MRP00108 & SDA00687.rar
- SHA256 7507bdd2d90113ba83c84b5efe0687f0e28b3909c7ef2d5ff94d2aeb4e3b78be
Static task
static1
Behavioral task
behavioral1
Sample
MRP00108 & SDA00687.rar
Resource
win7-20241010-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
MRP00108 & SDA00687.rar
Resource
win10v2004-20241007-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral3
Sample
MRP00108 & SDA00687.exe
Resource
win7-20240708-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral4
Sample
MRP00108 & SDA00687.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
16 signatures
150 seconds
Behavioral task
behavioral5
Sample
Filterintegration.ps1
Resource
win7-20240903-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral6
Sample
Filterintegration.ps1
Resource
win10v2004-20241007-en
windows10-2004-x64
12 signatures
150 seconds
General
- Target MRP00108 & SDA00687.rar
- Size 623KB
- Sample241209-kh522axjgl
- SHA256 7507bdd2d90113ba83c84b5efe0687f0e28b3909c7ef2d5ff94d2aeb4e3b78be
- MD5 d2529b6b54c81ad2cfba0b408153510b
- SHA1 bf1568d0d90ff4d9e727f577a00ab29b68c2c9da
- SHA512 f7f91b3cf99f15984ef57e90fe0bd00651f645d474fa2a24b1dce8022b792a882bb4456e6e7b8fe1297cb3e1edeb0a9d7970e3b8a718cfac367a3ae859c38647
- SSDEEP 12288:Nkfo3Kpb1TQX1o/K7g6MTDfM9pRBcgrC1PTLjW/NpGwqKqN3DqsL:NkgObtQX1o/ygzi6PTL2N4rKqtL
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
File Explorer
-
MRP00108 & SDA00687.rar.rar 623KB
-
MRP00108 & SDA00687.exe.exe 710KB
-
Filterintegration.Eks.ps1 52KB
-
Hydrometers221.rgt448KB
-
Marmalades.Pas338KB
-
Rouladernes/Slowfoxens125.ana485KB
-
Rouladernes/eksamensfries.hos327KB
MRP00108 & SDA00687.exe
- IMPHASH 7ed0d71376e55d58ab36dc7d3ffda898
- SHA256 30d74b831f98532075daed442b93067c7ce8846d7cbd557f43a13922840b698a
- MD5 9fc11ee03f60a10e4a2f26edbf8fcdaf
- SHA1 7ed74a2e69bd49aadc4716a420dcacea97e220d7
- SHA512 ee2d8b55b9b2b2d3e5cf867688236299a5585be3a7516dc8027e9965b2ac7354f1bf84fcf9f998af7ed185f8b36bbfd1b1a0e6d5a41b65a6d4ed06f722382adf
- SSDEEP 12288:X6qSGX12mgYtQvCOgMAwhsuiB/IhyrWQIUbMZHBeGoOO+XKCR6i0EYuCn0a:HJX1YBvCHMquiBJaQ/eBeGoOOKKCR655
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
3f:95:ac:8a:88:dd:59:97:12:07:21:39:09:b3:56:9d:00:aa:3b:56:3d:87:1c:90:e3:0b:f9:8a:dc:8d:c6:ae
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Flabe,O=Flabe,L=Thonon-les-Bains,C=FR
Chains
Dec 5, 2024
Subject
CN=Flabe,O=Flabe,L=Thonon-les-Bains,C=FR
Serial Number
50:88:0a:c6:f1:cf:8e:8d:27:4a:1a:b3:84:07:00:d5:8d:1e:15:bb
Issuer
CN=Flabe,O=Flabe,L=Thonon-les-Bains,C=FR
Timespan
Sep 7, 2024 - Sep 7, 2027
Minor OS version
0
Major OS version
4
Entry point
12799
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
CompareFileTime
SearchPathW
SetFileTime
CloseHandle
GetShortPathNameW
MoveFileW
SetCurrentDirectoryW
GetFileAttributesW
GetLastError
GetFullPathNameW
CreateDirectoryW
Sleep
GetTickCount
GetFileSize
GetModuleFileNameW
GetCurrentProcess
CopyFileW
ExitProcess
SetEnvironmentVariableW
GetWindowsDirectoryW
GetTempPathW
SetFileAttributesW
ExpandEnvironmentStringsW
LoadLibraryW
lstrlenW
lstrcpynW
GetDiskFreeSpaceW
GlobalUnlock
GlobalLock
CreateThread
CreateProcessW
RemoveDirectoryW
lstrcmpiA
CreateFileW
GetTempFileNameW
lstrcpyA
lstrcpyW
lstrcatW
GetSystemDirectoryW
GetVersion
GetProcAddress
LoadLibraryA
GetModuleHandleA
GetModuleHandleW
lstrcmpiW
lstrcmpW
WaitForSingleObject
GlobalFree
GlobalAlloc
LoadLibraryExW
GetExitCodeProcess
FreeLibrary
WritePrivateProfileStringW
SetErrorMode
GetCommandLineW
GetPrivateProfileStringW
FindFirstFileW
FindNextFileW
DeleteFileW
SetFilePointer
ReadFile
FindClose
MulDiv
MultiByteToWideChar
WriteFile
lstrlenA
WideCharToMultiByte
user32
EndDialog
ScreenToClient
GetWindowRect
RegisterClassW
EnableMenuItem
GetSystemMenu
SetClassLongW
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongW
SetCursor
LoadCursorW
CheckDlgButton
GetMessagePos
LoadBitmapW
CallWindowProcW
IsWindowVisible
CloseClipboard
SetClipboardData
wsprintfW
CreateWindowExW
SystemParametersInfoW
AppendMenuW
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextW
GetDlgItemTextW
MessageBoxIndirectW
CharPrevW
CharNextA
wsprintfA
DispatchMessageW
PeekMessageW
ReleaseDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
GetClientRect
FillRect
DrawTextW
GetClassInfoW
DialogBoxParamW
CharNextW
ExitWindowsEx
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
GetDC
SetWindowLongW
LoadImageW
SendMessageTimeoutW
FindWindowExW
EmptyClipboard
OpenClipboard
TrackPopupMenu
EndPaint
ShowWindow
GetDlgItem
IsWindow
SetForegroundWindow
gdi32
SelectObject
SetBkMode
CreateFontIndirectW
SetTextColor
DeleteObject
GetDeviceCaps
CreateBrushIndirect
SetBkColor
shell32
SHGetSpecialFolderLocation
SHGetPathFromIDListW
SHBrowseForFolderW
SHGetFileInfoW
ShellExecuteW
SHFileOperationW
advapi32
RegCloseKey
RegOpenKeyExW
RegDeleteKeyW
RegDeleteValueW
RegEnumValueW
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW
RegEnumKeyW
comctl32
ImageList_Create
ImageList_AddMasked
ImageList_Destroy
ord17
ole32
CoCreateInstance
CoTaskMemFree
OleInitialize
OleUninitialize
version
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
Name
.text
Size
23KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
128KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
132KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
137KB
Virtual Size
137KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=166, id=1, productName=Unmarked objects,
count=17, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
Filterintegration.Eks
- SHA256 e55feb751d85c738f96c802c9df5af30ef0722a0af003bdc65826f31c2d0b9cd
- MD5 b2675a19c8907bdb1caac87a463036ab
- SHA1 ce3eb4761dd92a88834851e404952edebac92ff3
- SHA512 5d0707af18e5e0790c48c33ab62869cdbba3662de10850368b8a0ad1511896a29ce6f7b1d1daaa45876ce83873d8cef1df592092c07615e7a72dd5d3620a95b4
- SSDEEP 768:DfV6aJ4eYCDeA0vC8w56zGmZJCLFm/EHXda1My4bDEh91kQAxKzeWSVlsIkgQSiN:DfV6k4XLK8S6XHENa12bYkQAxK+VlTdG
- MD5 SHA1 SHA512 SSDEEP
Hydrometers221.rgt
- SHA256 4a8090c04144eac1a68f4a2c00782cf080e9a0eda79c16e8f1a7bd4209fb3598
- MD5 8cb4a741e7a6876a86ce01d139a98975
- SHA1 263835c0354322b2d35170a864f14f5f509e9846
- SHA512 3950af78bcf4565795c19d9873ab1aa0d729d040ec8718953cd8e0a63603b98318b3e0a5009d8f39d52fa22a7aace07ffd7cfcba5fc0eea6b2f56d0b2792124c
- SSDEEP 1536:BeTid+LufWiWflQOm+ALu6d4U+rQ4b6sdDu:BeTij9+Ob+Db62
- MD5 SHA1 SHA512 SSDEEP
Marmalades.Pas
- SHA256 0515372b843282de9ff41a9c6a88a641dfd658d98674676fd83e79a871f8d681
- MD5 eee1c80e83b995bdcb5f27b31e64cdf6
- SHA1 d5e6eaf73c07d24efe44f443a0fc83fe92c51055
- SHA512 b0d4beed14e69b58c74617d612daf248b7b6e2535cded360156f38b42ae545700d852ccb60c9186903cd97b5b7ba3985261d95eb29cf700db91856a87dab9a75
- SSDEEP 6144:1lQhg2nDnwJrXH3AwYzM6+LkIgY550+udU2BsZ7rA/a:Dx2nTwJDAP46+YbY550+udDNa
- MD5 SHA1 SHA512 SSDEEP
Rouladernes/Slowfoxens125.ana
- SHA256 f48a89c1b8ed05d09032ff0138f32443b2f7f558f09c8f5efd26f9b7008fc266
- MD5 9e8e1b5c07b5ffeef040fb2f72826b38
- SHA1 f030c19d7ad4041df22458bbb35e348300fae3ca
- SHA512 ebeedd8106999e5afa0e3b860d6d7f45ea7eb039dac5e40a3dfae0f27013e52e195d61d3f27e519ed52bc7ccc5d51916ea43cd13b3ed44d79fb1f91940745142
- SSDEEP 1536:W/OvPwGaYUZK49jRTZXsN+7Ou+pVE/C0A2TkuFIrHPt+D7:WunyK4t8vpKlXsg7
- MD5 SHA1 SHA512 SSDEEP
Rouladernes/eksamensfries.hos
- SHA256 d3ba69ab55bbac0bc042e3b0e1dd0e9d7c5dbf78d1c9434b7995cc3957c38411
- MD5 9d8172d3daf1d7f9db2352545e01d3d5
- SHA1 af4b1e83ed3095751d627beaec3f63f3b160aa4c
- SHA512 174edd7a2e72f828a98606ede8c10e687cd24325328246e8709b0993441d6ff80fe2b823f60ae640a19d7557b166dc3a7ea17816d59c7f893f541a61c25a32b8
- SSDEEP 768:GPV714Dder4wzJKINsvpmQMcbWg8XwQF4/cyr94sbQ0u/70CBQFnKkgVEVew7YhE:4uEWMbMuMFVZidMq6l
- MD5 SHA1 SHA512 SSDEEP