14062024_0135_13062024_Unpaid Invoices.zip
- SHA256 a8e761fb8cb4875ad59c0979f16319b26e84b6a181cc9739f4150f46ecc656b8
Password
infected
Static task
static1
Behavioral task
behavioral1
Sample
tppemand.exe
Resource
win7-20240221-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
tppemand.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral3
Sample
Mercurialising/Anstesiens/Proclivous/endopterygote.com
Resource
win7-20240220-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
Mercurialising/Anstesiens/Proclivous/endopterygote.com
Resource
win10v2004-20240508-en
windows10-2004-x64
0 signatures
150 seconds
General
- Target 14062024_0135_13062024_Unpaid Invoices.zip
- Size 616KB
- Sample240614-bzy6datfmn
- SHA256 a8e761fb8cb4875ad59c0979f16319b26e84b6a181cc9739f4150f46ecc656b8
- MD5 6b64a42a98b115816b8e2a8cfc577137
- SHA1 7931caf1317ae32dde0715dc81bee05ca706ebd5
- SHA512 a34e5d3d6340d9a1abcd75bd7ff97eeb3b05af31a1b1eaf382d7665b2aa2ccfc10f5b16cf0ed3c5926fbd710fb2513f16b2dd4d8fbe91d4d210344c57afff011
- SSDEEP 12288:IamGXpvtfr2soi1dkqOh3cAFnEc/+ILguJUEEYxDWYnrR+OyafT8oq:1mOTTmnhsAnEs+IcuJ1EQWYnrRVl7q
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
File Explorer
-
14062024_0135_13062024_Unpaid Invoices.zip.zip 616KB
-
tppemand.exe.exe 933KB
-
Mercurialising/Anstesiens/Proclivous/endopterygote.com989KB
-
Mercurialising/Anstesiens/Proclivous/madam.aut553KB
-
Mercurialising/Anstesiens/deceptible.ref544KB
-
Mercurialising/Kithes.txt599B
-
Mercurialising/Refocusing.Hou15351KB
-
Titfer.Aux324KB
tppemand.exe
- IMPHASH 7ed0d71376e55d58ab36dc7d3ffda898
- SHA256 89bf76e33e8a2de09b8d9c5d26b7fd334fb8dad68b8fb2fe619c6ee437ce6466
- MD5 abb335140abdaae9a997dacd7defeb74
- SHA1 f2cc2699492144f89bababb25869b6a8fa929f10
- SHA512 47dce2bfcb3e7765b263178a58451486b30ad9b05e80c5035ea57768a3e07c32545a0f8ca19e5c241ce305ed0736677e489236c50dc4b625f7ce5f9309ef02af
- SSDEEP 24576:XwIC9jSMMMMMHLMMMMMMMMMMMMMoPhKVFSi9cu+IC+J1ESaUnrRbzIW:gIC9jSMMMMMHLMMMMMMMMMMMMMMKVFZD
- MD5 SHA1 SHA512 SSDEEP
Password
infected
PE Signature issue
Digest
1f:41:d3:8e:e7:07:0a:aa:08:7c:c2:ac:a2:2d:5e:e4:af:f5:d7:a7:b8:6c:48:09:86:c6:bb:df:01:20:21:f4
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Slagtofrene,OU=Segls Bethanked Vvestue\ ,O=Slagtofrene,L=Sarrazac,ST=Occitanie,C=FR,1.2.840.113549.1.9.1=#0c1850616167726962656c736540536f626572697365642e566f
Chains
Jun 12, 2024
Subject
CN=Slagtofrene,OU=Segls Bethanked Vvestue\ ,O=Slagtofrene,L=Sarrazac,ST=Occitanie,C=FR,1.2.840.113549.1.9.1=#0c1850616167726962656c736540536f626572697365642e566f
Serial Number
14:10:52:d8:22:30:78:16:5e:32:e4:a7:b1:ad:6c:0a:74:65:f5:1e
Issuer
CN=Slagtofrene,OU=Segls Bethanked Vvestue\ ,O=Slagtofrene,L=Sarrazac,ST=Occitanie,C=FR,1.2.840.113549.1.9.1=#0c1850616167726962656c736540536f626572697365642e566f
Timespan
Apr 8, 2024 - Apr 8, 2027
Minor OS version
0
Major OS version
4
Entry point
12799
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
CompareFileTime
SearchPathW
SetFileTime
CloseHandle
GetShortPathNameW
MoveFileW
SetCurrentDirectoryW
GetFileAttributesW
GetLastError
GetFullPathNameW
CreateDirectoryW
Sleep
GetTickCount
GetFileSize
GetModuleFileNameW
GetCurrentProcess
CopyFileW
ExitProcess
SetEnvironmentVariableW
GetWindowsDirectoryW
GetTempPathW
SetFileAttributesW
ExpandEnvironmentStringsW
LoadLibraryW
lstrlenW
lstrcpynW
GetDiskFreeSpaceW
GlobalUnlock
GlobalLock
CreateThread
CreateProcessW
RemoveDirectoryW
lstrcmpiA
CreateFileW
GetTempFileNameW
lstrcpyA
lstrcpyW
lstrcatW
GetSystemDirectoryW
GetVersion
GetProcAddress
LoadLibraryA
GetModuleHandleA
GetModuleHandleW
lstrcmpiW
lstrcmpW
WaitForSingleObject
GlobalFree
GlobalAlloc
LoadLibraryExW
GetExitCodeProcess
FreeLibrary
WritePrivateProfileStringW
SetErrorMode
GetCommandLineW
GetPrivateProfileStringW
FindFirstFileW
FindNextFileW
DeleteFileW
SetFilePointer
ReadFile
FindClose
MulDiv
MultiByteToWideChar
WriteFile
lstrlenA
WideCharToMultiByte
user32
EndDialog
ScreenToClient
GetWindowRect
RegisterClassW
EnableMenuItem
GetSystemMenu
SetClassLongW
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongW
SetCursor
LoadCursorW
CheckDlgButton
GetMessagePos
LoadBitmapW
CallWindowProcW
IsWindowVisible
CloseClipboard
SetClipboardData
wsprintfW
CreateWindowExW
SystemParametersInfoW
AppendMenuW
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextW
GetDlgItemTextW
MessageBoxIndirectW
CharPrevW
CharNextA
wsprintfA
DispatchMessageW
PeekMessageW
ReleaseDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
GetClientRect
FillRect
DrawTextW
GetClassInfoW
DialogBoxParamW
CharNextW
ExitWindowsEx
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
GetDC
SetWindowLongW
LoadImageW
SendMessageTimeoutW
FindWindowExW
EmptyClipboard
OpenClipboard
TrackPopupMenu
EndPaint
ShowWindow
GetDlgItem
IsWindow
SetForegroundWindow
gdi32
SelectObject
SetBkMode
CreateFontIndirectW
SetTextColor
DeleteObject
GetDeviceCaps
CreateBrushIndirect
SetBkColor
shell32
SHGetSpecialFolderLocation
SHGetPathFromIDListW
SHBrowseForFolderW
SHGetFileInfoW
ShellExecuteW
SHFileOperationW
advapi32
RegCloseKey
RegOpenKeyExW
RegDeleteKeyW
RegDeleteValueW
RegEnumValueW
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW
RegEnumKeyW
comctl32
ImageList_Create
ImageList_AddMasked
ImageList_Destroy
ord17
ole32
CoCreateInstance
CoTaskMemFree
OleInitialize
OleUninitialize
version
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
Name
.text
Size
23KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
128KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
212KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
410KB
Virtual Size
410KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=166, id=1, productName=Unmarked objects,
count=17, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
Mercurialising/Anstesiens/Proclivous/endopterygote.com
- SHA256 16e2287e1688be25e89a48506770f88f2da940fb66ab11322bab9c4de9a2935e
- MD5 22917c17a0cf55abe740867314bcba85
- SHA1 b8b667018188617cd410a738885fd5c5968f1bcb
- SHA512 a46afc64e775bbc890976d966891f2cedeea72c4c88edcb57b32261c2659c4c976b6803e9453b6604bae03c2b55817515aa7eedacd3be45588b19690154ec2c1
- SSDEEP 768:Bwk+6hVRRAbffQq9245i0H1h/osZZr+hXUH2JiO/KjFzi5twcHqkw2LshgEAHeVO:cx7XX5O7SlLh0y+
- MD5 SHA1 SHA512 SSDEEP
Mercurialising/Anstesiens/Proclivous/madam.aut
- SHA256 18bb88607a2e6b3b20d4e7000638529e36d0a44c1211a827b3ca02a01df74def
- MD5 4af4d639c2b229e00c2916ebc2f6a7ad
- SHA1 83a2f1083320b8c42c63d2b741a9a210bf32483a
- SHA512 dcf98350fa447688d3b16879cfc67b81f28acc79f535b48df4a3f461f4fa139f7b607082573ba7c42e92cb1654be4d13af4afb4923657ad1044d01e41f144aef
- SSDEEP 768:ufvnogdfgeNIEqZeQ2geFYGRIis/2jcDhhomo4RjG5Oa0JmhDyh1O981s1FSJyBl:azIi+tAtjx+hy7
- MD5 SHA1 SHA512 SSDEEP
Mercurialising/Anstesiens/deceptible.ref
- SHA256 347e5737b8e8e768d1665efb53fbbd5d78fc22bca0867e3f00ad4b2040b09943
- MD5 e919c7786667f519d752d4a3f4e0acfa
- SHA1 67cd729a0ebf49e4659ec78a6beca11e728a2bf9
- SHA512 ccda27896e8e31f08cbea17bf33760649c6b8f944eff42ddaa79c1599395a349bef5b6d4d649f688572bc01ff83f5ce383fdf4a5404cd12c2b733e986365e6b6
- SSDEEP 768:LoTzMtN5/ZMu0HnJn5zeioh4Sl3AjOGGQK44U3lXKC6PeRvtvKS8mBD8Qdz9Z2J/:sDS4Ax5
- MD5 SHA1 SHA512 SSDEEP
Mercurialising/Kithes.txt
- SHA256 ff7a4a6d826c7d506567b8c149e535d982f88a0d01c52dd70484afc50d1fd737
- MD5 383353c99b95e319ba47f1c3a8b05e8f
- SHA1 0ab4d3682bf4b80c14e9e27ad17d764798680797
- SHA512 6cc79e1a7c203fc13445c9e5a3687409e0c937006c364250ce604d10a0c62fe6450fd06377b82b146037b6326b5342551f076c82fd5ef6de63afa5ca86cf0151
- MD5 SHA1 SHA512
Mercurialising/Refocusing.Hou153
- SHA256 614d62ba287c27fb027d8b74c0a04f55fe1fb7c3fb212b32d5991dcb9ae4fc97
- MD5 da1b160ed52ffc26a8717a3cf2fbfd3a
- SHA1 283ac1fbd10ddaeede85c0d92459b5d4b29f55d6
- SHA512 e7fc094fe79488747a8aac8516e8a911f861093067797bb3b6ece50ad802023d680fc082b6493fb28fc4cd164fa7fcc5b4688ee7365e2a7d67c568555a874898
- SSDEEP 1536:iyqzZ2hnZrYHZgXrDlq34mh1dgfFLC3P/Ui6:ozoHvOxq43P/2
- MD5 SHA1 SHA512 SSDEEP
Titfer.Aux
- SHA256 8491ab4de35f4e82c3d1d17447a81600d5bee8265ce23172de1a30d604faff2e
- MD5 5be1b417047219eb069e762bcad1c847
- SHA1 5e02f1dd853a2d6ba0fd7f3a698ef83c62d6808c
- SHA512 2f629e32178f5cdb8524021a48e94c713f0affad25d53dbc6db456b87050500999dc01daf34423db046bcac16fd1f88db05981d41accd0951be64e8db6d2bac6
- SSDEEP 6144:PVKBuAOcp+AZYvAkSzdYHI/EVN627nj8vMkepI5X4icEdhmxA:tKBccpnJcI/Ej68kepyX5cEdD
- MD5 SHA1 SHA512 SSDEEP