06062024_1648_06062024_RFQ- 6-59512.rar
- SHA256 67d1605e76b3b979d2848bd9e433311cb03027383e92dbf9cca5fb00f7926da8
Password
infected
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Plinth.exe
Resource
win7-20240508-en
windows7-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
Plinth.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 06062024_1648_06062024_RFQ- 6-59512.rar
- Size 505KB
- Sample240606-vbml8ahg76
- SHA256 67d1605e76b3b979d2848bd9e433311cb03027383e92dbf9cca5fb00f7926da8
- MD5 40c474a17aa9c6f91f31aa38bcda984e
- SHA1 b0fd792fb063c0bbcd7f97d18b5d195a5b098d25
- SHA512 cad23fef257b53329d603718ebcf404d5e7c9f09b4801616aa1f31d8b04f8c5f58de8529e452dec2a1035559f871f7b68eeb6a7368b2a9c4670bae2b4fb83bb1
- SSDEEP 12288:XrkPr1QNF2N/UobbJBwdHTE2CTEcjXZL2VnuhV5:XrgrS/2N///8T9CTEcjFkuj5
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- NSIS installer 2 IoCs
resource yara_rule static1/unpack001/Plinth.exe nsis_installer_1 static1/unpack001/Plinth.exe nsis_installer_2
File Explorer
-
06062024_1648_06062024_RFQ- 6-59512.rar.rar 505KB
-
Plinth.exe.exe 571KB
-
Frekventeret187.ten9KB
-
Nonrateably.txt542B
-
Oderne.des3KB
-
Oplysningerne.Adm69KB
-
Sofisten/papuliferous.for3KB
-
Sofisten/torsoclusion.fis8KB
-
Sofisten/transferrins.ins8KB
-
Televiseringernes106.lyd4KB
-
Theriodonta.pen386KB
-
aandsstyrkens.mad3KB
-
bissau.bor3KB
-
consonantly.las9KB
-
firhndige.dat4KB
-
johannesburg.fje1KB
-
mangelunde.enh6KB
-
misassayed.dia7KB
Plinth.exe
- IMPHASH e160ef8e55bb9d162da4e266afd9eef3
- SHA256 59dbfa6970794dcf41bd6778eff1802625c5a376a7cf8034b61b3a4ecd96d073
- MD5 7482d0d37f5db0c286ea1772613d41b2
- SHA1 ae504ef9b5fceb1cee96b980c865535c91d7c921
- SHA512 444f715a0a1474484d74e69c6d998a86590943788daf891b890ea597c84ff6a728b156fcaef59134332e16f790d5e8d51286ccbebc5e71408adc929e6b3feb98
- SSDEEP 12288:0TpTV/+7dqJqWp4V+gVuEM0W0RS+BDASVDW3h5fCPEOVLypUb5bkhTnciqm9P:eT2eqWpdzEM0W0R1D1DkKPEyGWkdR9P
- MD5 SHA1 SHA512 SSDEEP
-
NSIS installer
Password
infected
PE Signature issue
Digest
94:e1:9d:f9:ed:25:cf:c5:b3:54:d2:bf:33:5a:b1:53:67:f0:45:6a:7c:ef:77:cb:51:fe:44:55:27:e1:ee:5f
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=ldreklubben,OU=Fedthasers Digestors\ ,O=ldreklubben,L=Phillack,ST=England,C=GB,1.2.840.113549.1.9.1=#0c1a5468696f73756c7068617465404b6f736865726564352e466f72
Chains
Jun 4, 2024
Subject
CN=ldreklubben,OU=Fedthasers Digestors\ ,O=ldreklubben,L=Phillack,ST=England,C=GB,1.2.840.113549.1.9.1=#0c1a5468696f73756c7068617465404b6f736865726564352e466f72
Serial Number
14:9b:46:e4:01:cd:20:aa:ef:2e:91:dd:06:0e:f5:9e:3c:09:73:1d
Issuer
CN=ldreklubben,OU=Fedthasers Digestors\ ,O=ldreklubben,L=Phillack,ST=England,C=GB,1.2.840.113549.1.9.1=#0c1a5468696f73756c7068617465404b6f736865726564352e466f72
Timespan
Nov 23, 2023 - Nov 22, 2026
Minor OS version
0
Major OS version
4
Entry point
12516
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetTickCount
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
SearchPathA
GetShortPathNameA
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
SetEnvironmentVariableA
GetWindowsDirectoryA
GetTempPathA
Sleep
CloseHandle
LoadLibraryA
lstrlenA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
CreateFileA
GetTempFileNameA
ReadFile
lstrcpyA
lstrcatA
GetSystemDirectoryA
GetVersion
GetProcAddress
GlobalAlloc
CompareFileTime
SetFileTime
ExpandEnvironmentStringsA
lstrcmpiA
lstrcmpA
WaitForSingleObject
GlobalFree
GetExitCodeProcess
GetModuleHandleA
SetErrorMode
GetCommandLineA
LoadLibraryExA
FindFirstFileA
FindNextFileA
DeleteFileA
SetFilePointer
WriteFile
FindClose
WritePrivateProfileStringA
MultiByteToWideChar
MulDiv
GetPrivateProfileStringA
FreeLibrary
user32
CreateWindowExA
EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
GetDC
SystemParametersInfoA
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
ReleaseDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
GetClassInfoA
DialogBoxParamA
CharNextA
ExitWindowsEx
DestroyWindow
CreateDialogParamA
SetTimer
GetDlgItem
wsprintfA
SetForegroundWindow
ShowWindow
IsWindow
LoadImageA
SetWindowLongA
SetClipboardData
EmptyClipboard
OpenClipboard
EndPaint
PostQuitMessage
FindWindowExA
SendMessageTimeoutA
SetWindowTextA
gdi32
SelectObject
SetBkMode
CreateFontIndirectA
SetTextColor
DeleteObject
GetDeviceCaps
CreateBrushIndirect
SetBkColor
shell32
SHGetSpecialFolderLocation
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
advapi32
RegCloseKey
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegEnumValueA
RegCreateKeyExA
RegSetValueExA
RegQueryValueExA
RegEnumKeyA
comctl32
ImageList_Create
ImageList_AddMasked
ImageList_Destroy
ord17
ole32
CoCreateInstance
CoTaskMemFree
OleInitialize
OleUninitialize
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
Name
.text
Size
23KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
149KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
64KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
94KB
Virtual Size
93KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=158, id=1, productName=Unmarked objects,
count=17, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
Frekventeret187.ten
- SHA256 9aaf2696c2ffd416345eefdf3211bc6bc2928b5aed33719e249bf3c59ddfeb96
- MD5 771da836cb0a4117b47a21a7bb29f452
- SHA1 0d59e9fae9435031d94f590583ba426ef45609ea
- SHA512 ffe3b147d17d3b4bc55ff03692a2b57763727b38638640aab7a2a69e61564d7b3533980caf90b25d3b751e9fc455859fb85037a6459496ea71924761e0150dcf
- SSDEEP 192:5DP0UjurKb1bLUw39oe6PNH9pbOXuzDdIFpzAL4b2KSEJK2:x1urKr92FnOXumFRVCG
- MD5 SHA1 SHA512 SSDEEP
Nonrateably.txt
- SHA256 001242fee5248e8f751a8a99592e6d3c63f408e4d6878fb49161c65f567f76f2
- MD5 93eb21e861285f57954f5559e9152ba2
- SHA1 7b40b86dab0ed52c7bbe04b2b6f957944cce40f5
- SHA512 a2c2c401fb660e30e285df10560a06bfef577cd57f3605adda83c73b86f79d43f480b547259f4305052b82af240fc94fe0e20ec92c1fc38d53e60fecba44b7bf
- MD5 SHA1 SHA512
Oderne.des
- SHA256 b5cac44675b811e8e75d3e9477928cda75483a5d947aa4119c37a203db90d9c5
- MD5 c2d21133f0f12dc9616319c2d2c3b63b
- SHA1 7d00aad07b6b9eb89cf1142f7eab9e8cd1bcd911
- SHA512 24d53de887d72a374279ba06e55015f9c666e416014360743300dc239b5c3f0f4130061546943aa34994ecf1ac59c1a7491e0f8149233da86efb2afca226bef4
- MD5 SHA1 SHA512
Oplysningerne.Adm
- SHA256 deb9225e2fc60f26ab0bb42b6502759d33e5f2e90d4897ca66671fd75a672b82
- MD5 1409f6360fe74d163d0fcc88fa85f822
- SHA1 cfd43dfbb10b26358c9d50a5621cc07593c6ee7f
- SHA512 2994df8d3d6123ea43ba5191a624dcc9501f05bccce6569ab55841c7c04d509b8daab051bf30909fef6f2ed80704a1e15536ee39a9266202a067390f143a993f
- SSDEEP 1536:9HGGOqk9EUTMAaH+ZXRgR2Upp5t8uNm3o18urGjKEQJ42FMTQT:xGGOd2HAdbQvppEuxLS+EQJOT0
- MD5 SHA1 SHA512 SSDEEP
Sofisten/papuliferous.for
- SHA256 9dd02e48ccd4ec1503430dc0b2dbe351c968d1109a446d6684f69fbce4a3ab93
- MD5 ec1eb69845f71cb938ae3c3218af44a4
- SHA1 0c9535dadbce71f6e2377e02160217e5ec5d24db
- SHA512 64cd0bb3554a3acd37368f4162100e4b1569555f15461de28153743d411db3cd1e329c65fdf7e1afb17d974403548eb29ca9374f04ce9cc2df55fadc80b84fc0
- MD5 SHA1 SHA512
Sofisten/torsoclusion.fis
- SHA256 ddf1186da594b36f3112c83ca020c8e7f8054984cc5f4bcf31f2056763434a19
- MD5 402dde4cd1c4b18f4195cc0eb7c34ba4
- SHA1 8264a481e787b6df9f278a1ba6126f939c16eacb
- SHA512 e7050817e88f19746b04706d3901ec3d168ea9bb910647510c482fcd81cd691d2b84ab1b47e6cf74722b9acee217fe524f0a9b594ea80ef54d7d8ef63dd22bed
- SSDEEP 192:Tas+okZUrh6fYQj5piRGQJuiJEF8vmdMlIXwFxzirV:TasprsAQmRzouEF85WAFxzgV
- MD5 SHA1 SHA512 SSDEEP
Sofisten/transferrins.ins
- SHA256 2c4d848248f2f591dbd79906a4fefd08d2566836338d8fcb99f4eabdbf20c776
- MD5 fe1467d5dfbb166c86a7df4044b23785
- SHA1 5e3723448479eee3c9014794d1940781ec931542
- SHA512 44b1f6072c979844b58f36c95588b4c43e44d3ef8074e6e5a66666b28e34941f3020b28a29a42009c30012a5fdba8ed36d2d9e4aad3ed4f3001f82ce9d49514c
- SSDEEP 192:SfWEQVeHRSngUMIXn5XeDGKLrnBsLhcHX5tL2oYcnHA:SfWzeHsmIXnJeDBswpIoXHA
- MD5 SHA1 SHA512 SSDEEP
Televiseringernes106.lyd
- SHA256 866c5b9bb8ff5e0fdbf5329d869b8e2eccd55dfe87a97d687095a01d8f3842e8
- MD5 f087f992a2b1de5660ac29e1e5da317c
- SHA1 7d36e39966a0f3cdfd4b7c2dca30c9194b41ca74
- SHA512 ff88e167e1beb05754a96fef6df1b4efce312b83f34cbe0021d24fd0373cca770030a0b7d39f264e306a0e1678daa14755f6ead0d1bd3d2eb9aa3d8ada9692e2
- SSDEEP 96:8VRla/E4YK3mwMA52J4wJvmyJ053g9gVRcra8WvIYRcH4r/I03CuS3cH2iGt+hBS:8UE4w9FvP0u9lAIYu4r/I9t+z7q
- MD5 SHA1 SHA512 SSDEEP
Theriodonta.pen
- SHA256 434071e1f5b388374b5a5a4afb884a9698a81c9e299f52f41d3fa7ec8f2f6269
- MD5 cc46778be5f857eb40641bfce8d7a0cf
- SHA1 0b53d61a9ae6d7217cf34649968f1981eb931a91
- SHA512 c5635768763d8989d78cd81e3d19826f3a34d704769778f7f8057ff71c0e378200a56293553c78ec7a579d953bc21d15ffe8b6f8a42cac0b173cba7c86bbcc58
- SSDEEP 12288:I72CJIRhgyd1gYDI3tuMgV4G/djU/6pPXb4l:hYIRhgyxppiG/ls6pPr4l
- MD5 SHA1 SHA512 SSDEEP
aandsstyrkens.mad
- SHA256 5bd522ca45a100238fc0d10347c033a0df9c9c17b9b668259392402d1ec0a277
- MD5 075d921b095033fb070f943c8676f573
- SHA1 6d0c1a348ad7979e37c0b7267349cd8d86decb12
- SHA512 c919a65c99e3c00e2a2ac3ba70dbcdda9626feee73df8264a3dbc065cf156a0e4a76638462db2a17789282c49f45e759dab31e5c64a7911b5b0eea7cb766a398
- MD5 SHA1 SHA512
bissau.bor
- SHA256 808ae65a3849654cc1ef4604f53ffc170f51d604b914dcdf4c26017b0cdb3757
- MD5 a3ee448010386479d30cba35be020d1e
- SHA1 d9288465959530fe5cfeea438fcf38c8445aa093
- SHA512 d293855f0720019b2134521aa07d8a517e221d0df444926449aa606ddcea0235f3f524ac9bab2d37ca71eb3e9f21b3b5047adab129d2341aabde517fc068e615
- MD5 SHA1 SHA512
consonantly.las
- SHA256 0c36db415c70581bc2501ec984910c1a7f16df27fc9328c6186e70dc60e3659b
- MD5 bc340f47a6c0668034bef800c5b292d6
- SHA1 f9d830c2a1bf937dfeebcd5f0891511bde3f8927
- SHA512 18794925b6427b1a0586390c7de6dfe82e6c8788f19da1b5f8505235b94338c50a9f592f6424beb93ae357ba82aacac5ed7f66c92a33398763de491f3a88948e
- SSDEEP 192:kRxutV4MkBgq5wuZVHQJTScKALzi88HhuN1ipqlQiYv:kR8JMVnCSpoYBOwYlQiYv
- MD5 SHA1 SHA512 SSDEEP
firhndige.dat
- SHA256 c0db22b6659ac609d7ee9b7c2542a4fde228295017f54fc5e7066bef6696d592
- MD5 861d8ff82e26e3985d2bf0cf8b81cf56
- SHA1 d79e9e77d6a7de85bac36b1af14a75754ba447e6
- SHA512 d9095dde4a79e23a47401b5e237f37a283785b665475bc1fc69fe8aa5a3fea47c2c3decf15853a34b3646ff8c4b16f3339fbd7a184cb7a4495c1dc345d2e9ca8
- SSDEEP 96:H/U9AXaG5Qt0hnxbomc27hcSZnKC58FC0QKyX5taC/WDB8:H/UiKIhxsr27hO9QKyX5ta7m
- MD5 SHA1 SHA512 SSDEEP
johannesburg.fje
- SHA256 d41e240ecbf7a1233191c53eabd30b9f17906237cd307aca602227c2c7026cb4
- MD5 c7ae4f280c6ba55bf0c4395bc3e422a4
- SHA1 784a020be13c30b5c5c151cdf8abaa500bb26e73
- SHA512 fe2273816b939f6ba9a2943bb7a15d2f456c4457825fd2e0fb52da7c2736fda91ef113e3d3bbef2287e8ef09058b35a974b5ce370fd98117b0ff662075bdf94c
- MD5 SHA1 SHA512
mangelunde.enh
- SHA256 47f5bcb38ec4ec0592a8f9553718c1ce67e50bc95efdf8dd101e1c67e2532995
- MD5 41d25e2a5b7c8f4067a17ebc8ac49015
- SHA1 7cdd151b1f6fe774aad91d4a7f469404d2bddda1
- SHA512 a95ae66851965c6b1059540427fdc7f23670c083923b898df4b037605118afca04df40e97be3ac2ae279b8f8ccb7d2ffb20769dfbc4e2d0659dcec3063888fd3
- SSDEEP 96:pqdzwpyaSQoDIuzLw8eijr16o3bQp9r3XLiW/GpDZBBLS7QZjnBro+3FRTxeXfz9:pkI8ewhv3b6r3XLiqGpDpLAojBrv1GP5
- MD5 SHA1 SHA512 SSDEEP
misassayed.dia
- SHA256 abb27c7ac9703bb56661dcad5a2f19953debad7b26b7d280064f6b627c83cfe3
- MD5 5444c00842c401ea82861639721fa154
- SHA1 2125bb1c31130ab04e1eaa53e8aadc1feaaefb7f
- SHA512 619c6578feaa24412f8ba8d13e4d4a0af658d2bb13593d0652847648e46c4525e2475c1c16cf2f1ca9f90e4d0b0e57671cc5e9d7e72de36d6cedde8d07062818
- SSDEEP 96:FJYLNCmblfchCmMjq0g0TaZj3AMFPih0pLorsHG90Q/uhdQj78neNCxxhwxysYy9:FaXc0TLIQ06VHLUZUCpaYyGl2r
- MD5 SHA1 SHA512 SSDEEP