19062024_1619_19062024_Package status.zip
- SHA256 7972ebd87bcda12969db2307835bcddbbd53ca5a287331906000d6f5bb7beebd
Password
infected
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Package status.exe
Resource
win7-20240611-en
windows7-x64
19 signatures
150 seconds
Behavioral task
behavioral2
Sample
Package status.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target 19062024_1619_19062024_Package status.zip
- Size 575KB
- Sample240619-tsxcbatbnf
- SHA256 7972ebd87bcda12969db2307835bcddbbd53ca5a287331906000d6f5bb7beebd
- MD5 35f321a6d92cfe2b48c968810016d252
- SHA1 81fc2a72d67af49a212561e91daa1d07cd2a3e09
- SHA512 728ccf3ec09f0a739f60c0b81eccad89728bf93cca4fda1905ae39ac490148e41141bfd830f98184dacaac8b52acd7092cc373c516c3cafc489e13023a6d8e88
- SSDEEP 12288:+6g0eth6/ig3fwGaWCOs7BKvLc2Leko5m3nnplhbOQ2X4br5lDf8IGvyT:+6Ith6/ig3VaWpvLxOm3nnplvqmD1Gvm
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Package status.exe - NSIS installer 2 IoCs
resource yara_rule static1/unpack001/Package status.exe nsis_installer_1 static1/unpack001/Package status.exe nsis_installer_2
File Explorer
-
19062024_1619_19062024_Package status.zip.zip 575KB
-
Package status.exe.exe 810KB
-
Glossectomy/Lenticulas.nyb1.4MB
-
Glossectomy/Livsforsikringssummers.acc365KB
-
Glossectomy/Ophavsrettigheds.txt314B
-
Glossectomy/Serrifera.sto791KB
-
Glossectomy/undre.pro376KB
-
Hjelmkldtes/Antesunrise.Ski69KB
-
Hjelmkldtes/Berloque34.urb1.1MB
-
Hjelmkldtes/Cerebrogalactose140.Mae314KB
Package status.exe
- IMPHASH 59a4a44a250c4cf4f2d9de2b3fe5d95f
- SHA256 1c4bde8818c2caac1ea5d08697561d52e4f977a31f648ef55fe54f13efe572e1
- MD5 f7f038db9cf8b30eedadbd0e1bd06475
- SHA1 183a7e4912252c912340580478a756449d420c18
- SHA512 43ce6cce5d06b7317b524689610b9154ffb2d7b16a55328321b19eb4baba9fb793f46e6d4e2ca582cfa5c5b7d7627e59cbd1860169efa31f4eadae3155322d1e
- SSDEEP 12288:NX8AAopS5s7Prs1K9qjmF7UC5xkd56/iS3xwWaoSOs9BOvLcajeUoZe3xn7dhLO3:18N56/iS3Dao55LTue3xn7d3sCDPa7l
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
-
NSIS installer
Password
infected
Minor OS version
0
Major OS version
4
Entry point
12823
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetTickCount
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
SearchPathA
GetShortPathNameA
CreateFileA
GetFileSize
GetModuleFileNameA
ReadFile
GetCurrentProcess
CopyFileA
ExitProcess
SetEnvironmentVariableA
Sleep
CloseHandle
GetCommandLineA
SetErrorMode
LoadLibraryA
lstrlenA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
GetTempFileNameA
lstrcpyA
lstrcatA
GetSystemDirectoryA
GetVersion
GetProcAddress
GlobalAlloc
CompareFileTime
SetFileTime
ExpandEnvironmentStringsA
lstrcmpiA
lstrcmpA
WaitForSingleObject
GlobalFree
GetExitCodeProcess
GetModuleHandleA
GetTempPathA
GetWindowsDirectoryA
LoadLibraryExA
FindFirstFileA
FindNextFileA
DeleteFileA
SetFilePointer
WriteFile
FindClose
WritePrivateProfileStringA
MultiByteToWideChar
MulDiv
GetPrivateProfileStringA
FreeLibrary
user32
CreateWindowExA
EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
GetDC
SystemParametersInfoA
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
ReleaseDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
GetClassInfoA
DialogBoxParamA
CharNextA
ExitWindowsEx
DestroyWindow
CreateDialogParamA
SetTimer
GetDlgItem
wsprintfA
SetForegroundWindow
ShowWindow
IsWindow
LoadImageA
SetWindowLongA
SetClipboardData
EmptyClipboard
OpenClipboard
EndPaint
PostQuitMessage
FindWindowExA
SendMessageTimeoutA
SetWindowTextA
gdi32
SelectObject
SetBkMode
CreateFontIndirectA
SetTextColor
DeleteObject
GetDeviceCaps
CreateBrushIndirect
SetBkColor
shell32
SHGetSpecialFolderLocation
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
advapi32
RegCloseKey
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegEnumValueA
RegCreateKeyExA
RegSetValueExA
RegQueryValueExA
RegEnumKeyA
comctl32
ImageList_Create
ImageList_AddMasked
ImageList_Destroy
ord17
ole32
CoCreateInstance
CoTaskMemFree
OleInitialize
OleUninitialize
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
Name
.text
Size
23KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
105KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
132KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
267KB
Virtual Size
266KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=158, id=1, productName=Unmarked objects,
count=17, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
Glossectomy/Lenticulas.nyb
- SHA256 40f8a46ba0855733c91414d9b63c2220eac101e7ef5fb326d945436c124a6baf
- MD5 0ac62f6bd674d132bfcaeaaa7a120bcf
- SHA1 230cf7ecb3b0eb5b3dc921bf8d2b7057c792b5bb
- SHA512 a5f861abb1ff0868a3d8cc172b024a21efff55c16ea8bf001cfa11430ea4acc3c7284edd9cbce6584c1669df2052ab907352440bdfa6e7e984925b3839221991
- SSDEEP 768:nUqCrfkts3075fPZnmBQDWHo4ZqRMH2IUeLmWPLkGVMLmiW4wJmjp3cVyEqm2gSw:T3BlNU0
- MD5 SHA1 SHA512 SSDEEP
Glossectomy/Livsforsikringssummers.acc
- SHA256 8f21623b27a79bfea7dff4d3c174e3b036acf6071b9bae6641a5e8a19b2768c7
- MD5 ba86751cc085ab68f350ca6553d55b1f
- SHA1 40a6bd2defae77936b0eff2a7fb8ebd7c9ebf490
- SHA512 e5b894cd87357a36d654199c5f1ea3b284eeac0876e50d2ed7964a01d69517e8f08165971848936064d35eaf99ff98c47b502bfe0fbefcff75f73a9c4eee9f07
- SSDEEP 384:4Zh01yR3+qupGXMrAatkvWDDkxH4j05FR7QxgcPbZdlAtyrRWNpKxzz62ibci6G+:sTR3+q6D8d4wBQxh7lzX9otrPS
- MD5 SHA1 SHA512 SSDEEP
Glossectomy/Ophavsrettigheds.txt
- SHA256 c7f819e371ca9b97e8e6d764a32b508604234b1d16bc9c73190b50ace57e12eb
- MD5 565ee3ddaa7eff0a2b8516ef80ad2592
- SHA1 863aedd5843d9e018691c70c5f3523c29d648854
- SHA512 c291747e2cccc40102c9ebfd8ec507a6e2c215e056888191891286465430d8fd1dd7e5f28f21c3a54d698e3ea7792336ef30207b0a86ee3b44da7a4dc1da04d1
- MD5 SHA1 SHA512
Glossectomy/Serrifera.sto
- SHA256 37a0e8670dfc2aad5c296b6ea0ca13e80d07c861cd4da2680d8f350db1be4783
- MD5 a8c4f1cd570ccdbee94d6b141cb146af
- SHA1 5907d6ff4968e2d8f5a8518e486ca89498ccc315
- SHA512 3f57d62e6ac3699125c139a2e98304c8c1b050045fd6d42099679cbd7f2bb90dbba76260904db4ce058de0628e3b6d5397dd1588eb8f6a0a56582d6f2bfe95ff
- SSDEEP 768:UMeapotsFqy6+fn1jLVrkvpEIuQ4sVqtynnwbUQd3pygfv80u48SDi8mYM3MKG7:5dAwr5C
- MD5 SHA1 SHA512 SSDEEP
Glossectomy/undre.pro
- SHA256 9bdbac40b4b7a6b4e8a76d62e0e94db30dc2a3c657829aae8acc7f4021305d70
- MD5 874ccf83d6201bd9fbab603cae63cba3
- SHA1 427a92c7ed7a543b4a3e1b3b2ac12f4fdc3f858c
- SHA512 109796b60283f353643b9b69508e0993d8a1de3017d59172867a36d1667923faaae8f6156feb9d37667c0c12ac60181e7712c847bddb71c6f612e6d47bc419c9
- SSDEEP 384:f8J+yN2TSmFU39WISVX/rXPOc+tYi8uen6GdwHBhaLNd96lD7/xJYIo+40j6xjev:Ny4Tk39+XLT+zgdExm+ZBedPUpo0m
- MD5 SHA1 SHA512 SSDEEP
Hjelmkldtes/Antesunrise.Ski
- SHA256 9c8314a2876644dff91652aefd829835e8700d7cd00d4a2f24173c29f9532dae
- MD5 95c71503bc640705b0973b75d1249e2b
- SHA1 44a3114402114ed571c9920eebf2a2c938c7e9c3
- SHA512 4512060a616f79bfaa62c3837a2ae68f798f1bb54d63e037b432b79a720fba3fb0c9b48409f22473ff63a7a21a37eb6e119f9eaa05521d40b7bfb771b66e4808
- SSDEEP 1536:QExGuWVenVNctjpRFUh3uqjKtKBGJZN6HcCmXxfJHloDhJn5:QSGpVenVNSjpAUwDwh6HcCefJHloB
- MD5 SHA1 SHA512 SSDEEP
Hjelmkldtes/Berloque34.urb
- SHA256 3f3ea1a848ac4753a8ad663f14edb5bee404ab4c6a187db32cac619b0973fa13
- MD5 339b7611deea9306347d61e608b3a510
- SHA1 c240921c3d3fb835712ebe56adbade6cb3fffe4e
- SHA512 903e57428e681df7cce0a8c90913c61dbccaa2b6f40747d999ac88f01965ca3517ae2a01da09c2722044f2721aca6b0bea98be67205735d60859d1bf02482db3
- SSDEEP 768:LRu0+QzdPWdeEK4jAwjdhUjLUNipJc+Atfb9WGUpkSdYEShj5mb/6Z2C9GRYUK2s:LgbOa
- MD5 SHA1 SHA512 SSDEEP
Hjelmkldtes/Cerebrogalactose140.Mae
- SHA256 410339e0545e9ee17cf941a8f41b371917495b0811b0b4796c259710a83671c2
- MD5 21282b210d55b15aa4083674e5b769eb
- SHA1 425367906b18c625a6d6182c42ed67ece27b5262
- SHA512 c6dae5cb93db9ec7b7f125c38e0a95887c9a3e9344d7da046162f08184e9bedae80fe18c6aea2dd98c36b6cd27726d189d341426fbda0ce3f05c58a09cd7e67e
- SSDEEP 6144:JC7ex5zY70YoLFnmE2at2NZpw9pB5vVOUr4vcLIoz:x5zYoTFmE2pHpw9uUrz
- MD5 SHA1 SHA512 SSDEEP