4367b359ac0a30eabf842a62e6557acda44857fcabb6b1d6b867da7055680ffd.lzh
- SHA256 4367b359ac0a30eabf842a62e6557acda44857fcabb6b1d6b867da7055680ffd
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Quotation.exe
Resource
win7-20241010-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
Quotation.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
20 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target 4367b359ac0a30eabf842a62e6557acda44857fcabb6b1d6b867da7055680ffd.lzh
- Size 1.0MB
- Sample241102-esbnaazapq
- SHA256 4367b359ac0a30eabf842a62e6557acda44857fcabb6b1d6b867da7055680ffd
- MD5 c62a4147f99e9d671c0d3f575849d73f
- SHA1 157475711c4cd0776c7b75d813ce390ce6ef6dbd
- SHA512 3120dc0b270435168ba22ad68a6f6c59fa5eef0c5d1dda17a97b52507c6da654148748e1e08ff6a9d5e00a8ed6bd55e81eef3a6f599074ce60e953beff4bd447
- SSDEEP 24576:8UrFoIbS04UV/gbBoxPo61tXnKrPCOBOFmE3SsMip:JrFNbV/gWA61tXKeO4fSsMip
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/$PLUGINSDIR/System.dll
File Explorer
-
4367b359ac0a30eabf842a62e6557acda44857fcabb6b1d6b867da7055680ffd.lzh.lzh 1.0MB
-
Quotation.exe.exe 1.1MB
-
$PLUGINSDIR/System.dll.dll 12KB
-
$_41_/Emmens.udk471KB
-
$_41_/Flirtish.Dai138KB
-
$_41_/Otomaco.Eta345KB
-
$_41_/Proprietrer.bet282KB
-
$_41_/Trikstanks.pra332KB
-
$_41_/boyaus.rom383KB
-
$_41_/gear.dra423KB
-
$_41_/jagtfalk.ill366KB
-
$_41_/regill.ful477KB
-
$_41_/sortlistningens.txt371B
Quotation.exe
- IMPHASH 3f91aceea750f765ef2ba5d9988e6a00
- SHA256 6d3bda97722c347d083d7127f23eae6f28e86ee31a8b9b643826a44bdc97be69
- MD5 eaad92690f4cc140b25affb391767c48
- SHA1 2f161c2e596eaca3f903f56fc24561c610ce0bcc
- SHA512 b9755a349d09904ed4f1c702353e9f8c3e8b4063f25eb349695452bcce1f930b3473ce1a0c3f4b1749e8afbc643fc87e253188e33182c2ff0ee50ef23de67c80
- SSDEEP 24576:z4nhDoAFq/DZt9+jNcwHCBNFSgaEMZNXLGQ7WczkxFnfbP9b:z+hkxlijusC5SxHNXKQKczgF
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
79:bd:93:de:d1:34:a7:01:59:aa:7b:89:a3:49:2c:8b:14:c1:69:18:88:e9:69:34:53:1f:c3:e7:6d:5e:9a:ae
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=hankelses,O=hankelses,L=Limoges,C=FR
Chains
Oct 29, 2024
PE Signature issue
Digest
07:06:da:ba:11:3f:5d:6b:63:07:fa:37:4d:04:ae:69:78:aa:df:ac
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=hankelses,O=hankelses,L=Limoges,C=FR
Chains
Oct 29, 2024
Subject
CN=hankelses,O=hankelses,L=Limoges,C=FR
Serial Number
39:b3:67:6a:3a:42:f6:a3:40:73:7e:0f:1b:95:83:58:5b:dd:0f:14
Issuer
CN=hankelses,O=hankelses,L=Limoges,C=FR
Timespan
Jul 30, 2024 - Jul 30, 2027
Subject
CN=hankelses,O=hankelses,L=Limoges,C=FR
Serial Number
39:b3:67:6a:3a:42:f6:a3:40:73:7e:0f:1b:95:83:58:5b:dd:0f:14
Issuer
CN=hankelses,O=hankelses,L=Limoges,C=FR
Timespan
Jul 30, 2024 - Jul 30, 2027
Minor OS version
1
Major OS version
5
Entry point
14042
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
advapi32
RegCloseKey
RegDeleteKeyW
RegDeleteValueW
RegEnumKeyW
RegEnumValueW
RegQueryValueExW
RegSetValueExW
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueW
SetFileSecurityW
RegCreateKeyExW
RegOpenKeyExW
shell32
ShellExecuteExW
SHFileOperationW
SHBrowseForFolderW
SHGetPathFromIDListW
SHGetFileInfoW
SHGetSpecialFolderLocation
ole32
OleInitialize
OleUninitialize
CoTaskMemFree
IIDFromString
CoCreateInstance
comctl32
ord17
ImageList_Destroy
ImageList_AddMasked
ImageList_Create
user32
DispatchMessageW
wsprintfA
SystemParametersInfoW
SetClassLongW
GetWindowLongW
GetSysColor
ScreenToClient
SetCursor
GetWindowRect
TrackPopupMenu
AppendMenuW
EnableMenuItem
CreatePopupMenu
GetSystemMenu
GetSystemMetrics
IsWindowEnabled
EmptyClipboard
SetClipboardData
CloseClipboard
OpenClipboard
CheckDlgButton
EndDialog
DialogBoxParamW
IsWindowVisible
SetWindowPos
CreateWindowExW
GetClassInfoW
PeekMessageW
CallWindowProcW
GetMessagePos
CharNextW
ExitWindowsEx
SetWindowTextW
SetTimer
CreateDialogParamW
DestroyWindow
LoadImageW
FindWindowExW
SetWindowLongW
InvalidateRect
ReleaseDC
GetDC
SetForegroundWindow
EnableWindow
GetDlgItem
ShowWindow
IsWindow
PostQuitMessage
SendMessageTimeoutW
SendMessageW
wsprintfW
FillRect
GetClientRect
EndPaint
BeginPaint
DrawTextW
DefWindowProcW
SetDlgItemTextW
GetDlgItemTextW
CharNextA
MessageBoxIndirectW
RegisterClassW
CharPrevW
LoadCursorW
gdi32
SetBkMode
CreateBrushIndirect
GetDeviceCaps
SelectObject
DeleteObject
SetBkColor
SetTextColor
CreateFontIndirectW
kernel32
WriteFile
GetLastError
WaitForSingleObject
GetExitCodeProcess
GetTempFileNameW
CreateFileW
CreateDirectoryW
WideCharToMultiByte
lstrlenW
lstrcpynW
GlobalLock
GlobalUnlock
CreateThread
GetDiskFreeSpaceW
CopyFileW
GetVersionExW
GetWindowsDirectoryW
ExitProcess
GetCurrentProcess
CreateProcessW
GetTempPathW
SetEnvironmentVariableW
GetCommandLineW
GetModuleFileNameW
GetTickCount
GetFileSize
MultiByteToWideChar
MoveFileW
WritePrivateProfileStringW
GetPrivateProfileStringW
lstrlenA
lstrcmpiW
lstrcmpW
MulDiv
GlobalFree
GlobalAlloc
LoadLibraryExW
GetModuleHandleW
FreeLibrary
Sleep
CloseHandle
SetFileTime
SetFilePointer
SetFileAttributesW
ReadFile
GetShortPathNameW
GetFullPathNameW
GetFileAttributesW
FindNextFileW
FindFirstFileW
FindClose
DeleteFileW
CompareFileTime
SearchPathW
SetCurrentDirectoryW
ExpandEnvironmentStringsW
RemoveDirectoryW
GetSystemDirectoryW
MoveFileExW
GetModuleHandleA
GetProcAddress
lstrcmpiA
lstrcpyA
lstrcatW
SetErrorMode
Name
.text
Size
27KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
3.6MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
200KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
250KB
Virtual Size
250KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=260, version=30795,
count=1, id=262, version=30795,
count=15, id=257, version=30795,
count=165, id=1, productName=Unmarked objects,
count=13, id=260, version=30146,
count=1, id=255, version=30146,
count=1, id=258, version=30146,
$PLUGINSDIR/System.dll
- IMPHASH 4f33ea844b96a31c8f4690530ba63854
- SHA256 f917aef484d1fbb4d723b2e2d3045cb6f5f664e61fbb3d5c577bd1c215de55d9
- MD5 d6f54d2cefdf58836805796f55bfc846
- SHA1 b980addc1a755b968dd5799179d3b4f1c2de9d2d
- SHA512 ce67da936a93d46ef7e81abc8276787c82fd844c03630ba18afc3528c7e420c3228bfe82aeda083bb719f2d1314afae913362abd1e220cb364606519690d45db
- SSDEEP 192:acA1YOTDExj7EFrYCT4E8y3hoSdtTgwF43E7QbGPXI9uIc6w79Mw:RR7SrtTv53tdtTgwF4SQbGPX36wJMw
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
6730
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GlobalAlloc
GlobalSize
GlobalFree
lstrcpynW
lstrcpyW
GetLastError
VirtualAlloc
VirtualProtect
VirtualFree
FreeLibrary
GetModuleHandleW
GetProcAddress
LoadLibraryW
lstrlenW
MultiByteToWideChar
WideCharToMultiByte
user32
wsprintfW
ole32
StringFromGUID2
CLSIDFromString
Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc
Name
.text
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
958B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
68B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
512B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=259, version=30034,
count=7, id=257, version=30795,
count=20, id=1, productName=Unmarked objects,
count=4, id=260, version=30146,
count=1, id=259, version=30146,
count=1, id=256, version=30146,
count=1, id=258, version=30146,
$_41_/Emmens.udk
- SHA256 1b6dc1ead079db05b998725b154e803e6e1504e7e5b49c5611d55e018cd45e6d
- MD5 1d099f6122f4b7c8a78925726b59e5c3
- SHA1 eea154e31ff04cd1a2ced0193f7633ed219cfa47
- SHA512 f31f0a285c5a6eb2236ccd49a8bf939e46624f270e0270fc4c5640b37684bc1c7780c5350f778da8e9d0b8cd25320c1909a9cd937f15bb3a7cddbceee94c47fb
- SSDEEP 1536:+yiLw81PnsncGiIsTVODPOqNbsVEVWZkZA4:G/Pne9iIyVODPsVpZkZA4
- MD5 SHA1 SHA512 SSDEEP
$_41_/Flirtish.Dai
- SHA256 d6b517f8a8c4b93f8bd0a3d9bf513459936ea8fd5521d83920c329d894eb14b4
- MD5 5e0fbb8824a8bfec31c19926b691ef86
- SHA1 0b77905858ff54631c6db2c417e5583236bab98c
- SHA512 395afb4d33bc9ce20c062a271c3a4dbb0c44f3621bbcdf5caadf58edbd0d63a08925601804d14ba39b340771d5b558ae7d20ec9a4773ccd50ee7b043275531dd
- SSDEEP 3072:VN1e86WYE6C9jyymU9LA5K3Et3RWYM5gg:VekfF94K3EtBWYkD
- MD5 SHA1 SHA512 SSDEEP
$_41_/Otomaco.Eta
- SHA256 c3b5cfe284b81b2e6c1028b3daa96c9171b060614ffbd5ccedf2c24e108de2df
- MD5 0b8469a4a00396d93894f3ca7c8254e3
- SHA1 209fb7b86c9911ace50dd144876354148f5915fb
- SHA512 be3e87f72255f0ea7bc46b9235b78dd8ce75cff68e7f270ff320f53826d8e99dbd7ce6034d42f8085431abafac0a027e085f1d91dbd42925e7832b41f93c0836
- SSDEEP 6144:GO1jOE2gJQAtsNGKmFCR0l3h0Y+Qm/XVKf/17R7C:L5Jb+F+13h05Qm/XqW
- MD5 SHA1 SHA512 SSDEEP
$_41_/Proprietrer.bet
- SHA256 645c325f62af720972466322b09a7e396e46d8e640b138d582374b68d763a3a7
- MD5 0b62328c4966f6b879b3c13b7fbd9c0d
- SHA1 6dd81f12e739e81e06778067513ed1178a06afc9
- SHA512 2f738a2950352f124f7b969d38b52bd2e4453ff42bc8deb7566620e6cdea30368a6dc16230ba49050f8c0327175cab71dc4a1709541f08a3ffdcf55faf5b75b8
- SSDEEP 768:l1SkOmjqFRV/HZzy6+19kZBH4YVHCdJS7G5iOUEEaXXLlgHHl7MRY9hN+418WPK5:KOqvBJzC5vBhp8KT9AGCbQTZkkR
- MD5 SHA1 SHA512 SSDEEP
$_41_/Trikstanks.pra
- SHA256 a55dac07fb586d4b64f0ddf812087a2eeec6f5286d9bc73ad648ed3220abdd3a
- MD5 49be0e06f2e4f0ccffb46426ee262642
- SHA1 ff9c56c31a824e4ca087705c23d01d288fe34239
- SHA512 27e9d035708943dd257186457c15488c9405747fc77f7c76760c96ee011c239f9fa53b5da17958038fb2ba1c4e27e643e7924a37e6164e250b9f45a109d92e53
- SSDEEP 768:AgVdAd1etxyZmQhZgJwrQTTwKuiTGrJqCoIEsPkZnFFSKsOI4v/3n35lB3LiADa4:5TxLsV5IjQ3xx12
- MD5 SHA1 SHA512 SSDEEP
$_41_/boyaus.rom
- SHA256 a56351ed69a301f5d9d89b6530280b7a85f998a806e1648911c37b6983ba9426
- MD5 f130ec3095dbecedc791d8c58a59040c
- SHA1 dad2300b487f31f199520e1b41ab02b7d677b352
- SHA512 8599200f472f2d59390e8f2c497331640b12ab9faf71817160c6d450edf8a99f78cef28cc3b57581d6aecfc1ec90a49947a6685c606321b6ee300d483c838360
- SSDEEP 768:jby0EUrStmwpKcx/orVcYZ+M3ok1I7vZFCDrlv2UV5t3votN6cGia46OGj3OkYSk:FaZaukRTadSdbrJ5N275Ea3nRYS3r
- MD5 SHA1 SHA512 SSDEEP
$_41_/gear.dra
- SHA256 fad1b5e641dc44b5a51048470d4e0fb47664cf2b994cea24304495d99323b9de
- MD5 53ff1a157920ae92c9bf891d453d6b65
- SHA1 b7bf3b7b16048f38132d8acca841130d73db44c3
- SHA512 e739381c24627f89255db55b2da39a09f055a322c577c3604ba048fb2c817ae7f63b12131f8461491f6140953fb33dd94eb66d8cb3b13b36717143342ce270af
- SSDEEP 768:NFXORpsqJLOaVDzzoIgUPRGRoYNxHVxyczaUz4pP9Nom56I4tY6UBh1Yc88LaAQo:TUAoYxPzqoIzdwWR1+/24cwZXeCPiIBo
- MD5 SHA1 SHA512 SSDEEP
$_41_/jagtfalk.ill
- SHA256 accd4911d88e808aed4a2aa27394628c62574810b0b47977b7103a246fdf2a10
- MD5 169115c751dda5e021e8c86e8454b26d
- SHA1 5a8254634c0c726bb18e42e626eaeb581d532dcd
- SHA512 2b643014e8623cadba7ce78b91d3c751d60fcbf3fa69fa26f29a14e55679fc6a5c2074834b2496773a1756e3172ec7c898e2df29cb4a0513dbf8bc0dcdda7e04
- SSDEEP 1536:XkYzjcLYszRzU5n1C900tMkYQx+gnpovYHO:XkYz4DzQB5sYYH
- MD5 SHA1 SHA512 SSDEEP
$_41_/regill.ful
- SHA256 4bc57a47b82b63ec20b393f65f3585eb81fe3f7748229cd19dec8fe8a41d67c3
- MD5 b4fb425baf217f31e91aab39abf66dcd
- SHA1 03de3bd0f923ab14213b6c4461c5ca73a0a6371c
- SHA512 e72395fd6098130efd543c5941781a1aa80fce17c7701cb40fa8874271e0d43e0f7f082ebf5d458181287de41cf4b34f88dcaabe84d8ad51003ef5da1495d871
- SSDEEP 1536:HMtjgMjMD1whyMu1IXCVAcFNpruXO+nBJH:stjgmYi03XDL+nBJ
- MD5 SHA1 SHA512 SSDEEP
$_41_/sortlistningens.txt
- SHA256 2ea079dede1b356842c5f5e0751b5e2b6565fded65dafb59a73d170c002abb27
- MD5 46003c65aa12a0ebe55662f0141186dc
- SHA1 739652c3375018daffb986302a7d3e8d32770b41
- SHA512 59d394789f9eece97873d56aea64f353d3e13e007e4acbd396ac76cb68e91494eb65888049ef05cbe9b20597adadcc960d067f90aad3ea5aa46ac3a82f5b82fd
- MD5 SHA1 SHA512