24102024_0543_22102024_5702771896_AWB_20240902_225_20240902.rar
- SHA256 544d772118922c50b382935f5403c6b9e6fcffdad5a82ea1ad1aec139c138581
Password
infected
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5702771896_AWB_20240902_225_20240902.exe
Resource
win7-20240903-en
windows7-x64
18 signatures
300 seconds
Behavioral task
behavioral2
Sample
5702771896_AWB_20240902_225_20240902.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
17 signatures
300 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240903-en
windows7-x64
3 signatures
300 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
300 seconds
General
- Target 24102024_0543_22102024_5702771896_AWB_20240902_225_20240902.rar
- Size 788KB
- Sample241024-gelmfawcmd
- SHA256 544d772118922c50b382935f5403c6b9e6fcffdad5a82ea1ad1aec139c138581
- MD5 54614a7c625ad736dd4e7edc9d5c4b50
- SHA1 b5edc7b8939e0a060083bca30daed83f7c1b6304
- SHA512 1aec6afe0720528d0e483e76085e2376906023f67e6ee69bb6969ea6e2ff1364d9472fc07a5d552f9a5f12113fd9caaed9428ff469e81cb7f9fef33c79c52503
- SSDEEP 12288:YV1fW0SUlPxWe7Xme4INRsfdBzf1lidN/UgicRwtFhyvEmTDsgADEGEdfqqQpJmp:4tSOxN7XmeRqVBjQmbgvEIMEpqqQpJzQ
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/5702771896_AWB_20240902_225_20240902.exe unpack002/$PLUGINSDIR/System.dll
File Explorer
-
24102024_0543_22102024_5702771896_AWB_20240902_225_20240902.rar.rar 788KB
-
5702771896_AWB_20240902_225_20240902.exe.exe 888KB
-
$PLUGINSDIR/System.dll.dll 11KB
-
Brugsgaardene/lapidaries.vab262KB
-
Brugsgaardene/pic-8.jpg.jpg 292KB
-
Fagidiots.Cam191KB
-
Incoagulability.Whi9KB
-
basely.txt533B
-
coordinative.alp30KB
-
juliennesuppe.hss405KB
5702771896_AWB_20240902_225_20240902.exe
- IMPHASH 1f23f452093b5c1ff091a2f9fb4fa3e9
- SHA256 f85e3c3cace64f9432cc9588a77cb687cdca8378ec16334923849913632973ce
- MD5 fca7c052afe3a4de2e3d0ce5d500932c
- SHA1 1873d11a40c7a727762ba70780a43a810f168333
- SHA512 b6cc45932fe3b6f0042e26609ad3a114872f044a667fbcdcd619e01380e03c77f203d88cbce79a09997ad645eb6f1a7d86217c1ec0f0667d8cc995cc28bb988c
- SSDEEP 12288:k9QQTGWRJxjcm4Z2dDnD7V1xk3ZCB8w6unDxGlxqHkZ084Y5bzY9n8+q8tiB/h5:FQTGWPxImi21Tx1J6uDxaxqHg7098+6n
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
4
Entry point
13449
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
ExitProcess
SetFileAttributesW
Sleep
GetTickCount
CreateFileW
GetFileSize
GetModuleFileNameW
GetCurrentProcess
SetCurrentDirectoryW
GetFileAttributesW
SetEnvironmentVariableW
GetWindowsDirectoryW
GetTempPathW
GetCommandLineW
GetVersion
SetErrorMode
lstrlenW
lstrcpynW
CopyFileW
GetShortPathNameW
GlobalLock
CreateThread
GetLastError
CreateDirectoryW
CreateProcessW
RemoveDirectoryW
lstrcmpiA
GetTempFileNameW
WriteFile
lstrcpyA
MoveFileExW
lstrcatW
GetSystemDirectoryW
GetProcAddress
GetModuleHandleA
GetExitCodeProcess
WaitForSingleObject
lstrcmpiW
MoveFileW
GetFullPathNameW
SetFileTime
SearchPathW
CompareFileTime
lstrcmpW
CloseHandle
ExpandEnvironmentStringsW
GlobalFree
GlobalUnlock
GetDiskFreeSpaceW
GlobalAlloc
FindFirstFileW
FindNextFileW
DeleteFileW
SetFilePointer
ReadFile
FindClose
lstrlenA
MulDiv
MultiByteToWideChar
WideCharToMultiByte
GetPrivateProfileStringW
WritePrivateProfileStringW
FreeLibrary
LoadLibraryExW
GetModuleHandleW
user32
GetSystemMenu
SetClassLongW
EnableMenuItem
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongW
SetCursor
LoadCursorW
CheckDlgButton
GetMessagePos
LoadBitmapW
CallWindowProcW
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
ScreenToClient
GetWindowRect
GetDlgItem
GetSystemMetrics
SetDlgItemTextW
GetDlgItemTextW
MessageBoxIndirectW
CharPrevW
CharNextA
wsprintfA
DispatchMessageW
PeekMessageW
ReleaseDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
GetClientRect
FillRect
DrawTextW
EndDialog
RegisterClassW
SystemParametersInfoW
CreateWindowExW
GetClassInfoW
DialogBoxParamW
CharNextW
ExitWindowsEx
DestroyWindow
GetDC
SetTimer
SetWindowTextW
LoadImageW
SetForegroundWindow
ShowWindow
IsWindow
SetWindowLongW
FindWindowExW
TrackPopupMenu
AppendMenuW
CreatePopupMenu
EndPaint
CreateDialogParamW
SendMessageTimeoutW
wsprintfW
PostQuitMessage
gdi32
SelectObject
SetBkMode
CreateFontIndirectW
SetTextColor
DeleteObject
GetDeviceCaps
CreateBrushIndirect
SetBkColor
shell32
SHGetSpecialFolderLocation
ShellExecuteExW
SHGetPathFromIDListW
SHBrowseForFolderW
SHGetFileInfoW
SHFileOperationW
advapi32
AdjustTokenPrivileges
RegCreateKeyExW
RegOpenKeyExW
SetFileSecurityW
OpenProcessToken
LookupPrivilegeValueW
RegEnumValueW
RegDeleteKeyW
RegDeleteValueW
RegCloseKey
RegSetValueExW
RegQueryValueExW
RegEnumKeyW
comctl32
ImageList_Create
ImageList_AddMasked
ImageList_Destroy
ord17
ole32
OleUninitialize
OleInitialize
CoTaskMemFree
CoCreateInstance
Name
.text
Size
25KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
128KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
148KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
185KB
Virtual Size
184KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=165, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
$PLUGINSDIR/System.dll
- IMPHASH fc0224e99e736751432961db63a41b76
- SHA256 c2f405d7402f815d0c3fadd9a50f0bbbb1bab9aa38fe347823478a2587299448
- MD5 9625d5b1754bc4ff29281d415d27a0fd
- SHA1 80e85afc5cccd4c0a3775edbb90595a1a59f5ce0
- SHA512 dce52b640897c2e8dbfd0a1472d5377fa91fb9cf1aeff62604d014bccbe5b56af1378f173132abeb0edd18c225b9f8f5e3d3e72434aed946661e036c779f165b
- SSDEEP 192:eX24sihno00Wfl97nH6BenXwWobpWBTtvShJ5omi7dJWjOlqSlS:D8QIl972eXqlWBFSt273YOlqz
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
4
Entry point
10178
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetModuleHandleW
GlobalFree
GlobalSize
lstrcpynW
lstrcpyW
GetProcAddress
WideCharToMultiByte
VirtualFree
FreeLibrary
lstrlenW
LoadLibraryW
GlobalAlloc
MultiByteToWideChar
VirtualAlloc
VirtualProtect
GetLastError
user32
wsprintfW
ole32
StringFromGUID2
CLSIDFromString
Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc
Name
.text
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
851B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
120B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1024B
Virtual Size
608B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=14, version=7299,
count=20, id=1, productName=Unmarked objects,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=4, id=48, version=9044,
count=1, id=42, version=8803,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
Brugsgaardene/lapidaries.vab
- SHA256 dad6e4f2db77badde3785025d96e826c4d3bb9e988826c756d0f3bf533d34157
- MD5 5cf1b5bf9befce5e3cc544981fec67a2
- SHA1 12c06b4438ebc19c37c250ba1659180f45eaa794
- SHA512 63405e185e59dffe2f1293ec8b5fb57bbff292812c0c04a88921364af2539a872cb3ac4f3fe20cfd7de2ce3b8a1aec3408ff7a32850acc66ceefe1f9314d490e
- SSDEEP 1536:BwoBnq/O+3Yd2/hAu06+A0y8GGA9rlevkNstKweMn2blzl4CTRXOBW6DPRaV4f65:jBniy2/hp+lNAdle8N2+Jh/ZeLRaV4u
- MD5 SHA1 SHA512 SSDEEP
Brugsgaardene/pic-8.jpg
- SHA256 a6c2cce7eab3e17900b57940fa813b1ddb2c3f059530fa8c9c6b2074d7910387
- MD5 6daecd0b73ba40744be16d5337050674
- SHA1 f07e1540fb2356d38d84dcd91d6ffc3f46a61e9e
- SHA512 a1872928810608d1b09a1e316aa7b557656f410878e76ec2a13a7748dcad5469ace722f45029abcc55d36d7100257edb1c624e08faeed77acfd4bf18cf33a3d8
- SSDEEP 6144:KtZVZH7u27ZRxl1AJXJFaLoA9PypP3dnZMijk6tq0mfynLBg:2rhr2ZyRyhdnZM36t/8yLy
- MD5 SHA1 SHA512 SSDEEP
Password
infected
Fagidiots.Cam
- SHA256 808a5502e09d2d4695510fb3410e03d430d52f084afecbb1640904f749ca7055
- MD5 57a63a3834e85fb36185d35c675068cd
- SHA1 ac27d1d4c6538ed2074d44c6223d16668970c90f
- SHA512 956d92d3ecacf630d664a3ad63e5f2d4649017b6d03d9406a43553154c3ea05e66700e938b737ef08d8c4d1620ab011b461e55f29b1490847fa4afd1155f209c
- SSDEEP 3072:rzB5CO+c/8BONO3mdE6Y23Cml8MJLiJuYzZqsuW+koX+2XFdonzjjyybY:55d+c0BP3r6Y2SG8gLiJvYf/nX+mSjy9
- MD5 SHA1 SHA512 SSDEEP
Incoagulability.Whi
- SHA256 9d6d6274bae7c515260ff12e5ecefaa183554c4dbea122706c49d498d88cb1e9
- MD5 d33c800b32c483f028aca7373f068978
- SHA1 d5f9dcb7da562b691142fdc5ec80bf64121a5326
- SHA512 eef347438c537c6e510141e9e7da3ddbc96388372ad278a46a3a4ab594e6cf9f8a7b7f92eb7b00e5261b499c5c666c8e86b869e8b1ee805dc7987b1ccdf3b6b5
- SSDEEP 192:9AybRp/dSMGucL7yo0Jlit+a8je8Ga7c4e9khe:Gyv0bL7yo0LK+a2excc4I
- MD5 SHA1 SHA512 SSDEEP
basely.txt
- SHA256 c182ee4c68dad2c036dd24d74f447883d236675f1376b0c1f9aef39d22977bc8
- MD5 8d6fbca088d85c0f2a19276b3f6111e1
- SHA1 178963408b490793d1521ef566f35875c34bea2d
- SHA512 dc5b4a0c6ca9fe60f8b7e94f756f1c42b439aa5e66ce7e497accbe34f6b44f4d874d3799ec04b2beffc03f995cf4e82805beb6480c177d854be238aa924c616f
- MD5 SHA1 SHA512
coordinative.alp
- SHA256 f6dd8e380be4a9bda616066c68ab6bc79350d6647de989b12a5a18fe4f66dbb7
- MD5 58bbd0e0b62f76d62afa5aba008ceb05
- SHA1 66bbde0b527b80877a0c82a2c7ffeaadadc9b8a6
- SHA512 4bc6707865675cfc1f8304ec5a334c2d6c6077cc8d7597181f99e3980131cf729b46b719f5f3b960d7dfbc0c8cde80adead913565217f00c3426b3df3464fcc1
- SSDEEP 384:0Fcv1s7Vs23bdDoMgfa05e70Ap5iLqG0zkG7WccQkm9kev:V+G2ret4Zq2r4GCQkmR
- MD5 SHA1 SHA512 SSDEEP
juliennesuppe.hss
- SHA256 c4c57f40db30cd9a087c022bfaced884ba4647a77285207ba64377d620f4ba97
- MD5 8f918301a34c7243d35c3b312ab3c998
- SHA1 aaf3bbd6a4cc704f44de6444dcaca2a195771891
- SHA512 d50d8e452e6e124c7026a320769e07ae68eaf300318d43d11acdc6f47d72dc1526a4bdc4325fd09a08f7ad0224c42423cf097df8fcc9b74ea8978104a8dfe31f
- SSDEEP 3072:JGYT/pzT6A/nMJnMkgf5tIu2U9+ylK7hOa:JG0TnMBJgAulI+a
- MD5 SHA1 SHA512 SSDEEP