ZAMWIENIE_NR24120117938022.IMG
- SHA256 6a58775b1bda073351933d2b4d7347f4520c6631602acce063d1c0bdedc0890f
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ZAMÓWIENIE_NR24120117938022.exe
Resource
win7-20240903-en
windows7-x64
19 signatures
150 seconds
Behavioral task
behavioral2
Sample
ZAMÓWIENIE_NR24120117938022.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
18 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target ZAMWIENIE_NR24120117938022.IMG
- Size 1.5MB
- Sample241209-leddaatjgt
- SHA256 6a58775b1bda073351933d2b4d7347f4520c6631602acce063d1c0bdedc0890f
- MD5 209d612d3fd23f6e0151bb2cc81b0993
- SHA1 a5b650a280c788a6c7607e3b9b435e27af94c0df
- SHA512 5472243ad5ada4ab49c725e46a888593f862e242aeec8443dfac269b306598098ebb4ecefac0d1019ff5fb96dc53119b34cc3ed07b35319e29f0ba36d270aa64
- SSDEEP 24576:kYB//x9siaesoieYuVffHku3WggclxxIJzsGO:t9//FAUHffHkumggclxGZ
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack002/ZAMÓWIENIE_NR24120117938022.exe unpack003/$PLUGINSDIR/System.dll
File Explorer
-
ZAMWIENIE_NR24120117938022.IMG.iso 1.5MB
-
out.iso.iso 1.5MB
-
ZAMÓWIENIE_NR24120117938022.exe.exe 999KB
-
$PLUGINSDIR/System.dll.dll 12KB
-
Centiloquy204/Inagglutinability.fug433KB
-
Centiloquy204/aftrksrrets.Kun480KB
-
Centiloquy204/bingy.uda365KB
-
Centiloquy204/molge.gos316KB
-
Centiloquy204/overissued.rei319KB
-
Centiloquy204/ramessid.gla445KB
-
Centiloquy204/triaxiality.gen305KB
out.iso
- SHA256 6a58775b1bda073351933d2b4d7347f4520c6631602acce063d1c0bdedc0890f
- MD5 209d612d3fd23f6e0151bb2cc81b0993
- SHA1 a5b650a280c788a6c7607e3b9b435e27af94c0df
- SHA512 5472243ad5ada4ab49c725e46a888593f862e242aeec8443dfac269b306598098ebb4ecefac0d1019ff5fb96dc53119b34cc3ed07b35319e29f0ba36d270aa64
- SSDEEP 24576:kYB//x9siaesoieYuVffHku3WggclxxIJzsGO:t9//FAUHffHkumggclxGZ
- MD5 SHA1 SHA512 SSDEEP
ZAMÓWIENIE_NR24120117938022.exe
- IMPHASH 61259b55b8912888e90f516ca08dc514
- SHA256 b7e96f5e7dc899dc84e8eb7d63c867f38e8b742c2e44680dba593969ff148052
- MD5 5c45c0877fb82d10594fde27ceef591d
- SHA1 ea68349b2af800d39680cf50da9e3284ec1d52a4
- SHA512 d6497d61d8bbf155223fe4554783b0e86ab326ffb20bbbac4b444e0d27f16715458bf055085732c4204cbccba84419de62bd75615602a291e26c1dbc74a6bda9
- SSDEEP 24576:+YB//x9siaesoieYuVffHku3WggclxxIJzsGOB:j9//FAUHffHkumggclxGZW
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
13888
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
advapi32
RegCreateKeyExW
RegEnumKeyW
RegQueryValueExW
RegSetValueExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
SetFileSecurityW
RegOpenKeyExW
RegEnumValueW
shell32
SHGetSpecialFolderLocation
SHFileOperationW
SHBrowseForFolderW
SHGetPathFromIDListW
ShellExecuteExW
SHGetFileInfoW
ole32
OleInitialize
OleUninitialize
CoCreateInstance
IIDFromString
CoTaskMemFree
comctl32
ord17
ImageList_Create
ImageList_Destroy
ImageList_AddMasked
user32
GetClientRect
EndPaint
DrawTextW
IsWindowEnabled
DispatchMessageW
wsprintfA
CharNextA
CharPrevW
MessageBoxIndirectW
GetDlgItemTextW
SetDlgItemTextW
GetSystemMetrics
FillRect
AppendMenuW
TrackPopupMenu
OpenClipboard
SetClipboardData
CloseClipboard
IsWindowVisible
CallWindowProcW
GetMessagePos
CheckDlgButton
LoadCursorW
SetCursor
GetSysColor
SetWindowPos
GetWindowLongW
PeekMessageW
SetClassLongW
GetSystemMenu
EnableMenuItem
GetWindowRect
ScreenToClient
EndDialog
RegisterClassW
SystemParametersInfoW
CreateWindowExW
GetClassInfoW
DialogBoxParamW
CharNextW
ExitWindowsEx
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
FindWindowExW
IsWindow
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
ReleaseDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
EmptyClipboard
CreatePopupMenu
gdi32
SetBkMode
SetBkColor
GetDeviceCaps
CreateFontIndirectW
CreateBrushIndirect
DeleteObject
SetTextColor
SelectObject
kernel32
GetExitCodeProcess
WaitForSingleObject
GetModuleHandleA
GetProcAddress
GetSystemDirectoryW
lstrcatW
Sleep
lstrcpyA
WriteFile
GetTempFileNameW
lstrcmpiA
RemoveDirectoryW
CreateProcessW
CreateDirectoryW
GetLastError
CreateThread
GlobalLock
GlobalUnlock
GetDiskFreeSpaceW
WideCharToMultiByte
lstrcpynW
lstrlenW
SetErrorMode
GetVersionExW
GetCommandLineW
GetTempPathW
GetWindowsDirectoryW
SetEnvironmentVariableW
CopyFileW
ExitProcess
GetCurrentProcess
GetModuleFileNameW
GetFileSize
CreateFileW
GetTickCount
MulDiv
SetFileAttributesW
GetFileAttributesW
SetCurrentDirectoryW
MoveFileW
GetFullPathNameW
GetShortPathNameW
SearchPathW
CompareFileTime
SetFileTime
CloseHandle
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalFree
GlobalAlloc
GetModuleHandleW
LoadLibraryExW
MoveFileExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
lstrlenA
MultiByteToWideChar
ReadFile
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW
Name
.text
Size
26KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
128KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
164KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
232KB
Virtual Size
232KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=165, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
$PLUGINSDIR/System.dll
- IMPHASH fc0224e99e736751432961db63a41b76
- SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
- MD5 cff85c549d536f651d4fb8387f1976f2
- SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
- SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
- SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
10879
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetModuleHandleW
GlobalFree
GlobalSize
lstrcpynW
lstrcpyW
GetProcAddress
WideCharToMultiByte
VirtualFree
FreeLibrary
lstrlenW
LoadLibraryW
GlobalAlloc
MultiByteToWideChar
VirtualAlloc
VirtualProtect
GetLastError
user32
wsprintfW
ole32
StringFromGUID2
CLSIDFromString
Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc
Name
.text
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
867B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
120B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1024B
Virtual Size
662B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=14, version=7299,
count=20, id=1, productName=Unmarked objects,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=4, id=48, version=9044,
count=1, id=42, version=8803,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
Centiloquy204/Inagglutinability.fug
- SHA256 2c121ed02b618293b4402e6b21f2c732bc94085ef655406349c39f31831d498c
- MD5 84fa0dd1b45fb180585f2e2f50699931
- SHA1 0a0463be047f0429e8ecee07c01b2cf1d5877c60
- SHA512 886ac6ae7ea0242f672d349e73804c24c4ef5406ecfdbaed52a96908bb32b719fac804abfa2f75d2c3c9b230c148881624938509ba012bc65cecaf963c9e7d28
- SSDEEP 768:ac7PvH0g06m8EO44p5avB58Z4xunuY1TRicIrA/bjWGAgd+DArFLB+F0PNwhiV2y:Tnu+/YlZbezJVf975PexHNpRZwxM
- MD5 SHA1 SHA512 SSDEEP
Centiloquy204/aftrksrrets.Kun
- SHA256 2442b7f846fe4aec71d6dd8e93a08e00184d013c57e38bab835b382ea62a10ee
- MD5 7ec8fddb2ce485a139f770a114182456
- SHA1 43dff0be9d8f2336c0d7fad9c5f2f113e2a71b6d
- SHA512 ed3b4c88a73d46d8b22c15c353275501ce57a2a97c8db5c59feb19357bfebc9f53485ad635fd4db034ed45b3d185fb0f7a010005ca16b760d72b0d9d81364bd8
- SSDEEP 6144:LLrqUQ7JsRcUFyAgHJ/LCZH64IBPHrvbVftUIbROtOj0nxm+:LLrPazh1p/LQH4PH9SIbRzom+
- MD5 SHA1 SHA512 SSDEEP
Centiloquy204/bingy.uda
- SHA256 82c098cee0901c5eab36e7e58f5be50bb6a4b730a1dcce30868a6a070b7d7b0d
- MD5 63ab01179f7f08cb3fd31a84d307923e
- SHA1 fe08fc38c13fbd2b2d3fac0ecb21a61fac348909
- SHA512 5b5ccdbe1613bf6e0ad01568cf0730fa8e3782ff29a04fde9eba47fe9858e3827be61582fb19b451dfa8fae98d11a715458b114965fdae58b6a0181d7d318e7e
- SSDEEP 1536:lsam/YZz1HsF/LIx4xzs+FxFWEYth0ZDmHmSwIHLh:yYXa8x4xzsbLmyHNLh
- MD5 SHA1 SHA512 SSDEEP
Centiloquy204/molge.gos
- SHA256 56f956599d7c9c0279244826eef098087e0792d2df9fcdef56808096bb7171ad
- MD5 b80d0cb89fe7fa621981d8d20875c6f8
- SHA1 e9e5efcc9a0bf3fcb96ed74300cb3eda8824a903
- SHA512 503b3cb4198976af94d07938f8a74da751cdabfead629fa84b50fa964e3aa7e5a9d9aeec38a530b84ebc6ca835d453a65fbb4be172bcc36f4b2f1716ac0af45b
- SSDEEP 768:EoZQ4ffHokStkE7R3fsPebnEzwBFK/UGxsF7zd3axJXZUJ9uSPHH+Xwxo4wAlU0I:Eo3ITfBkCnaS/HuAiNNo5mzagNT
- MD5 SHA1 SHA512 SSDEEP
Centiloquy204/overissued.rei
- SHA256 0ad6e32ab10e80bcdb3474b904a369af8e6ea7f78f7422d51843f43a4b0d8ff5
- MD5 38662e787c7d317321b9352fe6269829
- SHA1 918fd791b9a00725bcd818648c25e5cbcec3bc84
- SHA512 7e707f205191acf77966283832ee364d26ca14670c820cd7d51f2fc407521cefd69eb17f04dee6c75c58f47c3085f9d1707f0dec4e81a40f67c1741c97e921b4
- SSDEEP 768:u8Rnm6RqiOI7/5CnMuIXKM3+4MTe0vTGzJhhslmbnvlVD36APjFUNDVs1bcE8o48:RjXT6B6JmUDr5ahkRssMs7
- MD5 SHA1 SHA512 SSDEEP
Centiloquy204/ramessid.gla
- SHA256 28b750c621da76e80615c113a689bf77c32d81f5d4c5445a433206e0b3b2f0a4
- MD5 417fd08aa77f114479b10d88872bf95e
- SHA1 1e4630475a91ea0dd64a136cadc446fa38649a41
- SHA512 5079a3f462f38067cb572a43625c2b2d7eb98eb062459fe045408f3dda3e68770efb2bc78e12ad171e2b4aace97ad753a440e9ffb0f7f8b59d3c01608be7e288
- SSDEEP 768:Nh0M1M+UE28IhUidpSGkmkNebfgnKMfExKsYzoi6tW0ySuHg3b38P8c34C7yzyEX:NqELXsuJHGCKoU1ilsGzaE7rE4zPBo
- MD5 SHA1 SHA512 SSDEEP
Centiloquy204/triaxiality.gen
- SHA256 4229532b012088022c28b2aded22acb76d8882061ad020135dd761a9fab13090
- MD5 60a38455325df314a0421f85af3dd490
- SHA1 5edb899c3fddb7f242573e9afc9e92eb93c837fc
- SHA512 962b89fa92a239878c75ae702e3deba81a9353ddfd9e130ae4b7c4749fb6d859a0d3629f1f901b949b7e370c0baa0024d6a92f7c2d7e656aed04219ded2568cc
- SSDEEP 768:hCdYgMOEvuXzI1TjEbC35gF5MA2QF73GmDMi5BzXXhVVbD3507pldZytBoNpUq59:hXF0F5s82cHzHDZenqEfnpm+ijc2s
- MD5 SHA1 SHA512 SSDEEP