dc8bb75ad0523aec1b266d8d6ac4ba77a100ee31be2edff7ead8c18fdc59a7b7.gz
- SHA256 dc8bb75ad0523aec1b266d8d6ac4ba77a100ee31be2edff7ead8c18fdc59a7b7
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Order NO 000293988494948595850000595995000.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
Order NO 000293988494948595850000595995000.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
20 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target dc8bb75ad0523aec1b266d8d6ac4ba77a100ee31be2edff7ead8c18fdc59a7b7.gz
- Size 474KB
- Sample241206-dx8cdatpdp
- SHA256 dc8bb75ad0523aec1b266d8d6ac4ba77a100ee31be2edff7ead8c18fdc59a7b7
- MD5 e0b412577315b4784f422ab40a87eb58
- SHA1 cb517388624cbffbb69c8e21545193ab1a250310
- SHA512 ebd5042d94e05837cf2f11f0b3c9458970556d2dbf9560ccabab1bb021a71c2459d50e806ff48c70456ddc455a472b3a876af77a92a7ecc4b6bb50c9ca5d1f63
- SSDEEP 12288:WSqTv4CQr9epHBHFUF3AT4ySg3NVeJ2Cho12hb7WzT:WH4CkajjTwgreJ2Cho1Q3sT
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/Order NO 000293988494948595850000595995000.exe unpack002/$PLUGINSDIR/System.dll
File Explorer
-
dc8bb75ad0523aec1b266d8d6ac4ba77a100ee31be2edff7ead8c18fdc59a7b7.gz.rar 474KB
-
Order NO 000293988494948595850000595995000.exe.exe 600KB
-
$PLUGINSDIR/System.dll.dll 12KB
-
Basalterne.nec91KB
-
Beregningsmssige.Hst203KB
-
Underacting.far436KB
-
slutstrrelsernes.par468KB
Order NO 000293988494948595850000595995000.exe
- IMPHASH 9dda1a1d1f8a1d13ae0297b47046b26e
- SHA256 935cbed36f8d1f6e18a988bc200c075039f4dc6ffb1a87e1a72c9f8b393fe4fa
- MD5 52131cce80de6868d4eb452ec3bcb91b
- SHA1 4ce48ce0ac577aa4008359cc9178dfb1e9e95f25
- SHA512 88203976f238dc1f93c2bfa7ac255f77755bf0b692f45631d9e7ccc853ef89b8c1d3ddfd0fe86978409bee0f81ac03c81c11757ed2deadb29b3f4b495a1680bc
- SSDEEP 12288:tHadcxTcho0xSH0dgsK4lU7MMJtkbgPtYDoZ:VadhaNUdgPsqJtkIYDoZ
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
13925
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
advapi32
RegEnumValueW
RegEnumKeyW
RegQueryValueExW
RegSetValueExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
RegOpenKeyExW
RegCreateKeyExW
shell32
SHGetPathFromIDListW
SHBrowseForFolderW
SHGetFileInfoW
SHFileOperationW
ShellExecuteExW
ole32
CoCreateInstance
OleUninitialize
OleInitialize
IIDFromString
CoTaskMemFree
comctl32
ImageList_Destroy
ord17
ImageList_AddMasked
ImageList_Create
user32
MessageBoxIndirectW
GetDlgItemTextW
SetDlgItemTextW
CreatePopupMenu
AppendMenuW
TrackPopupMenu
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
IsWindowVisible
CallWindowProcW
GetMessagePos
CheckDlgButton
LoadCursorW
SetCursor
GetSysColor
SetWindowPos
GetWindowLongW
IsWindowEnabled
SetClassLongW
GetSystemMenu
EnableMenuItem
GetWindowRect
ScreenToClient
EndDialog
RegisterClassW
SystemParametersInfoW
CharPrevW
GetClassInfoW
DialogBoxParamW
CharNextW
ExitWindowsEx
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
FindWindowExW
IsWindow
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
ReleaseDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
GetClientRect
FillRect
DrawTextW
EndPaint
CharNextA
wsprintfA
DispatchMessageW
CreateWindowExW
PeekMessageW
GetSystemMetrics
gdi32
GetDeviceCaps
SetBkColor
SelectObject
DeleteObject
CreateBrushIndirect
CreateFontIndirectW
SetBkMode
SetTextColor
kernel32
RemoveDirectoryW
lstrcmpiA
GetTempFileNameW
CreateProcessW
CreateDirectoryW
GetLastError
CreateThread
GlobalLock
GlobalUnlock
GetDiskFreeSpaceW
WideCharToMultiByte
lstrcpynW
lstrlenW
SetErrorMode
GetVersionExW
GetCommandLineW
GetTempPathW
GetWindowsDirectoryW
SetEnvironmentVariableW
WriteFile
ExitProcess
GetCurrentProcess
GetModuleFileNameW
GetFileSize
CreateFileW
GetTickCount
Sleep
SetFileAttributesW
GetFileAttributesW
SetCurrentDirectoryW
MoveFileW
GetFullPathNameW
GetShortPathNameW
SearchPathW
CompareFileTime
SetFileTime
CloseHandle
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalFree
GlobalAlloc
GetModuleHandleW
LoadLibraryExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
lstrlenA
MultiByteToWideChar
ReadFile
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW
MulDiv
lstrcpyA
MoveFileExW
lstrcatW
GetSystemDirectoryW
GetProcAddress
GetModuleHandleA
GetExitCodeProcess
WaitForSingleObject
CopyFileW
Name
.text
Size
26KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
126KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
152KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
196KB
Virtual Size
195KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=163, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
$PLUGINSDIR/System.dll
- IMPHASH 509a34b3a68a773e0afb4259e68f9f82
- SHA256 23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6
- MD5 192639861e3dc2dc5c08bb8f8c7260d5
- SHA1 58d30e460609e22fa0098bc27d928b689ef9af78
- SHA512 6e573d8b2ef6ed719e271fd0b2fd9cd451f61fc9a9459330108d6d7a65a0f64016303318cad787aa1d5334ba670d8f1c7c13074e1be550b4a316963ecc465cdc
- SSDEEP 192:ljHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZqE0QPi:R/Qlt7wiij/lMRv/9V4bfr
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
10879
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GlobalAlloc
GlobalFree
GlobalSize
lstrcpynW
lstrcpyW
GetProcAddress
WideCharToMultiByte
VirtualFree
FreeLibrary
lstrlenW
LoadLibraryW
GetModuleHandleW
MultiByteToWideChar
VirtualAlloc
VirtualProtect
GetLastError
user32
wsprintfW
ole32
StringFromGUID2
CLSIDFromString
Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc
Name
.text
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
867B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
120B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1024B
Virtual Size
662B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=14, version=7299,
count=20, id=1, productName=Unmarked objects,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=4, id=48, version=9044,
count=1, id=42, version=8803,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
Basalterne.nec
- SHA256 2b3aeedc78f7bf296454e5d28457b9b19f081dc637fe0680c748b3d670ba3395
- MD5 9f64f450771196b87786be2512310627
- SHA1 3a8ed73d8f37b79e1825ceca4e9faf95cd69c41e
- SHA512 1558afc4de1058307867c54bdf660422d2117d5fdf47b6c141e68f701f1770048d3d5ab99895aaa4f058304b0bb24ea89bdfcb1381fecd7775d4bf65055b9cb3
- SSDEEP 768:i9qrj3bsBMZsVMzeC+Uo6XHavWZQvXee9rq:xk2hQNrq
- MD5 SHA1 SHA512 SSDEEP
Beregningsmssige.Hst
- SHA256 20dc2be7389f4f1961b60ed70d1af57c47a9deef9aba2d2101e4ce4aadf11e06
- MD5 07d4918edabfdd5fe9e58bf1d7f85ab3
- SHA1 4d730609ac7234ef2a9962d36d9d4e99dbc73868
- SHA512 a8f25e526b581651d9ae3f862ab5d9cd52531bd615c895fc3f84f216a1d2eb97c9b40e10b162308eaaf583f8c70c9605f6291cc09a965ca4ff4545577f64500c
- SSDEEP 6144:/BIrdAaw4NDAnFZOKXsD3eOi3k17pcwdpr5O5/1c:89PXD3Nfhpr5OHc
- MD5 SHA1 SHA512 SSDEEP
Underacting.far
- SHA256 bb08a1ba4bed6b267e74796794da545b748f743b4e4efbd70661d344819a96be
- MD5 9f5ff2b911941f49bb1e95c9eb879200
- SHA1 133807f8968b8043ed2efe92e72cce953e515804
- SHA512 e8cf3028d7b468da197b4fd4af5b2b88beac2349b3991440432cccb722c521c88430c118db81483621538d2516aefeca305d1743ef927d42473bfff8866b1052
- SSDEEP 1536:2Ocq92oEYvMX/pi98CBDfaCzJ3/m/A9820WYH8Szyt+SoeDYLcFNcChEMQYNcFr9:9NCVJ5m3oGpAbP33+BQLWF2yjE1Ipkp
- MD5 SHA1 SHA512 SSDEEP
slutstrrelsernes.par
- SHA256 2209b57fabe05e4e314d5fe84bc99892bc189f11b7793dd7f658e3d403d5fd3c
- MD5 4593d427554a1f61d609ff98908779b3
- SHA1 f377a88eb1e9bd29dc1a2730ee3e85651d56c6a0
- SHA512 33a2f6e58dfc1aa7b38e4aa1085b8740cff02e1a42db09f46c0516c3f9d9526a6d94d8cf9a6204a289bd6d8110ffd59b6a338f0b81ee1612fd8fd7b29ef272c7
- SSDEEP 1536:JwEDT97SToCGRVFl5C1SX6/eibc4YMhoEw2T:eQcop5CP/eyYLEtT
- MD5 SHA1 SHA512 SSDEEP