30102024_0120_29102024_PEDIDO.rar
- SHA256 eccc0b1a8a0cc1fa0ecc235f09a927349f20330751c8f0f87fc977b7b5763d1f
Password
infected
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Papmlken.exe
Resource
win7-20241023-en
windows7-x64
14 signatures
300 seconds
Behavioral task
behavioral2
Sample
Papmlken.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
14 signatures
300 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240903-en
windows7-x64
3 signatures
300 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
300 seconds
General
- Target 30102024_0120_29102024_PEDIDO.rar
- Size 750KB
- Sample241030-bqdhbasldy
- SHA256 eccc0b1a8a0cc1fa0ecc235f09a927349f20330751c8f0f87fc977b7b5763d1f
- MD5 b1c32624da3d5109caa6b225f79a71ed
- SHA1 54aab4a492681c599c857ec485dd403f33989bc5
- SHA512 9e9974b182de9e288247ac682b4674e7cd1e1a21cd327ddb9400a82b9935a0551d8a20e0fe7a20437b7ed0615751296968b987648527865810801fe95cae7102
- SSDEEP 12288:K5nIJZx/stcZ+nmyEPJK01pB8jREFMYU1EoorYKduHAyv3+pmHvwlm6mOr1gQzAQ:EnY4tcYLEPY2XtM6o3KaotE4rkTygs62
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/$PLUGINSDIR/System.dll - NSIS installer 2 IoCs
resource yara_rule static1/unpack001/Papmlken.exe nsis_installer_1 static1/unpack001/Papmlken.exe nsis_installer_2
File Explorer
-
30102024_0120_29102024_PEDIDO.rar.rar 750KB
-
Papmlken.exe.exe 897KB
-
$PLUGINSDIR/System.dll.dll 11KB
-
Andelshaveres.Afr199KB
-
Anklages.bod419KB
-
Barbequing.kog437KB
-
Buffs/ankomsttidernes.obs310KB
-
Buffs/beggarliness.rab423KB
-
Buffs/besindelse.del467KB
-
Buffs/bevidsthedsudvidelsen.und216KB
-
Buffs/phonetism.ham216KB
-
Buffs/skovtursstemningernes.and272KB
-
Buffs/telcontar.txt381B
Papmlken.exe
- IMPHASH 3abe302b6d9a1256e6a915429af4ffd2
- SHA256 d015e6ce88f2d44bacf7b9d17d1341d071835570263c5c87dbf12e7674b2597a
- MD5 f7861077df1c126558e396dd2011ef6b
- SHA1 c8e5a886a2fde8a2d1c4b55d2521855afc8a978b
- SHA512 d012a8e962e68ffcb482a67957d199e00090774b5501f8bb8eb5e6402283eae2b481369187c0a0ffc9fee9a3fdc55827b4625e6ec9e66d1f2bb48b181eb077ea
- SSDEEP 24576:Ax+ra+8DOCqv2LqoAzIusXT62HnQIQMOKOaeKx:Ax+2+8DEuLqFzeXm2HTzOKOwx
- MD5 SHA1 SHA512 SSDEEP
-
NSIS installer
Password
infected
PE Signature issue
Digest
41:91:0c:b0:36:47:de:2e:24:54:43:cb:75:b2:bf:e0:8a:07:78:1b:28:1d:57:83:57:96:d2:21:3c:db:59:d7
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=battlecraft,O=battlecraft,L=Melber,C=US
Chains
Oct 29, 2024
PE Signature issue
Digest
57:1d:b7:22:35:a8:33:9b:80:4f:8a:f0:3b:6d:13:9c:14:d2:14:07
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=battlecraft,O=battlecraft,L=Melber,C=US
Chains
Oct 29, 2024
Subject
CN=battlecraft,O=battlecraft,L=Melber,C=US
Serial Number
31:1f:9d:9f:d9:64:93:5e:9f:9d:7c:04:f8:48:14:71:79:78:8d:5c
Issuer
CN=battlecraft,O=battlecraft,L=Melber,C=US
Timespan
Nov 3, 2023 - Nov 2, 2026
Subject
CN=battlecraft,O=battlecraft,L=Melber,C=US
Serial Number
31:1f:9d:9f:d9:64:93:5e:9f:9d:7c:04:f8:48:14:71:79:78:8d:5c
Issuer
CN=battlecraft,O=battlecraft,L=Melber,C=US
Timespan
Nov 3, 2023 - Nov 2, 2026
Minor OS version
0
Major OS version
4
Entry point
12731
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetTempPathA
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
SetEnvironmentVariableA
Sleep
GetTickCount
GetCommandLineA
lstrlenA
GetVersion
SetErrorMode
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GetWindowsDirectoryA
SetCurrentDirectoryA
GetLastError
CreateDirectoryA
CreateProcessA
RemoveDirectoryA
CreateFileA
GetTempFileNameA
ReadFile
WriteFile
lstrcpyA
MoveFileExA
lstrcatA
GetSystemDirectoryA
GetProcAddress
GetExitCodeProcess
WaitForSingleObject
CompareFileTime
SetFileAttributesA
GetFileAttributesA
GetShortPathNameA
MoveFileA
GetFullPathNameA
SetFileTime
SearchPathA
CloseHandle
lstrcmpiA
CreateThread
GlobalLock
lstrcmpA
FindFirstFileA
FindNextFileA
DeleteFileA
SetFilePointer
GetPrivateProfileStringA
FindClose
MultiByteToWideChar
FreeLibrary
MulDiv
WritePrivateProfileStringA
LoadLibraryExA
GetModuleHandleA
GlobalAlloc
GlobalFree
ExpandEnvironmentStringsA
user32
ScreenToClient
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
PostQuitMessage
GetWindowRect
EnableMenuItem
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
ReleaseDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndDialog
RegisterClassA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
ExitWindowsEx
GetDC
CreateDialogParamA
SetTimer
GetDlgItem
SetWindowLongA
SetForegroundWindow
LoadImageA
IsWindow
SendMessageTimeoutA
FindWindowExA
OpenClipboard
TrackPopupMenu
AppendMenuA
EndPaint
DestroyWindow
wsprintfA
ShowWindow
SetWindowTextA
gdi32
SelectObject
SetBkMode
CreateFontIndirectA
SetTextColor
DeleteObject
GetDeviceCaps
CreateBrushIndirect
SetBkColor
shell32
SHGetSpecialFolderLocation
ShellExecuteExA
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
SHFileOperationA
advapi32
AdjustTokenPrivileges
RegCreateKeyExA
RegOpenKeyExA
SetFileSecurityA
OpenProcessToken
LookupPrivilegeValueA
RegEnumValueA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegSetValueExA
RegQueryValueExA
RegEnumKeyA
comctl32
ImageList_Create
ImageList_AddMasked
ImageList_Destroy
ord17
ole32
OleUninitialize
OleInitialize
CoTaskMemFree
CoCreateInstance
Name
.text
Size
24KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
106KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
124KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
169KB
Virtual Size
168KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=159, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
$PLUGINSDIR/System.dll
- IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
- SHA256 b80a5cba69d1853ed5979b0ca0352437bf368a5cfb86cb4528edadd410e11352
- MD5 c9473cb90d79a374b2ba6040ca16e45c
- SHA1 ab95b54f12796dce57210d65f05124a6ed81234a
- SHA512 eafe7d5894622bc21f663bca4dd594392ee0f5b29270b6b56b0187093d6a3a103545464ff6398ad32d2cf15dab79b1f133218ba9ba337ddc01330b5ada804d7b
- SSDEEP 192:cPtkumJX7zBE2kGwfy9S9VkPsFQ1MZ1c:N7O2k5q9wA1MZa
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
4
Entry point
9993
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
MultiByteToWideChar
GlobalFree
GlobalSize
lstrcpynA
lstrcpyA
GetProcAddress
VirtualFree
FreeLibrary
lstrlenA
LoadLibraryA
GetModuleHandleA
GlobalAlloc
WideCharToMultiByte
VirtualAlloc
VirtualProtect
GetLastError
user32
wsprintfA
ole32
StringFromGUID2
CLSIDFromString
Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc
Name
.text
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
851B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
104B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1024B
Virtual Size
606B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=14, version=7299,
count=19, id=1, productName=Unmarked objects,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=4, id=48, version=9044,
count=1, id=42, version=8803,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
Andelshaveres.Afr
- SHA256 649b296d819e8cfd37c203a6fa38b76e0f2eacbd3a99bbd513a9018b404375ef
- MD5 c9be6ba43be2cc50a0f1afeae236a099
- SHA1 6f04863fb27682354bec9d008dc2e6636674480c
- SHA512 8c10c8f2a4df16d5b26abe0a1e917c109297d98d741caa7caa8610fa6aec4af33d1174a9f8188f7a07f56629980420ada79c671fd3a69ff7f62c858eab79c0fe
- SSDEEP 6144:TxJFgDH1ZZWKa38qII542lOEQQzpr0E92oLvxOjQfvM7vKYeeo6Tr9j9PjL:NJFgDH1ZZWKa38G55lPQQzd0s2K0t7v/
- MD5 SHA1 SHA512 SSDEEP
Anklages.bod
- SHA256 886b9aea37a0d8f21e3a9daeb974cff48197a47fe17279130576779e43ea44d5
- MD5 beb0697ff747afd61850cf6c4221d5bd
- SHA1 b36f5a97652154421dede2c9efa27c5bc48f696b
- SHA512 a64adb44f9ea5395c3712f84fac6d124486f8589fd8f2f5e6afabc741e603651f405954aeb753da1ad67af3a05b7c39cbc552334cdf4c075b032c58967089790
- SSDEEP 768:85nhJxzwEt9iIiklH+RybHpWf86+6Jl71/F4V/ay/b1kgPN0kfPvgJ95A9dqsFx/:7Et1jHF4h9exefjskVy6Ofnp44PcT+
- MD5 SHA1 SHA512 SSDEEP
Barbequing.kog
- SHA256 cccbebb46550d794e5ca6d987bb43c4429ef441b3bd3b6a83c01d669046f9198
- MD5 b7ccae8b133e1e714120ca77ea8c7249
- SHA1 2617de8b6a7b8d9d2d62ad20f778af9978f21202
- SHA512 53269311ff1afffbab37b1c94dfc88aa1b181e4d6d306bff7ecbd6091151f09f9552c5468879846e2921df7f307ee546b1ab89a4e827a998ca9d8a5439d76100
- SSDEEP 1536:gn/6Nqqaew9UavmqsYgIf5teefqAaNvaqX6dWAS46rdSQ7nPas8Vd9FjQTZa2fJl:gntpfz8XH/zxYWUyfWLgYfVA
- MD5 SHA1 SHA512 SSDEEP
Buffs/ankomsttidernes.obs
- SHA256 75c184e5697a25e1fddb29321c1fe5670191041a26f7e5209264d4b948cdbda5
- MD5 e709e62365caa58ef4be2f1d9d635944
- SHA1 74c294cf4b723304883cf6812549e7584ed8ca44
- SHA512 22f057add0fd2dc37f539b66e37e75aede5f59c255d878257b01adcd22889b129778fd194f43822599c38619a515e1c07e38601257ec872cf6c2cf7bd597ce06
- SSDEEP 1536:aSSMNripeTi8tcwZ5DxukXUgVOrokqGykfq:aWJThqSXUHyh
- MD5 SHA1 SHA512 SSDEEP
Buffs/beggarliness.rab
- SHA256 e8a6c6cc2f29488ee76e0e5f5751c8345d8fcfa58ae162f98e07ecbabf8f58b5
- MD5 5066398dacf47b0581cbae543934824f
- SHA1 f17d4884d4f1743e99e9cc2acb4927d3aac3f87c
- SHA512 9b937a0d2a77da03244b4abebe2b015a55fb3acdf6e60587debdd5efbe90d62ea0353d3eb0e77f7eb4a34ff0afa6a85484a983b7c676e9ae821d6dc6a1559922
- SSDEEP 1536:hnk5eUOtB6NJw8scQFwogPfCrb7iGRpPEG+sCLO6u:tktO8orbP/+su8
- MD5 SHA1 SHA512 SSDEEP
Buffs/besindelse.del
- SHA256 9fad11e966e65f071438182d65d5c366fdec1b2e6e55b62fac6d340ed6af8e3d
- MD5 ba84ecd8b2559ecbecbde1432c367ece
- SHA1 abffeadcfd7ed93b57d884a9437a62e19eb66d11
- SHA512 3ec3b59c9f7fc3039bfdf8f902a79f147f9d2f4d691bdad62df9edc209061931469dc9857eac0f22ca94fe3a33681520cfcd1953ebbafe575bffab8263e6d52f
- SSDEEP 1536:oXoLe735oOOBiucAvUul/HY2/XtMWRHrRLhamiX:o4LuJNOBizS/HtFMWRLbam2
- MD5 SHA1 SHA512 SSDEEP
Buffs/bevidsthedsudvidelsen.und
- SHA256 adc2099b40e08d64c7c12e43f0a4877f9c8b2593b86edb6eb6381049093aafee
- MD5 2a6ffc736e96e911cc777df21dd9207c
- SHA1 41fe98c7ac97ac97f444383e8838f63899ac6a85
- SHA512 b5c391f6106950d37110144968b899fe6f929dbb00257657ba8e63fb1ffb024aebe3eb6b8c3f0e4c336b5d4156d9a1e88d882f14d04555006afd66175b59e95a
- SSDEEP 768:Sr45/U0agoHI2U/gRdeMgkZhDARzPafwGkOyRuI6WFTPj4c2ciLTSXfkgzIWN2CV:z/3POxDyCo6yjXH
- MD5 SHA1 SHA512 SSDEEP
Buffs/phonetism.ham
- SHA256 7eb2dcf0349ad2a17d56426054a123ff8dd0ecf60a74fbf59267d1e94fc86b78
- MD5 5dc04b53c924a15c430da960db73aa27
- SHA1 d3367203e4f7eac0d40ea08bd7434db17cbfc2e8
- SHA512 90c85bb1da20e01f111fef7270ff4827d268c86467de338524ebd0e7736d1b77bf1bc9c3fa1fa1ee75a10cf3e9df5680babf49c4fd52e65e2a7f88c665eb3bf8
- SSDEEP 768:UEGD8pi+OnyGF8VOfpmIamQ+1r2xhgXPyxI+R/9d7jdr5oGEqsraoC8R55An+T7+:sy3E6xuqr5t3q4ls6
- MD5 SHA1 SHA512 SSDEEP
Buffs/skovtursstemningernes.and
- SHA256 4e8b0fa52dc775d52f34528f17e40bc3c7b645de8fcbd15a13e15c9d8c9343de
- MD5 a5dc7826aad6e8f21b82862d3dce5e19
- SHA1 de1a5a38d84e7e89047d7cd75ce21476756569ed
- SHA512 c44443a2c1e5738af7ff276e80cce08e6e830e1258252c43bd501ac8b3fa23fe72d801f9bf4eee3baf8075996fc89d2b276bdbe30af421faebb0681922057db7
- SSDEEP 768:r8/GPBxg6M7g7OzAqybt6Yan7KhA4wowv9w81X/W136VZ+iE8iTnqcfW/+YcM3kV:A6S6E+wB/Y1zzZ+K3dX
- MD5 SHA1 SHA512 SSDEEP
Buffs/telcontar.txt
- SHA256 981c4f156a8d30ae7b40e6b611114707b46d0ef7ba61d6ecd813267b99b0a6ff
- MD5 6ef48e64e0432b3eeb16614315305eab
- SHA1 7921fb890955694225ef254dad564ff42ea888b9
- SHA512 d58f034e162b33134c21373b0e7e77adfc5b4a1e6b193baca8960f2c33828ce0349dfa2b415605877075c65730245e1af80049aafbf450a6e1906218e7574811
- MD5 SHA1 SHA512