e9ac7b75d3fce7318121fd04c86910feffebde6020e7c7965b045d8c1db7a67a.unknown
- SHA256 e9ac7b75d3fce7318121fd04c86910feffebde6020e7c7965b045d8c1db7a67a
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
PaymentAdvice_SWIFT _USD39060-AUG-7-070224-000214.scr
Resource
win7-20240705-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
PaymentAdvice_SWIFT _USD39060-AUG-7-070224-000214.scr
Resource
win10v2004-20240802-en
windows10-2004-x64
17 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240708-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target e9ac7b75d3fce7318121fd04c86910feffebde6020e7c7965b045d8c1db7a67a.unknown
- Size 434KB
- Sample240809-b4f6csyamf
- SHA256 e9ac7b75d3fce7318121fd04c86910feffebde6020e7c7965b045d8c1db7a67a
- MD5 548bb6b836b991e17cc43b896c5cf62f
- SHA1 29a1d58e82b038ae4499d146f5d5a5f31325ea4a
- SHA512 432ab63a366231c3b3e89f28dfd9244b72c28169cd905480d2672ead08b60eb8db20464489a2dc7605bc8d2c8303220657e481c9cc848c6c321147a86e665553
- SSDEEP 12288:TG1mA15zcyckwtPdHh9GIAyq2+2ojf822:Tw3UL6U+2ojf822
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack003/$PLUGINSDIR/System.dll
File Explorer
-
e9ac7b75d3fce7318121fd04c86910feffebde6020e7c7965b045d8c1db7a67a.unknown.bz2 434KB
-
sample.tar 508KB
-
PaymentAdvice_SWIFT _USD39060-AUG-7-070224-000214.scr.exe 506KB
-
$PLUGINSDIR/System.dll.dll 12KB
-
Arvens.Kom137KB
-
Illitterres/germayne.txt580B
-
Illitterres/inoriginate.mbl8KB
-
Illitterres/middelmaadighed.sty4KB
-
Illitterres/pokalturnerings.are5KB
-
Laurbrkransene.pri8KB
-
Regulariser/Nagas.udv2KB
-
Vedhftende.Rat392KB
sample
- SHA256 80cda742d9991ff253d47e7a0c36a93f15a4fc9906823caa50f0280e64f66cd4
- MD5 90ff33d42f64cc44348a5a8bff511273
- SHA1 962e6c2a294972f2514e48b5ced66c892ad0b021
- SHA512 d9e351429e8b1fd438b6a50ae41ecf97c0b14821c6780a5c7f64a10c94d71d7ccf6dbe132e7a85b6a0c508f636a857274a114d0f0aa0c65ecf88c64ba8175f57
- SSDEEP 12288:vHadbvM/N20WJ2kva9YffxVTo1AXwcGHswMi1XZ3f88:PadLM/N7WJ2qZV01AFGMwMQU
- MD5 SHA1 SHA512 SSDEEP
PaymentAdvice_SWIFT _USD39060-AUG-7-070224-000214.scr
- IMPHASH 9dda1a1d1f8a1d13ae0297b47046b26e
- SHA256 b81db352466d0a651374b1be399fc2f1b02b638c9a1786a2556d5d7919d2486e
- MD5 e0c9e77759bee166680888c7417a358f
- SHA1 f28e61ee3a03d315962e72e4f9875281f39fc4d6
- SHA512 8fc2324f1040bb52d5ba03d367682a9caae24c769264958822e4efa613183bc3d30940f6b7d3179fc985e80b7ea5a0b0563a16505d64bfa8ad79d22fad9b6523
- SSDEEP 12288:mHadbvM/N20WJ2kva9YffxVTo1AXwcGHswMi1XZ3f88:aadLM/N7WJ2qZV01AFGMwMQU
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
07:01:e5:b0:c4:c5:22:84:59:5d:00:60:1a:e4:25:44:af:5e:a1:2e:a3:56:f5:2e:22:33:44:3a:bf:7a:58:a3
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Ununiformly Udstationerer\ ,O=Vornedskabers,L=Montigny-sur-l'Hallue,ST=Hauts-de-France,C=FR
Chains
Aug 5, 2024
PE Signature issue
Digest
0f:76:08:c4:62:56:de:9e:18:4a:a2:02:17:0a:8e:7c:1d:f8:9b:f3
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Ununiformly Udstationerer\ ,O=Vornedskabers,L=Montigny-sur-l'Hallue,ST=Hauts-de-France,C=FR
Chains
Aug 5, 2024
Subject
CN=Ununiformly Udstationerer\ ,O=Vornedskabers,L=Montigny-sur-l'Hallue,ST=Hauts-de-France,C=FR
Serial Number
4c:93:a5:2b:60:68:3c:fd:34:52:3d:ed:f6:75:46:0c:2f:d0:d1:d3
Issuer
CN=Ununiformly Udstationerer\ ,O=Vornedskabers,L=Montigny-sur-l'Hallue,ST=Hauts-de-France,C=FR
Timespan
Jun 4, 2024 - Jun 4, 2027
Subject
CN=Ununiformly Udstationerer\ ,O=Vornedskabers,L=Montigny-sur-l'Hallue,ST=Hauts-de-France,C=FR
Serial Number
4c:93:a5:2b:60:68:3c:fd:34:52:3d:ed:f6:75:46:0c:2f:d0:d1:d3
Issuer
CN=Ununiformly Udstationerer\ ,O=Vornedskabers,L=Montigny-sur-l'Hallue,ST=Hauts-de-France,C=FR
Timespan
Jun 4, 2024 - Jun 4, 2027
Minor OS version
0
Major OS version
4
Entry point
13925
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
advapi32
RegEnumValueW
RegEnumKeyW
RegQueryValueExW
RegSetValueExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
RegOpenKeyExW
RegCreateKeyExW
shell32
SHGetPathFromIDListW
SHBrowseForFolderW
SHGetFileInfoW
SHFileOperationW
ShellExecuteExW
ole32
CoCreateInstance
OleUninitialize
OleInitialize
IIDFromString
CoTaskMemFree
comctl32
ImageList_Destroy
ord17
ImageList_AddMasked
ImageList_Create
user32
MessageBoxIndirectW
GetDlgItemTextW
SetDlgItemTextW
CreatePopupMenu
AppendMenuW
TrackPopupMenu
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
IsWindowVisible
CallWindowProcW
GetMessagePos
CheckDlgButton
LoadCursorW
SetCursor
GetSysColor
SetWindowPos
GetWindowLongW
IsWindowEnabled
SetClassLongW
GetSystemMenu
EnableMenuItem
GetWindowRect
ScreenToClient
EndDialog
RegisterClassW
SystemParametersInfoW
CharPrevW
GetClassInfoW
DialogBoxParamW
CharNextW
ExitWindowsEx
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
FindWindowExW
IsWindow
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
ReleaseDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
GetClientRect
FillRect
DrawTextW
EndPaint
CharNextA
wsprintfA
DispatchMessageW
CreateWindowExW
PeekMessageW
GetSystemMetrics
gdi32
GetDeviceCaps
SetBkColor
SelectObject
DeleteObject
CreateBrushIndirect
CreateFontIndirectW
SetBkMode
SetTextColor
kernel32
RemoveDirectoryW
lstrcmpiA
GetTempFileNameW
CreateProcessW
CreateDirectoryW
GetLastError
CreateThread
GlobalLock
GlobalUnlock
GetDiskFreeSpaceW
WideCharToMultiByte
lstrcpynW
lstrlenW
SetErrorMode
GetVersionExW
GetCommandLineW
GetTempPathW
GetWindowsDirectoryW
SetEnvironmentVariableW
WriteFile
ExitProcess
GetCurrentProcess
GetModuleFileNameW
GetFileSize
CreateFileW
GetTickCount
Sleep
SetFileAttributesW
GetFileAttributesW
SetCurrentDirectoryW
MoveFileW
GetFullPathNameW
GetShortPathNameW
SearchPathW
CompareFileTime
SetFileTime
CloseHandle
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalFree
GlobalAlloc
GetModuleHandleW
LoadLibraryExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
lstrlenA
MultiByteToWideChar
ReadFile
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW
MulDiv
lstrcpyA
MoveFileExW
lstrcatW
GetSystemDirectoryW
GetProcAddress
GetModuleHandleA
GetExitCodeProcess
WaitForSingleObject
CopyFileW
Name
.text
Size
26KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
126KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
144KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
102KB
Virtual Size
102KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=163, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
$PLUGINSDIR/System.dll
- IMPHASH 509a34b3a68a773e0afb4259e68f9f82
- SHA256 23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6
- MD5 192639861e3dc2dc5c08bb8f8c7260d5
- SHA1 58d30e460609e22fa0098bc27d928b689ef9af78
- SHA512 6e573d8b2ef6ed719e271fd0b2fd9cd451f61fc9a9459330108d6d7a65a0f64016303318cad787aa1d5334ba670d8f1c7c13074e1be550b4a316963ecc465cdc
- SSDEEP 192:ljHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZqE0QPi:R/Qlt7wiij/lMRv/9V4bfr
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
10879
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GlobalAlloc
GlobalFree
GlobalSize
lstrcpynW
lstrcpyW
GetProcAddress
WideCharToMultiByte
VirtualFree
FreeLibrary
lstrlenW
LoadLibraryW
GetModuleHandleW
MultiByteToWideChar
VirtualAlloc
VirtualProtect
GetLastError
user32
wsprintfW
ole32
StringFromGUID2
CLSIDFromString
Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc
Name
.text
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
867B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
120B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1024B
Virtual Size
662B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=14, version=7299,
count=20, id=1, productName=Unmarked objects,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=4, id=48, version=9044,
count=1, id=42, version=8803,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
Arvens.Kom
- SHA256 b012218fb42450c1bda13268fc9a8ba35595dd15c5847ab84c871e0ee51e4e58
- MD5 b27a8a0bd03c8521c12805a6ddab9316
- SHA1 2dbd49a6edcc8a75d9ae2ec94299f790c6de099b
- SHA512 b6215ad84dec6abd660b82099f1c5fea6020ca3179c4797f30383b9d1d906a0506d27c23a24e942b5252ca94e14232c71e87bb0bcc5892ee89c0828c05b827e9
- SSDEEP 1536:W4LPqUbkBBSyq+BPdRbnAk70x96x8I4XsJKIZB8FOCo8P7T0wSZRhkLImfdlTK3v:WGyUIBH/ldRbr0E8L28w8jT0wa8ImGhJ
- MD5 SHA1 SHA512 SSDEEP
Illitterres/germayne.txt
- SHA256 2130fd2e69bec09906f7d0997d0cabaa46fefd171a8a59b86ae64d9e1b012e43
- MD5 6dfd2500492018d81e890f5051c84841
- SHA1 76ae538de134f2efe584706f6dd25dcd35417cc4
- SHA512 93cb93eeda8e53540619ab8102648062342e8cbe5d2088df3e68b07a3a4a5e2596e627197523a8109d4f101a0fe4246b484fdc6c8a7834bfcbfd1ffeaa54221c
- MD5 SHA1 SHA512
Illitterres/inoriginate.mbl
- SHA256 5c463e24be2283f53deb95eeb1f60703f30069e50e9ff023afe9410b8f4bc606
- MD5 64cb7b02fec9ae6da5bf498f510fec40
- SHA1 b06cef3c1c39ddda5966213ddee4e37f1a2a77c2
- SHA512 769050b747459b064303dc79d38cf533dd4e8533cbeecae8993723b41d6d5bbb1910c6087b15e97b99d668901bd921092de9af3ebf6f65764f7fe2c9f53abbdb
- SSDEEP 192:LUfn/tq5pFBftpHSzn+hbAhLkY7XaHICL:8nl0FBFpH++hbK4YWHv
- MD5 SHA1 SHA512 SSDEEP
Illitterres/middelmaadighed.sty
- SHA256 bd2b07566d3c232c5f042252aac4b8c051f7ab16036147a52e3448c60adac07a
- MD5 1ec6252928c6001672306b3f5d92e677
- SHA1 f8833c1af8cb18b698e83502dbd27d368935bd78
- SHA512 ff43fdfbcde35c0bb88a9251aebe407b75d1c2a38e42d331fb820ab51924ebed9ac1d20cf2ccd645e686821199a9243c38b35238d03856768e100a8308deb9c4
- SSDEEP 48:g/DQmyV67T4bHtUxOn3R+X8UHsRleK1qEEGAfvxJY+zHNx5Qtjg5P3Mu9HzFl7Up:QQmc6n4qXORlz11efyg5vMuXi+6Z9l
- MD5 SHA1 SHA512 SSDEEP
Illitterres/pokalturnerings.are
- SHA256 5fdc35305cc6f1b88be647583227a6462f81515e4f100894ec5ee7537b9cf129
- MD5 2bf260d20cd4a4648a8fef2d442febcd
- SHA1 5db2d245d835dc181452be95db91c2d3162ea021
- SHA512 7ebc6376829183b201b903d9fd5f8c777a1beee6743dc5f03384460c95356fe599babace8ca35bf09f49c65df132ce140b4f659b1b93bb78b293bc5219b4f047
- SSDEEP 96:UQXO/jN2WsUw335ebwCIVjt61braiYbeqZjKm2T1CelrtmrpgpFQmn:UYOh2WsUrwH8qbt+lhigpFjn
- MD5 SHA1 SHA512 SSDEEP
Laurbrkransene.pri
- SHA256 614c3a73c3afe4290825d32929fdba543db086757546852ff5c288c78ccd9f56
- MD5 c85144838825b192b0c266e99457fb56
- SHA1 a57f2cd00b107289736018d506b1cdd1adfc4f35
- SHA512 2234acb5d50ba68c3aa7873dbd5d4a08d8c8ef403b011176b7aaae1d2adee08efa86dd88a43add2c80f77afbfb231eb8bc4d38015d6c1d27dab54633e065b157
- SSDEEP 192:K/d1oG3qvqf5pC2rH6+oiq+a1RxG8o5CEYtpg0FuR:KnbFUcH6+oZL1Rtrpgn
- MD5 SHA1 SHA512 SSDEEP
Regulariser/Nagas.udv
- SHA256 7794148b4d857da853f7e2104e9b6fd3c73fc0757058908720151fed984328bb
- MD5 d32a3e909b5cb9d079ffd178bf5b1c80
- SHA1 9769845db162d9831a8e69dd286c167fd19be0c4
- SHA512 c38c12b86522a647fc1d30864967e113c1a95e3e9f97a7737314177b2e13fa11c13f908a5560417a72f212c6a3ac7c7a70ef5c6e4304a3093d99fcc83e799f70
- MD5 SHA1 SHA512
Vedhftende.Rat
- SHA256 1380824a5e85243608dc0274fdfdbd8ead0eae249e43889250098eb1c43f6601
- MD5 f0278e0e52f62db61f645c030acb5e0e
- SHA1 839e92218f48d737a629f968c63be9bec5d6c630
- SHA512 2a22401af9fa214c5b3169edde5c57f5147437a13abe0560bba12083745f2ab8213de09cd56d68aa6f7b3fc4a29df7947293983c5a0d4ee119acecf0303a0fc7
- SSDEEP 6144:up8AlrjXyohQ/gZmLPsKcXC8fFqrp1cJMW01tOBNzCwUmUcA:apiuULXc/fFqNue1t+zCIY
- MD5 SHA1 SHA512 SSDEEP