Static task
static1
Behavioral task
behavioral1
Sample
Purchase_Order.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
Purchase_Order.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240802-en
General
-
Target
Purchase_Order.exe
-
Size
571KB
-
MD5
b62ee57117901589f2eae0429616da05
-
SHA1
273e0bc16cdf02f85e5d9ff0297ecc6605935055
-
SHA256
613852c1a3f49a2015a6c2fd5922296fa8f6e086e5b03ee93879161ab15f4650
-
SHA512
0b3887d86894d9c1a050d115c4d20b98b65071931013fae7d77492d630f6ce254590c6d5624092bdecdf7849910570e738e73d72251dd52f373a7f1086804faf
-
SSDEEP
12288:gE7Q/ArJEj7xAFZAUk74c2kNw922o4SK6+KTYPjeBr+ZMAFIb:0iJEjiFZzaB20Ehxz6+kt+Z6
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/$PLUGINSDIR/System.dll -
NSIS installer 2 IoCs
resource yara_rule sample nsis_installer_1 sample nsis_installer_2
Files
-
Purchase_Order.exe.exe windows:4 windows x86 arch:x86
e990dd07e89d04c53e337ab9b3f5e0cc
Code Sign
59:51:5a:0b:49:a7:6e:a6:46:80:f8:55:bd:7a:43:a4:ae:10:8a:c3Certificate
IssuerCN=Scutty Dioptometry Udgjorte\ ,O=Pilimiction,L=Naumburg,ST=Sachsen-Anhalt,C=DENot Before05/12/2023, 08:19Not After04/12/2026, 08:19SubjectCN=Scutty Dioptometry Udgjorte\ ,O=Pilimiction,L=Naumburg,ST=Sachsen-Anhalt,C=DE59:51:5a:0b:49:a7:6e:a6:46:80:f8:55:bd:7a:43:a4:ae:10:8a:c3Certificate
IssuerCN=Scutty Dioptometry Udgjorte\ ,O=Pilimiction,L=Naumburg,ST=Sachsen-Anhalt,C=DENot Before05/12/2023, 08:19Not After04/12/2026, 08:19SubjectCN=Scutty Dioptometry Udgjorte\ ,O=Pilimiction,L=Naumburg,ST=Sachsen-Anhalt,C=DE4c:d5:d8:29:3c:f0:ed:f1:d5:07:37:cf:84:8b:4e:03:b2:23:c2:3f:96:b1:13:55:33:e7:13:b3:a1:9a:49:a2Signer
Actual PE Digest4c:d5:d8:29:3c:f0:ed:f1:d5:07:37:cf:84:8b:4e:03:b2:23:c2:3f:96:b1:13:55:33:e7:13:b3:a1:9a:49:a2Digest Algorithmsha256PE Digest Matchestrued7:43:37:10:6e:8d:fe:a1:d3:eb:1c:5c:1a:d5:85:0e:4b:60:37:ceSigner
Actual PE Digestd7:43:37:10:6e:8d:fe:a1:d3:eb:1c:5c:1a:d5:85:0e:4b:60:37:ceDigest Algorithmsha1PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
Sleep
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
CompareFileTime
SearchPathA
GetTickCount
CreateFileA
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
SetEnvironmentVariableA
SetFileAttributesA
lstrcmpiA
GetCommandLineA
SetErrorMode
LoadLibraryA
lstrlenA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
GetTempFileNameA
lstrcpyA
lstrcatA
GetSystemDirectoryA
GetVersion
GetProcAddress
WaitForSingleObject
SetFileTime
CloseHandle
GlobalFree
lstrcmpA
ExpandEnvironmentStringsA
GetExitCodeProcess
GlobalAlloc
GetModuleHandleA
LoadLibraryExA
GetTempPathA
GetWindowsDirectoryA
FreeLibrary
FindFirstFileA
FindNextFileA
DeleteFileA
SetFilePointer
ReadFile
FindClose
GetPrivateProfileStringA
WritePrivateProfileStringA
MulDiv
WriteFile
MultiByteToWideChar
user32
CreateWindowExA
EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
GetDC
SystemParametersInfoA
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
ReleaseDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
GetClassInfoA
DialogBoxParamA
CharNextA
ExitWindowsEx
DestroyWindow
CreateDialogParamA
SetTimer
GetDlgItem
wsprintfA
SetForegroundWindow
ShowWindow
IsWindow
LoadImageA
SetWindowLongA
SetClipboardData
EmptyClipboard
OpenClipboard
EndPaint
PostQuitMessage
FindWindowExA
SendMessageTimeoutA
SetWindowTextA
gdi32
SelectObject
SetBkMode
CreateFontIndirectA
SetTextColor
DeleteObject
GetDeviceCaps
CreateBrushIndirect
SetBkColor
shell32
SHGetSpecialFolderLocation
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
advapi32
RegCloseKey
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegEnumValueA
RegCreateKeyExA
RegSetValueExA
RegQueryValueExA
RegEnumKeyA
comctl32
ImageList_Create
ImageList_AddMasked
ImageList_Destroy
ord17
ole32
CoCreateInstance
CoTaskMemFree
OleInitialize
OleUninitialize
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
Sections
.text Size: 23KB - Virtual size: 22KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 107KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ndata Size: - Virtual size: 124KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 94KB - Virtual size: 93KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
$PLUGINSDIR/System.dll.dll windows:4 windows x86 arch:x86
8c8a576201f68de1a3f26fc723b9f30f
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
MultiByteToWideChar
GlobalFree
GlobalSize
lstrcpynA
lstrcpyA
GetProcAddress
VirtualFree
FreeLibrary
lstrlenA
LoadLibraryA
GetModuleHandleA
GlobalAlloc
WideCharToMultiByte
VirtualAlloc
VirtualProtect
GetLastError
user32
wsprintfA
ole32
StringFromGUID2
CLSIDFromString
Exports
Exports
Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc
Sections
.text Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1024B - Virtual size: 835B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 104B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1024B - Virtual size: 584B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Paulie.Teg
-
Subcontraoctave.txt
-
Tuple.Fov
-
brres/vapourisation.skr
-
kapitalindskud.svi