KSI RFQ-20240732AB.tgz
- SHA256 24798751df33c8a9a5e2173e2f26c5ad51bc95dec30cc7791abc8deffc751c24
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
KSI RFQ-20240732AB.exe
Resource
win7-20240704-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
KSI RFQ-20240732AB.exe
Resource
win10v2004-20240730-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240708-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240730-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20240704-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20240730-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target KSI RFQ-20240732AB.tgz
- Size 418KB
- Sample240731-pxalwstdmr
- SHA256 24798751df33c8a9a5e2173e2f26c5ad51bc95dec30cc7791abc8deffc751c24
- MD5 d7dfb721283050cf44fd3617019d8143
- SHA1 24679e7acf0fae88e7e65f3a2d7fae2fcf26d958
- SHA512 9458c8ad7d4912c7ac0f46e59e7a5d6dd2259cd8bc77b0a0586b5f99153a2555911706cd2f0d635c6f495026efd41c7be30d5b18c7ff03cc8233cf742450a3eb
- SSDEEP 12288:VuhBqsd6boC+fIR0naMkFldbQ7ZKPzISby+oY:SBf4l+E0nwqZszuY
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack002/$PLUGINSDIR/System.dll unpack002/$PLUGINSDIR/nsExec.dll - NSIS installer 2 IoCs
resource yara_rule static1/unpack001/KSI RFQ-20240732AB.exe nsis_installer_1 static1/unpack001/KSI RFQ-20240732AB.exe nsis_installer_2
File Explorer
-
KSI RFQ-20240732AB.tgz.rar 418KB
-
KSI RFQ-20240732AB.exe.exe 509KB
-
$PLUGINSDIR/System.dll.dll 11KB
-
$PLUGINSDIR/nsExec.dll.dll 6KB
-
Actinometre/sammenkogt.ren216KB
-
Actinometre/stipendiets.aec442KB
-
Another.Bel78215KB
-
Medindflydelsens148.txt373B
-
blanklaksene.num331KB
-
traverseringers.Wha67KB
KSI RFQ-20240732AB.exe
- IMPHASH ea4e67a31ace1a72683a99b80cf37830
- SHA256 e26a2e19e50d80e946bc61c92fe1fcfa53572bfc5494289d36d9126143d92663
- MD5 8219db83bdd90d0a123efdf6800f2050
- SHA1 454c190f0635ff504a83d459e0034ebdf877b63d
- SHA512 b539215e3c7d4d5c62e68c05d76dd4bace557fc3185f7a149a2a5ae90698b036f0b78f0f2d9e622e806ec358d81107fc2b7ccffd329905133adfd605882d1fd3
- SSDEEP 6144:OPXmDTGDND3MmPNRv8+lmrKyARexVib4bZmGuqMqtEmCMAruHvg8R02kA7WtrAA6:nDS180TAAReWJ1qMGY4nR/foncEgke9
- MD5 SHA1 SHA512 SSDEEP
-
NSIS installer
PE Signature issue
Digest
b9:65:4b:d1:6b:54:05:b7:3e:27:a0:c5:e6:36:ee:1c:26:e0:3b:48:21:76:63:13:a5:66:d8:00:08:7d:f8:c6
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Mohikanere Anskueliggoeres Moderbindingerne\ ,O=Begribelses,L=Vineland,ST=New Jersey,C=US
Chains
Jul 26, 2024
PE Signature issue
Digest
46:c5:04:b6:63:1d:b0:d0:5a:a5:c9:92:c4:f6:99:43:4c:bc:d8:44
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Mohikanere Anskueliggoeres Moderbindingerne\ ,O=Begribelses,L=Vineland,ST=New Jersey,C=US
Chains
Jul 26, 2024
Subject
CN=Mohikanere Anskueliggoeres Moderbindingerne\ ,O=Begribelses,L=Vineland,ST=New Jersey,C=US
Serial Number
5b:93:98:b0:a9:a6:00:fe:a9:21:29:ff:d0:34:c8:3b:c4:a6:1f:e6
Issuer
CN=Mohikanere Anskueliggoeres Moderbindingerne\ ,O=Begribelses,L=Vineland,ST=New Jersey,C=US
Timespan
Nov 28, 2023 - Nov 27, 2026
Subject
CN=Mohikanere Anskueliggoeres Moderbindingerne\ ,O=Begribelses,L=Vineland,ST=New Jersey,C=US
Serial Number
5b:93:98:b0:a9:a6:00:fe:a9:21:29:ff:d0:34:c8:3b:c4:a6:1f:e6
Issuer
CN=Mohikanere Anskueliggoeres Moderbindingerne\ ,O=Begribelses,L=Vineland,ST=New Jersey,C=US
Timespan
Nov 28, 2023 - Nov 27, 2026
Minor OS version
0
Major OS version
4
Entry point
13409
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
advapi32
RegCreateKeyExA
RegEnumKeyA
RegQueryValueExA
RegSetValueExA
RegCloseKey
RegDeleteValueA
RegDeleteKeyA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
SetFileSecurityA
RegOpenKeyExA
RegEnumValueA
shell32
SHGetFileInfoA
SHFileOperationA
SHGetPathFromIDListA
ShellExecuteExA
SHGetSpecialFolderLocation
SHBrowseForFolderA
ole32
IIDFromString
OleInitialize
OleUninitialize
CoCreateInstance
CoTaskMemFree
comctl32
ord17
ImageList_Create
ImageList_Destroy
ImageList_AddMasked
user32
SetClipboardData
CharPrevA
CallWindowProcA
PeekMessageA
DispatchMessageA
MessageBoxIndirectA
GetDlgItemTextA
SetDlgItemTextA
GetSystemMetrics
CreatePopupMenu
AppendMenuA
TrackPopupMenu
FillRect
EmptyClipboard
LoadCursorA
GetMessagePos
CheckDlgButton
GetSysColor
SetCursor
GetWindowLongA
SetClassLongA
SetWindowPos
IsWindowEnabled
GetWindowRect
GetSystemMenu
EnableMenuItem
RegisterClassA
ScreenToClient
EndDialog
GetClassInfoA
SystemParametersInfoA
CreateWindowExA
ExitWindowsEx
DialogBoxParamA
CharNextA
SetTimer
DestroyWindow
CreateDialogParamA
SetForegroundWindow
SetWindowTextA
PostQuitMessage
SendMessageTimeoutA
ShowWindow
wsprintfA
GetDlgItem
FindWindowExA
IsWindow
GetDC
SetWindowLongA
LoadImageA
InvalidateRect
ReleaseDC
EnableWindow
BeginPaint
SendMessageA
DefWindowProcA
DrawTextA
GetClientRect
EndPaint
IsWindowVisible
CloseClipboard
OpenClipboard
gdi32
SetBkMode
SetBkColor
GetDeviceCaps
CreateFontIndirectA
CreateBrushIndirect
DeleteObject
SetTextColor
SelectObject
kernel32
GetExitCodeProcess
WaitForSingleObject
GetProcAddress
GetSystemDirectoryA
WideCharToMultiByte
MoveFileExA
GetTempFileNameA
RemoveDirectoryA
WriteFile
CreateDirectoryA
GetLastError
CreateProcessA
GlobalLock
GlobalUnlock
CreateThread
lstrcpynA
SetErrorMode
GetDiskFreeSpaceA
lstrlenA
GetCommandLineA
GetVersion
GetWindowsDirectoryA
SetEnvironmentVariableA
GetTempPathA
CopyFileA
GetCurrentProcess
ExitProcess
GetModuleFileNameA
GetFileSize
ReadFile
GetTickCount
Sleep
CreateFileA
GetFileAttributesA
SetCurrentDirectoryA
SetFileAttributesA
GetFullPathNameA
GetShortPathNameA
MoveFileA
CompareFileTime
SetFileTime
SearchPathA
lstrcmpiA
lstrcmpA
CloseHandle
GlobalFree
GlobalAlloc
ExpandEnvironmentStringsA
LoadLibraryExA
FreeLibrary
lstrcpyA
lstrcatA
FindClose
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
SetFilePointer
GetModuleHandleA
FindNextFileA
FindFirstFileA
DeleteFileA
MulDiv
Name
.text
Size
25KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
106KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
88KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
99KB
Virtual Size
99KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=160, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
$PLUGINSDIR/System.dll
- IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
- SHA256 6fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e
- MD5 fccff8cb7a1067e23fd2e2b63971a8e1
- SHA1 30e2a9e137c1223a78a0f7b0bf96a1c361976d91
- SHA512 f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c
- SSDEEP 192:xPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4v:g7VpNo8gmOyRsVc4
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
10529
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
MultiByteToWideChar
GlobalFree
GlobalSize
lstrcpynA
lstrcpyA
GetProcAddress
VirtualFree
FreeLibrary
lstrlenA
LoadLibraryA
GetModuleHandleA
GlobalAlloc
WideCharToMultiByte
VirtualAlloc
VirtualProtect
GetLastError
user32
wsprintfA
ole32
StringFromGUID2
CLSIDFromString
Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc
Name
.text
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
867B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
104B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1024B
Virtual Size
636B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=14, version=7299,
count=19, id=1, productName=Unmarked objects,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=4, id=48, version=9044,
count=1, id=42, version=8803,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
$PLUGINSDIR/nsExec.dll
- IMPHASH e269b6260a93a17ceff5184b3982ded8
- SHA256 114c6941a8b489416c84563e94fd266ea5cad2b518db45cd977f1f9761e00cb1
- MD5 09c2e27c626d6f33018b8a34d3d98cb6
- SHA1 8d6bf50218c8f201f06ecf98ca73b74752a2e453
- SHA512 883454bef7b6de86d53af790755ae624f756b48b23970f865558ba03a5aecfa8d15f14700e92b3c51546e738c93e53dc50b8a45f79ef3f00aa84382853440954
- SSDEEP 96:pBNUBGfVwhcAlhPRJAixx+3eDEsgcBbcB/NFyVOHd0+uisX4:qBGfV5AlJJfFgcBbcB/N8Ved0P
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4231
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
advapi32
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
user32
wsprintfA
SendMessageA
CharNextA
OemToCharBuffA
FindWindowExA
CharNextExA
CharPrevA
kernel32
GetVersion
lstrcmpiA
lstrlenA
lstrcpynA
ExitProcess
Sleep
TerminateProcess
GlobalReAlloc
ReadFile
PeekNamedPipe
GetExitCodeProcess
WaitForSingleObject
GetTickCount
lstrcpyA
CreateProcessA
GetStartupInfoA
CreatePipe
CreateFileA
DeleteFileA
CopyFileA
GetCommandLineA
lstrcatA
CloseHandle
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
GlobalAlloc
GetTempFileNameA
GlobalFree
GetModuleHandleA
GetModuleFileNameA
GetProcAddress
GetCurrentProcess
Exec
ExecToLog
ExecToStack
Name
.text
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
432B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=44, id=1, productName=Unmarked objects,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=2, id=48, version=9044,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
Actinometre/sammenkogt.ren
- SHA256 f8a781776798f71b643af56715cad9c8ec9879ade16793312ee2e8e073d292a6
- MD5 40868df8f1aaf06e4883e4d719576f21
- SHA1 2e0626a69d4623a6236cd8aa71ecfe9323284265
- SHA512 278490117d74db9a0fac83cfcd6ab4f05340b6f5f6c818846eae5d1a039e4e6fce204bffcb346f9aeb68bc6ce5014e6d574f1af8af5e371acf65e6957c653fe3
- SSDEEP 768:FQe9UUXrS3QN5r8OAXE98ttCeyGFeQqFOXVpk/KFdihSq++oyvOM4sdOufzv9:FkN3tk6a4t
- MD5 SHA1 SHA512 SSDEEP
Actinometre/stipendiets.aec
- SHA256 589f56a70b8707de5ec99bfb737508b9aba5395274c01c41b2f4fdaf4a5e11fc
- MD5 a54539fa6b35838d192c8ff73ff45958
- SHA1 7cdcbece9e35d9069e78aa91dcc478431845c240
- SHA512 d88b37d6cfc9768c3ec54eda6f2fe5de94b7d6aa153fb754f731b541901167a5fca0aa523fdf93f6511f406ea42e2015d938b00c420adf6628d6c6a8afcb86e8
- SSDEEP 768:Lfe5ThjUHFJ83geEvZcqs+V+iWFmlwsMD9aw4Y9XWt7V5pne8JLvg9x0WTglVZ4N:rog3x9eko0beJMK1kbBU/B0ax6
- MD5 SHA1 SHA512 SSDEEP
Another.Bel78
- SHA256 71e187268a8eda6c5cb5e617c225efafea9919127ea9e091552c3156e39bad49
- MD5 1388f4cf346e0357facd31bd1b45679e
- SHA1 9392ae07b7243cf353bdef41aeebad594940bcb1
- SHA512 5b1edef1523d52d1f55b4ec95b3e110522921576bfcf7538ffd8a5270ffacd63f2f52485456859a95b8aa9281b36795b58475b47b4c8b76f6fe8541181c48ed0
- SSDEEP 3072:0SISkkgz1cpMm6HH0lyZSZ/HWMID7YXwt96NpWREy3BCgwgtnabSM6ZOsmN:0xSyapvG0Yc/HWMSUVBMdwgwdsOsmN
- MD5 SHA1 SHA512 SSDEEP
Medindflydelsens148.txt
- SHA256 86bc83dcc00030c4a4d5c01eafab86ec5309400900cbb9099dc63302f1199016
- MD5 f5d23a0183e9986941862d5bfbce55a7
- SHA1 eb20b613cbff5fc0290d8deae4bb25ee1c4fb82f
- SHA512 a07f1571f4afcaa1d577c6b3d40ba66e4e43aae9891bc199b15505da9b47390a32aacc175622228f91b77522f15d70f71ea01d8e3bebca605f32fd13188b588a
- MD5 SHA1 SHA512
blanklaksene.num
- SHA256 2792877a191c549cdf0c7f4cdb5fb44e323b8c9525fe0d16d884418c87073161
- MD5 3c5d4f1442146755823a1c3e6e8abd0d
- SHA1 9c7a0e6cbb3f3940e860444ebc38191ff096dc84
- SHA512 7c9942b290f7ff9a7b4299814501a11a927ec22674e368beb668baed7a3b052d1b0dc7bcbd1e23bf841c045f61f6dc243568d450938b687750f1b04ed1abee47
- SSDEEP 1536:w8cuH5oEsjoCcPAO1DStVxlls2vwnl5Vdus+:dZoyTAwetBlvwlF+
- MD5 SHA1 SHA512 SSDEEP
traverseringers.Wha
- SHA256 ab4ccc7a39132b19406824ed3561bc53574fb22bae64ef55afb1dec6dcfc89d7
- MD5 f7f92de5f2d357f0dafa979b519ce4b2
- SHA1 62a193ba38e10f7387e9a06b4e1aadca2bffea4f
- SHA512 9ef2c15fe6c6eccef2d5cc93e0f68c158340e71da6b71fc9a257e37c2337674e9b269b23e574fec94c62fd73e59bf84c43dde9357a01a931a8cbdd587346171d
- SSDEEP 1536:UNwiXXrXOwxQIFmy2Up7mZ3rUlnQzqEW1lcs:kOGFT9
- MD5 SHA1 SHA512 SSDEEP