4123adc7fb7ebd593662bdf2c415afd6.bin
- SHA256 1622b7a78bf26276fabcb4ef00eb29957bc70c76c97966922a51d26eb7b19503
Password
infected
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
04bcf38fe795bd3884ba28e2b28d7848cdaf880b057d9d8263629901220fdf7f.exe
Resource
win7-20240704-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
04bcf38fe795bd3884ba28e2b28d7848cdaf880b057d9d8263629901220fdf7f.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win7-20240708-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240708-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target 4123adc7fb7ebd593662bdf2c415afd6.bin
- Size 354KB
- Sample240817-blqbbaydla
- SHA256 1622b7a78bf26276fabcb4ef00eb29957bc70c76c97966922a51d26eb7b19503
- MD5 f0fe60027807b4f404ac0bfb0444af04
- SHA1 918802ca8e10b9b20656ee3ff6f7e6d00fbbb1d8
- SHA512 ce4dd96794851366136f44a0d02bc2927d815067f1db89c1aaa7f07cadb770c4623ddb8088caf72a08125d3a54db50716dc5dfafdc4743048f2ae6dad453e054
- SSDEEP 6144:aN3aDKsjTdCC1EtcbZJ5f0nhHEIOA+npjYjZLSjYhkKG9Ri/bq5eio/QBHenf7on:apjQY6GmNfQhHPOAGjYFaYh26h/QiUBJ
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/04bcf38fe795bd3884ba28e2b28d7848cdaf880b057d9d8263629901220fdf7f.exe unpack002/$PLUGINSDIR/LangDLL.dll unpack002/$PLUGINSDIR/System.dll
File Explorer
-
4123adc7fb7ebd593662bdf2c415afd6.bin.zip 354KB
-
04bcf38fe795bd3884ba28e2b28d7848cdaf880b057d9d8263629901220fdf7f.exe.exe 522KB
-
$PLUGINSDIR/LangDLL.dll.dll 5KB
-
$PLUGINSDIR/System.dll.dll 12KB
-
Cuoco65.sjk16KB
-
Tave180.Tre316KB
-
magnas/Soricid.spr21KB
-
magnas/Superstylish.Con175117KB
-
magnas/glissader.txt369B
-
magnas/militaristerne.smo11KB
04bcf38fe795bd3884ba28e2b28d7848cdaf880b057d9d8263629901220fdf7f.exe
- IMPHASH 3f91aceea750f765ef2ba5d9988e6a00
- SHA256 04bcf38fe795bd3884ba28e2b28d7848cdaf880b057d9d8263629901220fdf7f
- MD5 4123adc7fb7ebd593662bdf2c415afd6
- SHA1 9b429517289adb669897f3b8c9b5fd0f5be570d4
- SHA512 29c6a850368b88bd40ef16b9ea018d4f8bb35bcbb254b82ec4e12e76e4613241184f2f8f31d142335c2230dc656841194a0fef8a4b4cebd11c9283c5322f5171
- SSDEEP 12288:KS4O7b4e/75hsekk5Ha8bBA2QK4Ym1yvdLXuzbJ:R49ez56u9DQKAeLGJ
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
1
Major OS version
5
Entry point
14042
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
advapi32
RegCloseKey
RegDeleteKeyW
RegDeleteValueW
RegEnumKeyW
RegEnumValueW
RegQueryValueExW
RegSetValueExW
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueW
SetFileSecurityW
RegCreateKeyExW
RegOpenKeyExW
shell32
ShellExecuteExW
SHFileOperationW
SHBrowseForFolderW
SHGetPathFromIDListW
SHGetFileInfoW
SHGetSpecialFolderLocation
ole32
OleInitialize
OleUninitialize
CoTaskMemFree
IIDFromString
CoCreateInstance
comctl32
ord17
ImageList_Destroy
ImageList_AddMasked
ImageList_Create
user32
DispatchMessageW
wsprintfA
SystemParametersInfoW
SetClassLongW
GetWindowLongW
GetSysColor
ScreenToClient
SetCursor
GetWindowRect
TrackPopupMenu
AppendMenuW
EnableMenuItem
CreatePopupMenu
GetSystemMenu
GetSystemMetrics
IsWindowEnabled
EmptyClipboard
SetClipboardData
CloseClipboard
OpenClipboard
CheckDlgButton
EndDialog
DialogBoxParamW
IsWindowVisible
SetWindowPos
CreateWindowExW
GetClassInfoW
PeekMessageW
CallWindowProcW
GetMessagePos
CharNextW
ExitWindowsEx
SetWindowTextW
SetTimer
CreateDialogParamW
DestroyWindow
LoadImageW
FindWindowExW
SetWindowLongW
InvalidateRect
ReleaseDC
GetDC
SetForegroundWindow
EnableWindow
GetDlgItem
ShowWindow
IsWindow
PostQuitMessage
SendMessageTimeoutW
SendMessageW
wsprintfW
FillRect
GetClientRect
EndPaint
BeginPaint
DrawTextW
DefWindowProcW
SetDlgItemTextW
GetDlgItemTextW
CharNextA
MessageBoxIndirectW
RegisterClassW
CharPrevW
LoadCursorW
gdi32
SetBkMode
CreateBrushIndirect
GetDeviceCaps
SelectObject
DeleteObject
SetBkColor
SetTextColor
CreateFontIndirectW
kernel32
WriteFile
GetLastError
WaitForSingleObject
GetExitCodeProcess
GetTempFileNameW
CreateFileW
CreateDirectoryW
WideCharToMultiByte
lstrlenW
lstrcpynW
GlobalLock
GlobalUnlock
CreateThread
GetDiskFreeSpaceW
CopyFileW
GetVersionExW
GetWindowsDirectoryW
ExitProcess
GetCurrentProcess
CreateProcessW
GetTempPathW
SetEnvironmentVariableW
GetCommandLineW
GetModuleFileNameW
GetTickCount
GetFileSize
MultiByteToWideChar
MoveFileW
WritePrivateProfileStringW
GetPrivateProfileStringW
lstrlenA
lstrcmpiW
lstrcmpW
MulDiv
GlobalFree
GlobalAlloc
LoadLibraryExW
GetModuleHandleW
FreeLibrary
Sleep
CloseHandle
SetFileTime
SetFilePointer
SetFileAttributesW
ReadFile
GetShortPathNameW
GetFullPathNameW
GetFileAttributesW
FindNextFileW
FindFirstFileW
FindClose
DeleteFileW
CompareFileTime
SearchPathW
SetCurrentDirectoryW
ExpandEnvironmentStringsW
RemoveDirectoryW
GetSystemDirectoryW
MoveFileExW
GetModuleHandleA
GetProcAddress
lstrcmpiA
lstrcpyA
lstrcatW
SetErrorMode
Name
.text
Size
27KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
3.6MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
156KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
165KB
Virtual Size
165KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=260, version=29395,
count=1, id=262, version=29395,
count=15, id=257, version=29395,
count=165, id=1, productName=Unmarked objects,
count=13, id=260, version=30145,
count=1, id=255, version=30145,
count=1, id=258, version=30145,
$PLUGINSDIR/LangDLL.dll
- IMPHASH 7dc2e9f6e94bce5fc6b9a1cfe4f3e41a
- SHA256 92cb3b3a7280246743543325d3fe9a7d72c63227f9540d25d5ef27b2ce8856b4
- MD5 af4324802813a5a897db2167fc10e291
- SHA1 916bd47457dcb4247743626e86492436b77bebf8
- SHA512 cb3e07c4558049634078808bd419860c6e2855a02bba79541cea80873fe6db58cf667a27c111521df09ef30f92c149736092c473fde28bbb5974be6d7ddab83c
- SSDEEP 48:qcjtDVP10LgQL8QRU8IlmWm7WmnuWK8hSemoMqG5QEv8sF9UwofMU:xVPFQIqlemWm7WmTaehG+Ekq
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
6
Entry point
4761
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
lstrcmpW
lstrcpyW
MulDiv
lstrcpynW
GlobalFree
GlobalAlloc
lstrlenW
GetModuleHandleW
user32
SendDlgItemMessageW
GetDC
SetWindowTextW
LoadIconW
SetDlgItemTextW
EndDialog
ShowWindow
SendMessageW
DialogBoxParamW
gdi32
DeleteObject
GetDeviceCaps
CreateFontIndirectW
LangDialog
Name
.text
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
758B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
352B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
232B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=257, version=29395,
count=23, id=1, productName=Unmarked objects,
count=3, id=260, version=30145,
count=1, id=256, version=30145,
count=1, id=255, version=30145,
count=1, id=258, version=30145,
$PLUGINSDIR/System.dll
- IMPHASH 4f33ea844b96a31c8f4690530ba63854
- SHA256 1624d9ad8b2e2658af224691263f64388ba3a997efe80011889e3c35237ce4c1
- MD5 6c38da8922cc37b4bbb77de4a63ad843
- SHA1 4e0533fd11df8bddbd543ed58df7b6060d9f4631
- SHA512 ad0be3d7e57da9c304e9b9cac5341b6c76b157456ab44f5579d6c38c830a31c9c3e1e9a875b8f465243c607ea2ede6b0bb77237f17a70a4d4c78606e036c3430
- SSDEEP 192:wA1YOTDExj7EFrYCT4E8y3hoSdtTgwF43E7QbGPXI9uIc6gn9Mw:QR7SrtTv53tdtTgwF4SQbGPX36g9Mw
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
6
Entry point
6730
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GlobalAlloc
GlobalSize
GlobalFree
lstrcpynW
lstrcpyW
GetLastError
VirtualAlloc
VirtualProtect
VirtualFree
FreeLibrary
GetModuleHandleW
GetProcAddress
LoadLibraryW
lstrlenW
MultiByteToWideChar
WideCharToMultiByte
user32
wsprintfW
ole32
StringFromGUID2
CLSIDFromString
Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc
Name
.text
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
958B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
68B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
512B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=259, version=30034,
count=7, id=257, version=29395,
count=20, id=1, productName=Unmarked objects,
count=4, id=260, version=30145,
count=1, id=259, version=30145,
count=1, id=256, version=30145,
count=1, id=258, version=30145,
Cuoco65.sjk
- SHA256 517c352ee95b347fb1b401a250275bc1efd11c8791948e56f605c3a83a16035d
- MD5 1edaab37c00abc6faf9cb0a3c0e12b59
- SHA1 2d97fcd04b6ff1dd4747925017b100ed82bd954a
- SHA512 c2b84190f63f3eac99f98b5315843eb17c1d51e026bdbf0a86538b1295615fcdef1886dbad0167c88a60ff62d598e84c69bc512dc47adc8fa68921a5e90456c7
- SSDEEP 384:eYJ4rij37mtcL0RPwDItXRTZ9gkc3xwzVReVCkpic9dTDz8:eH037mGL/sbZ9gkcezVR4ic9N8
- MD5 SHA1 SHA512 SSDEEP
Tave180.Tre
- SHA256 3443b0cca185c2455132a48eada4d4cc21dbead9cdb094860e371b34b00a64de
- MD5 e37761d1cdc657d26601b74d59b05fea
- SHA1 04b8406bdca7407bf778c313c3981b3b31e959c1
- SHA512 ff3b8dcb1ff99907c72400f11dd528f1478abd88cadf04ab3d7e698e3f6f1e3fa5c07fdecc50351b3ea47a4031aecf1974d1c92b695eee602b5971aa443327ba
- SSDEEP 3072:pHovQ2H2ek04fwOKAP6nSnpwtu3HVOK2WlRPJ3b6+4ZVOMNNTeAPC/e27VW20hI2:pIVc5UlShx2e33b6+4Wkev1mjRO7MR9j
- MD5 SHA1 SHA512 SSDEEP
magnas/Soricid.spr
- SHA256 0eee0e4b3b1e6f21a23a32f32e5115fdba1baea74f5f5364624971b88e2eb8f5
- MD5 66414689a47a89419cfedc52bd474f2c
- SHA1 22af451e7b4124b737573c3e1538c2bce9bff0b2
- SHA512 47efe671aae40d94c0f70dbadad35edecf3a5905fe7e20246958abcf563f5c86b0ba7499e4e77a8234bd57217f1207cfb4de0574755eff37751c2cfd81f1d80d
- SSDEEP 384:9LZDITjLE/CTVlxpaDy9gcIDcfT4OJ1UPXu5OvLrt7V:9LQWwjCDy99IDQTnJ1Upp7V
- MD5 SHA1 SHA512 SSDEEP
magnas/Superstylish.Con175
- SHA256 6a448610d910a5e7535f7c64cb8a78841a82e9a7c001775fa34b28719842de3d
- MD5 0d59752eb6de47ca07f835b8640d4779
- SHA1 648d88b0cc607c6c8e0596ed8a7f48d6121a02e3
- SHA512 2bb84839a9bc7c0216327eb6cf8329b8b379921d2d8edcf12c51bdabd41c368a998a05487ab513471bd7c271db958de875d8e5db5fbd4a969d4a1e82c45bf572
- SSDEEP 1536:tPvfxy8RXLKic/+W7NbjzeHxTkjdD39STN/hrZkCVZNEPg4VjGV:lXeywMPTn14o
- MD5 SHA1 SHA512 SSDEEP
magnas/glissader.txt
- SHA256 bd07ba8fd6ca068308fba9fa43b6a44fd5166121aaa6d8de83c77f3db10b52c9
- MD5 ceb6bbfec1fd6fada75a5013edd70948
- SHA1 075eee41757c13d94c0d731a2db72cf9da06bce7
- SHA512 e0d40a4825c9ea2aa99f8a9cdb05c9bb527b28af5fc787672f6d377e36e127f5c5ed8388259417fb470b701a513946c0e2b1fd14a7cc93ccd80f20655fffffcd
- MD5 SHA1 SHA512
magnas/militaristerne.smo
- SHA256 6881c2805686a0b05960d8b990a166baa82dd7ae82f0d243d5647702abf81d7d
- MD5 8f28b6a06d784e1bb063a396d39d9f85
- SHA1 1885308ea7d5f896e65dbdbbc36c2e253e6fd2c6
- SHA512 fc66fb219a11faa4a4656ede118eb6a8f5159ef5761c938c9b994b4b6598e3d0382e70c580b140a08ae009cc614f99c35ba638ba314cc259418f52f85c1c3688
- SSDEEP 192:QlRs5UCQ77Iym2fZXa0DTA3P1IatiV5LRxTbvgbqoLWVhe9SxAG/Ni:QffCQ77Iym2hK0DTeP1IaEVVRljgbqot
- MD5 SHA1 SHA512 SSDEEP