06122024_1223_06122024_Nakliye belgeleri.gz
- SHA256 897157add816cce92dbd71702f67356ade3bfe16a405f9c89e7eebeeebbf9ceb
Password
infected
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Nakliye belgeleri.exe
Resource
win7-20240903-en
windows7-x64
11 signatures
300 seconds
Behavioral task
behavioral2
Sample
Nakliye belgeleri.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
9 signatures
300 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240903-en
windows7-x64
3 signatures
300 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
300 seconds
Behavioral task
behavioral5
Sample
hypohydrochloria.app
Resource
macos-20241101-en
macos-10.15-amd64
1 signatures
300 seconds
General
- Target 06122024_1223_06122024_Nakliye belgeleri.gz
- Size 831KB
- Sample241206-pkgjnssrbn
- SHA256 897157add816cce92dbd71702f67356ade3bfe16a405f9c89e7eebeeebbf9ceb
- MD5 6229096ae5421057efee44aa89cd77ad
- SHA1 3b86be094df15ead66c16589a0eeb4483aa521dd
- SHA512 7154f622161bdc1c4426a16e252ebb0d0a009686e39c427bc9a95982a57841e72aa40d97908252e9f33f76c9ae5c97547b97ab731cd04d45c26e1ffc5380fc41
- SSDEEP 12288:yeI9M8qCD+dWEho5UIIy8gk8tyfhsiUN0dWOrWdsr2xETJrCesF7V83nv:uiFbo53Zk08hjdrWc2qTJ0F7V8Xv
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/$PLUGINSDIR/System.dll
File Explorer
-
06122024_1223_06122024_Nakliye belgeleri.gz.rar 831KB
-
Nakliye belgeleri.exe.exe 1.1MB
-
$PLUGINSDIR/System.dll.dll 11KB
-
Bifidities.Kra197213KB
-
Retardment.Spi427KB
-
Unerrableness36.unt432KB
-
aflse.cir397KB
-
cancans.hyp419KB
-
cirkuses.ker336KB
-
hypohydrochloria.app487KB
-
tediously.jor374KB
Nakliye belgeleri.exe
- IMPHASH e221f4f7d36469d53810a4b5f9fc8966
- SHA256 014f4753734a62111955ca64721aa64a4b6d98b36e5a3bd9a4da5afc128b2f17
- MD5 620924d9a2e90d34b060c7e210785926
- SHA1 736ce2fe105049ed45e90e5bd9d83086a6006c32
- SHA512 d9b73f6d65eb4aabf05e96e06c864a68d921c627eca178cba573a46a1818f00d6934ce794eb1bcedccc2fbaef83ae2270eb9583217705293860450ef25a41912
- SSDEEP 12288:pl/4qNMmw1GYDmImQgThNj/yMf5ck8WMvwvKIcrIPdEBEo7vPmXaNgI+pMeVOqIt:rM05NjKiclwSIU04Eb1MncwaF0C9Wn
- MD5 SHA1 SHA512 SSDEEP
Password
infected
PE Signature issue
Digest
fc:69:fa:37:83:cc:9b:f8:c0:a0:4d:0c:9b:91:67:a7:63:be:1b:63:9a:c1:f8:61:6e:f7:3f:61:9e:f8:c6:1c
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Entomostracan,O=Entomostracan,L=Mcnary,C=US
Chains
Dec 5, 2024
PE Signature issue
Digest
b9:6e:b7:da:53:28:35:d0:2d:71:7a:3c:b0:46:ad:c0:14:f8:37:3e
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Entomostracan,O=Entomostracan,L=Mcnary,C=US
Chains
Dec 5, 2024
Subject
CN=Entomostracan,O=Entomostracan,L=Mcnary,C=US
Serial Number
15:b5:1e:8d:ea:e6:8e:d6:ee:d7:3e:70:11:ab:c7:57:47:c0:d6:b5
Issuer
CN=Entomostracan,O=Entomostracan,L=Mcnary,C=US
Timespan
Aug 5, 2024 - Aug 5, 2027
Subject
CN=Entomostracan,O=Entomostracan,L=Mcnary,C=US
Serial Number
15:b5:1e:8d:ea:e6:8e:d6:ee:d7:3e:70:11:ab:c7:57:47:c0:d6:b5
Issuer
CN=Entomostracan,O=Entomostracan,L=Mcnary,C=US
Timespan
Aug 5, 2024 - Aug 5, 2027
Minor OS version
0
Major OS version
4
Entry point
13146
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
CompareFileTime
SearchPathW
SetFileTime
CloseHandle
GetShortPathNameW
MoveFileW
SetCurrentDirectoryW
GetFileAttributesW
GetLastError
GetFullPathNameW
CreateDirectoryW
Sleep
GetTickCount
CreateFileW
GetFileSize
GetModuleFileNameW
GetCurrentProcess
CopyFileW
ExitProcess
SetEnvironmentVariableW
GetWindowsDirectoryW
SetFileAttributesW
ExpandEnvironmentStringsW
SetErrorMode
LoadLibraryW
lstrlenW
lstrcpynW
GetDiskFreeSpaceW
GlobalUnlock
GlobalLock
CreateThread
CreateProcessW
RemoveDirectoryW
lstrcmpiA
GetTempFileNameW
lstrcpyA
lstrcpyW
lstrcatW
GetSystemDirectoryW
GetVersion
GetProcAddress
LoadLibraryA
GetModuleHandleA
GetModuleHandleW
lstrcmpiW
lstrcmpW
WaitForSingleObject
GlobalFree
GlobalAlloc
LoadLibraryExW
GetExitCodeProcess
FreeLibrary
WritePrivateProfileStringW
GetCommandLineW
GetTempPathW
GetPrivateProfileStringW
FindFirstFileW
FindNextFileW
DeleteFileW
SetFilePointer
ReadFile
FindClose
MulDiv
MultiByteToWideChar
WriteFile
lstrlenA
WideCharToMultiByte
user32
EndDialog
ScreenToClient
GetWindowRect
RegisterClassW
EnableMenuItem
GetSystemMenu
SetClassLongW
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongW
SetCursor
LoadCursorW
CheckDlgButton
GetMessagePos
LoadBitmapW
CallWindowProcW
IsWindowVisible
CloseClipboard
SetClipboardData
wsprintfW
CreateWindowExW
SystemParametersInfoW
AppendMenuW
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextW
GetDlgItemTextW
MessageBoxIndirectW
CharPrevW
CharNextA
wsprintfA
DispatchMessageW
PeekMessageW
ReleaseDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
GetClientRect
FillRect
DrawTextW
GetClassInfoW
DialogBoxParamW
CharNextW
ExitWindowsEx
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
GetDC
SetWindowLongW
LoadImageW
SendMessageTimeoutW
FindWindowExW
EmptyClipboard
OpenClipboard
TrackPopupMenu
EndPaint
ShowWindow
GetDlgItem
IsWindow
SetForegroundWindow
gdi32
SelectObject
SetBkMode
CreateFontIndirectW
SetTextColor
DeleteObject
GetDeviceCaps
CreateBrushIndirect
SetBkColor
shell32
SHGetSpecialFolderLocation
SHGetPathFromIDListW
SHBrowseForFolderW
SHGetFileInfoW
ShellExecuteW
SHFileOperationW
advapi32
RegCloseKey
RegOpenKeyExW
RegDeleteKeyW
RegDeleteValueW
RegEnumValueW
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW
RegEnumKeyW
comctl32
ImageList_Create
ImageList_AddMasked
ImageList_Destroy
ord17
ole32
CoCreateInstance
CoTaskMemFree
OleInitialize
OleUninitialize
version
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
Name
.text
Size
24KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
128KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
204KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
412KB
Virtual Size
412KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=166, id=1, productName=Unmarked objects,
count=17, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
$PLUGINSDIR/System.dll
- IMPHASH fc0224e99e736751432961db63a41b76
- SHA256 7fe77ca13121a113c59630a3dba0c8aaa6372e8082393274da8f8608c4ce4528
- MD5 fc90dfb694d0e17b013d6f818bce41b0
- SHA1 3243969886d640af3bfa442728b9f0dff9d5f5b0
- SHA512 324f13aa7a33c6408e2a57c3484d1691ecee7c3c1366de2bb8978c8dc66b18425d8cab5a32d1702c13c43703e36148a022263de7166afdce141da2b01169f1c6
- SSDEEP 192:e/b2HS5ih/7i00eWz9T7PH6yeFcQMI5+Vw+EXWZ77dslFZk:ewSUmWw9T7MmnI5+/F7Kdk
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
4
Entry point
10125
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetModuleHandleW
GlobalFree
GlobalSize
lstrcpynW
lstrcpyW
GetProcAddress
WideCharToMultiByte
VirtualFree
FreeLibrary
lstrlenW
LoadLibraryW
GlobalAlloc
MultiByteToWideChar
VirtualAlloc
VirtualProtect
GetLastError
user32
wsprintfW
ole32
StringFromGUID2
CLSIDFromString
Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc
Name
.text
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
835B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
120B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1024B
Virtual Size
574B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=14, version=7299,
count=20, id=1, productName=Unmarked objects,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=4, id=48, version=9044,
count=1, id=42, version=8803,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
Bifidities.Kra197
- SHA256 382ad53a98ecd49037d036d7921cdae918422e5fa5c47922cee0af559cc393e7
- MD5 0c1066dd894cd04c2f45dbf35ebbed1f
- SHA1 ead10a98fd7a2ccff996a2ce351b5669cae10bd3
- SHA512 ee197f355c42236e83360b521acd6f4e9afe887176e899634b4bc86a318800674e9248117926ce1ba8e4e1085dc7598fde8aa01c1042807b12190f48049ca0e9
- SSDEEP 3072:sTdC1VIWfO1Q9tudT0DrQ89F3j2tnesFY0kLK5kJGi6qkaklfuH5Kx:iKIwiwt4QDrl9FqtneJFGikTlfuZK
- MD5 SHA1 SHA512 SSDEEP
Retardment.Spi
- SHA256 22b6146c7c34d5715fa0892cb510d40dac3f4585deb5658e533ad7b5589fa652
- MD5 a72bf33ae89f7e1c1fd9095af5d617eb
- SHA1 aefa941c134827c1d0a4b61c233f93c9d25dc02d
- SHA512 41658847df5c2e1d306ee6091bbfb22da1e7a4b77b5435f585d227a974360051d0a07006875e3c21cc01603314a480a91bad8944c06442870306e383d52f28ce
- SSDEEP 1536:H/smHNSTWiIrAzZo6jdd6+tYs9AkGQs6m2LVD6tvRJDf4aDgSRqUpv/wd6wCwuzP:QxqwSYiSQjFq+JlkwZ2QYRC4xU
- MD5 SHA1 SHA512 SSDEEP
Unerrableness36.unt
- SHA256 ac3c1e52b246ed6f81e5ba59915c5a3ff7def95d6c1ccc82a192d0f54075f09d
- MD5 ed077b45a0a53a7a5036d9ffc5b8f726
- SHA1 5315c210331de98087afc1515459de960dbffe25
- SHA512 79309f5fa9c690a4df1ea8da70d0bfe52ebfaa86d596d3ba7acd143cde345ec8f04aea49922fbace2ec9b4d74b7d73467d914419b18897e9d67f5b5674614708
- SSDEEP 768:DSlRtz0zsa6+GPP0cJHCsuMejujek9QNf/NBCtnxuXnHjHK8HXGgB2fmoiPr+7//:DWyz1g7HpPo8JaCgxJNjBnQC0V
- MD5 SHA1 SHA512 SSDEEP
aflse.cir
- SHA256 b89af215a5f718bd058f30d0a5de3defdf00f2379cb642974a61eb1d66d73078
- MD5 8cbf0555cbd6c67954b03bb45b98bf07
- SHA1 1310f145d49aca347cd9b96b2164388975bb4779
- SHA512 8be8a5c607f8acb03af55c937c02ad2a95bde56f6424ee2c8ea41a108e7d66a8173ed1a3922e398e207e07d6d3e7d8a706c4209a72ab9022ba3cb46eb4f829c4
- SSDEEP 1536:Tty2T9uv1Snk57FxGht2oxbB23ysF/7JT7:T82TQgw72t2Co3L9J/
- MD5 SHA1 SHA512 SSDEEP
cancans.hyp
- SHA256 7dc5edb8459f95a949940eac3bcc953308f64742ba35595dfdebbba1f84a8483
- MD5 64a588c908ec2138d95545c55c4628c2
- SHA1 304af85bbd95fe0a7ea7a31998557195a55e12bb
- SHA512 5b6c26d887669a9ae1093b3ac1e824016c9b80d8c17e844b88737cdd4a7f1766af366b2ca261d434c4306b776ab49cd514c540f2129520adf696e15dae22098d
- SSDEEP 1536:TDYQqTeSc/PtqgqJNQCJJMMNg/q8HMiRBx:TUp3gqLbJM9i7ih
- MD5 SHA1 SHA512 SSDEEP
cirkuses.ker
- SHA256 d58e8ee02c2cdefefc3a3cc844fa1eb23d99181b2b5307c3ae23a813b8a5da50
- MD5 a639217d7e56e28d6136f5115fea5663
- SHA1 29ace7111a910cf8ca5d3b2f51233f321f713f6a
- SHA512 1445e4a7bed24bb8776d99b4b7e9f8356178d21d5cc53481f269a8679f34efb25bd1eacc65c5a2a3264fe97e20f925fea001f902b9c95b20456ac9265f3c1b0f
- SSDEEP 768:HWyO66PXz+jOfYqfU3KVoGI0+M4r1UpsYUMVxzZ+KlqaRk8nLPZMzV6OjpXslPim:S66fuyU3KqMtVyZ8Fe1oVpaHG5vyXVQ
- MD5 SHA1 SHA512 SSDEEP
hypohydrochloria.app
- SHA256 60412767f4eaea33f06a6a02f3b0975015e75f251ba6cbeee96ac712d0b23f9b
- MD5 271b95b44bbafaf5d68ae0d972e1163a
- SHA1 6816bd06b9b638de8e6517dfe7647ce409f2f4c8
- SHA512 cb7a65001cc0dbb63cddcd89166b575bd2612f75100ca47ff8a8162825a5c91a5c2b60b83447f33a7aad1c0f1a7eee4c5f340e5d66141ee59309b59ca461d992
- SSDEEP 1536:vGAVO3tWkduBR8240f+rzESOotNlufM+A/:nYQSA6AMIk+A/
- MD5 SHA1 SHA512 SSDEEP
tediously.jor
- SHA256 a8341690144805b2557185ef9fbc7b62aa72ba4f07a746a8cd594196f81546b3
- MD5 1aa223aebb480b99b5a91d4ec7fb2c62
- SHA1 4ede8243bfe48147bf09c5b03f080d0c1335a097
- SHA512 23619bef59c7400849fa4f35b31020930d24d92f209ffb045a89614c97dbbea162068888f76912659584c0d97e835839052a3da17d97d016fb36a0abdff70429
- SSDEEP 768:e+iJ6uGlUCFA02tyQsl6Pa2appBG/3uo+cNqymOOdXy814eYeF+1l7ZBvRPSdUY4:fRh666zHNcH94dvDWTUnE3J0yIAJMy2
- MD5 SHA1 SHA512 SSDEEP