11072024_1652_11072024_Fatura.rar
- SHA256 6292fdf69844ed834e9f6ca211bdabde3b0ac0de7a11a9cca188ca3f99c313ef
Password
infected
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Fatura.exe
Resource
win7-20240705-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
Fatura.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
22 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240704-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20240705-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target 11072024_1652_11072024_Fatura.rar
- Size 434KB
- Sample240711-vdd3vsxhmd
- SHA256 6292fdf69844ed834e9f6ca211bdabde3b0ac0de7a11a9cca188ca3f99c313ef
- MD5 7ac7c7311256fcadff9d5d577a1341cd
- SHA1 4023a172b0d4ee39eedd857f238967c3caa6dd65
- SHA512 2cdbece21bff99a6b50f2d6f6c3bf4bb57fd2f2fa4058ab6cf30079567435ea7bb9a97d40f731d80b3526e5afad1c7f01f9ad3f4cd98b7910ed12c60df8c025b
- SSDEEP 6144:tNEXGAIZ2+PZtk05/eM0kJkb1OroG8TcWf75pSolDPdNbN3eHIEkLTcWjt1m50/d:tNEXGRZ7I05/zvrtKpBNb4o7Njt1UHO
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack002/$PLUGINSDIR/System.dll unpack002/$PLUGINSDIR/nsExec.dll - NSIS installer 2 IoCs
resource yara_rule static1/unpack001/Fatura.exe nsis_installer_1 static1/unpack001/Fatura.exe nsis_installer_2
File Explorer
-
11072024_1652_11072024_Fatura.rar.rar 434KB
-
Fatura.exe.exe 630KB
-
$PLUGINSDIR/System.dll.dll 11KB
-
$PLUGINSDIR/nsExec.dll.dll 6KB
-
Jammer.Opi144KB
-
Politicking.Ine15KB
-
computerspillets.txt414B
-
disusance.nar339KB
Fatura.exe
- IMPHASH f677acae05efabe7411a40902b2d88fb
- SHA256 f797957066f7df06f719849951c278e9c5f56a225f6d68ee352a14539579d8af
- MD5 c6ba6c0f42898b7564e3d217a24efb3a
- SHA1 2cea91f4568bc298fe098e7caaac446ed706c05f
- SHA512 006095e1ccbea8483bc85f9aa98751b56d153646cee21a348388dff0e21fa030f654e5dea82753ae1bfddc75859e7c6a63fd6c6cf7ceb992841a1ce83a35f849
- SSDEEP 12288:KvxwRbB0H5KUjUPKCuO+ggobwxJ3C4e5cI2kD7Bl:Kvx6bB0ZqAHgDSqcEn
- MD5 SHA1 SHA512 SSDEEP
-
NSIS installer
Password
infected
PE Signature issue
Digest
9b:b7:29:d5:f8:18:33:ce:63:8a:94:af:4a:01:87:a8:0e:9a:7f:c2:ec:44:55:fb:68:0c:c1:9b:41:c2:fb:c7
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Noteapparatet,OU=Chlorate Promitosis\ ,O=Noteapparatet,L=Rayville,ST=Missouri,C=US,1.2.840.113549.1.9.1=#0c1f466f726d6f646e696e6765726e6573404876616c66616e676572732e466573
Chains
Jul 11, 2024
Subject
CN=Noteapparatet,OU=Chlorate Promitosis\ ,O=Noteapparatet,L=Rayville,ST=Missouri,C=US,1.2.840.113549.1.9.1=#0c1f466f726d6f646e696e6765726e6573404876616c66616e676572732e466573
Serial Number
19:cd:d4:ef:08:e5:36:6a:0b:2a:51:fe:f5:bb:5c:e7:4a:2d:c2:c6
Issuer
CN=Noteapparatet,OU=Chlorate Promitosis\ ,O=Noteapparatet,L=Rayville,ST=Missouri,C=US,1.2.840.113549.1.9.1=#0c1f466f726d6f646e696e6765726e6573404876616c66616e676572732e466573
Timespan
Sep 22, 2023 - Sep 21, 2026
Minor OS version
1
Major OS version
5
Entry point
13518
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
advapi32
RegCloseKey
RegDeleteKeyA
RegDeleteValueA
RegEnumKeyA
RegEnumValueA
RegQueryValueExA
RegSetValueExA
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueA
SetFileSecurityA
RegCreateKeyExA
RegOpenKeyExA
shell32
SHBrowseForFolderA
SHFileOperationA
SHGetPathFromIDListA
SHGetFileInfoA
ShellExecuteExA
ole32
OleUninitialize
IIDFromString
OleInitialize
CoTaskMemFree
CoCreateInstance
comctl32
ord17
ImageList_Destroy
ImageList_AddMasked
ImageList_Create
user32
DispatchMessageA
SystemParametersInfoA
LoadCursorA
SetClassLongA
GetSysColor
ScreenToClient
SetCursor
GetWindowRect
TrackPopupMenu
AppendMenuA
EnableMenuItem
CreatePopupMenu
GetSystemMenu
GetSystemMetrics
IsWindowEnabled
EmptyClipboard
SetClipboardData
CloseClipboard
OpenClipboard
CheckDlgButton
EndDialog
DialogBoxParamA
IsWindowVisible
SetWindowPos
CreateWindowExA
GetClassInfoA
RegisterClassA
PeekMessageA
GetMessagePos
CharNextA
ExitWindowsEx
SetWindowTextA
SetTimer
CreateDialogParamA
DestroyWindow
LoadImageA
FindWindowExA
SetWindowLongA
InvalidateRect
ReleaseDC
GetDC
SetForegroundWindow
EnableWindow
GetDlgItem
ShowWindow
IsWindow
PostQuitMessage
SendMessageTimeoutA
SendMessageA
wsprintfA
FillRect
GetClientRect
EndPaint
BeginPaint
DrawTextA
DefWindowProcA
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CallWindowProcA
CharPrevA
GetWindowLongA
gdi32
SetBkMode
CreateBrushIndirect
GetDeviceCaps
SelectObject
DeleteObject
SetBkColor
SetTextColor
CreateFontIndirectA
kernel32
GetTempFileNameA
GetLastError
WaitForSingleObject
RemoveDirectoryA
ReadFile
CreateFileA
CreateDirectoryA
lstrcpynA
GlobalLock
GlobalUnlock
CreateThread
GetDiskFreeSpaceA
CopyFileA
lstrlenA
GetVersionExA
GetWindowsDirectoryA
ExitProcess
GetExitCodeProcess
SetErrorMode
GetTempPathA
SetEnvironmentVariableA
GetCommandLineA
GetModuleFileNameA
GetTickCount
GetFileSize
MultiByteToWideChar
MoveFileA
WritePrivateProfileStringA
GetPrivateProfileStringA
lstrcmpiA
lstrcmpA
MulDiv
GetShortPathNameA
GlobalFree
GlobalAlloc
LoadLibraryExA
GetModuleHandleA
FreeLibrary
Sleep
CloseHandle
SetFileTime
SetFilePointer
SetFileAttributesA
GetFullPathNameA
GetFileAttributesA
FindNextFileA
FindFirstFileA
FindClose
DeleteFileA
CompareFileTime
SearchPathA
SetCurrentDirectoryA
ExpandEnvironmentStringsA
WriteFile
CreateProcessA
WideCharToMultiByte
GetSystemDirectoryA
GetProcAddress
lstrcpyA
lstrcatA
MoveFileExA
GetCurrentProcess
Name
.text
Size
26KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
3.6MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
108KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
424KB
Virtual Size
423KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=260, version=30795,
count=1, id=262, version=30795,
count=15, id=257, version=30795,
count=159, id=1, productName=Unmarked objects,
count=13, id=260, version=30146,
count=1, id=255, version=30146,
count=1, id=258, version=30146,
$PLUGINSDIR/System.dll
- IMPHASH 595a3fd71239f605bb02d7a5e48fd4df
- SHA256 aec5af9c7c551c3590492b0c0120b535b55ab048e84f695b617a5ab4b1a52f54
- MD5 bff2a11d26d951ec34679b8fa1ee7192
- SHA1 d3de629a5a86ee35b6afa1802f6ac8b141b07062
- SHA512 1dce397c9cab3cd3b58c181688286a89067c743f195403694819c2d988435268ffd01939beaaa17cfa344160c89414f28273b70de154be0def034af8c470723a
- SSDEEP 192:G9rQDenC9VrcK7REgSWOprANupQYLRszDDH/d9CWlXo7U6Wxf:GJQEaVAK7R9SfpjpQYLRszfH/d9CWB1j
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
6
Entry point
6599
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GlobalAlloc
GlobalSize
GlobalFree
lstrcpynA
lstrcpyA
GetLastError
VirtualAlloc
VirtualProtect
VirtualFree
FreeLibrary
GetModuleHandleA
GetProcAddress
LoadLibraryA
lstrlenA
MultiByteToWideChar
WideCharToMultiByte
user32
wsprintfA
ole32
StringFromGUID2
CLSIDFromString
Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc
Name
.text
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
926B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
68B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
492B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=259, version=30034,
count=7, id=257, version=30795,
count=19, id=1, productName=Unmarked objects,
count=4, id=260, version=30146,
count=1, id=259, version=30146,
count=1, id=256, version=30146,
count=1, id=258, version=30146,
$PLUGINSDIR/nsExec.dll
- IMPHASH 0d6ae1f1ecbace583969d8eb8b21d1b8
- SHA256 e18984e78d58b2383f2c1e8ed0000088ee8d9d469345383618f179176fcddff6
- MD5 fdee755c4987e9859e0eec130ee22efd
- SHA1 ba32823881a98da6b92eee1d866be2b3a20c6e5d
- SHA512 31ba3dad22fd9b78ab3f6017c4373c923d048cf0c010900a131c4533ef185d408a88052aa4cf6184dbe484d44aab9cfa94a052185cf0b9ad19286ed921e4723f
- SSDEEP 96:ft4Vl/7Lo1UBrob9ljNEUgD7cyuM1x9XkraK2A2KAB5VVDyssKZ:ft4Vlw1Iul5J8T1vK20I5VVGsb
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
6
Entry point
4339
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
advapi32
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
user32
FindWindowExA
CharNextExA
CharPrevA
CharNextA
OemToCharBuffA
SendMessageA
wsprintfA
kernel32
CopyFileA
GetStartupInfoA
CreateFileMappingA
lstrlenA
lstrcatA
lstrcpyA
lstrcpynA
GetCommandLineA
CreateFileA
DeleteFileA
ReadFile
GetTempFileNameA
CloseHandle
CreatePipe
PeekNamedPipe
WaitForSingleObject
Sleep
GetCurrentProcess
ExitProcess
TerminateProcess
GetExitCodeProcess
CreateProcessA
GetVersion
GetTickCount
MapViewOfFile
UnmapViewOfFile
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GlobalAlloc
GlobalReAlloc
GlobalFree
lstrcmpiA
Exec
ExecToLog
ExecToStack
Name
.text
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
252B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=257, version=30795,
count=45, id=1, productName=Unmarked objects,
count=3, id=260, version=30146,
count=1, id=256, version=30146,
count=1, id=258, version=30146,
Jammer.Opi
- SHA256 de9e26ad33a27fdb6639d5ba5c04e8fda9511784e357a308180df49f8a9ba21c
- MD5 f6fc2de0bfee07197dcf049fae596bf4
- SHA1 d23eebe8209685eeff5d86f9ed940ac8a7a85ab6
- SHA512 3c61f1bca4cab88735e7b55616569c17ec947f93ce2a153a9bc2a238659e32ffa54f04030aec14e50d3df5424c8dd50ab67d2a7ebe18af8e90f66010e112550d
- SSDEEP 3072:BKw92BNL5mAn02sujn7/XYlMSAyiG7NusKn26ILnp3sQ:Tsz5mARl/X2MSAi7NusaUnp37
- MD5 SHA1 SHA512 SSDEEP
Politicking.Ine
- SHA256 ceb146c854dd890bce4cddd72e1a427da910ac81093ef0cf99104a87c80f5303
- MD5 c18f408019c246db1326b3ba74fd227d
- SHA1 2a5f3f75febce417caa621a795941b2fcd7ff75f
- SHA512 f4ffb340acb547d9bb74b9259f43d1eb60bf34876748df7d79d12dbd72a85758cff44d10f600e13487218b8833daa9057aa3203297dec2d3af354ed3f9cc5bf4
- SSDEEP 384:1NdmZWL5Yh/vlGUMfdBqz2AWsXbqnb79fJ63ku2:1DNMG5fdBqqRsXbE1fJ6Y
- MD5 SHA1 SHA512 SSDEEP
computerspillets.txt
- SHA256 888024ef7f696f978d89fc6de80720f01f74c96108f7e747b3fe9b6dc215e630
- MD5 df9ff56e018189b5916f39aff5811397
- SHA1 653feb865e0c3a7210442b4d48c9419cdc44143e
- SHA512 7d390ba963be29909388c9085d45d9156469a345055371aa82cd055c3e7fc78e8f508374c7f8c8a6cb307f43f9976e5c1b86de4b93b60dd95c4dec9eb3aa70eb
- MD5 SHA1 SHA512
disusance.nar
- SHA256 6a02bb5a2dda116bfafc7e0019446b89564e5513c72a47499d6d4debc070d82f
- MD5 029f26487d958257ec8b51a1743d1324
- SHA1 5a1796c48e7785f8ca7a60a290f4ba759b8e6377
- SHA512 c7a091e8a0ac15ca686a7f9b0a024815de71cb9c4e3beeb41f62f0827df31814df5fc6ed3714365ae7a501331ce6fb6c69d0b583a84e932761d8e9550bbf5e4d
- SSDEEP 384:/WZKMB2DCvQxpCtqSHYn2GgNDNxijVKwBcwIx1FtDDpNLgA9g0VRaj/Od+exEpPU:/WoMmcHrrxg/xWZDHgMaj/OZUmfQG2I
- MD5 SHA1 SHA512 SSDEEP