b199b1b1500796c646cfb42f1175b84b7e1493694a80bea9d5de5a0550ed4f92[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
b199b1b1500796c646cfb42f1175b84b7e1493694a80bea9d5de5a0550ed4f92.exe
Size 354KB
Sample241115-de2rwaxkft
SHA256 b199b1b1500796c646cfb42f1175b84b7e1493694a80bea9d5de5a0550ed4f92
MD5 0f34c819b26907e1508f9cc886cd5440
SHA1 790d7283f25f77ad24de07368194d4266c24f051
SHA512 9b359aaa21b81d6751f3ff1061286a7118847427a07b449e2d31f5dfad55d9ce6cd958b7e70b0d62cbe1b1bb4924af2673a35049ab821d5a57657bb077f55c8d
SSDEEP 6144:tNDlOlZOvRQmfszRZBdhOSmhhyDRXR0OjN5c/9WG3ktHhpBnyv+bx2MTxrLM37Vh:tsZOv09dhOSmCVhjg/9WG3QBPyv+9Zt
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/$PLUGINSDIR/System.dll

File Explorer

b199b1b1500796c646cfb42f1175b84b7e1493694a80bea9d5de5a0550ed4f92.exe

.exe 354KB
$PLUGINSDIR/System.dll

.dll 12KB
Ferskenen/Nielloing.Gui

180KB
Ferskenen/revisionsinstitutternes.whi

100KB
Sammentrdningernes/benchmark/Ganelydene/Busternes/Flagellata.Fin

180KB

b199b1b1500796c646cfb42f1175b84b7e1493694a80bea9d5de5a0550ed4f92.exe

IMPHASH 7eae418c7423834ffc3d79b4300bd6fb
SHA256 b199b1b1500796c646cfb42f1175b84b7e1493694a80bea9d5de5a0550ed4f92
MD5 0f34c819b26907e1508f9cc886cd5440
SHA1 790d7283f25f77ad24de07368194d4266c24f051
SHA512 9b359aaa21b81d6751f3ff1061286a7118847427a07b449e2d31f5dfad55d9ce6cd958b7e70b0d62cbe1b1bb4924af2673a35049ab821d5a57657bb077f55c8d
SSDEEP 6144:tNDlOlZOvRQmfszRZBdhOSmhhyDRXR0OjN5c/9WG3ktHhpBnyv+bx2MTxrLM37Vh:tsZOv09dhOSmCVhjg/9WG3QBPyv+9Zt
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

bf:b6:5d:b1:e6:08:dc:8e:f8:1f:cc:84:61:f4:ca:3d:5f:e2:0d:28:9d:0a:cb:61:02:19:78:69:4c:8f:f6:72

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

OU=Prebaptizes Springbrtternes totalforlisets\ ,O=Desolation,L=Saint-Privat-du-Fau,ST=Occitanie,C=FR,1.2.840.113549.1.9.1=#0c1d537465646d6f646572626c6f6d7374656e7340546f7265726f732e4f72

Chains

Nov 11, 2024

PE Signature issue

Digest

a5:59:1c:88:96:b7:ad:2f:a8:68:bb:1d:06:a9:95:f8:76:13:78:89

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

OU=Prebaptizes Springbrtternes totalforlisets\ ,O=Desolation,L=Saint-Privat-du-Fau,ST=Occitanie,C=FR,1.2.840.113549.1.9.1=#0c1d537465646d6f646572626c6f6d7374656e7340546f7265726f732e4f72

Chains

Nov 11, 2024

Minor OS version

Major OS version

Entry point

13252

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetEnvironmentVariableW SetFileAttributesW Sleep GetTickCount GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW SetCurrentDirectoryW GetFileAttributesW GetWindowsDirectoryW GetTempPathW GetCommandLineW GetVersion SetErrorMode lstrlenW lstrcpynW GetDiskFreeSpaceW ExitProcess MoveFileW CreateThread GetLastError CreateDirectoryW CreateProcessW RemoveDirectoryW lstrcmpiA CreateFileW GetTempFileNameW WriteFile lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject lstrcmpiW lstrcmpW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle ExpandEnvironmentStringsW GlobalFree GlobalLock GlobalUnlock GlobalAlloc DeleteFileW FindFirstFileW FindNextFileW FindClose SetFilePointer ReadFile MulDiv lstrlenA WideCharToMultiByte MultiByteToWideChar WritePrivateProfileStringW FreeLibrary GetPrivateProfileStringW GetModuleHandleW LoadLibraryExW

user32

GetWindowRect GetSystemMenu SetClassLongW IsWindowEnabled SetWindowPos GetSysColor GetWindowLongW SetCursor LoadCursorW CheckDlgButton GetMessagePos CallWindowProcW IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard TrackPopupMenu ScreenToClient EnableMenuItem GetDlgItem SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharPrevW CharNextA wsprintfA DispatchMessageW PeekMessageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect SystemParametersInfoW EndDialog RegisterClassW DialogBoxParamW CreateWindowExW GetClassInfoW DestroyWindow CharNextW ExitWindowsEx SetWindowTextW LoadImageW SetTimer ShowWindow PostQuitMessage wsprintfW SetWindowLongW FindWindowExW IsWindow CreatePopupMenu AppendMenuW GetSystemMetrics DrawTextW EndPaint CreateDialogParamW SendMessageTimeoutW SetForegroundWindow

gdi32

SelectObject SetTextColor SetBkMode CreateFontIndirectW CreateBrushIndirect DeleteObject GetDeviceCaps SetBkColor

shell32

ShellExecuteExW SHGetPathFromIDListW SHGetSpecialFolderLocation SHGetFileInfoW SHFileOperationW SHBrowseForFolderW

advapi32

AdjustTokenPrivileges RegCreateKeyExW RegOpenKeyExW SetFileSecurityW OpenProcessToken LookupPrivilegeValueW RegEnumValueW RegDeleteKeyW RegDeleteValueW RegCloseKey RegSetValueExW RegQueryValueExW RegEnumKeyW

comctl32

ImageList_Create ImageList_AddMasked ord17 ImageList_Destroy

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 6950991102462d84fdc0e3b0ae30c95af8c192f77ce3d78e8d54e6b22f7c09ba
MD5 8cf2ac271d7679b1d68eefc1ae0c5618
SHA1 7cc1caaa747ee16dc894a600a4256f64fa65a9b8
SHA512 ce828fb9ecd7655cc4c974f78f209d3326ba71ced60171a45a437fc3fff3bd0d69a0997adaca29265c7b5419bdea2b17f8cc8ceae1b8ce6b22b7ed9120bb5ad3
SSDEEP 192:BenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XB9IwL:B8+Qlt70Fj/lQRY/9VjjlL
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10719

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

b199b1b1500796c646cfb42f1175b84b7e1493694a80bea9d5de5a0550ed4f92.exe

PE Signature issue

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Ferskenen/Nielloing.Gui

Ferskenen/revisionsinstitutternes.whi

Sammentrdningernes/benchmark/Ganelydene/Busternes/Flagellata.Fin