07112024_0045_06112024_Anfrage_244384.7z
- SHA256 fabdde579b133e129408ab4ecf04fad0a9807fe70bf61383f236dcb7674999e0
Password
infected
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Anfrage_244384.exe
Resource
win7-20241010-en
windows7-x64
10 signatures
300 seconds
Behavioral task
behavioral2
Sample
Anfrage_244384.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
12 signatures
300 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20241010-en
windows7-x64
3 signatures
300 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
300 seconds
General
- Target 07112024_0045_06112024_Anfrage_244384.7z
- Size 968KB
- Sample241107-a326rssbpj
- SHA256 fabdde579b133e129408ab4ecf04fad0a9807fe70bf61383f236dcb7674999e0
- MD5 a5f52d0d4386ac439b9aaeb22f81e48d
- SHA1 2f8b3f4eccba084ece5a71638e08e2b43172a173
- SHA512 7f566ef4d2e7b3bad4daecfb3fd85661c5db964ecd4a4a35e190c7a346f660caccbb05d5c7727b01fead672161e9c44a8ab5a1f8f983aa4a14c99c284b451264
- SSDEEP 24576:vKNjqIvtEU3vVbNpQZVTPhD8jJW6/6334RMHdRwciVXHEF:vKAIVE2VbI3PhD8dxI3KMHLRiVXHE
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/$PLUGINSDIR/System.dll - NSIS installer 2 IoCs
resource yara_rule static1/unpack001/Anfrage_244384.exe nsis_installer_1 static1/unpack001/Anfrage_244384.exe nsis_installer_2
File Explorer
-
07112024_0045_06112024_Anfrage_244384.7z.7z 968KB
-
Anfrage_244384.exe.exe 1.2MB
-
$PLUGINSDIR/System.dll.dll 11KB
-
Angoragedernes/nilgedde.mes346KB
-
Angoragedernes/selefant.kri291KB
-
Angoragedernes/speil.int485KB
-
Hemmeligt70.Bly57KB
-
Tingid.pig465KB
-
anya.por437KB
-
besiddertrang.gra354KB
-
darbyite.txt497B
-
straffespark.Sek277KB
Anfrage_244384.exe
- IMPHASH b78ecf47c0a3e24a6f4af114e2d1f5de
- SHA256 eda014e3b658bfbbfd141c1459a3414d9ee8b7c139a3976fe732141fa9cf3f80
- MD5 b03f23199ae987a7bce0ff1a0d742e3e
- SHA1 f454c8de72926ee9f98db7056fa89f0c3ada9666
- SHA512 01ccdc0f586a8926a56f0d3bfee91c5e882bff5df84cbb5363df6681fb62863a8075af8261bb72ecf2360d9d4dc4552dddb4e1ec1da002c24b9416ff0d3f95be
- SSDEEP 24576:aCAoDyk/vnt3h1CzLuTIv08yZVk7ku8h7w6/t338euHdB4bU4VD4C:aCAfqvtx1UuTIMfg7ku8Vfx3/uHHSU4t
- MD5 SHA1 SHA512 SSDEEP
-
NSIS installer
Password
infected
PE Signature issue
Digest
a1:2f:7f:ea:67:7d:42:54:4d:79:3f:df:86:4d:9f:ee:50:ec:64:ee:d5:eb:b7:e1:bd:b7:26:90:45:e4:c5:56
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=immechanical,O=immechanical,L=Montiers,C=FR
Chains
Nov 6, 2024
PE Signature issue
Digest
63:ee:bf:24:8e:3c:2b:ab:8d:b5:84:a5:06:99:22:47:ae:ff:1c:66
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=immechanical,O=immechanical,L=Montiers,C=FR
Chains
Nov 5, 2024
Subject
CN=immechanical,O=immechanical,L=Montiers,C=FR
Serial Number
31:3e:1c:1a:b8:5c:6c:f7:6b:12:2f:eb:88:5e:f1:11:ca:a7:ce:29
Issuer
CN=immechanical,O=immechanical,L=Montiers,C=FR
Timespan
Jul 26, 2024 - Jul 26, 2027
Subject
CN=immechanical,O=immechanical,L=Montiers,C=FR
Serial Number
31:3e:1c:1a:b8:5c:6c:f7:6b:12:2f:eb:88:5e:f1:11:ca:a7:ce:29
Issuer
CN=immechanical,O=immechanical,L=Montiers,C=FR
Timespan
Jul 26, 2024 - Jul 26, 2027
Subject
CN=Timestamp Signer MA1,O=Apple Inc.,C=US
Serial Number
3c:fe:cb:50:32:64:4d:af
Issuer
CN=Apple Timestamp Certification Authority,OU=Apple Certification Authority,O=Apple Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 28, 2024 - Dec 9, 2024
Subject
CN=Apple Timestamp Certification Authority,OU=Apple Certification Authority,O=Apple Inc.,C=US
Serial Number
7d:4c:57:63:9f:f3:f0:b7
Issuer
CN=Apple Root CA,OU=Apple Certification Authority,O=Apple Inc.,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 5, 2012 - Apr 5, 2027
Subject
CN=Apple Root CA,OU=Apple Certification Authority,O=Apple Inc.,C=US
Serial Number
02
Issuer
CN=Apple Root CA,OU=Apple Certification Authority,O=Apple Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 25, 2006 - Feb 9, 2035
Minor OS version
0
Major OS version
4
Entry point
12707
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
SetEnvironmentVariableA
Sleep
GetTickCount
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
GetFileAttributesA
SetFileAttributesA
GetWindowsDirectoryA
GetTempPathA
GetCommandLineA
lstrlenA
GetVersion
SetErrorMode
lstrcpynA
ExitProcess
GetFullPathNameA
GlobalLock
CreateThread
GetLastError
CreateDirectoryA
CreateProcessA
RemoveDirectoryA
CreateFileA
GetTempFileNameA
ReadFile
WriteFile
lstrcpyA
MoveFileExA
lstrcatA
GetSystemDirectoryA
GetProcAddress
CloseHandle
SetCurrentDirectoryA
MoveFileA
CompareFileTime
GetShortPathNameA
SearchPathA
lstrcmpiA
SetFileTime
lstrcmpA
ExpandEnvironmentStringsA
GlobalUnlock
GetDiskFreeSpaceA
GlobalFree
FindFirstFileA
FindNextFileA
DeleteFileA
SetFilePointer
GetPrivateProfileStringA
FindClose
MultiByteToWideChar
FreeLibrary
MulDiv
WritePrivateProfileStringA
LoadLibraryExA
GetModuleHandleA
GetExitCodeProcess
WaitForSingleObject
GlobalAlloc
user32
ScreenToClient
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
PostQuitMessage
GetWindowRect
EnableMenuItem
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
ReleaseDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndDialog
RegisterClassA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
ExitWindowsEx
GetDC
CreateDialogParamA
SetTimer
GetDlgItem
SetWindowLongA
SetForegroundWindow
LoadImageA
IsWindow
SendMessageTimeoutA
FindWindowExA
OpenClipboard
TrackPopupMenu
AppendMenuA
EndPaint
DestroyWindow
wsprintfA
ShowWindow
SetWindowTextA
gdi32
SelectObject
SetBkMode
CreateFontIndirectA
SetTextColor
DeleteObject
GetDeviceCaps
CreateBrushIndirect
SetBkColor
shell32
SHGetSpecialFolderLocation
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
advapi32
RegDeleteKeyA
SetFileSecurityA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegOpenKeyExA
RegEnumValueA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA
RegSetValueExA
RegQueryValueExA
RegEnumKeyA
comctl32
ImageList_Create
ImageList_AddMasked
ImageList_Destroy
ord17
ole32
OleUninitialize
OleInitialize
CoTaskMemFree
CoCreateInstance
Name
.text
Size
24KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
149KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
108KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
404KB
Virtual Size
403KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=159, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
$PLUGINSDIR/System.dll
- IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
- SHA256 fa4ab1d6f79fd677433a31ada7806373a789d34328da46ccb0449bbf347bd73e
- MD5 3f176d1ee13b0d7d6bd92e1c7a0b9bae
- SHA1 fe582246792774c2c9dd15639ffa0aca90d6fd0b
- SHA512 0a69124819b7568d0dea4e9e85ce8fe61c7ba697c934e3a95e2dcfb9f252b1d9da7faf8774b6e8efd614885507acc94987733eba09a2f5e7098b774dfc8524b6
- SSDEEP 192:OPtkumJX7zB22kGwfy0mtVgkCPOsX1un:/702k5qpdsXQn
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
4
Entry point
9995
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
MultiByteToWideChar
GlobalFree
GlobalSize
lstrcpynA
lstrcpyA
GetProcAddress
VirtualFree
FreeLibrary
lstrlenA
LoadLibraryA
GetModuleHandleA
GlobalAlloc
WideCharToMultiByte
VirtualAlloc
VirtualProtect
GetLastError
user32
wsprintfA
ole32
StringFromGUID2
CLSIDFromString
Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc
Name
.text
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
851B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
104B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1024B
Virtual Size
608B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=14, version=7299,
count=19, id=1, productName=Unmarked objects,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=4, id=48, version=9044,
count=1, id=42, version=8803,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
Angoragedernes/nilgedde.mes
- SHA256 5a3b61a0bc8e81e756374d2a9ff5087fa4496543a635738aca8911e95d6340d9
- MD5 df7a44909b03ab5bc45910b405d9977a
- SHA1 3d0583a7dfb39e559827189e02123f2c983a21d5
- SHA512 c2b4e951a185fc3fb75109b5caa554431c1517588d04b8f2ba865f75be448a0448364bcb84253c9b44579078787dda616f33666c0c1bf902ec644ebc9a6fe621
- SSDEEP 768:E2oz5FNvncy2DZRau7W0sxOvPfSfpg5rWuWAAUIdde/FwPPMk/FOuyQv9biuPia6:opho02mYrKiKLFyJ1AIu2
- MD5 SHA1 SHA512 SSDEEP
Angoragedernes/selefant.kri
- SHA256 1d84f9462c244a4500c213df8dd79971b286392ca02bc536f5f6c3eebc94e7e3
- MD5 b4c9fc75bab8c9f006a7d9ddbc249f79
- SHA1 70d4047e7e3bb10cf237b82775c89a1d92700162
- SHA512 2e2279cb3755ac5708abb30e8342235b7f0a24223e3d6f4b2b21b62e59012a5126adc1bd73d7b64e72634728decce7a049d3e6f5055f8d74e959bee54edbea4c
- SSDEEP 768:nLoDoRi0SWvTrmnVqvh6dzfCaci65UhXqjMctTGA3QBgdRWqrw3q3LFPRvx7H155:DStBsLk6gsifeQIGA0iYRwvy8n
- MD5 SHA1 SHA512 SSDEEP
Angoragedernes/speil.int
- SHA256 b5a607f50c65e41b2bff7f852f27373177d326d9dfa1040e1c2b3af62f757bab
- MD5 f3f6c6e37eab51d3b9b9c059c1eb874c
- SHA1 401e5740ccfbc1da83bd9b426c11020c812986f2
- SHA512 060b328595adaf9e85b390aa2aaceefe4c6197294b7c45594798755c5e04be1e2110f617b51e38d7df423cd807fa81b30702ce2548563980b9ca195ecf2c11a7
- SSDEEP 1536:rbNZ/Rg8JCCgxT2eIgde/lBWTTBwGceukAdTYz91n6n:9NRg836IVLWHeGxKYQ
- MD5 SHA1 SHA512 SSDEEP
Hemmeligt70.Bly
- SHA256 4b029ecd2ce2eb26d9686573d7d891e689a717672bb8f76903bc44ec43da2955
- MD5 ced0be5e2d0028efd3f1249ac1126ba3
- SHA1 3902cd952ea81d8a7d9e0fc1f17972967ddd917d
- SHA512 7f14e8fd856d1d1e2fd89c692685eb70c462bc1c202c4946cc1b0d27e59264278264c3c7ea72e63f9b9ba35c434faab305724827a4c8d63adbe78d8c4e4759fd
- SSDEEP 768:hUm9EMv+RHOORqqYH3VEwnRnXNcmhdmPJPU9FLd86+qWhTeFVk6t6MmaEEXrDH9S:Om9chszXJlVdmPJuTWcJ6+3O9Rh
- MD5 SHA1 SHA512 SSDEEP
Tingid.pig
- SHA256 beed12f00b12156ff9fa63595de11a5c01493cf5f85488cb2e159cf1a8236778
- MD5 f236a74f28f6f32f81f1347d9f129268
- SHA1 d5be521661ee4bf3c186c3eaa0411dd5df6f3eba
- SHA512 d6ad37ddf7b6b38b90f09186ac81c6a76f16f9a4613d6113f10d7b2a4f68129e570effc77a19b04f276277b7a569ebd5fd4a48d2e2e72cea8cee5a8f67cc5ef4
- SSDEEP 1536:zGmPxn4XjZOVebnJjvYbTUBhGKcjnO/EeMHPm:Sm6zYVb849nH6
- MD5 SHA1 SHA512 SSDEEP
anya.por
- SHA256 3965d74dbd296aa8e7524c773fe81fe63a78355145502153cb577e9cb136dda0
- MD5 3ad8d5763ca124c7392d1f4f53d24f0e
- SHA1 17d48ef1ab8d52a31821a069c225d45201535899
- SHA512 ee8bde196a33297bfd4e51ed01e7d0178cf457497e822771d2be3c58a97681ac52cd19a2bbbb71220f06f6d936a6aa67966295df3c676104b9643f07cbe37ec8
- SSDEEP 1536:i9EUBeeNEu//hQg77ea6OP/B1p7to4APRUYZAkxe:qFZO5u/B1pBo510
- MD5 SHA1 SHA512 SSDEEP
besiddertrang.gra
- SHA256 fcd149788a3530e5e2cf5e17a09b1de51eb67b51f3e8941e7091f88b610373f1
- MD5 8ab9852274fa64e09b5711a2e7d94aab
- SHA1 2c39272b969040b4c185ee4a69a5f04fd1f7c0db
- SHA512 6761208a22e8d93d70465e6dd9cf1b53826aa6bf0418dccb0a6e5816a183790a61ad67edcf52d21366975014701107563ce47a0465cee801300493aeb566cc69
- SSDEEP 768:uFKWW9YiDlIMhmjVacve6tEvHBLNB3tQsrTpPH8mZLAUFwsahGF48hDpWRcKthwz:u5W9yMJLNbJ1CbFV3Gd6Ie48dPs
- MD5 SHA1 SHA512 SSDEEP
darbyite.txt
- SHA256 72a2010cdb6ed407fca17cdb181d5f01801f16040c2c9443bd7cb5032cdaaef7
- MD5 1560371431ceb91914af5b9d0d307ee1
- SHA1 182b8979d4d0f9f26366653638a9c92fdaff0d56
- SHA512 865ef0f7636149a47043183583635c2a4306bf49565166760672b88f0f9da89a529fe4166dff496327304e56a8a460b8113e5f3d58601c0b8a3efaabd792af3d
- MD5 SHA1 SHA512
straffespark.Sek
- SHA256 35be42786f6ef050a3baea615517e40958e6140a089e7d4a83283f1708994c03
- MD5 301af874579f9ce64fce51a01f616625
- SHA1 6d35516da84e4342c8e094023b60175bab5edceb
- SHA512 3275c3b39115c29fe923c415d36f4932c279018994e636ce6606c5604b6fa5da984c7244be7017ac78204f6f8d90ae7706b1e729fad91eaeb3c2020a610755e4
- SSDEEP 6144:fOiGjlSjER8DMKEzL4eNm6Vkg9XNf805ft+MODD+T:GCjEa4/zLD+05ek
- MD5 SHA1 SHA512 SSDEEP