PTHAV002_2024-10-24_15_43_35.016.zip
- SHA256 859571a129deed67ebc60c7e2e5d48b1e1282121e11d1d696e9cac88fa7c3643
Password
Malware123!
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
PTHAV002_2024-10-24_15_43_35.016.zip
Resource
win7-20240903-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
PTHAV002_2024-10-24_15_43_35.016.zip
Resource
win10v2004-20241007-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral3
Sample
Device/HarddiskVolume4/Users/belia.peso.IBEROSTARHV.000/AppData/Local/Temp/Rar$EXa7092.35635/factura 563423.exe
Resource
win7-20240903-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral4
Sample
Device/HarddiskVolume4/Users/belia.peso.IBEROSTARHV.000/AppData/Local/Temp/Rar$EXa7092.35635/factura 563423.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
14 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target PTHAV002_2024-10-24_15_43_35.016.zip
- Size 787KB
- Sample241024-s77adswhlp
- SHA256 859571a129deed67ebc60c7e2e5d48b1e1282121e11d1d696e9cac88fa7c3643
- MD5 5a2c6cfffcac05ee6c740c0f7565375e
- SHA1 a097fa2843dd14bcfb671e65d2a6c1609cc583fd
- SHA512 2a29df18728198eef81a8c568e81d47aad79826d38f15aad54be5c260a9528a2a86ebb4a3126a15a127efff5cbee21765abac51fd83a0b84889858ef1971f197
- SSDEEP 24576:n/JgJcJ7c3Zd02xS3KNcFz3As/MFdL4qNj:nhgJc5cpd02x9cFzzYXNj
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/$PLUGINSDIR/System.dll - NSIS installer 2 IoCs
resource yara_rule static1/unpack001/Device/HarddiskVolume4/Users/belia.peso.IBEROSTARHV.000/AppData/Local/Temp/Rar$EXa7092.35635/factura 563423.exe nsis_installer_1 static1/unpack001/Device/HarddiskVolume4/Users/belia.peso.IBEROSTARHV.000/AppData/Local/Temp/Rar$EXa7092.35635/factura 563423.exe nsis_installer_2
File Explorer
-
PTHAV002_2024-10-24_15_43_35.016.zip.zip 787KB
-
Device/HarddiskVolume4/Users/belia.peso.IBEROSTARHV.000/AppData/Local/Temp/Rar$EXa7092.35635/factura 563423.exe.exe 901KB
-
$PLUGINSDIR/System.dll.dll 11KB
-
Objektiviseringen/Hematomancy42.txt274B
-
Objektiviseringen/Rvegraves.rej200KB
-
chagul/Fortovs/southwestern.gor241KB
-
chagul/Hjortetakkens.pro368KB
-
chagul/Opskrivningerne.Omb426KB
-
chagul/Sluttidspunktets.ace218KB
-
chagul/crappin.fan329KB
-
chagul/legaliserende.tro449KB
-
chagul/momentousments.afr320KB
-
chagul/programdels.fla475KB
-
manifest.json302B
Device/HarddiskVolume4/Users/belia.peso.IBEROSTARHV.000/AppData/Local/Temp/Rar$EXa7092.35635/factura 563423.exe
- IMPHASH b40f29cd171eb54c01b1dd2683c9c26b
- SHA256 057e7554f7a499adfd2c0a3485675fef4f602b23e2e0a1fd4e07da5b993e4ebf
- MD5 6cb35cad38c80bbb552c99caf75f9371
- SHA1 f1dcc7d9805738aaf1f30b32383674ea30706269
- SHA512 638594b7228a8e747c34f1ab7916774feaff1ce58e875e64bb28cc6742472a305c5aa06e709ec708aad990d9e78ce828509af8a575b3fe62082699de1bb81734
- SSDEEP 12288:TSlZI9dcNnPmsS7wkJW7DQFeh2FCCMntz6I8128TsXULDh+gDBf6j4Ydcv+l:2lTnpc/J2d2UVf+DLD1BbYGW
- MD5 SHA1 SHA512 SSDEEP
-
NSIS installer
Password
Malware123!
PE Signature issue
Digest
0e:1e:a5:59:64:2f:39:d8:18:b1:d7:af:ea:bd:f3:b5:a9:ba:42:0b:76:1e:20:c7:62:2a:f7:4b:2a:26:4d:8b
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Velfrdssamfund,O=Velfrdssamfund,L=Little York,C=US
Chains
Oct 24, 2024
PE Signature issue
Digest
01:d3:27:2e:0e:8f:82:a5:7a:0c:3a:39:1d:71:a3:c5:b4:17:1b:ac
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Velfrdssamfund,O=Velfrdssamfund,L=Little York,C=US
Chains
Oct 24, 2024
Subject
CN=Velfrdssamfund,O=Velfrdssamfund,L=Little York,C=US
Serial Number
5d:1f:15:9b:bc:de:9f:be:bf:df:c1:6b:05:33:ec:59:28:91:e1:78
Issuer
CN=Velfrdssamfund,O=Velfrdssamfund,L=Little York,C=US
Timespan
Apr 22, 2024 - Apr 22, 2027
Subject
CN=Velfrdssamfund,O=Velfrdssamfund,L=Little York,C=US
Serial Number
5d:1f:15:9b:bc:de:9f:be:bf:df:c1:6b:05:33:ec:59:28:91:e1:78
Issuer
CN=Velfrdssamfund,O=Velfrdssamfund,L=Little York,C=US
Timespan
Apr 22, 2024 - Apr 22, 2027
Minor OS version
0
Major OS version
4
Entry point
12508
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
Sleep
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
CompareFileTime
SearchPathA
GetTickCount
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
SetEnvironmentVariableA
GetWindowsDirectoryA
SetFileAttributesA
lstrcmpiA
SetErrorMode
LoadLibraryA
lstrlenA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
CreateFileA
GetTempFileNameA
lstrcpyA
lstrcatA
GetSystemDirectoryA
GetVersion
GetProcAddress
WaitForSingleObject
SetFileTime
CloseHandle
GlobalFree
lstrcmpA
ExpandEnvironmentStringsA
GetExitCodeProcess
GlobalAlloc
GetModuleHandleA
LoadLibraryExA
GetCommandLineA
GetTempPathA
FreeLibrary
FindFirstFileA
FindNextFileA
DeleteFileA
SetFilePointer
ReadFile
FindClose
GetPrivateProfileStringA
WritePrivateProfileStringA
MulDiv
WriteFile
MultiByteToWideChar
user32
CreateWindowExA
EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
GetDC
SystemParametersInfoA
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
ReleaseDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
GetClassInfoA
DialogBoxParamA
CharNextA
ExitWindowsEx
DestroyWindow
CreateDialogParamA
SetTimer
GetDlgItem
wsprintfA
SetForegroundWindow
ShowWindow
IsWindow
LoadImageA
SetWindowLongA
SetClipboardData
EmptyClipboard
OpenClipboard
EndPaint
PostQuitMessage
FindWindowExA
SendMessageTimeoutA
SetWindowTextA
gdi32
SelectObject
SetBkMode
CreateFontIndirectA
SetTextColor
DeleteObject
GetDeviceCaps
CreateBrushIndirect
SetBkColor
shell32
SHGetSpecialFolderLocation
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
advapi32
RegCloseKey
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegEnumValueA
RegCreateKeyExA
RegSetValueExA
RegQueryValueExA
RegEnumKeyA
comctl32
ImageList_Create
ImageList_AddMasked
ImageList_Destroy
ord17
ole32
CoCreateInstance
CoTaskMemFree
OleInitialize
OleUninitialize
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
Name
.text
Size
23KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
107KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
164KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
161KB
Virtual Size
161KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=158, id=1, productName=Unmarked objects,
count=17, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
$PLUGINSDIR/System.dll
- IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
- SHA256 3b6a5cb2a3c091814fce297c04fb677f72732fb21615102c62a195fdc2e7dfac
- MD5 cf85183b87314359488b850f9e97a698
- SHA1 6b6c790037eec7ebea4d05590359cb4473f19aea
- SHA512 fe484b3fc89aeed3a6b71b90b90ea11a787697e56be3077154b6ddc2646850f6c38589ed422ff792e391638a80a778d33f22e891e76b5d65896c6fb4696a2c3b
- SSDEEP 96:3IsUxO9udx4qYp7AJb76BykUbQMtHUOA5Iv+RnsrqeXV+d1g2IW9t2c+cEwF9oug:YVL7ikJb76BQUoUm+RnyXVYO2RvHoug
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
Malware123!
Minor OS version
0
Major OS version
4
Entry point
9922
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
MultiByteToWideChar
GlobalFree
GlobalSize
lstrcpynA
lstrcpyA
GetProcAddress
VirtualFree
FreeLibrary
lstrlenA
LoadLibraryA
GetModuleHandleA
GlobalAlloc
WideCharToMultiByte
VirtualAlloc
VirtualProtect
GetLastError
user32
wsprintfA
ole32
StringFromGUID2
CLSIDFromString
Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc
Name
.text
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
835B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
104B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1024B
Virtual Size
584B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=14, version=7299,
count=19, id=1, productName=Unmarked objects,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=4, id=48, version=9044,
count=1, id=42, version=8803,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
Objektiviseringen/Hematomancy42.txt
- SHA256 4f6eb70f672b677aaa6a534a1bfe8834e2608b72957d57df8089665816ddd90e
- MD5 4da37058224bd7b59229bb611e105f39
- SHA1 1da82b8c8f86e54f744aff64c798e84d1c70e4eb
- SHA512 f839f7fbfedd517cf9a9c253ced6641f1d7cdb69694ba6ed939500ff99fe5247976c09ec915675d8691c04b80ba2f8e49068b4f916904bde994b4051abe3e98e
- MD5 SHA1 SHA512
Objektiviseringen/Rvegraves.rej
- SHA256 8bf70ce6c463271b6bb4e259d1cbf5ae228751ccf95c5b69756cbeb9de60be95
- MD5 84523a696370eab2f84cc398ffd50054
- SHA1 9279a88692c419da715b74828f456ef4756ee7a0
- SHA512 40d04c68c156e120eef4463962d0dfb96e48a86709a3f162c4c1aa2c840f6058881ccda0d9006c35bbbe5bdde40eb27b1ddc0f71262cd682f37601992d9d853a
- SSDEEP 3072:8c08HF3wCgjtQyeN/TcAIO893u2MI6zZGQRMemZrVB3X6gMZf/tmpuSKSCdoKkFH:1oy/5Ed3MTzZBOlX6g4tmpuSKS3XFBF
- MD5 SHA1 SHA512 SSDEEP
chagul/Fortovs/southwestern.gor
- SHA256 1c0cc2363d16826b2c8d36d983e883e3d81e12df8456e3512bf80e7de28c9583
- MD5 79ad4943801e304b83e39774d00ed227
- SHA1 e3ed1c0c871e490194fad68584d401104e0d2bd6
- SHA512 497dc447dd0bd52479445e7fce633427e17dcb02546e876b9ad6945a2c1186de20c26f7ea324ebb8608bf76b16846b738c8fba138004da07a7494e743e925481
- SSDEEP 768:gzZPsA7rgqOMM2DrESpbi+XRztJVhKNzOCoav5rk3d+y8EOYGniroubgYhOxYBCD:gHhOEeCQrEOkQKv
- MD5 SHA1 SHA512 SSDEEP
chagul/Hjortetakkens.pro
- SHA256 838472456a1b5905bec73fe10a4afc9a09c01dfa3ff108deb1ceb57fac83718f
- MD5 87a52f4e6ce72e090d982511c93e363e
- SHA1 c6a263c8afd9d2fc60fc7a07a8449f8a8cbd713d
- SHA512 1d1f3973faebb73c0989d3fc991adad9f444ca36f7ea2c5fc0443769fde9e11c6eb1cbd2c6143c5da9167f2176c298d169a828b466826a6fde68e61961387b58
- SSDEEP 1536:+HOv/LhxM6cip+EE9wBy/PoHWvK5jnsujovmT:+uHLY6cQ+jPoHWi+O
- MD5 SHA1 SHA512 SSDEEP
chagul/Opskrivningerne.Omb
- SHA256 6843a8ca804134621441b6144683faa22b4942f036d8cfe80a55d69962683ac7
- MD5 f66d75f361e0ec5ffc8ad40deaa72b80
- SHA1 ff2d4716d80681e82c06244d3ef27cb4ff02c0df
- SHA512 767c09a4795b3a4ce3156fc1fe31fc05ab0837fbdcdc25c96072e18d5915bc2d036734d028bcca6de93fed4329c42d6a78027e4f97bdd3dfb920be4253658a54
- SSDEEP 3072:ypErUn1uw0Y+EyXVnY83VG3uYkDh9nfCNk0:yp2Un1r0GY53s3uYk99fwk0
- MD5 SHA1 SHA512 SSDEEP
chagul/Sluttidspunktets.ace
- SHA256 6770149a0d8af75d3d8df950cf3d1a8475fc73e60ef9e3bd03ad04a2001035e7
- MD5 27a799752643f5e96c57957dd115f836
- SHA1 c25dbe476573cbb94df8cb43cbbb7446e57b5bd4
- SHA512 fc46c8bd1186b0381e0f4679cb0844456dde98e62c47888c4eefdddc34c56274ab739c21c1dad4c75473a74a188698d9a268e07cd66c33464619ff6094ccf66f
- SSDEEP 768:u96Aql7WmW/QZ5UqPOsuEcWbolkZgkyecaSgaGz+5Kap5nuXNw2Keaj9JB/MwBE5:u9f45EWn++Gxc
- MD5 SHA1 SHA512 SSDEEP
chagul/crappin.fan
- SHA256 4cbc5303baa96a022304acac34ad9cbf9db661e89bf603ca872b0f38e2c7f3b7
- MD5 e2701f9b21e2e3383c23d42a8a80f0cd
- SHA1 b48623eb7f31a6e559cb276cec52b8629f28688f
- SHA512 c3d53de9228dbcc8498be846562a4630a35a321bab5344bd2ca4452b8c161405785a65ad2425b8764c0e95479f230fd8f78bf5501cad820deba8e5563621a122
- SSDEEP 768:TL/dvXcDgOiWbzPnOh+6OfAUFYoesdGESv76fMFxWcghnE9+cCvNrsgR6W9R20sA:lvXw6mnTAV0cYJNNo15U8OifFoHNwhk
- MD5 SHA1 SHA512 SSDEEP
chagul/legaliserende.tro
- SHA256 3eb84177ebd5ca99880fee24652579f356008c29ff31e8e0f157693c3e16cc69
- MD5 a372469d5ea672a9c76fdcfe1127b8df
- SHA1 25129be715c8a42ececfc70330e29a8bb7d21e14
- SHA512 15179350720dec225250a113603e1b7d9f11d7556365dcf61f150d775ddfdb930fd08079f6d933c108d3748e63118b5d5d7017b2f29657af6ff07eb826d36d20
- SSDEEP 1536:U25888m6hmlnUIklhR+yzHuuFHQUdq8SWHztpMYIJ5+w:yzhmlUIkB+yzOuFwg3DHUn
- MD5 SHA1 SHA512 SSDEEP
chagul/momentousments.afr
- SHA256 705a96fff4440f49a231e8d17b289d97786ec373aa5b39fdad48b410dca53ea8
- MD5 c6cca0bf9fb8cc569e1edbb70f5ab95e
- SHA1 fa9a3e70d31a5009f0d63d88ea8d224763936862
- SHA512 efa09455d16f63322bd81986aeccc65aeab92a601aa11eb68725afcb3f61965510ffea65bb87a89a0123263189e6a4200958582f135b3c5bb0a023fddda35911
- SSDEEP 768:0Ecv8XSTGyX64S5RDgZMitDVajTqwbR8F9SuFEq4d8CA60r9UY74l8jc9hcCq1uC:VJdFl4QUHc9DvozcowpARAwhh1
- MD5 SHA1 SHA512 SSDEEP
chagul/programdels.fla
- SHA256 f7161357b945d6764d2c290af7f7290c1c00a08aaaac622b45e2719ac6a50968
- MD5 b0f8a54823350c2f31d2bb230615afb1
- SHA1 6f46b1e8491247556108d37809870f0c34fb0f7f
- SHA512 957b98b57883b2d56186a2ac17582453d092f8ef84ac360d16c3e3ee4bc28100537df84d0f30ae880298657404e45ba29761814a5e3cf16c90510cb8175a63a3
- SSDEEP 1536:1xH2QjimoGTRLqVL7X16QOrP2tPUW59mkVwjYtTj:/ImvRWd7DtP9xZtTj
- MD5 SHA1 SHA512 SSDEEP
manifest.json
- SHA256 684ab1f17a8754bb70d3bf1fa50747ea5f01331ccc153052631606503e993aa2
- MD5 1309e3c3a9bbdd9d4c9daf4d3629e52c
- SHA1 a92ec510a3fe716506a4ed7ba74dbb75771b0d11
- SHA512 c3cd6b31daec3d6ebb4e048bfc2f4ca25da12301c88f2ab7c227f361400330b5024939ea5e2ac7381613a3267648bea8ee47aab1b2a95069973b666e364721f4
- MD5 SHA1 SHA512