA
PeekMessageA
GetClassInfoA
DispatchMessageA
TrackPopupMenu
gdi32
GetDeviceCaps
SetBkColor
SelectObject
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
kernel32
CreateFileA
GetTempFileNameA
ReadFile
RemoveDirectoryA
CreateProcessA
CreateDirectoryA
GetLastError
CreateThread
GlobalLock
GlobalUnlock
GetDiskFreeSpaceA
lstrcpynA
SetErrorMode
GetVersionExA
lstrlenA
GetCommandLineA
GetTempPathA
GetWindowsDirectoryA
WriteFile
ExitProcess
CopyFileA
GetCurrentProcess
GetModuleFileNameA
GetFileSize
GetTickCount
Sleep
SetFileAttributesA
GetFileAttributesA
SetCurrentDirectoryA
MoveFileA
GetFullPathNameA
GetShortPathNameA
SearchPathA
CompareFileTime
SetFileTime
CloseHandle
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
GetModuleHandleA
LoadLibraryExA
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
MulDiv
lstrcpyA
MoveFileExA
lstrcatA
WideCharToMultiByte
GetSystemDirectoryA
GetProcAddress
GetExitCodeProcess
WaitForSingleObject
SetEnvironmentVariableA
Name
.text
Size
25KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
105KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
108KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
109KB
Virtual Size
109KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=158, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
$PLUGINSDIR/System.dll
- IMPHASH 240ca92ecc1c291801c451c447e16c12
- SHA256 014f1dfeb842cf7265a3644bc6903c592abe9049bfc7396829172d3d72c4d042
- MD5 12b140583e3273ee1f65016becea58c4
- SHA1 92df24d11797fefd2e1f8d29be9dfd67c56c1ada
- SHA512 49ffdfa1941361430b6acb3555fd3aa05e4120f28cbdf7ceaa2af5937d0b8cccd84471cf63f06f97cf203b4aa20f226bdad082e9421b8e6b62ab6e1e9fc1e68a
- SSDEEP 192:gFiQJ77pJp17C8F1A5xjGNxrgFOgb7lrT/nC93:E7pJp48F2exrg5F/C
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
4
Entry point
10673
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GlobalAlloc
GlobalFree
GlobalSize
lstrcpynA
lstrcpyA
GetProcAddress
VirtualFree
FreeLibrary
lstrlenA
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
WideCharToMultiByte
VirtualAlloc
VirtualProtect
GetLastError
user32
wsprintfA
ole32
StringFromGUID2
CLSIDFromString
Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc
Name
.text
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
867B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
104B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1024B
Virtual Size
654B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=14, version=7299,
count=19, id=1, productName=Unmarked objects,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=4, id=48, version=9044,
count=1, id=42, version=8803,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
Chott151.pro
- SHA256 e85b367006f230c3b2e29a11766cda65a0582f9eab4a601bdecea7229b26d0fc
- MD5 cdcec2c558fa8a8e63aa5356507265b3
- SHA1 69423e82b8c5a9ce561be425de34e38fd348246e
- SHA512 b01517dac0ce0b0320a6889fd9e1c385731de8713677003fcddc020add8b2e70126ef9711d63172b58b6ef7911629fdfffd0e290b021ffe2d7ab4bd439345122
- SSDEEP 384:1CThvb6qpJM51+qDtHndoq9zMhjBH8S/mIB3mtOLjsC/gz+8U/jLco4zNsO2MTiz:nlQQKmtJULsNsODkxV
- MD5 SHA1 SHA512 SSDEEP
Periskopers.Kru
- SHA256 5f23be48412b57713929d7e1a9d59865d027309dcea8eee993cd99963045a409
- MD5 2be73d33d7ea7f8e7b7c55aeb875cdfb
- SHA1 689fed5602dbd107935b11cf77695d27224d1777
- SHA512 c9bc5676f91a8e608d61bed5c3ad2a56144419bb588993ba22cda3e67d7ec55b1f34949f822d583904fdd2a7255668e2a0519943877d1de47674af8fb42653ef
- SSDEEP 6144:GqtoR54PIHG1WluNIzfpeE3BykBbrOpWXTF6lglpfUl9vULmWvvFyWqQYhUp1LZh:iHNlcIzfpeib6YXElU498LmUyPu1LZh
- MD5 SHA1 SHA512 SSDEEP
Sponsible.gum
- SHA256 9e381e8be66b5e4b91462ed8fb919409595eb718e600f4327d864743ec899dde
- MD5 15d9eacef1e85cf33b6bda50a20bb952
- SHA1 f970803c1192fc9e74f54f23124ea401522c70e1
- SHA512 705783cf4e7cd5cdb33277f60994d8a60c977990d7615ee8c1ea9a52a452f043d3fffce0d8ad3999e80f8df15a3350272e87e34b244a9fd780fd925a40cb966b
- SSDEEP 768:HC2H0KZapOXkkuEb/eLGdJoyr9XAtNK5i62zCxT7ciI4m:l9
- MD5 SHA1 SHA512 SSDEEP
aromatiseres.kny
- SHA256 dca1dcefb8b08f47a8d82f1135f1b6e6edffdb70930a1227676ec4f7a1d9502a
- MD5 8a71483589e505b551dab3e14caecf9f
- SHA1 d0fa3d65a453d2c274f3fa6c3318bd28dd34cd35
- SHA512 9672a5c5d04fca5fb5d9195caee4cde23e27778069586c6d2cc28c649e9d63cf176ffdcc0d8df77b10192c2d058ca17cced76ac993e18c1f02c602fcfd6d4809
- SSDEEP 768:YBQpe8ptpsXQPCNuvNyZVS83SVKpUQmRhFJzdEqQgapTQVNvW:LtM
- MD5 SHA1 SHA512 SSDEEP
contraproposal.ber
- SHA256 06aaba7bfae63698e760b60d9c7cad5c8a5a4a85595153c90c306a61c47a20f7
- MD5 a9e2cb65cc04e6c0f54609fb8b7cc0a4
- SHA1 159d40f96a5c58dd7fe2d93d2cfbe22e13ef530a
- SHA512 e35545502071c3870bef25277be7daf509f52d087cdbc600917794580bbffca48a439289f887f6b65c7d245dbdc7fec239714b6e2794140b7b71f3e54a66aaca
- SSDEEP 384:ilBG9dPPlcRudyhsEJ3u1j8qiNRLMH1VRJ0sx3ldd6z83v7rXDvUE0uGavEy0m2y:h97ohs11QnNu53/rvDvR0y7u+GheAd2
- MD5 SHA1 SHA512 SSDEEP
overelaborates.txt
- SHA256 94d29fe8a4b016cb3ab9b3134b49911795198b3e1c16df0d16e3c8f7b45ed2fe
- MD5 a351fc586f6d81c2d14b8ed97fa675fe
- SHA1 699ecb3f5c9409026082f83ad4f040151d285db1
- SHA512 a023df771d677ac64ec5ae718229552379ab3ec037b92ce5acc7ca56320adf94d1eed0a37599adc6d595f38293fc0ffacb20ded5d55a95c47c797ccc518b9d3f
- MD5 SHA1 SHA512