RFQ_for_WIKA_pdf[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
RFQ_for_WIKA_pdf.exe
Size 630KB
Sample240715-jmrjrswamn
SHA256 76afbad7304f66738d4f26200c7c1eb410a70b0e9a051794d93f836ced3fa387
MD5 8c0f245674a12540750ace4a664f3af6
SHA1 a3809bd7cbc4d0448a6aff8bb3ae6f3b0546017a
SHA512 ca611211bcf37fa19070b6e6ae8e42c0aa50b5785b5bf65454834e65ed8432e014e10f4e70405de43c9eadb55dfb752e0caacf8c94927c8340f76f6b73b8d468
SSDEEP 12288:XvxwRbB0H5KUjUPKCuO+ggobwxF80a/mBPjC:Xvx6bB0ZqAHgDSFa/ojC
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsExec.dll

NSIS installer 2 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

File Explorer

RFQ_for_WIKA_pdf.exe

.exe 630KB
$PLUGINSDIR/System.dll

.dll 11KB
$PLUGINSDIR/nsExec.dll

.dll 6KB
Bibliotherapy.Mul52

149KB
Sjlehelgens/Fabricature.pre

9KB
Sjlehelgens/disusance.nar

339KB
computerspillets.txt

414B

RFQ_for_WIKA_pdf.exe

IMPHASH f677acae05efabe7411a40902b2d88fb
SHA256 76afbad7304f66738d4f26200c7c1eb410a70b0e9a051794d93f836ced3fa387
MD5 8c0f245674a12540750ace4a664f3af6
SHA1 a3809bd7cbc4d0448a6aff8bb3ae6f3b0546017a
SHA512 ca611211bcf37fa19070b6e6ae8e42c0aa50b5785b5bf65454834e65ed8432e014e10f4e70405de43c9eadb55dfb752e0caacf8c94927c8340f76f6b73b8d468
SSDEEP 12288:XvxwRbB0H5KUjUPKCuO+ggobwxF80a/mBPjC:Xvx6bB0ZqAHgDSFa/ojC
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

fc:cc:cd:be:3f:30:18:1e:42:13:ec:f2:3d:8f:eb:25:ff:57:94:e5:37:86:86:a7:0c:2c:fd:e2:50:cd:8d:ca

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Rdvines,OU=Stjdelen Ankylomele\ ,O=Rdvines,L=Paris La Défense,ST=Île-de-France,C=FR,1.2.840.113549.1.9.1=#0c18466f726574726b6b654053696e6c6573736e6573732e5363

Chains

Jul 12, 2024

Minor OS version

Major OS version

Entry point

13518

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCloseKey RegDeleteKeyA RegDeleteValueA RegEnumKeyA RegEnumValueA RegQueryValueExA RegSetValueExA OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueA SetFileSecurityA RegCreateKeyExA RegOpenKeyExA

shell32

SHBrowseForFolderA SHFileOperationA SHGetPathFromIDListA SHGetFileInfoA ShellExecuteExA

ole32

OleUninitialize IIDFromString OleInitialize CoTaskMemFree CoCreateInstance

comctl32

ord17 ImageList_Destroy ImageList_AddMasked ImageList_Create

user32

DispatchMessageA SystemParametersInfoA LoadCursorA SetClassLongA GetSysColor ScreenToClient SetCursor GetWindowRect TrackPopupMenu AppendMenuA EnableMenuItem CreatePopupMenu GetSystemMenu GetSystemMetrics IsWindowEnabled EmptyClipboard SetClipboardData CloseClipboard OpenClipboard CheckDlgButton EndDialog DialogBoxParamA IsWindowVisible SetWindowPos CreateWindowExA GetClassInfoA RegisterClassA PeekMessageA GetMessagePos CharNextA ExitWindowsEx SetWindowTextA SetTimer CreateDialogParamA DestroyWindow LoadImageA FindWindowExA SetWindowLongA InvalidateRect ReleaseDC GetDC SetForegroundWindow EnableWindow GetDlgItem ShowWindow IsWindow PostQuitMessage SendMessageTimeoutA SendMessageA wsprintfA FillRect GetClientRect EndPaint BeginPaint DrawTextA DefWindowProcA SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CallWindowProcA CharPrevA GetWindowLongA

gdi32

SetBkMode CreateBrushIndirect GetDeviceCaps SelectObject DeleteObject SetBkColor SetTextColor CreateFontIndirectA

kernel32

GetTempFileNameA GetLastError WaitForSingleObject RemoveDirectoryA ReadFile CreateFileA CreateDirectoryA lstrcpynA GlobalLock GlobalUnlock CreateThread GetDiskFreeSpaceA CopyFileA lstrlenA GetVersionExA GetWindowsDirectoryA ExitProcess GetExitCodeProcess SetErrorMode GetTempPathA SetEnvironmentVariableA GetCommandLineA GetModuleFileNameA GetTickCount GetFileSize MultiByteToWideChar MoveFileA WritePrivateProfileStringA GetPrivateProfileStringA lstrcmpiA lstrcmpA MulDiv GetShortPathNameA GlobalFree GlobalAlloc LoadLibraryExA GetModuleHandleA FreeLibrary Sleep CloseHandle SetFileTime SetFilePointer SetFileAttributesA GetFullPathNameA GetFileAttributesA FindNextFileA FindFirstFileA FindClose DeleteFileA CompareFileTime SearchPathA SetCurrentDirectoryA ExpandEnvironmentStringsA WriteFile CreateProcessA WideCharToMultiByte GetSystemDirectoryA GetProcAddress lstrcpyA lstrcatA MoveFileExA GetCurrentProcess

$PLUGINSDIR/System.dll

IMPHASH 595a3fd71239f605bb02d7a5e48fd4df
SHA256 aec5af9c7c551c3590492b0c0120b535b55ab048e84f695b617a5ab4b1a52f54
MD5 bff2a11d26d951ec34679b8fa1ee7192
SHA1 d3de629a5a86ee35b6afa1802f6ac8b141b07062
SHA512 1dce397c9cab3cd3b58c181688286a89067c743f195403694819c2d988435268ffd01939beaaa17cfa344160c89414f28273b70de154be0def034af8c470723a
SSDEEP 192:G9rQDenC9VrcK7REgSWOprANupQYLRszDDH/d9CWlXo7U6Wxf:GJQEaVAK7R9SfpjpQYLRszfH/d9CWB1j
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

6599

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsExec.dll

IMPHASH 0d6ae1f1ecbace583969d8eb8b21d1b8
SHA256 e18984e78d58b2383f2c1e8ed0000088ee8d9d469345383618f179176fcddff6
MD5 fdee755c4987e9859e0eec130ee22efd
SHA1 ba32823881a98da6b92eee1d866be2b3a20c6e5d
SHA512 31ba3dad22fd9b78ab3f6017c4373c923d048cf0c010900a131c4533ef185d408a88052aa4cf6184dbe484d44aab9cfa94a052185cf0b9ad19286ed921e4723f
SSDEEP 96:ft4Vl/7Lo1UBrob9ljNEUgD7cyuM1x9XkraK2A2KAB5VVDyssKZ:ft4Vlw1Iul5J8T1vK20I5VVGsb
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

4339

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

RFQ_for_WIKA_pdf.exe

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/nsExec.dll

advapi32

user32

kernel32

generic

Bibliotherapy.Mul52

Sjlehelgens/Fabricature.pre

Sjlehelgens/disusance.nar

computerspillets.txt