1644ba09d5611298e997ef161c3d9c68b3b01271c37da89333e09c18cd071a0a.img
- SHA256 1644ba09d5611298e997ef161c3d9c68b3b01271c37da89333e09c18cd071a0a
-
NSIS installer
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Order 0002939399440.exe
Resource
win7-20240508-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
Order 0002939399440.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240220-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target 1644ba09d5611298e997ef161c3d9c68b3b01271c37da89333e09c18cd071a0a.img
- Size 1.2MB
- Sample240612-bhdhcaxcpm
- SHA256 1644ba09d5611298e997ef161c3d9c68b3b01271c37da89333e09c18cd071a0a
- MD5 41281de2261db2b236e0c61c18add431
- SHA1 a3991bb82680c06802a3812f7a6331dc445a5eaa
- SHA512 5d63587ed47f4c1e1c70630d459a8ff87b91b8bd6b1fe1b32e6b2719da2bf109a235a6cba7641a66525d54179e71ad5faebcf418c7b3882dbb805ff529ba3129
- SSDEEP 12288:/8oTmXIyx0DtKbV9Xaftvk6IAEy9UhK+8TAQ5+rROX:koTW0RPC6kyK104I
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack002/Order 0002939399440.bat unpack003/$PLUGINSDIR/System.dll - NSIS installer 3 IoCs
resource yara_rule sample nsis_installer_2 static1/unpack002/Order 0002939399440.bat nsis_installer_1 static1/unpack002/Order 0002939399440.bat nsis_installer_2
File Explorer
-
1644ba09d5611298e997ef161c3d9c68b3b01271c37da89333e09c18cd071a0a.img.iso 1.2MB
-
out.iso.iso 1.2MB
-
Order 0002939399440.bat.exe 631KB
-
$PLUGINSDIR/System.dll.dll 11KB
-
Gunvors.Kle164KB
-
Ligydidae.mam955KB
-
Mahdiship/laantagningen.sav1.0MB
-
Marxs.ano621KB
-
Smoos/exothecium.txt524B
out.iso
- SHA256 1644ba09d5611298e997ef161c3d9c68b3b01271c37da89333e09c18cd071a0a
- MD5 41281de2261db2b236e0c61c18add431
- SHA1 a3991bb82680c06802a3812f7a6331dc445a5eaa
- SHA512 5d63587ed47f4c1e1c70630d459a8ff87b91b8bd6b1fe1b32e6b2719da2bf109a235a6cba7641a66525d54179e71ad5faebcf418c7b3882dbb805ff529ba3129
- SSDEEP 12288:/8oTmXIyx0DtKbV9Xaftvk6IAEy9UhK+8TAQ5+rROX:koTW0RPC6kyK104I
- MD5 SHA1 SHA512 SSDEEP
-
NSIS installer
Order 0002939399440.bat
- IMPHASH 3abe302b6d9a1256e6a915429af4ffd2
- SHA256 96cf5dfbfad599910d48cf01f8cdc77ac3ab5f9e39e3f044bad94a28126c2f20
- MD5 3241e9dc842b78c707935a1c82bbe906
- SHA1 925707f0c8b49c65873e6677b1075b97df866719
- SHA512 93e6084100e2b8302249926c5737054dd0c3675ec481a4099f9c8cdb76fa630aa192c8f4548b147d211fc0261d70e90b2e2f66b41f85d8183ac87eb3479e1a6c
- SSDEEP 12288:f8oTmXIyx0DtKbV9Xaftvk6IAEy9UhK+8TAQ5+rROXP:EoTW0RPC6kyK104If
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
-
NSIS installer
Minor OS version
0
Major OS version
4
Entry point
12812
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetTempPathA
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
SetEnvironmentVariableA
Sleep
GetTickCount
GetCommandLineA
lstrlenA
GetVersion
SetErrorMode
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GetWindowsDirectoryA
SetCurrentDirectoryA
GetLastError
CreateDirectoryA
CreateProcessA
RemoveDirectoryA
CreateFileA
GetTempFileNameA
ReadFile
WriteFile
lstrcpyA
MoveFileExA
lstrcatA
GetSystemDirectoryA
GetProcAddress
GetExitCodeProcess
WaitForSingleObject
CompareFileTime
SetFileAttributesA
GetFileAttributesA
GetShortPathNameA
MoveFileA
GetFullPathNameA
SetFileTime
SearchPathA
CloseHandle
lstrcmpiA
CreateThread
GlobalLock
lstrcmpA
FindFirstFileA
FindNextFileA
DeleteFileA
SetFilePointer
GetPrivateProfileStringA
FindClose
MultiByteToWideChar
FreeLibrary
MulDiv
WritePrivateProfileStringA
LoadLibraryExA
GetModuleHandleA
GlobalAlloc
GlobalFree
ExpandEnvironmentStringsA
user32
ScreenToClient
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
PostQuitMessage
GetWindowRect
EnableMenuItem
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
ReleaseDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndDialog
RegisterClassA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
ExitWindowsEx
GetDC
CreateDialogParamA
SetTimer
GetDlgItem
SetWindowLongA
SetForegroundWindow
LoadImageA
IsWindow
SendMessageTimeoutA
FindWindowExA
OpenClipboard
TrackPopupMenu
AppendMenuA
EndPaint
DestroyWindow
wsprintfA
ShowWindow
SetWindowTextA
gdi32
SelectObject
SetBkMode
CreateFontIndirectA
SetTextColor
DeleteObject
GetDeviceCaps
CreateBrushIndirect
SetBkColor
shell32
SHGetSpecialFolderLocation
ShellExecuteExA
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
SHFileOperationA
advapi32
AdjustTokenPrivileges
RegCreateKeyExA
RegOpenKeyExA
SetFileSecurityA
OpenProcessToken
LookupPrivilegeValueA
RegEnumValueA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegSetValueExA
RegQueryValueExA
RegEnumKeyA
comctl32
ImageList_Create
ImageList_AddMasked
ImageList_Destroy
ord17
ole32
OleUninitialize
OleInitialize
CoTaskMemFree
CoCreateInstance
Name
.text
Size
25KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
149KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
100KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
185KB
Virtual Size
184KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=159, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
$PLUGINSDIR/System.dll
- IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
- SHA256 a0cac4cf4852895619bc7743ebeb89f9e4927ccdb9e66b1bcd92a4136d0f9c77
- MD5 b0c77267f13b2f87c084fd86ef51ccfc
- SHA1 f7543f9e9b4f04386dfbf33c38cbed1bf205afb3
- SHA512 f2b57a2eea00f52a3c7080f4b5f2bb85a7a9b9f16d12da8f8ff673824556c62a0f742b72be0fd82a2612a4b6dbd7e0fdc27065212da703c2f7e28d199696f66e
- SSDEEP 192:4PtkiQJr7jHYT87RfwXQ6YSYtOuVDi7IsFW14Ll8CO:H78TQIgGCDp14LGC
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
-
NSIS installer
Minor OS version
0
Major OS version
4
Entry point
10469
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
MultiByteToWideChar
GlobalFree
GlobalSize
lstrcpynA
lstrcpyA
GetProcAddress
VirtualFree
FreeLibrary
lstrlenA
LoadLibraryA
GetModuleHandleA
GlobalAlloc
WideCharToMultiByte
VirtualAlloc
VirtualProtect
GetLastError
user32
wsprintfA
ole32
StringFromGUID2
CLSIDFromString
Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc
Name
.text
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
867B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
104B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1024B
Virtual Size
636B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=14, version=7299,
count=19, id=1, productName=Unmarked objects,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=4, id=48, version=9044,
count=1, id=42, version=8803,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
Gunvors.Kle
- SHA256 82ea42ad6898e041940173d172e0d383e4516b6f6574ede4a331d35cf20a62b7
- MD5 9727692b0b13bd82cf4cb7af37fedcf9
- SHA1 36a74d2abeeea323da0530d9210f1ed8332721f0
- SHA512 caa619ce326046cfba1c4d6e56170f6fb6b48ff37ce0ee6b386aba52fab3d896daa8365874186ec03b088bd8c9997d0902437762d4d74c315bc1e100e44ed765
- SSDEEP 3072:dLGg8ZtTHYLfbbJOn1JiGvz1r7Y0bbBO76ACtg79kmt8rI5Lmht1MRvrv4x+1:AgYEfbUn1Jl1Hrb866SiYzMRvrv31
- MD5 SHA1 SHA512 SSDEEP
-
NSIS installer
Ligydidae.mam
- SHA256 59472058deeb4c40447d44502936e0362f84c130249ad97e359adb960d9e0dd7
- MD5 d3f6868c0818103e2ecf2a34be561aeb
- SHA1 603300772c2e961c6b8924dc737bc1d6e3aad159
- SHA512 e388c4886f34a2d962ff153f14c6d2abb2cabceb6e48ddcaadb0586bd890933d70bd84c70f2634f7a7f9a038e6244b76e0343d849baabe380ecdfbb6b1ced6d6
- SSDEEP 768:zBX1IOuKrOPRy82KI9huCuYCrQFsOxix64y8nTnHxsqqJWtFfhu2r6FqRYHsMvMn:dYjy8nWNmIv18yF2
- MD5 SHA1 SHA512 SSDEEP
-
NSIS installer
Mahdiship/laantagningen.sav
- SHA256 5081bd8604e276fda7597c7535e34c5b8f3a136a1b3d4de4289b0ea20989784a
- MD5 a9fff331f6abb942fc5c35e1c29e4be9
- SHA1 a2df0ce91e27d4d8f483db82c0d7749e2fab819a
- SHA512 deb8f9dbc391ca31ccfd7d4ba52bb9aa69a0ad7c2f2132217af0ce6697616c6e76cf29b98686c416d90a90b817afcf8c34d6cb5b1a550e94b4195da86c71e782
- SSDEEP 768:277XUFU0mP7ZunWraygWVwW7xZPwhrzIFAD/C3mzYhNoGc4MNTopVke62XIlZk8Y:cAd/t+0oBIaW5cSc
- MD5 SHA1 SHA512 SSDEEP
-
NSIS installer
Marxs.ano
- SHA256 ce0784c072efc078117a326dda548f2031aa2481b16af9c85e8c555e95dbe085
- MD5 b30e2818d30caf2de7668fbb9586382f
- SHA1 d2398dbeb49bd4bd41e82e9779f13fcf136594ef
- SHA512 674ac7f99bce1cc0da759cdefd515090f9a329199194de755ee4cf4f104db60082aafaadb0810d1c2b0d38343e37eeda091fcc446a613347b93423b90fde6fed
- SSDEEP 768:lUFYHDGM+Ozg2yd8FfwMs++juZsLvKi5rQiYz0TPnDEFd1mg9HZaZUPmqmmLIsz1:lzdfEj
- MD5 SHA1 SHA512 SSDEEP
-
NSIS installer
Smoos/exothecium.txt
- SHA256 f04a389563c38da5da4ea895509f8755f78893ede1e4de8511fca96d5d0eedbd
- MD5 f1caf21e82b7fb835823862a5f1eb5de
- SHA1 8b7a89de09160a24bfbe09da1643d20519f39394
- SHA512 aae771bfa9a488141a46935fb424151cb14d884013b7da8e28cec9ec6a30099e687bb7cf2bb1ef6e50b1fa06128763516e97bc5939ec0a9d81ef447e435046f1
- MD5 SHA1 SHA512
-
NSIS installer