892885effadd96dae30af906c0e900706652b3b20e5547b9e4289f531d1a2c73.rar
- SHA256 892885effadd96dae30af906c0e900706652b3b20e5547b9e4289f531d1a2c73
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
SWIFT.exe
Resource
win7-20240705-en
windows7-x64
19 signatures
150 seconds
Behavioral task
behavioral2
Sample
SWIFT.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
20 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240705-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20240704-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target 892885effadd96dae30af906c0e900706652b3b20e5547b9e4289f531d1a2c73.rar
- Size 436KB
- Sample240711-b5ph5avakb
- SHA256 892885effadd96dae30af906c0e900706652b3b20e5547b9e4289f531d1a2c73
- MD5 091c13e617638d0d7acfd5ff81594b6a
- SHA1 7dc3d25ddfcbb478390e0f132825f93737143a13
- SHA512 d67a752edae3933420551cb8f91817b134ca71b341585c24b7912d151802b19ad719836e94143af0cd6878e84034f649fb7247c40040a1df9f9d9b1671fb77f1
- SSDEEP 6144:Z2d4/41dDbqRK8rqr7hnRGCf8+MpVbLC0jJ6+Wgx8qNwU51mTRwTZz1PVeFV4fmv:wdIRKaqPh0xV0A/Ya7Yab+xOqj
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack002/$PLUGINSDIR/System.dll unpack002/$PLUGINSDIR/nsExec.dll - NSIS installer 2 IoCs
resource yara_rule static1/unpack001/SWIFT.exe nsis_installer_1 static1/unpack001/SWIFT.exe nsis_installer_2
File Explorer
-
892885effadd96dae30af906c0e900706652b3b20e5547b9e4289f531d1a2c73.rar.rar 436KB
-
SWIFT.exe.exe 775KB
-
$PLUGINSDIR/System.dll.dll 11KB
-
$PLUGINSDIR/nsExec.dll.dll 6KB
-
Hylozoism/Forbundsformndene237.gen1.2MB
-
Hylozoism/Haardhudet.rav7KB
-
Hylozoism/Herbiest116.vre502KB
-
Hylozoism/Unfrail.nay514KB
-
Hylozoism/afrettelsers.stj1.3MB
-
Hylozoism/figurally.txt359B
-
Hylozoism/smudses.yde998KB
-
Occluding225.Ten152KB
SWIFT.exe
- IMPHASH 076b06e6a65c9b7cca5a61be0cd82165
- SHA256 c58de5f40be8fd760fc08b1ef7ae5a3f5771dbc214426156e3a21a89bb8303fc
- MD5 0d0f944239a7dd07826e28edf9647185
- SHA1 3911f09935fb37f9f6cc3ff990e12e6143282d8a
- SHA512 e5077fa3179d7082587d606b8c8c6b5c0d74794225394522d92a06295e962a1cdb9868ac415720e3908222cc6c55312d24868be8d8ec2e52ef81243080fe5b7e
- SSDEEP 12288:7akAv7gfFvt8pjs0p1cvxM/r9RKGqHmIdD+c:+kiext2Y0QMz9RKHHF9D
- MD5 SHA1 SHA512 SSDEEP
-
NSIS installer
PE Signature issue
Digest
49:aa:93:8c:9e:24:42:17:81:32:ba:a7:09:76:27:59:9e:33:ce:91:3a:72:f2:f4:1f:13:ea:2f:aa:30:2e:dd
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Antievangelical,OU=Stormskadernes Mammae fashionering\ ,O=Antievangelical,L=Madonne-et-Lamerey,ST=Grand Est,C=FR,1.2.840.113549.1.9.1=#0c1648657465726f67726166744042726472656e652e4b61
Chains
Jul 5, 2024
Subject
CN=Antievangelical,OU=Stormskadernes Mammae fashionering\ ,O=Antievangelical,L=Madonne-et-Lamerey,ST=Grand Est,C=FR,1.2.840.113549.1.9.1=#0c1648657465726f67726166744042726472656e652e4b61
Serial Number
75:89:2f:6b:36:b3:55:22:d1:97:06:73:81:15:05:72:38:22:33:3d
Issuer
CN=Antievangelical,OU=Stormskadernes Mammae fashionering\ ,O=Antievangelical,L=Madonne-et-Lamerey,ST=Grand Est,C=FR,1.2.840.113549.1.9.1=#0c1648657465726f67726166744042726472656e652e4b61
Timespan
Nov 30, 2023 - Nov 29, 2026
Minor OS version
0
Major OS version
4
Entry point
12505
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
Sleep
SetFileAttributesA
GetFileAttributesA
GetTickCount
GetModuleFileNameA
GetCurrentProcess
CopyFileA
GetFileSize
ExitProcess
GetWindowsDirectoryA
GetTempPathA
GetCommandLineA
GetVersion
SetErrorMode
lstrlenA
lstrcpynA
ExpandEnvironmentStringsA
SetEnvironmentVariableA
GetFullPathNameA
CreateThread
GetLastError
CreateDirectoryA
CreateProcessA
RemoveDirectoryA
CreateFileA
GetTempFileNameA
ReadFile
WriteFile
lstrcpyA
MoveFileExA
lstrcatA
GetSystemDirectoryA
LoadLibraryA
GetProcAddress
lstrcmpiA
lstrcmpA
SetCurrentDirectoryA
MoveFileA
CompareFileTime
GetShortPathNameA
SearchPathA
CloseHandle
SetFileTime
GlobalLock
GetDiskFreeSpaceA
GlobalUnlock
GlobalFree
FindFirstFileA
FindNextFileA
DeleteFileA
SetFilePointer
GetPrivateProfileStringA
FindClose
MultiByteToWideChar
MulDiv
WritePrivateProfileStringA
FreeLibrary
LoadLibraryExA
GetModuleHandleA
GetExitCodeProcess
WaitForSingleObject
GlobalAlloc
user32
GetSystemMenu
SetClassLongA
EnableMenuItem
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
ScreenToClient
GetWindowRect
GetDlgItem
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
GetDC
ReleaseDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
EndDialog
RegisterClassA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
ExitWindowsEx
LoadImageA
CreateDialogParamA
SetTimer
SetWindowTextA
SetWindowLongA
SetForegroundWindow
ShowWindow
IsWindow
SendMessageTimeoutA
FindWindowExA
OpenClipboard
TrackPopupMenu
AppendMenuA
DrawTextA
EndPaint
DestroyWindow
wsprintfA
PostQuitMessage
gdi32
SelectObject
SetBkMode
CreateFontIndirectA
SetTextColor
DeleteObject
GetDeviceCaps
CreateBrushIndirect
SetBkColor
shell32
SHGetSpecialFolderLocation
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
advapi32
RegDeleteKeyA
SetFileSecurityA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegOpenKeyExA
RegEnumValueA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA
RegSetValueExA
RegQueryValueExA
RegEnumKeyA
comctl32
ImageList_AddMasked
ord17
ImageList_Destroy
ImageList_Create
ole32
OleUninitialize
OleInitialize
CoTaskMemFree
CoCreateInstance
Name
.text
Size
23KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
106KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
112KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
366KB
Virtual Size
366KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=160, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
$PLUGINSDIR/System.dll
- IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
- SHA256 fda0018ab182ac6025d2fc9a2efcce3745d1da21ce5141859f8286cf319a52ce
- MD5 4d3b19a81bd51f8ce44b93643a4e3a99
- SHA1 35f8b00e85577b014080df98bd2c378351d9b3e9
- SHA512 b2ba9c961c0e1617f802990587a9000979ab5cc493ae2f8ca852eb43eeaf24916b0b29057dbff7d41a1797dfb2dce3db41990e8639b8f205771dbec3fd80f622
- SSDEEP 192:BPtkumJX7zB22kGwfy0mtVgkCPOse1un:u702k5qpdseQn
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
9995
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
MultiByteToWideChar
GlobalFree
GlobalSize
lstrcpynA
lstrcpyA
GetProcAddress
VirtualFree
FreeLibrary
lstrlenA
LoadLibraryA
GetModuleHandleA
GlobalAlloc
WideCharToMultiByte
VirtualAlloc
VirtualProtect
GetLastError
user32
wsprintfA
ole32
StringFromGUID2
CLSIDFromString
Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc
Name
.text
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
851B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
104B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1024B
Virtual Size
608B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=14, version=7299,
count=19, id=1, productName=Unmarked objects,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=4, id=48, version=9044,
count=1, id=42, version=8803,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
$PLUGINSDIR/nsExec.dll
- IMPHASH 46f8b6973f33717335c0f6d8087de67b
- SHA256 1c2f19e57dc72587aa00800a498c5f581b7d6761dc13b24bcf287ea7bd5ca2bf
- MD5 3eb4cd50dcb9f5981f5408578cb7fb70
- SHA1 13b38cc104ba6ee22dc4dfa6e480e36587f4bc71
- SHA512 5a0c9d28df7a77e157046dce876282c48f434a441ee34e12b88f55be31be536eff676f580adbe4586da3f1519f94b5793ccbb3068b4b009eee286c0c5135d324
- SSDEEP 96:+7GUxNkO6GR0t9GKKr1Zd8NHYVVHp4dEeY3kRnHdMqqyVgNv3e:QXhHR0aTQN4gRHdMqJVgNG
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4231
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetModuleHandleA
lstrlenA
GetExitCodeProcess
WaitForSingleObject
Sleep
TerminateProcess
GlobalReAlloc
GlobalUnlock
GlobalSize
lstrcpynA
ReadFile
PeekNamedPipe
GetTickCount
lstrcpyA
CreateProcessA
GetStartupInfoA
GetProcAddress
GetVersion
DeleteFileA
lstrcmpiA
GetCurrentProcess
CloseHandle
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
CreateFileA
CopyFileA
GetTempFileNameA
GlobalFree
GlobalAlloc
GetModuleFileNameA
ExitProcess
GetCommandLineA
CreatePipe
GlobalLock
lstrcatA
user32
SendMessageA
OemToCharBuffA
FindWindowExA
CharNextA
wsprintfA
CharPrevA
advapi32
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
Exec
ExecToLog
ExecToStack
Name
.text
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
458B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=47, id=1, productName=Unmarked objects,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=2, id=48, version=9044,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
Hylozoism/Forbundsformndene237.gen
- SHA256 889569c108fa11e997516be33f3fe3a596c51b7e724cc2685ff7489d1e4f785e
- MD5 68e60fbc8995cf416a66817858cf474e
- SHA1 11e403b2e4e55f3f273385e8a6b06e3af9df9393
- SHA512 f63681e583c3dda89eeee00a064ed6eba46d17761ce4367570f28ed3311e07e7cee43264e1243cd800bd889855269bfe9cb65f7bd74e0eefecdee75d99225e6f
- SSDEEP 768:7OnjCMOzGZmKApM2SXVd1FAWTowGv6AyC8ROl2MHLZnPvcWhXkSKUP48Y6jmZ2EE:ynwo
- MD5 SHA1 SHA512 SSDEEP
Hylozoism/Haardhudet.rav
- SHA256 e516cbf11affce145b97030f76e9018d0d0e192e1344889f2f32aee9fd793d72
- MD5 448051ad54c2ef3f720bf745e574633e
- SHA1 fd9ac245e6017e4101dcb97b91e8333064b1f628
- SHA512 e6e4d782d51f85671c781d9af6f909690c58d7405ecae3f75774f4e142a542047375cfdc7159b471c4b4c1613238855ed3e41a72ff8d0bee9958a38255d1f29a
- SSDEEP 192:mYI89WkpIDLXWpuzU4YESK3K/n2EExBg15x:TokpIDCpuzAEVcExqd
- MD5 SHA1 SHA512 SSDEEP
Hylozoism/Herbiest116.vre
- SHA256 53512f1c52eaf92a898fb36109dae0a9d213756a883e05b2f0fcf116eef6b60e
- MD5 62de12ed6ed6ff40a198d8b60827cceb
- SHA1 fdc628000b2c284c8ec7dd07a125060deb714813
- SHA512 3941aeb05dabca894676c6701827f5e93eb262cf39086a445f9de4e26ad84727f5ada7054d35cc3b5b196ca7785c4e928e2328a064198eccd47841fb16364909
- SSDEEP 768:Sx+0VL5OUfjWsP4iWQPZ1VJ0FVBBHvr/L2UJVQIH:SMRB
- MD5 SHA1 SHA512 SSDEEP
Hylozoism/Unfrail.nay
- SHA256 af0e57677bd14876793edb39eff56c044919a1ab62cd4b16754f6745b52f22e4
- MD5 2494532c59743970919b467911cf098c
- SHA1 0a651c761229511408ec9974dae00bc051bdcb4b
- SHA512 eabe10516f56fc95c24512e1d6ea0d6f9f28d353febf51531fa200479abe5a296da598f3187dce73c96949daec5aabb647ebddc4c7a75a71c56b2c627be9b894
- SSDEEP 384:GlAaIvea1OoHvWR7RyDyrTF7TeFNXvCGEKutK3cAgnXE37WzaZ3IIDOGAOBp5qXu:0cTKRRvJgr6UWGKIDbzEUKf1gip9xvE
- MD5 SHA1 SHA512 SSDEEP
Hylozoism/afrettelsers.stj
- SHA256 94e16d1fe3825dc4f2ca01698d2cdc0f1d4f9507aa606c7b5a6ce6d1e8bba64d
- MD5 2c23f1adc70959d7f715ff1decaa3ffe
- SHA1 89597d09d89bb076d30b3303feac287cecd339f8
- SHA512 dbfeba6be17c9781049c9f3d4ac653e3f61b64fee143b47b313199d398bbc5e97c01506e9113ad0decba29db639e5dd2c0d143a50a13f6e1d577e359246eb3c0
- SSDEEP 768:6tVRQvXsCZx/3WqeKzGl1ixDDcYhuMu39HqMjRCqaWW0knhjhPlKWMtO4G3VeEwJ:6P4Dba
- MD5 SHA1 SHA512 SSDEEP
Hylozoism/figurally.txt
- SHA256 66a293dc597f6dec3a665255a2adb2fc3652cefa4977e4551eae99f70586a94c
- MD5 eb25616ae9dd1f3469be2ab4bc497047
- SHA1 50b7c2992000772d52ce857e3ff4d30b891f8181
- SHA512 8e4fb6f25baa50aa8e53a14d2443f48b01f0e6c8ee439bcd0b9cc17d8a799fc9bd9ba0fa69e5aa5784ad661457508f19fd149c1e8aaa44c5e53721c9f884b0e4
- MD5 SHA1 SHA512
Hylozoism/smudses.yde
- SHA256 5181b85f34ad4a096b83647c13d31656dcdd3c993fac3a96d4396b8d69f3e5e7
- MD5 893cd3b016a43f89778f901eef7a7ece
- SHA1 259ca8de763f1c32526bc23516f77130a7782faa
- SHA512 31d393ae2e9ce2d155143ee2a5fe2493c6a5030f5c428ee29d8151d3315f27f13ab3dd7ff9a1dcc83c6d55cba64a13202a49a84000de22ee29300f3726a190a5
- SSDEEP 768:TvBs/GHVGz2HBbnQ30Lo0yvDHGg3Gv2x1htjY8Z6nxv52ou+GwBCpEu8Q4IxbVIr:dsHOCa
- MD5 SHA1 SHA512 SSDEEP
Occluding225.Ten
- SHA256 105ba1547c65997e87eb160e25dc8f06e9b40811477a48b3eb18bd15ce459867
- MD5 4e1ae5f5d6b31a47fdea4e64dedf5fb2
- SHA1 b7b268bc4e6f2568a6c5ac2a6e2d10ffbcae26e7
- SHA512 cdba7852db1787944ac7414eac18b1438f0eebf21c2a6415048b43bccf54b9431db88f1692e2c35113e137617e477ce9339a5fbec3c55e93b3862c8a1595a130
- SSDEEP 3072://tL4mssBCciuzOVbcHbzYD0yZfPaLvT7XOWr99Rqt4Z:tszrcpOVbSbcevGPc
- MD5 SHA1 SHA512 SSDEEP