4cd15dc8b62b8638a429d4c7722ad1f6.bin
- SHA256 abc657553f6ea795d56f3ea6d1466790855e9a9f0d1f678fa305efc581b59ce3
Password
infected
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
4a83e984de761ee13699b30d48ea2ba2499371efa437698cf3b81d495e266008.exe
Resource
win7-20231129-en
windows7-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
4a83e984de761ee13699b30d48ea2ba2499371efa437698cf3b81d495e266008.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
14 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target 4cd15dc8b62b8638a429d4c7722ad1f6.bin
- Size 622KB
- Sample240611-cmhtas1clm
- SHA256 abc657553f6ea795d56f3ea6d1466790855e9a9f0d1f678fa305efc581b59ce3
- MD5 51ca7862ab065c0912caf1705db25c84
- SHA1 7776552bdd61f27cc0166e45c7c6d8cd6053494f
- SHA512 a95653f9806424f813c6cb159dacb1c47d199781cc2deaa7ce66a28655e3697db989a9b7045f68f7d3e15af258e806cb75a0ca522e47c99a0fb1ea6b41eb1f67
- SSDEEP 12288:6xfBnfU56VwW/BVAyhlnUTpH8mAuTp+nJbfK3af/LkuGhuA:6jfUsVwWLDicmA5JG3afjkuiuA
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/$PLUGINSDIR/System.dll - NSIS installer 2 IoCs
resource yara_rule static1/unpack001/4a83e984de761ee13699b30d48ea2ba2499371efa437698cf3b81d495e266008.exe nsis_installer_1 static1/unpack001/4a83e984de761ee13699b30d48ea2ba2499371efa437698cf3b81d495e266008.exe nsis_installer_2
File Explorer
-
4cd15dc8b62b8638a429d4c7722ad1f6.bin.zip 622KB
-
4a83e984de761ee13699b30d48ea2ba2499371efa437698cf3b81d495e266008.exe.exe 793KB
-
$PLUGINSDIR/System.dll.dll 11KB
-
Opslagsformlers.Bai383KB
-
Unalphabetical.nuc64KB
-
carcoon.txt485B
-
ceroline.cha314KB
-
obducerendes.myt114KB
-
predeserving.bed110KB
-
strany.for311KB
4a83e984de761ee13699b30d48ea2ba2499371efa437698cf3b81d495e266008.exe
- IMPHASH ea4e67a31ace1a72683a99b80cf37830
- SHA256 4a83e984de761ee13699b30d48ea2ba2499371efa437698cf3b81d495e266008
- MD5 4cd15dc8b62b8638a429d4c7722ad1f6
- SHA1 b8df8bcc13adbaf14c17d6ea3459c6afed991e8e
- SHA512 da8a5cbe477185908434b5e099abe972cfe3d369d3156a2a309d28b57e4e84d23a040332b69319198b567769274f5fa2f83f2237be54cb71f3b1fda776ace27f
- SSDEEP 12288:OKdQYPhiCUSyZsnY40EfLBe69uUZrSP9bKcaPv0po9jwoUCAgBm:OJYHUS9F0ETB5IEuocanTdwoJAZ
- MD5 SHA1 SHA512 SSDEEP
-
NSIS installer
Password
infected
PE Signature issue
Digest
9b:05:7e:a0:cf:65:99:f0:af:39:98:f6:6a:38:5e:69:71:28:ae:00:a8:0e:c6:24:b8:98:23:cd:69:9c:42:73
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=bortslbtes,OU=Privatkonomi Yodels\ ,O=bortslbtes,L=Hescamps,ST=Hauts-de-France,C=FR,1.2.840.113549.1.9.1=#0c1a426f726b7376656a40536b72707065626c61646574732e547269
Chains
May 16, 2024
PE Signature issue
Digest
04:18:12:7f:4a:52:0f:c3:d9:43:c4:47:43:77:43:e8:12:73:5d:1c
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=bortslbtes,OU=Privatkonomi Yodels\ ,O=bortslbtes,L=Hescamps,ST=Hauts-de-France,C=FR,1.2.840.113549.1.9.1=#0c1a426f726b7376656a40536b72707065626c61646574732e547269
Chains
Jun 10, 2024
Subject
CN=bortslbtes,OU=Privatkonomi Yodels\ ,O=bortslbtes,L=Hescamps,ST=Hauts-de-France,C=FR,1.2.840.113549.1.9.1=#0c1a426f726b7376656a40536b72707065626c61646574732e547269
Serial Number
49:ad:6a:52:4d:a5:14:0e:2e:72:f9:e2:07:de:ed:2e:d9:f3:a0:47
Issuer
CN=bortslbtes,OU=Privatkonomi Yodels\ ,O=bortslbtes,L=Hescamps,ST=Hauts-de-France,C=FR,1.2.840.113549.1.9.1=#0c1a426f726b7376656a40536b72707065626c61646574732e547269
Timespan
Nov 1, 2023 - Oct 31, 2026
Subject
CN=bortslbtes,OU=Privatkonomi Yodels\ ,O=bortslbtes,L=Hescamps,ST=Hauts-de-France,C=FR,1.2.840.113549.1.9.1=#0c1a426f726b7376656a40536b72707065626c61646574732e547269
Serial Number
49:ad:6a:52:4d:a5:14:0e:2e:72:f9:e2:07:de:ed:2e:d9:f3:a0:47
Issuer
CN=bortslbtes,OU=Privatkonomi Yodels\ ,O=bortslbtes,L=Hescamps,ST=Hauts-de-France,C=FR,1.2.840.113549.1.9.1=#0c1a426f726b7376656a40536b72707065626c61646574732e547269
Timespan
Nov 1, 2023 - Oct 31, 2026
Subject
CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Issuer
CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 12, 2016 - Jan 11, 2031
Subject
CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Issuer
CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 23, 2017 - Mar 22, 2029
Minor OS version
0
Major OS version
4
Entry point
13409
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
advapi32
RegCreateKeyExA
RegEnumKeyA
RegQueryValueExA
RegSetValueExA
RegCloseKey
RegDeleteValueA
RegDeleteKeyA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
SetFileSecurityA
RegOpenKeyExA
RegEnumValueA
shell32
SHGetFileInfoA
SHFileOperationA
SHGetPathFromIDListA
ShellExecuteExA
SHGetSpecialFolderLocation
SHBrowseForFolderA
ole32
IIDFromString
OleInitialize
OleUninitialize
CoCreateInstance
CoTaskMemFree
comctl32
ord17
ImageList_Create
ImageList_Destroy
ImageList_AddMasked
user32
SetClipboardData
CharPrevA
CallWindowProcA
PeekMessageA
DispatchMessageA
MessageBoxIndirectA
GetDlgItemTextA
SetDlgItemTextA
GetSystemMetrics
CreatePopupMenu
AppendMenuA
TrackPopupMenu
FillRect
EmptyClipboard
LoadCursorA
GetMessagePos
CheckDlgButton
GetSysColor
SetCursor
GetWindowLongA
SetClassLongA
SetWindowPos
IsWindowEnabled
GetWindowRect
GetSystemMenu
EnableMenuItem
RegisterClassA
ScreenToClient
EndDialog
GetClassInfoA
SystemParametersInfoA
CreateWindowExA
ExitWindowsEx
DialogBoxParamA
CharNextA
SetTimer
DestroyWindow
CreateDialogParamA
SetForegroundWindow
SetWindowTextA
PostQuitMessage
SendMessageTimeoutA
ShowWindow
wsprintfA
GetDlgItem
FindWindowExA
IsWindow
GetDC
SetWindowLongA
LoadImageA
InvalidateRect
ReleaseDC
EnableWindow
BeginPaint
SendMessageA
DefWindowProcA
DrawTextA
GetClientRect
EndPaint
IsWindowVisible
CloseClipboard
OpenClipboard
gdi32
SetBkMode
SetBkColor
GetDeviceCaps
CreateFontIndirectA
CreateBrushIndirect
DeleteObject
SetTextColor
SelectObject
kernel32
GetExitCodeProcess
WaitForSingleObject
GetProcAddress
GetSystemDirectoryA
WideCharToMultiByte
MoveFileExA
GetTempFileNameA
RemoveDirectoryA
WriteFile
CreateDirectoryA
GetLastError
CreateProcessA
GlobalLock
GlobalUnlock
CreateThread
lstrcpynA
SetErrorMode
GetDiskFreeSpaceA
lstrlenA
GetCommandLineA
GetVersion
GetWindowsDirectoryA
SetEnvironmentVariableA
GetTempPathA
CopyFileA
GetCurrentProcess
ExitProcess
GetModuleFileNameA
GetFileSize
ReadFile
GetTickCount
Sleep
CreateFileA
GetFileAttributesA
SetCurrentDirectoryA
SetFileAttributesA
GetFullPathNameA
GetShortPathNameA
MoveFileA
CompareFileTime
SetFileTime
SearchPathA
lstrcmpiA
lstrcmpA
CloseHandle
GlobalFree
GlobalAlloc
ExpandEnvironmentStringsA
LoadLibraryExA
FreeLibrary
lstrcpyA
lstrcatA
FindClose
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
SetFilePointer
GetModuleHandleA
FindNextFileA
FindFirstFileA
DeleteFileA
MulDiv
Name
.text
Size
25KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
106KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
92KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
402KB
Virtual Size
401KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=160, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
$PLUGINSDIR/System.dll
- IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
- SHA256 269d232712c86983336badb40b9e55e80052d8389ed095ebf9214964d43b6bb1
- MD5 34442e1e0c2870341df55e1b7b3cccdc
- SHA1 99b2fa21aead4b6ccd8ff2f6d3d3453a51d9c70c
- SHA512 4a8c57fb12997438b488b862f3fc9dc0f236e07bb47b2bce6053dcb03ac7ad171842f02ac749f02dda4719c681d186330524cd2953d33cb50854844e74b33d51
- SSDEEP 192:jPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4I:u7VpNo8gmOyRsVc4
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
4
Entry point
10529
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
MultiByteToWideChar
GlobalFree
GlobalSize
lstrcpynA
lstrcpyA
GetProcAddress
VirtualFree
FreeLibrary
lstrlenA
LoadLibraryA
GetModuleHandleA
GlobalAlloc
WideCharToMultiByte
VirtualAlloc
VirtualProtect
GetLastError
user32
wsprintfA
ole32
StringFromGUID2
CLSIDFromString
Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc
Name
.text
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
867B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
104B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1024B
Virtual Size
636B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=14, version=7299,
count=19, id=1, productName=Unmarked objects,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=4, id=48, version=9044,
count=1, id=42, version=8803,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
Opslagsformlers.Bai
- SHA256 a548c1cd4f26e9bbf32981f53dfc245e31b5b2b20ef42e23849c32756e321d82
- MD5 3be0056c1ac97197390577d26b2aa96b
- SHA1 c701129eb55241875132e5631ac997c71e104b9a
- SHA512 e54ddbba841ae44c45760b9274203f5a754e3287f16e2a28ea1126b5e5efa1fcea69f409c99e2c0c152135bb4dd8bffc0c9626628a857cc1802c50410b4e8d96
- SSDEEP 6144:wpTue6l5hG0o8nuIS6gUFlB/jQmMEjvDBjl7LBBMq7ZVuFV9R:KieO5WeuIS6Z5bQmDLDLBdAFV9R
- MD5 SHA1 SHA512 SSDEEP
Unalphabetical.nuc
- SHA256 95a06839df03661c732e7517b624c5091ff5ece1a10f20171e776e1bfb07a100
- MD5 1b2b32f1b9664f6618a7086851bb5dcb
- SHA1 48a0f959c4cad08f3ea25f23d3cebd853277b7e7
- SHA512 43f6d34205d7e32bda9086c274e64ba4463f98d21635661d70016e8f78f25a2837370fe1cce2dfdef662bf8c6d8cfb574c2cc8a1f62d5a75198721ec635e288c
- SSDEEP 24:GiG5VCiil9xzkWFAgoIPlSOAakga+4dCaLnvCCaZCoXIgytMMzm:A5Ti5gW4clSOGgaJMvnpXIgzMz
- MD5 SHA1 SHA512 SSDEEP
carcoon.txt
- SHA256 63038d32fb5157052435ec5ae2d7a28606e8f801c86f2dec187ce2b9e1be59b4
- MD5 9d56caa657c499242cee0d4ca31ba2a0
- SHA1 99392b3fe07311d468fe038f31dcb020417891d7
- SHA512 36c1b3f8a63b5f1b45f6304cd6f5a3492539d7501feb1d02c55e7569deb5f608a612dcdd7985977e22318b8cb4f8f060443741099c28d8ca42d03da24dea9357
- MD5 SHA1 SHA512
ceroline.cha
- SHA256 972585795998ed370226cd33e37eb4555433d0cb4951391b31734745ae09b4f9
- MD5 b00c3ade5a3fee1ee05e9db640968e32
- SHA1 27cec838b372c5928368a75f0c01537e195c389a
- SHA512 83ca34db3cc535b0931dce440abad14c62bd68cd54f640f141caee1e50300da88384d5f02b482ff69f9691f4ce3e11932bb7d324a09a3ed66260f541cbbb8605
- SSDEEP 384:11ugUjZibER15ke6IxuP/cVb9i1iHdB53C:1RU7RfoMbzdB
- MD5 SHA1 SHA512 SSDEEP
obducerendes.myt
- SHA256 b9333ade5f3cf5592638b06b7f1071bac50111f961a12cefb1e1b696a9200e0c
- MD5 1b5551fe88dddde0d83953971068683a
- SHA1 4f2f426c09607d0e678c9bfa9ae044382ff29ced
- SHA512 c1d80003ccff409b221d84f26ed81f8ba7152c8230db79a6c87de2a1ad35cbadff020fdc0e694134be689dc1406b2db1ea654a07a283513c9e6b90dda14871fe
- SSDEEP 48:10aTGDGYsLAdqInPf7Cur/X9331L8UWWEUI+on3MFN:/GN3OSN331L/WWEr+uG
- MD5 SHA1 SHA512 SSDEEP
predeserving.bed
- SHA256 3301548551758f829bad9a57f63f46e1e81909a6e7668ca5148983e3196130b2
- MD5 18c77508bd1e3e6325956f6bb0b75911
- SHA1 d78a51d5b4b2821d3a9d7c8662235b1972e546ff
- SHA512 5da9291ef4953318f5ac3e0b359e88ff612a8a00d2bf3e569cb38288e7f0682011293e92a06f90d98a95cbb7606e48b4dd4d8613f3753fe88877bd426e1f51ea
- SSDEEP 48:u8qJbVPRpWe4fETsm01MICZ8GxaN5O/BrQYq:f+rpWTETJICZ8GxaN5gBrQr
- MD5 SHA1 SHA512 SSDEEP
strany.for
- SHA256 aace0f67e37ef79fd7a66bd0ac0dd0289e5221463d4abb82651f07365cea202b
- MD5 f73c6d062c028740aa41e7f22b0fe7e5
- SHA1 52a6780e9e999fa82c9a5242a4f8b306b31eb85b
- SHA512 62ecf91b0a65f51ccceb60b90dff68ded1eda816a3a4846ac3fce8b38c092dfdd95cd29508434c16a6dd2459dcbbee8693a4ae8ab957058ae866db1057867f5b
- SSDEEP 384:IXGuBicePZhDHFUE3pCjxVnmBTXGxNwqoHb8:ISzOH7Nw
- MD5 SHA1 SHA512 SSDEEP