10072024_1507_10072024_COMANDA URGENTA.zip
- SHA256 7932a6860c6d63ce966ff426eec13a07a5ebc4cdf8bf13fc935bee9e4eef7698
Password
infected
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
COMANDA URGENTA.exe
Resource
win7-20240704-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
COMANDA URGENTA.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
22 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240704-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240704-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20240704-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target 10072024_1507_10072024_COMANDA URGENTA.zip
- Size 476KB
- Sample240710-shsqpsvbqq
- SHA256 7932a6860c6d63ce966ff426eec13a07a5ebc4cdf8bf13fc935bee9e4eef7698
- MD5 faafd76f3b07f04accf3497d539399d8
- SHA1 c2e35d9f62067e511ee357e8fb510cbbeb4b8612
- SHA512 9e426da9f43a0e90fa224244d3ea0f7697ed54064c591c833bb630b720d3a270760ef3b57c476520d30937045b36e462af69d87b764c38c9374ee5137bc1870c
- SSDEEP 12288:+bP9zDFRIPG9TbbwK8DQiVi8lncWC7FNnW5xX:unLdbbwK8rTlF4FNnWrX
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack002/$PLUGINSDIR/System.dll unpack002/$PLUGINSDIR/nsExec.dll - NSIS installer 2 IoCs
resource yara_rule static1/unpack001/COMANDA URGENTA.exe nsis_installer_1 static1/unpack001/COMANDA URGENTA.exe nsis_installer_2
File Explorer
-
10072024_1507_10072024_COMANDA URGENTA.zip.zip 476KB
-
COMANDA URGENTA.exe.exe 620KB
-
$PLUGINSDIR/System.dll.dll 11KB
-
$PLUGINSDIR/nsExec.dll.dll 6KB
-
Doundake/disusance.nar339KB
-
Fiskerimssige.Ebr134KB
-
Unwig.cal10KB
-
computerspillets.txt414B
COMANDA URGENTA.exe
- IMPHASH f677acae05efabe7411a40902b2d88fb
- SHA256 c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b
- MD5 b409d2fd594633bc71e64da08aed9951
- SHA1 c6f38e204419c12044e34baf398030b76e616a2f
- SHA512 b234f0a848c3d775cde23d4965084714fe13b3dd076f3749213e0f55a3f69cad302bebd2db2ce189333f85b4d81554dffc74b58553120251acb0f2ce6b03ecf6
- SSDEEP 12288:9vxwRbB0H5KUjUPKCuO+ggobwxbAW07FN3WNZt:9vx6bB0ZqAHgDSbxQFN3WDt
- MD5 SHA1 SHA512 SSDEEP
-
NSIS installer
Password
infected
PE Signature issue
Digest
07:7e:cb:62:23:cd:53:1f:fe:a6:08:3c:49:b2:40:a3:1a:08:80:f5:d7:79:07:85:78:51:2e:d0:72:86:c3:8f
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Flypasts,OU=Fordrivelsers Skipperlgne Defector\ ,O=Flypasts,L=Besançon,ST=Bourgogne-Franche-Comté,C=FR,1.2.840.113549.1.9.1=#0c1a47616c6f636865726e65313533405269766572686561642e4e6f
Chains
Jul 9, 2024
Subject
CN=Flypasts,OU=Fordrivelsers Skipperlgne Defector\ ,O=Flypasts,L=Besançon,ST=Bourgogne-Franche-Comté,C=FR,1.2.840.113549.1.9.1=#0c1a47616c6f636865726e65313533405269766572686561642e4e6f
Serial Number
38:82:1d:a7:9d:b8:6f:af:b1:6c:97:87:d8:e0:1b:e4:fc:77:7a:32
Issuer
CN=Flypasts,OU=Fordrivelsers Skipperlgne Defector\ ,O=Flypasts,L=Besançon,ST=Bourgogne-Franche-Comté,C=FR,1.2.840.113549.1.9.1=#0c1a47616c6f636865726e65313533405269766572686561642e4e6f
Timespan
Aug 28, 2023 - Aug 27, 2026
Minor OS version
1
Major OS version
5
Entry point
13518
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
advapi32
RegCloseKey
RegDeleteKeyA
RegDeleteValueA
RegEnumKeyA
RegEnumValueA
RegQueryValueExA
RegSetValueExA
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueA
SetFileSecurityA
RegCreateKeyExA
RegOpenKeyExA
shell32
SHBrowseForFolderA
SHFileOperationA
SHGetPathFromIDListA
SHGetFileInfoA
ShellExecuteExA
ole32
OleUninitialize
IIDFromString
OleInitialize
CoTaskMemFree
CoCreateInstance
comctl32
ord17
ImageList_Destroy
ImageList_AddMasked
ImageList_Create
user32
DispatchMessageA
SystemParametersInfoA
LoadCursorA
SetClassLongA
GetSysColor
ScreenToClient
SetCursor
GetWindowRect
TrackPopupMenu
AppendMenuA
EnableMenuItem
CreatePopupMenu
GetSystemMenu
GetSystemMetrics
IsWindowEnabled
EmptyClipboard
SetClipboardData
CloseClipboard
OpenClipboard
CheckDlgButton
EndDialog
DialogBoxParamA
IsWindowVisible
SetWindowPos
CreateWindowExA
GetClassInfoA
RegisterClassA
PeekMessageA
GetMessagePos
CharNextA
ExitWindowsEx
SetWindowTextA
SetTimer
CreateDialogParamA
DestroyWindow
LoadImageA
FindWindowExA
SetWindowLongA
InvalidateRect
ReleaseDC
GetDC
SetForegroundWindow
EnableWindow
GetDlgItem
ShowWindow
IsWindow
PostQuitMessage
SendMessageTimeoutA
SendMessageA
wsprintfA
FillRect
GetClientRect
EndPaint
BeginPaint
DrawTextA
DefWindowProcA
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CallWindowProcA
CharPrevA
GetWindowLongA
gdi32
SetBkMode
CreateBrushIndirect
GetDeviceCaps
SelectObject
DeleteObject
SetBkColor
SetTextColor
CreateFontIndirectA
kernel32
GetTempFileNameA
GetLastError
WaitForSingleObject
RemoveDirectoryA
ReadFile
CreateFileA
CreateDirectoryA
lstrcpynA
GlobalLock
GlobalUnlock
CreateThread
GetDiskFreeSpaceA
CopyFileA
lstrlenA
GetVersionExA
GetWindowsDirectoryA
ExitProcess
GetExitCodeProcess
SetErrorMode
GetTempPathA
SetEnvironmentVariableA
GetCommandLineA
GetModuleFileNameA
GetTickCount
GetFileSize
MultiByteToWideChar
MoveFileA
WritePrivateProfileStringA
GetPrivateProfileStringA
lstrcmpiA
lstrcmpA
MulDiv
GetShortPathNameA
GlobalFree
GlobalAlloc
LoadLibraryExA
GetModuleHandleA
FreeLibrary
Sleep
CloseHandle
SetFileTime
SetFilePointer
SetFileAttributesA
GetFullPathNameA
GetFileAttributesA
FindNextFileA
FindFirstFileA
FindClose
DeleteFileA
CompareFileTime
SearchPathA
SetCurrentDirectoryA
ExpandEnvironmentStringsA
WriteFile
CreateProcessA
WideCharToMultiByte
GetSystemDirectoryA
GetProcAddress
lstrcpyA
lstrcatA
MoveFileExA
GetCurrentProcess
Name
.text
Size
26KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
3.6MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
108KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
424KB
Virtual Size
423KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=260, version=30795,
count=1, id=262, version=30795,
count=15, id=257, version=30795,
count=159, id=1, productName=Unmarked objects,
count=13, id=260, version=30146,
count=1, id=255, version=30146,
count=1, id=258, version=30146,
$PLUGINSDIR/System.dll
- IMPHASH 595a3fd71239f605bb02d7a5e48fd4df
- SHA256 aec5af9c7c551c3590492b0c0120b535b55ab048e84f695b617a5ab4b1a52f54
- MD5 bff2a11d26d951ec34679b8fa1ee7192
- SHA1 d3de629a5a86ee35b6afa1802f6ac8b141b07062
- SHA512 1dce397c9cab3cd3b58c181688286a89067c743f195403694819c2d988435268ffd01939beaaa17cfa344160c89414f28273b70de154be0def034af8c470723a
- SSDEEP 192:G9rQDenC9VrcK7REgSWOprANupQYLRszDDH/d9CWlXo7U6Wxf:GJQEaVAK7R9SfpjpQYLRszfH/d9CWB1j
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
6
Entry point
6599
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GlobalAlloc
GlobalSize
GlobalFree
lstrcpynA
lstrcpyA
GetLastError
VirtualAlloc
VirtualProtect
VirtualFree
FreeLibrary
GetModuleHandleA
GetProcAddress
LoadLibraryA
lstrlenA
MultiByteToWideChar
WideCharToMultiByte
user32
wsprintfA
ole32
StringFromGUID2
CLSIDFromString
Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc
Name
.text
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
926B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
68B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
492B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=259, version=30034,
count=7, id=257, version=30795,
count=19, id=1, productName=Unmarked objects,
count=4, id=260, version=30146,
count=1, id=259, version=30146,
count=1, id=256, version=30146,
count=1, id=258, version=30146,
$PLUGINSDIR/nsExec.dll
- IMPHASH 0d6ae1f1ecbace583969d8eb8b21d1b8
- SHA256 e18984e78d58b2383f2c1e8ed0000088ee8d9d469345383618f179176fcddff6
- MD5 fdee755c4987e9859e0eec130ee22efd
- SHA1 ba32823881a98da6b92eee1d866be2b3a20c6e5d
- SHA512 31ba3dad22fd9b78ab3f6017c4373c923d048cf0c010900a131c4533ef185d408a88052aa4cf6184dbe484d44aab9cfa94a052185cf0b9ad19286ed921e4723f
- SSDEEP 96:ft4Vl/7Lo1UBrob9ljNEUgD7cyuM1x9XkraK2A2KAB5VVDyssKZ:ft4Vlw1Iul5J8T1vK20I5VVGsb
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
6
Entry point
4339
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
advapi32
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
user32
FindWindowExA
CharNextExA
CharPrevA
CharNextA
OemToCharBuffA
SendMessageA
wsprintfA
kernel32
CopyFileA
GetStartupInfoA
CreateFileMappingA
lstrlenA
lstrcatA
lstrcpyA
lstrcpynA
GetCommandLineA
CreateFileA
DeleteFileA
ReadFile
GetTempFileNameA
CloseHandle
CreatePipe
PeekNamedPipe
WaitForSingleObject
Sleep
GetCurrentProcess
ExitProcess
TerminateProcess
GetExitCodeProcess
CreateProcessA
GetVersion
GetTickCount
MapViewOfFile
UnmapViewOfFile
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GlobalAlloc
GlobalReAlloc
GlobalFree
lstrcmpiA
Exec
ExecToLog
ExecToStack
Name
.text
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
252B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=257, version=30795,
count=45, id=1, productName=Unmarked objects,
count=3, id=260, version=30146,
count=1, id=256, version=30146,
count=1, id=258, version=30146,
Doundake/disusance.nar
- SHA256 6a02bb5a2dda116bfafc7e0019446b89564e5513c72a47499d6d4debc070d82f
- MD5 029f26487d958257ec8b51a1743d1324
- SHA1 5a1796c48e7785f8ca7a60a290f4ba759b8e6377
- SHA512 c7a091e8a0ac15ca686a7f9b0a024815de71cb9c4e3beeb41f62f0827df31814df5fc6ed3714365ae7a501331ce6fb6c69d0b583a84e932761d8e9550bbf5e4d
- SSDEEP 384:/WZKMB2DCvQxpCtqSHYn2GgNDNxijVKwBcwIx1FtDDpNLgA9g0VRaj/Od+exEpPU:/WoMmcHrrxg/xWZDHgMaj/OZUmfQG2I
- MD5 SHA1 SHA512 SSDEEP
Fiskerimssige.Ebr
- SHA256 9891d0c4fc62f92b380e91343c0f6985715042c368f55ef17f51a7cf746c297b
- MD5 caf7638318263008374cefe3d1df91b2
- SHA1 50c7394eae97d5ec91efe1d3ab600535fb9365dc
- SHA512 4a4961d125b115d78d7db53361172880ccdcdf2ab2959e508a725fadfc3a5fbaef0f4dff189695674ae48c0df413d890ad606b59edf2652fe6dd63fb3ef34244
- SSDEEP 3072:WjJsNTzep0XB8ZrCtdzcvrTP1PJFQI63gOBKORXNg8+74Yv2:Z/00XyGdov1hj6XKORdWe
- MD5 SHA1 SHA512 SSDEEP
Unwig.cal
- SHA256 d2c49e0b222aef73be75481b3f05b1db409221b309201bcf8794c0294bc1958b
- MD5 7e12105629d3aff3e390d05c1562b88f
- SHA1 99b7a121d574465cff585adc8a445944d629767d
- SHA512 c070bf9102ae678fd3e9866fb47ab5edf828bc09be4bbe9a9e07fbbb9196056589fb4a6a5584ffa5c9ebeedc8ea5062d038af46ca94795743eaace4ede70172d
- SSDEEP 192:Uc4AF1AI948EmI0K1F6E+umTfvjMrGCQxGGIHLqIi:UMF1AeaR1F6fTfvIrGCeGGIHuIi
- MD5 SHA1 SHA512 SSDEEP
computerspillets.txt
- SHA256 888024ef7f696f978d89fc6de80720f01f74c96108f7e747b3fe9b6dc215e630
- MD5 df9ff56e018189b5916f39aff5811397
- SHA1 653feb865e0c3a7210442b4d48c9419cdc44143e
- SHA512 7d390ba963be29909388c9085d45d9156469a345055371aa82cd055c3e7fc78e8f508374c7f8c8a6cb307f43f9976e5c1b86de4b93b60dd95c4dec9eb3aa70eb
- MD5 SHA1 SHA512