3c39b200b1fe812d8d7c7b6b778692aba434d218eda4dc88ed22ba58d36d89d7
- SHA256 3c39b200b1fe812d8d7c7b6b778692aba434d218eda4dc88ed22ba58d36d89d7
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
IMG_TENTATIVE_AUDIT_PLAN.exe
Resource
win7-20240708-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
IMG_TENTATIVE_AUDIT_PLAN.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
22 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win7-20240704-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240708-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target 3c39b200b1fe812d8d7c7b6b778692aba434d218eda4dc88ed22ba58d36d89d7
- Size 333KB
- Sample240807-l2ql5azfma
- SHA256 3c39b200b1fe812d8d7c7b6b778692aba434d218eda4dc88ed22ba58d36d89d7
- MD5 561e264bc7a0081352f3ebf2c4a13329
- SHA1 8fb521e2a2a52eb3d46a95e361468f621db3babb
- SHA512 8e9985d5df4da1fca333146ba16ce32068f1f1d716b32218b0bf28738e3bb35bfb613c00cf301233a73cd9fd529822ba2dc1974c47a8549c7041b41bfbede123
- SSDEEP 6144:mCWVaxwxGYkDKT8l1mO+7WDrHe+nYHR6JrtWmSjjMo3rKS95EX3AkWpysUJR:mCWUSniUtaDq+YutWDprKdHYfGR
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack002/$PLUGINSDIR/LangDLL.dll unpack002/$PLUGINSDIR/System.dll
File Explorer
-
3c39b200b1fe812d8d7c7b6b778692aba434d218eda4dc88ed22ba58d36d89d7.7z 333KB
-
IMG_TENTATIVE_AUDIT_PLAN.exe.exe 505KB
-
$PLUGINSDIR/LangDLL.dll.dll 5KB
-
$PLUGINSDIR/System.dll.dll 12KB
-
Opspring.dia8KB
-
Overfamiliarly.lit1KB
-
Unblighted.Ast122KB
-
cuddled.txt469B
-
demephitize.Men302KB
-
nsec.tar6KB
-
piggy.riv9KB
-
produktionskden.slu7KB
IMG_TENTATIVE_AUDIT_PLAN.exe
- IMPHASH 6e7f9a29f2c85394521a08b9f31f6275
- SHA256 41e39c9347ae609ed82773dcf1c9a94848e6351dd1d93ca6d69225d684dba6d2
- MD5 0c926d01a5dd053c5923cd8c9f4d2e41
- SHA1 3b0663393acd23c388cd7cfb0c6b667a03be52f4
- SHA512 17191e955a26ba7f9473668a8fffd2d5207a5b3e18fd31876fdf5fabf3b5ce5bae6c7eba53e02af75153c8c0686450db780d521592b00a86ff9ecf38d142330f
- SSDEEP 6144:pMm4CCdCDZ+0Ci5kDTT8l12N+7dDSHenzHR6JrtWmSMjMojWmSL5/X/caW4ysgA:pMw4Cc0CajEopDJzutWs1WmAPM0j
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
17:9c:9e:6e:b3:aa:c0:30:fd:0b:af:89:26:45:31:9b:1c:92:33:ed:c8:d7:9b:b2:36:04:85:70:68:99:b5:ee
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Rosinweed Periphasis Bardlet\ ,O=Embowed,L=Lynchburg,ST=Ohio,C=US
Chains
Aug 5, 2024
Subject
CN=Rosinweed Periphasis Bardlet\ ,O=Embowed,L=Lynchburg,ST=Ohio,C=US
Serial Number
1a:d5:56:bc:f1:b0:96:18:4d:69:b7:ef:f3:52:87:ce:94:1a:0d:68
Issuer
CN=Rosinweed Periphasis Bardlet\ ,O=Embowed,L=Lynchburg,ST=Ohio,C=US
Timespan
Jul 17, 2024 - Jul 17, 2027
Minor OS version
0
Major OS version
4
Entry point
13455
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
advapi32
RegCreateKeyExW
RegEnumKeyW
RegQueryValueExW
RegSetValueExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
SetFileSecurityW
RegOpenKeyExW
RegEnumValueW
shell32
SHGetSpecialFolderLocation
SHFileOperationW
SHBrowseForFolderW
SHGetPathFromIDListW
ShellExecuteExW
SHGetFileInfoW
ole32
OleInitialize
OleUninitialize
CoCreateInstance
IIDFromString
CoTaskMemFree
comctl32
ord17
ImageList_Create
ImageList_Destroy
ImageList_AddMasked
user32
GetClientRect
EndPaint
DrawTextW
IsWindowEnabled
DispatchMessageW
wsprintfA
CharNextA
CharPrevW
MessageBoxIndirectW
GetDlgItemTextW
SetDlgItemTextW
GetSystemMetrics
FillRect
AppendMenuW
TrackPopupMenu
OpenClipboard
SetClipboardData
CloseClipboard
IsWindowVisible
CallWindowProcW
GetMessagePos
CheckDlgButton
LoadCursorW
SetCursor
GetWindowLongW
GetSysColor
SetWindowPos
PeekMessageW
SetClassLongW
GetSystemMenu
EnableMenuItem
GetWindowRect
ScreenToClient
EndDialog
RegisterClassW
SystemParametersInfoW
CreateWindowExW
GetClassInfoW
DialogBoxParamW
CharNextW
ExitWindowsEx
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
FindWindowExW
IsWindow
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
ReleaseDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
EmptyClipboard
CreatePopupMenu
gdi32
SetBkMode
SetBkColor
GetDeviceCaps
CreateFontIndirectW
CreateBrushIndirect
DeleteObject
SetTextColor
SelectObject
kernel32
GetExitCodeProcess
WaitForSingleObject
GetModuleHandleA
GetProcAddress
GetSystemDirectoryW
lstrcatW
Sleep
lstrcpyA
WriteFile
GetTempFileNameW
CreateFileW
lstrcmpiA
RemoveDirectoryW
CreateProcessW
CreateDirectoryW
GetLastError
CreateThread
GlobalLock
GlobalUnlock
GetDiskFreeSpaceW
WideCharToMultiByte
lstrcpynW
lstrlenW
SetErrorMode
GetVersion
GetCommandLineW
GetTempPathW
GetWindowsDirectoryW
SetEnvironmentVariableW
ExitProcess
CopyFileW
GetCurrentProcess
GetModuleFileNameW
GetFileSize
GetTickCount
MulDiv
SetFileAttributesW
GetFileAttributesW
SetCurrentDirectoryW
MoveFileW
GetFullPathNameW
GetShortPathNameW
SearchPathW
CompareFileTime
SetFileTime
CloseHandle
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalFree
GlobalAlloc
GetModuleHandleW
LoadLibraryExW
MoveFileExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
lstrlenA
MultiByteToWideChar
ReadFile
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW
Name
.text
Size
25KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
128KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
184KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
168KB
Virtual Size
168KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=165, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
$PLUGINSDIR/LangDLL.dll
- IMPHASH 3e8d18bb71c7ebbda2ddc2a4bb03547b
- SHA256 4883cd4231744be2dca4433ef62824b7957a3c16be54f8526270402d9413ebe6
- MD5 08de81a4584f5201086f57a7a93ed83b
- SHA1 266a6ecc8fb7dca115e6915cd75e2595816841a8
- SHA512 b72e7cea5ce1f4dc64e65a1f683a3ef9e3fa2dc45cf421f569eb461f1fdcc0caf4ff62a872e62b400579f567c6ff9fc3c2e6e020cdca89d96015502c803a09b9
- SSDEEP 48:S46+/1TKYKxbWsptIpBtWZ0iV8jAWiAJCvxft2O2B8mLofjLl:zHuPbOBtWZBV8jAWiAJCdv2CmeL
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5439
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
lstrlenW
GlobalFree
lstrcpynW
lstrcmpW
GlobalAlloc
MulDiv
GetModuleHandleW
lstrcpyW
user32
DialogBoxParamW
SetDlgItemTextW
SendDlgItemMessageW
EndDialog
SetWindowTextW
LoadIconW
ShowWindow
SendMessageW
GetDC
gdi32
GetDeviceCaps
CreateFontIndirectW
DeleteObject
LangDialog
Name
.text
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
681B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
352B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
352B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=23, id=1, productName=Unmarked objects,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=2, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
$PLUGINSDIR/System.dll
- IMPHASH fc0224e99e736751432961db63a41b76
- SHA256 acf90ab6f4edc687e94aaf604d05e16e6cfb5e35873783b50c66f307a35c6506
- MD5 6e55a6e7c3fdbd244042eb15cb1ec739
- SHA1 070ea80e2192abc42f358d47b276990b5fa285a9
- SHA512 2d504b74da38edc967e3859733a2a9cacd885db82f0ca69bfb66872e882707314c54238344d45945dc98bae85772aceef71a741787922d640627d3c8ae8f1c35
- SSDEEP 192:MenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XBaIwL:M8+Qlt70Fj/lQRY/9VjjgL
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
10719
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetModuleHandleW
GlobalFree
GlobalSize
lstrcpynW
lstrcpyW
GetProcAddress
WideCharToMultiByte
VirtualFree
FreeLibrary
lstrlenW
LoadLibraryW
GlobalAlloc
MultiByteToWideChar
VirtualAlloc
VirtualProtect
GetLastError
user32
wsprintfW
ole32
StringFromGUID2
CLSIDFromString
Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc
Name
.text
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
867B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
120B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1024B
Virtual Size
648B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=14, version=7299,
count=20, id=1, productName=Unmarked objects,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=4, id=48, version=9044,
count=1, id=42, version=8803,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
Opspring.dia
- SHA256 bd2421d6c1b53d016f7c61004bfa7640a36a25686d29d87372d736e241ad5314
- MD5 82a269f5bae8475eacd0e5cf4c7fa6db
- SHA1 e50aa449bfeab5c72eb98bf0f98d16c7b5846e23
- SHA512 896244a0c5819e2d4979529797fab0b801fe4ca13dbf7039531ed157b8c4f55c512447878c5cc764fc78c1d01300894c038996d31ce66099deb930cfaa730a8b
- SSDEEP 192:MVenofP5CL1Vkht0EjXViZ/jjRI6CUwHC6dqSAzZ+PHPwEc2VO:9s5CLwIaXkZLjMrC2EZ+PvwX
- MD5 SHA1 SHA512 SSDEEP
Overfamiliarly.lit
- SHA256 4336f9f5f28e007e6a48a5b2078d04fcbfabddf8fa91c7a1a1496965459600f2
- MD5 19ad849311a96a6e4cf732f801e4e82f
- SHA1 097a4d680e6ec048650497bf0a5de57045435ac2
- SHA512 4b454937708f04506e2444434b005badd21cc7d901d72cd3ddfbb97e74c617d1a6558613c2ba6921c3c3c8818f920d6d635f82ca4a7037b37d87192fd45ee0b3
- MD5 SHA1 SHA512
Unblighted.Ast
- SHA256 2ed308a19b4d5e895fdc6423915b25b9444f982ea89f8dfa555142d9bf9a70a0
- MD5 49a58629dddcecde7fa35655a5e5d4a8
- SHA1 1b7b47e89a79fef816686c2dd477ee2a4843fecd
- SHA512 e0b3355a8dd02fc5f9fd42030218e210ae2f36f5afaff48b4d7a6e3a2ea57361e77d8ed93c518db182371edfd0ffeacb44798a653e5f4f18d6e3a52176958677
- SSDEEP 1536:cCxgTF/Hze7aeHcFrG4/wopdfIYKROMPg2Sx68zCcnVo0KwMj0rO2rXAq2Zk:xUFaLc0swopap5g3oozrr
- MD5 SHA1 SHA512 SSDEEP
cuddled.txt
- SHA256 17931d5fa3f3e93fe13344de61e8239d41a1b7b603493f07aa5a04d131557592
- MD5 3483fab1a78f10e7784ca3ca3150b2ca
- SHA1 fe5e671a0a0d3b278bef62e29d3bc95a6b842b82
- SHA512 ec6d70b3f03dfd8ae89112e66a07847597d7d1d3b6a508fb396ddf0b7e69ff6109ea1929dd904d5fe6b7dc41fe79d599e05e3869483838416f95a0adb663d670
- MD5 SHA1 SHA512
demephitize.Men
- SHA256 fd9485108d7c5ab63c8ee4bc337e8b26801d0a190c00bb66c777de642426d568
- MD5 c47ae7c3bac521fa95dac329d73a0dbe
- SHA1 456fee362f0827b508b36719b6d5134209eb385a
- SHA512 df34b6bf943d86904d42e2d8ddb6c654de58afe444b849068c2da8fc8152025008706aba7bbc826c958cbe6e1059be50b140604d7123c4232746226660505c53
- SSDEEP 6144:aTrrVNnArMRWNEw/yakmWWBG50IanI8K2XxAG6AM/HPeQ8Ok:SrVNnaXDdW8r98wxAG6rPGQ8Ok
- MD5 SHA1 SHA512 SSDEEP
nsec.tar
- SHA256 8f73ab5e525b86591b138f15fd4315876f07f0222683711d84a56966c5901a9f
- MD5 39dcabfd6c10c19cc2d532b2c03e57ea
- SHA1 1b2813c18ff9f2f6344704133e579a70d623f0e2
- SHA512 2c63bdde2fcc891fdb41fc45d46dad3083828512704533e427ffc1d1c8a04140be96bfbfa6d4277b9ee2ad73983350452526583c38d0a2efe1631413f8e1eb26
- SSDEEP 96:YPAr4BCbpOje1kysgOM27luhZl9ubZmlRe9zKOfTKeDxy8nO433trIO8syU+B8:Y4rSje1FI85uU78hTTDUB433tkGCu
- MD5 SHA1 SHA512 SSDEEP
piggy.riv
- SHA256 706a3591732ab4fc5a227386e6c3b32592f9a5467327c876d45a3070035c844b
- MD5 0843d03d3c1cc92613470216de0ef1a1
- SHA1 ac8e656c3a2044b4fc51b38ba985e57eabf0b995
- SHA512 afdf0c65fd83f494a9d2a7094614d66608d7eef0e5427c74d2c2e787f3338c0c530a57055b5e3db5ac90c0c6cbc4f683d3c590e5477260bd7f9edb141a41b7cc
- SSDEEP 192:A9k5U5K4UkC9ZN17ktv4u2vwusr8JwlHRPguH48XsSNdJOAosgASLfljirw:AsMtlCHTwCu29K8uJRhH488oJ4MSzc0
- MD5 SHA1 SHA512 SSDEEP
produktionskden.slu
- SHA256 d757263bdbcdb4ae46691df9bcb12e168f745a5716a9feea75c20e359e2ad2af
- MD5 2bb28d61ddf2533ccbb803ddbe326bdc
- SHA1 8b7c2571f544ec2aed6ac232d561fee3016d99c8
- SHA512 66ddbf35ba173a8dcc8204426e66200436347890d2154a8bc604cdbe2da59577dcc35156d1a4ce46cf1e775d0e9aa6e875c28841b4f7adc78a77c7501e285cc8
- SSDEEP 192:cvQVyl9vo9vkEB/g8s5GI4SGvPEu/mVI1PVpb80:c4V4xbEdR8T4SaFuVI7
- MD5 SHA1 SHA512 SSDEEP