05112024_1451_Quotation.lzh
- SHA256 1612a197144adfe1b30ca1c680e93d2ee916d46be0b7b163bf5afb212cff4155
Password
infected
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Quotation.exe
Resource
win7-20240903-en
windows7-x64
17 signatures
300 seconds
Behavioral task
behavioral2
Sample
Quotation.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
20 signatures
300 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20241010-en
windows7-x64
3 signatures
300 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
300 seconds
General
- Target 05112024_1451_Quotation.lzh
- Size 1.0MB
- Sample241105-r76hesvrfr
- SHA256 1612a197144adfe1b30ca1c680e93d2ee916d46be0b7b163bf5afb212cff4155
- MD5 0e359e0015e712e892ec5b680c68cfcc
- SHA1 62e4dffb7bdd5011e8715ffdbd4ff6a9cdaaa827
- SHA512 d7c2291f78c6dbbceb90061e6a20b08f575641cae0d76c8e0d8b30d307d4e878af81e0053f6291e95c3a6ca5991230f6097b43601140b06b48faec50fc314daf
- SSDEEP 24576:8+Nd8zfriTrzIEkO50kgaVJRxie41v3NN+asZIp3Ks7:qcrUEf+BIYe8PGcKs7
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/$PLUGINSDIR/System.dll
File Explorer
-
05112024_1451_Quotation.lzh.lzh 1.0MB
-
Quotation.exe.exe 1.1MB
-
$PLUGINSDIR/System.dll.dll 12KB
-
$_41_/Emmens.udk471KB
-
$_41_/Induktionskogezoner.Nsk342KB
-
$_41_/Proprietrer.bet282KB
-
$_41_/Smalfilmerens.Sem146KB
-
$_41_/Trikstanks.pra332KB
-
$_41_/boyaus.rom383KB
-
$_41_/gear.dra423KB
-
$_41_/jagtfalk.ill366KB
-
$_41_/regill.ful477KB
-
$_41_/sortlistningens.txt371B
Quotation.exe
- IMPHASH 3f91aceea750f765ef2ba5d9988e6a00
- SHA256 648ee80543d70f070c497309e4c7ce090254374da938799074de93bdaafaff5a
- MD5 816b7984251ee4c846a7f0d6160624e2
- SHA1 be82357d711260a412103e7fde8785febd060974
- SHA512 81e035b9ffd16b8a31ab23f1d2bf621954cd42b8c0fdf0daffbac12f1964d41d949af68a06259e27bcc8163221cbfdb05f300eca7151ff901a2bcd36ca8b7a4c
- SSDEEP 24576:G4nhDoAFAcvHumQbl7nu5v12dUC5YpdBNFQWEZNXLGQ7WczkxFnfbP9:G+hkJcvfyl7nu5vaUCMd5iNXKQKczg
- MD5 SHA1 SHA512 SSDEEP
Password
infected
PE Signature issue
Digest
49:9f:f2:fd:3b:c0:18:ef:a6:02:e6:da:6c:68:c6:ad:ca:be:b8:4a:b8:34:66:53:7c:86:c9:8d:e5:ec:c2:1c
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Bomsejlene,O=Bomsejlene,L=Cergy-Pontoise,C=FR
Chains
Nov 5, 2024
PE Signature issue
Digest
db:6e:07:3e:71:eb:d7:dd:73:86:87:7a:55:c9:cf:44:96:5b:6e:90
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Bomsejlene,O=Bomsejlene,L=Cergy-Pontoise,C=FR
Chains
Nov 5, 2024
Subject
CN=Bomsejlene,O=Bomsejlene,L=Cergy-Pontoise,C=FR
Serial Number
5f:96:9f:e1:05:f6:12:64:18:78:91:d5:61:f9:3f:fc:d4:c5:c2:c2
Issuer
CN=Bomsejlene,O=Bomsejlene,L=Cergy-Pontoise,C=FR
Timespan
Sep 29, 2024 - Sep 29, 2027
Subject
CN=Bomsejlene,O=Bomsejlene,L=Cergy-Pontoise,C=FR
Serial Number
5f:96:9f:e1:05:f6:12:64:18:78:91:d5:61:f9:3f:fc:d4:c5:c2:c2
Issuer
CN=Bomsejlene,O=Bomsejlene,L=Cergy-Pontoise,C=FR
Timespan
Sep 29, 2024 - Sep 29, 2027
Minor OS version
1
Major OS version
5
Entry point
14042
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
advapi32
RegCloseKey
RegDeleteKeyW
RegDeleteValueW
RegEnumKeyW
RegEnumValueW
RegQueryValueExW
RegSetValueExW
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueW
SetFileSecurityW
RegCreateKeyExW
RegOpenKeyExW
shell32
ShellExecuteExW
SHFileOperationW
SHBrowseForFolderW
SHGetPathFromIDListW
SHGetFileInfoW
SHGetSpecialFolderLocation
ole32
OleInitialize
OleUninitialize
CoTaskMemFree
IIDFromString
CoCreateInstance
comctl32
ord17
ImageList_Destroy
ImageList_AddMasked
ImageList_Create
user32
DispatchMessageW
wsprintfA
SystemParametersInfoW
SetClassLongW
GetWindowLongW
GetSysColor
ScreenToClient
SetCursor
GetWindowRect
TrackPopupMenu
AppendMenuW
EnableMenuItem
CreatePopupMenu
GetSystemMenu
GetSystemMetrics
IsWindowEnabled
EmptyClipboard
SetClipboardData
CloseClipboard
OpenClipboard
CheckDlgButton
EndDialog
DialogBoxParamW
IsWindowVisible
SetWindowPos
CreateWindowExW
GetClassInfoW
PeekMessageW
CallWindowProcW
GetMessagePos
CharNextW
ExitWindowsEx
SetWindowTextW
SetTimer
CreateDialogParamW
DestroyWindow
LoadImageW
FindWindowExW
SetWindowLongW
InvalidateRect
ReleaseDC
GetDC
SetForegroundWindow
EnableWindow
GetDlgItem
ShowWindow
IsWindow
PostQuitMessage
SendMessageTimeoutW
SendMessageW
wsprintfW
FillRect
GetClientRect
EndPaint
BeginPaint
DrawTextW
DefWindowProcW
SetDlgItemTextW
GetDlgItemTextW
CharNextA
MessageBoxIndirectW
RegisterClassW
CharPrevW
LoadCursorW
gdi32
SetBkMode
CreateBrushIndirect
GetDeviceCaps
SelectObject
DeleteObject
SetBkColor
SetTextColor
CreateFontIndirectW
kernel32
WriteFile
GetLastError
WaitForSingleObject
GetExitCodeProcess
GetTempFileNameW
CreateFileW
CreateDirectoryW
WideCharToMultiByte
lstrlenW
lstrcpynW
GlobalLock
GlobalUnlock
CreateThread
GetDiskFreeSpaceW
CopyFileW
GetVersionExW
GetWindowsDirectoryW
ExitProcess
GetCurrentProcess
CreateProcessW
GetTempPathW
SetEnvironmentVariableW
GetCommandLineW
GetModuleFileNameW
GetTickCount
GetFileSize
MultiByteToWideChar
MoveFileW
WritePrivateProfileStringW
GetPrivateProfileStringW
lstrlenA
lstrcmpiW
lstrcmpW
MulDiv
GlobalFree
GlobalAlloc
LoadLibraryExW
GetModuleHandleW
FreeLibrary
Sleep
CloseHandle
SetFileTime
SetFilePointer
SetFileAttributesW
ReadFile
GetShortPathNameW
GetFullPathNameW
GetFileAttributesW
FindNextFileW
FindFirstFileW
FindClose
DeleteFileW
CompareFileTime
SearchPathW
SetCurrentDirectoryW
ExpandEnvironmentStringsW
RemoveDirectoryW
GetSystemDirectoryW
MoveFileExW
GetModuleHandleA
GetProcAddress
lstrcmpiA
lstrcpyA
lstrcatW
SetErrorMode
Name
.text
Size
27KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
3.6MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
200KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
250KB
Virtual Size
250KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=260, version=30795,
count=1, id=262, version=30795,
count=15, id=257, version=30795,
count=165, id=1, productName=Unmarked objects,
count=13, id=260, version=30146,
count=1, id=255, version=30146,
count=1, id=258, version=30146,
$PLUGINSDIR/System.dll
- IMPHASH 4f33ea844b96a31c8f4690530ba63854
- SHA256 f917aef484d1fbb4d723b2e2d3045cb6f5f664e61fbb3d5c577bd1c215de55d9
- MD5 d6f54d2cefdf58836805796f55bfc846
- SHA1 b980addc1a755b968dd5799179d3b4f1c2de9d2d
- SHA512 ce67da936a93d46ef7e81abc8276787c82fd844c03630ba18afc3528c7e420c3228bfe82aeda083bb719f2d1314afae913362abd1e220cb364606519690d45db
- SSDEEP 192:acA1YOTDExj7EFrYCT4E8y3hoSdtTgwF43E7QbGPXI9uIc6w79Mw:RR7SrtTv53tdtTgwF4SQbGPX36wJMw
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
6
Entry point
6730
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GlobalAlloc
GlobalSize
GlobalFree
lstrcpynW
lstrcpyW
GetLastError
VirtualAlloc
VirtualProtect
VirtualFree
FreeLibrary
GetModuleHandleW
GetProcAddress
LoadLibraryW
lstrlenW
MultiByteToWideChar
WideCharToMultiByte
user32
wsprintfW
ole32
StringFromGUID2
CLSIDFromString
Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc
Name
.text
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
958B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
68B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
512B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=259, version=30034,
count=7, id=257, version=30795,
count=20, id=1, productName=Unmarked objects,
count=4, id=260, version=30146,
count=1, id=259, version=30146,
count=1, id=256, version=30146,
count=1, id=258, version=30146,
$_41_/Emmens.udk
- SHA256 1b6dc1ead079db05b998725b154e803e6e1504e7e5b49c5611d55e018cd45e6d
- MD5 1d099f6122f4b7c8a78925726b59e5c3
- SHA1 eea154e31ff04cd1a2ced0193f7633ed219cfa47
- SHA512 f31f0a285c5a6eb2236ccd49a8bf939e46624f270e0270fc4c5640b37684bc1c7780c5350f778da8e9d0b8cd25320c1909a9cd937f15bb3a7cddbceee94c47fb
- SSDEEP 1536:+yiLw81PnsncGiIsTVODPOqNbsVEVWZkZA4:G/Pne9iIyVODPsVpZkZA4
- MD5 SHA1 SHA512 SSDEEP
$_41_/Induktionskogezoner.Nsk
- SHA256 a63dbf74f1bbff5707aeb80ed80ded99b4e83878d78e9e2970df9e0ed0e8b76e
- MD5 153d8e26703db4537452788634d68f3a
- SHA1 4583b70f72fb96e9a9fb0eeb265004f78b0d3dd6
- SHA512 b785a175a3485a621c1623e3e1ce4d08469abca14cf1159d06c0e7adac3a12e1632a055a67a259a65e280b7a5f012aeb4df544c96b8e7b54301e2b850f4c58a8
- SSDEEP 6144:PdJiCE/E9q19n90UdvyMJsOKp1CJ/VNMaiC05MHhrRkwjJjK5U:PLh4vJOg7KZp1CJ/ti752hrRjOW
- MD5 SHA1 SHA512 SSDEEP
$_41_/Proprietrer.bet
- SHA256 645c325f62af720972466322b09a7e396e46d8e640b138d582374b68d763a3a7
- MD5 0b62328c4966f6b879b3c13b7fbd9c0d
- SHA1 6dd81f12e739e81e06778067513ed1178a06afc9
- SHA512 2f738a2950352f124f7b969d38b52bd2e4453ff42bc8deb7566620e6cdea30368a6dc16230ba49050f8c0327175cab71dc4a1709541f08a3ffdcf55faf5b75b8
- SSDEEP 768:l1SkOmjqFRV/HZzy6+19kZBH4YVHCdJS7G5iOUEEaXXLlgHHl7MRY9hN+418WPK5:KOqvBJzC5vBhp8KT9AGCbQTZkkR
- MD5 SHA1 SHA512 SSDEEP
$_41_/Smalfilmerens.Sem
- SHA256 700b075118b5b9f6b87f91d93737846483bfae61abb562454ae416b246c7792f
- MD5 5afe09b3aef2b87007d437ea12c40c5a
- SHA1 32c89636169419c6c84c9e8ae4beb0575e2a60a1
- SHA512 b2b5d8c1ac33eb3e2d0f67b475e1027d84eedb794bbc3ea765abadd528cd166861c87ab72e56b197d994c90bb65cb194a28bfc03795bebc0591f667bc0edc547
- SSDEEP 3072:YlQkdicTlaY9bRNq/yW2AmPCeRWOUUdr+jHH:8Qkdi4llG/yW+7QB7
- MD5 SHA1 SHA512 SSDEEP
$_41_/Trikstanks.pra
- SHA256 a55dac07fb586d4b64f0ddf812087a2eeec6f5286d9bc73ad648ed3220abdd3a
- MD5 49be0e06f2e4f0ccffb46426ee262642
- SHA1 ff9c56c31a824e4ca087705c23d01d288fe34239
- SHA512 27e9d035708943dd257186457c15488c9405747fc77f7c76760c96ee011c239f9fa53b5da17958038fb2ba1c4e27e643e7924a37e6164e250b9f45a109d92e53
- SSDEEP 768:AgVdAd1etxyZmQhZgJwrQTTwKuiTGrJqCoIEsPkZnFFSKsOI4v/3n35lB3LiADa4:5TxLsV5IjQ3xx12
- MD5 SHA1 SHA512 SSDEEP
$_41_/boyaus.rom
- SHA256 a56351ed69a301f5d9d89b6530280b7a85f998a806e1648911c37b6983ba9426
- MD5 f130ec3095dbecedc791d8c58a59040c
- SHA1 dad2300b487f31f199520e1b41ab02b7d677b352
- SHA512 8599200f472f2d59390e8f2c497331640b12ab9faf71817160c6d450edf8a99f78cef28cc3b57581d6aecfc1ec90a49947a6685c606321b6ee300d483c838360
- SSDEEP 768:jby0EUrStmwpKcx/orVcYZ+M3ok1I7vZFCDrlv2UV5t3votN6cGia46OGj3OkYSk:FaZaukRTadSdbrJ5N275Ea3nRYS3r
- MD5 SHA1 SHA512 SSDEEP
$_41_/gear.dra
- SHA256 fad1b5e641dc44b5a51048470d4e0fb47664cf2b994cea24304495d99323b9de
- MD5 53ff1a157920ae92c9bf891d453d6b65
- SHA1 b7bf3b7b16048f38132d8acca841130d73db44c3
- SHA512 e739381c24627f89255db55b2da39a09f055a322c577c3604ba048fb2c817ae7f63b12131f8461491f6140953fb33dd94eb66d8cb3b13b36717143342ce270af
- SSDEEP 768:NFXORpsqJLOaVDzzoIgUPRGRoYNxHVxyczaUz4pP9Nom56I4tY6UBh1Yc88LaAQo:TUAoYxPzqoIzdwWR1+/24cwZXeCPiIBo
- MD5 SHA1 SHA512 SSDEEP
$_41_/jagtfalk.ill
- SHA256 accd4911d88e808aed4a2aa27394628c62574810b0b47977b7103a246fdf2a10
- MD5 169115c751dda5e021e8c86e8454b26d
- SHA1 5a8254634c0c726bb18e42e626eaeb581d532dcd
- SHA512 2b643014e8623cadba7ce78b91d3c751d60fcbf3fa69fa26f29a14e55679fc6a5c2074834b2496773a1756e3172ec7c898e2df29cb4a0513dbf8bc0dcdda7e04
- SSDEEP 1536:XkYzjcLYszRzU5n1C900tMkYQx+gnpovYHO:XkYz4DzQB5sYYH
- MD5 SHA1 SHA512 SSDEEP
$_41_/regill.ful
- SHA256 4bc57a47b82b63ec20b393f65f3585eb81fe3f7748229cd19dec8fe8a41d67c3
- MD5 b4fb425baf217f31e91aab39abf66dcd
- SHA1 03de3bd0f923ab14213b6c4461c5ca73a0a6371c
- SHA512 e72395fd6098130efd543c5941781a1aa80fce17c7701cb40fa8874271e0d43e0f7f082ebf5d458181287de41cf4b34f88dcaabe84d8ad51003ef5da1495d871
- SSDEEP 1536:HMtjgMjMD1whyMu1IXCVAcFNpruXO+nBJH:stjgmYi03XDL+nBJ
- MD5 SHA1 SHA512 SSDEEP
$_41_/sortlistningens.txt
- SHA256 2ea079dede1b356842c5f5e0751b5e2b6565fded65dafb59a73d170c002abb27
- MD5 46003c65aa12a0ebe55662f0141186dc
- SHA1 739652c3375018daffb986302a7d3e8d32770b41
- SHA512 59d394789f9eece97873d56aea64f353d3e13e007e4acbd396ac76cb68e91494eb65888049ef05cbe9b20597adadcc960d067f90aad3ea5aa46ac3a82f5b82fd
- MD5 SHA1 SHA512