49f25b9220873286e9363a6b10fe0297d145578c2990cca55cc5cd385b49ab09
- SHA256 49f25b9220873286e9363a6b10fe0297d145578c2990cca55cc5cd385b49ab09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
New_OrderNew_OrderNew_OrderNew_OrderNew_OrderNew_OrderNew_OrderNew_OrderNew_OrderNew_OrderNew_OrderNew_OrderNew_Order.exe
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
New_OrderNew_OrderNew_OrderNew_OrderNew_OrderNew_OrderNew_OrderNew_OrderNew_OrderNew_OrderNew_OrderNew_OrderNew_Order.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target 49f25b9220873286e9363a6b10fe0297d145578c2990cca55cc5cd385b49ab09
- Size 441KB
- Sample241201-x895wstraq
- SHA256 49f25b9220873286e9363a6b10fe0297d145578c2990cca55cc5cd385b49ab09
- MD5 cc6834513cd3ddc2168dcd9924dc67ff
- SHA1 6e19ee6a29179a26ac43c18d59ef1621585490ca
- SHA512 29efebdbf3c0b99ff700ffcd97bc0623f579dce76a776efa9c4e61b028c377bce9754f3bcfc6053ddb77399706ff53c7a70e1810523e36a2b16e724d32b89d74
- SSDEEP 6144:xGkShEm1aRt3qiKliBjfEUj+Ew56R/gfkufYzmwraNV8RXr9Fab5zIGVl5xaDC/F:ZmOnpDjzxN2SQOt5FaIGV163hWr
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/New_OrderNew_OrderNew_OrderNew_OrderNew_OrderNew_OrderNew_OrderNew_OrderNew_OrderNew_OrderNew_OrderNew_OrderNew_Order.exe unpack002/$PLUGINSDIR/System.dll
File Explorer
-
49f25b9220873286e9363a6b10fe0297d145578c2990cca55cc5cd385b49ab09.zip 441KB
-
New_OrderNew_OrderNew_OrderNew_OrderNew_OrderNew_OrderNew_OrderNew_OrderNew_OrderNew_OrderNew_OrderNew_OrderNew_Order.exe.exe 524KB
-
$PLUGINSDIR/System.dll.dll 12KB
-
Alphin.ndv360KB
-
Bellyacher/zittauerlgs.cou53KB
-
Indurance166.Mas128KB
-
Tutele.esp262KB
-
inhabilitetssprgsmaalene.eth40KB
-
ol.jpg.jpg 22KB
New_OrderNew_OrderNew_OrderNew_OrderNew_OrderNew_OrderNew_OrderNew_OrderNew_OrderNew_OrderNew_OrderNew_OrderNew_Order.exe
- IMPHASH 61259b55b8912888e90f516ca08dc514
- SHA256 eeab9fb352cb6be16656c5e2432f3c7d1e4fdcde4b0053cc13110b35bcad3be9
- MD5 d7dfbeafd73680ece456544358ff4ae8
- SHA1 8bfae1107957528a267642e1de35cd706e21239f
- SHA512 a9b0e71b53dfa3805c6e86f8f773eb1fa6b0a6d79e9ba41cbec9007393c8e7a3826007bd44251ecabbe90f770cb8bf0c5dd551834b05fc20138f28b56a9e85a5
- SSDEEP 6144:wYa6WLKRTIXwlWVwV7j3qKWOY+LF0EUFbPkhw56R/SI2BLfYi4K5+Q8cfVFa23Qn:wY0FQEU7RKDBSxSTtvGctF1oC2WzS
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
13888
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
advapi32
RegCreateKeyExW
RegEnumKeyW
RegQueryValueExW
RegSetValueExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
SetFileSecurityW
RegOpenKeyExW
RegEnumValueW
shell32
SHGetSpecialFolderLocation
SHFileOperationW
SHBrowseForFolderW
SHGetPathFromIDListW
ShellExecuteExW
SHGetFileInfoW
ole32
OleInitialize
OleUninitialize
CoCreateInstance
IIDFromString
CoTaskMemFree
comctl32
ord17
ImageList_Create
ImageList_Destroy
ImageList_AddMasked
user32
GetClientRect
EndPaint
DrawTextW
IsWindowEnabled
DispatchMessageW
wsprintfA
CharNextA
CharPrevW
MessageBoxIndirectW
GetDlgItemTextW
SetDlgItemTextW
GetSystemMetrics
FillRect
AppendMenuW
TrackPopupMenu
OpenClipboard
SetClipboardData
CloseClipboard
IsWindowVisible
CallWindowProcW
GetMessagePos
CheckDlgButton
LoadCursorW
SetCursor
GetSysColor
SetWindowPos
GetWindowLongW
PeekMessageW
SetClassLongW
GetSystemMenu
EnableMenuItem
GetWindowRect
ScreenToClient
EndDialog
RegisterClassW
SystemParametersInfoW
CreateWindowExW
GetClassInfoW
DialogBoxParamW
CharNextW
ExitWindowsEx
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
FindWindowExW
IsWindow
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
ReleaseDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
EmptyClipboard
CreatePopupMenu
gdi32
SetBkMode
SetBkColor
GetDeviceCaps
CreateFontIndirectW
CreateBrushIndirect
DeleteObject
SetTextColor
SelectObject
kernel32
GetExitCodeProcess
WaitForSingleObject
GetModuleHandleA
GetProcAddress
GetSystemDirectoryW
lstrcatW
Sleep
lstrcpyA
WriteFile
GetTempFileNameW
lstrcmpiA
RemoveDirectoryW
CreateProcessW
CreateDirectoryW
GetLastError
CreateThread
GlobalLock
GlobalUnlock
GetDiskFreeSpaceW
WideCharToMultiByte
lstrcpynW
lstrlenW
SetErrorMode
GetVersionExW
GetCommandLineW
GetTempPathW
GetWindowsDirectoryW
SetEnvironmentVariableW
CopyFileW
ExitProcess
GetCurrentProcess
GetModuleFileNameW
GetFileSize
CreateFileW
GetTickCount
MulDiv
SetFileAttributesW
GetFileAttributesW
SetCurrentDirectoryW
MoveFileW
GetFullPathNameW
GetShortPathNameW
SearchPathW
CompareFileTime
SetFileTime
CloseHandle
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalFree
GlobalAlloc
GetModuleHandleW
LoadLibraryExW
MoveFileExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
lstrlenA
MultiByteToWideChar
ReadFile
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW
Name
.text
Size
26KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
128KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
160KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
100KB
Virtual Size
99KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=165, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
$PLUGINSDIR/System.dll
- IMPHASH fc0224e99e736751432961db63a41b76
- SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
- MD5 cff85c549d536f651d4fb8387f1976f2
- SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
- SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
- SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
10879
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetModuleHandleW
GlobalFree
GlobalSize
lstrcpynW
lstrcpyW
GetProcAddress
WideCharToMultiByte
VirtualFree
FreeLibrary
lstrlenW
LoadLibraryW
GlobalAlloc
MultiByteToWideChar
VirtualAlloc
VirtualProtect
GetLastError
user32
wsprintfW
ole32
StringFromGUID2
CLSIDFromString
Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc
Name
.text
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
867B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
120B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1024B
Virtual Size
662B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=14, version=7299,
count=20, id=1, productName=Unmarked objects,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=4, id=48, version=9044,
count=1, id=42, version=8803,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
Alphin.ndv
- SHA256 2bb18c8a743efe123f34ddcaadc57bf5a43a4e3da6bc24f2c233c02a8e28efaf
- MD5 df50d8a740ad9b359a7c30cd4086265e
- SHA1 a6db5b4e739044456d672fbd58f03cb787ecfa0c
- SHA512 e45503db9ce31daaff4f9cdbe056fef373782fa2e6ad8b76314503beab0de8e8feda934eab832c578e384ddd2d9594153b888a7c4946e4eae2d81be4bf9ca8a7
- SSDEEP 768:xKrNHm8LdHpnmjbTF+1iGQqB2ktSwxZoOXZpQUgsAXTDMkDGnTiEq8X15VU4IWuU:VbTR6plTxM7zwsc0P3tz8Op1
- MD5 SHA1 SHA512 SSDEEP
Bellyacher/zittauerlgs.cou
- SHA256 a466ac303015f587660c9a74f9d8b64d2f8061b7ec3f5a60dbfdc2d633cefed1
- MD5 54a3b377d0a23535f43b79d4a64d406f
- SHA1 18eb862f40a82a0fea47c01183db1f88f77a50f3
- SHA512 1b05a0f59215bd342cd3fa3d1c6a61e3dd3c7df6f4bf06278d29a15b286868b600963b435ff248663784f7da1cfe75210d166dc943e53dbd7216ad32f4231862
- SSDEEP 384:NnS8NBSHJ7m5hshqCufHlk1pLaEyMy4WaQ5x0asBDu1mrp2Osohfcar:NTSp7mYIspJi+PpO4cO
- MD5 SHA1 SHA512 SSDEEP
Indurance166.Mas
- SHA256 773756eddcd2f86fdb975161b7e8b7025b4f5a0038d4597f4207647f9ce73680
- MD5 958d89765fec32a4232089e90e5749dd
- SHA1 eb301c11d95d179f631b62d341700c1683425833
- SHA512 8b856e6da719ae992c7577ed1f8f74bf641d4b17cc6b0440f99de908e348c22ed9a5688826bcb0fdf42e13adb15ca20d09f6dfe67d38baef8ad0aa5b5209764b
- SSDEEP 3072:wN1cwTAPIxqMHjxCYI946kwISr7XKIk7J6Lv:41caAPOjx4RknSr7XJv
- MD5 SHA1 SHA512 SSDEEP
Tutele.esp
- SHA256 8e70aaa03a0e8ae97cde965ecf2c614c719156b022da80290767870e6bcd143a
- MD5 8dc97b6180d1da539af02db338941457
- SHA1 ef8cc33bc1822c3a2ada6bfe1a37c00d0f7abd81
- SHA512 01dce1899e1b029d604d1b5b1dfda20aa9a631c2badc9a8c2221d6b97650bccb88b99e88d35057618cf0ef3b55598ba0907d1cd6ae4aafa5dcf4a16a75c29ae5
- SSDEEP 6144:qnEaOuCcLpjrr29xj8zXAnPTLtf6FGB3OiUfdx8Y:rDuDLE9YQLhysQft
- MD5 SHA1 SHA512 SSDEEP
inhabilitetssprgsmaalene.eth
- SHA256 7dc8867304864ef9ee3d5cb53f9b506f10176559ccb2bb279bfe895ff978a7f0
- MD5 b14de140fa27f9f986ee6f81d88bb960
- SHA1 733103599313abc11ca2afa03da33a2b45614d17
- SHA512 f7bbf313d38c0dda6a92638bb371340e1cf09d54cc02488276061ca657580636aad5d763837844f6ed24de19779d4f0d6b634744d936765ad02457426269f247
- SSDEEP 384:ijN704BjDd35sYdKtJQO3VAkzPzPZIvz3Th:63NJGJp/zy7Th
- MD5 SHA1 SHA512 SSDEEP
ol.jpg
- SHA256 f572a47bb80d78e1fb2bcbab358afd46150519cc2d4b8a46e2bf1d0a9cb58b9d
- MD5 5f8be4ce36e2be3a0e10f37acb7c67bc
- SHA1 297757b881bf1f40a594863068650234b9a91691
- SHA512 09c75ab33ea01f5598e9226f8e0a7da031b8c2ed8f3f87d9f77702b8e24918752416ebc85a35c07e2467a8a855cd8a859f96bb598c9d77d57f670c1b9238ac3b
- SSDEEP 384:+r6SU8iDg2aDb588D7op0b1ETFBQQEm5ZI8wWFrT9w2h31H:+rt+DYV8N0b1ETTQQ57T1ZJ
- MD5 SHA1 SHA512 SSDEEP