nELITE_TRADING_LLC_PRICE_INQUIRY-17002025.xz
- SHA256 41ea7154db5991f96b1ebcbec4e94b004db3b19f44d2b2ddf207ba81610409b5
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
ELITE TRADING LLC_PRICE INQUIRY-05002025-024142914208136738390-00143983188212000.exe/odg-Diskontoer.exe
Resource
win7-20240903-en
windows7-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
ELITE TRADING LLC_PRICE INQUIRY-05002025-024142914208136738390-00143983188212000.exe/odg-Diskontoer.exe
Resource
win10v2004-20250207-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20250211-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target nELITE_TRADING_LLC_PRICE_INQUIRY-17002025.xz
- Size 710KB
- Sample250217-e5fg1azrdx
- SHA256 41ea7154db5991f96b1ebcbec4e94b004db3b19f44d2b2ddf207ba81610409b5
- MD5 d7f639e35e5aae78854578fa009ff2da
- SHA1 abbaae985dbd6b05601ca4b274261032437b569e
- SHA512 e463829b606c2a456d507b0d47b94e8bc744aa27b4314f549e1e93b4400c9352aceca6989cb31021e3ae6df314ad6b18b5b48121bbc706244790799eeac4ab67
- SSDEEP 12288:eNXPL2rqozldWNFKzRGvCQ+/4Sbba3Jp7eKlK6CNKTmMgSJTqZJQPmRcN+EqvfJN:eNXPLdlNItUtmhbe37BlKBIvJ5+muRcQ
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/ELITE TRADING LLC_PRICE INQUIRY-05002025-024142914208136738390-00143983188212000.exe/odg-Diskontoer.exe unpack002/$PLUGINSDIR/System.dll - NSIS installer 2 IoCs
resource yara_rule static1/unpack001/ELITE TRADING LLC_PRICE INQUIRY-05002025-024142914208136738390-00143983188212000.exe/odg-Diskontoer.exe nsis_installer_1 static1/unpack001/ELITE TRADING LLC_PRICE INQUIRY-05002025-024142914208136738390-00143983188212000.exe/odg-Diskontoer.exe nsis_installer_2
File Explorer
-
nELITE_TRADING_LLC_PRICE_INQUIRY-17002025.xz.rar 710KB
-
ELITE TRADING LLC_PRICE INQUIRY-05002025-024142914208136738390-00143983188212000.exe/odg-Diskontoer.exe.exe 930KB
-
$PLUGINSDIR/System.dll.dll 12KB
-
Hyblen.Del203383KB
-
Programmeringsprojekterne/zabism.txt480B
-
Tandhvals/Slankes/topiarius.tan345KB
-
Tandhvals/Slankes/trompetstdene.ini444B
-
Tandhvals/skinnebenssaarets.txt1KB
-
Tandhvals/synchronies.mon268KB
-
Upstare.txt647B
-
chit.tha13KB
-
junkboard.jpg.jpg 16KB
ELITE TRADING LLC_PRICE INQUIRY-05002025-024142914208136738390-00143983188212000.exe/odg-Diskontoer.exe
- IMPHASH 671f2a1f8aee14d336bab98fea93d734
- SHA256 e81747a9ede60d251a5cca15da28963fb84975bcbd4f6ff2bb96558639dfc9e6
- MD5 c730d2226304c997f5cc1124a9cfe6fc
- SHA1 79e71e9efb193582619f93287202404d73348088
- SHA512 b19281c8bbe04847bd4000da0569f9c9aa05be60e8b29c12ab116f8fa352d120675db8c165b00315366e13e6a0b5d055c36620f2f51eea300dac80deadd71e68
- SSDEEP 24576:FerYnK4TwIld1V20+FDbzUMX5gBb4J4MOqsk3UiFZ:FerYnKRIlHV20+FDbzhX5gOJ8TJiz
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
-
NSIS installer
Minor OS version
0
Major OS version
4
Entry point
13240
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
advapi32
RegEnumValueA
RegEnumKeyA
RegQueryValueExA
RegSetValueExA
RegCloseKey
RegDeleteValueA
RegDeleteKeyA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegOpenKeyExA
RegCreateKeyExA
shell32
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
SHFileOperationA
ShellExecuteExA
ole32
OleUninitialize
OleInitialize
IIDFromString
CoCreateInstance
CoTaskMemFree
comctl32
ImageList_Destroy
ord17
ImageList_AddMasked
ImageList_Create
user32
SetDlgItemTextA
GetSystemMetrics
CreatePopupMenu
AppendMenuA
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
IsWindowVisible
CallWindowProcA
GetMessagePos
CheckDlgButton
LoadCursorA
SetCursor
GetSysColor
SetWindowPos
GetWindowLongA
IsWindowEnabled
SetClassLongA
GetSystemMenu
EnableMenuItem
GetWindowRect
ScreenToClient
EndDialog
RegisterClassA
SystemParametersInfoA
CreateWindowExA
GetDlgItemTextA
DialogBoxParamA
CharNextA
ExitWindowsEx
DestroyWindow
CreateDialogParamA
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
ReleaseDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
MessageBoxIndirectA
CharPrevA
PeekMessageA
GetClassInfoA
DispatchMessageA
TrackPopupMenu
gdi32
GetDeviceCaps
SetBkColor
SelectObject
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
kernel32
CreateFileA
GetTempFileNameA
ReadFile
RemoveDirectoryA
CreateProcessA
CreateDirectoryA
GetLastError
CreateThread
GlobalLock
GlobalUnlock
GetDiskFreeSpaceA
lstrcpynA
SetErrorMode
GetVersionExA
lstrlenA
GetCommandLineA
GetTempPathA
GetWindowsDirectoryA
WriteFile
ExitProcess
CopyFileA
GetCurrentProcess
GetModuleFileNameA
GetFileSize
GetTickCount
Sleep
SetFileAttributesA
GetFileAttributesA
SetCurrentDirectoryA
MoveFileA
GetFullPathNameA
GetShortPathNameA
SearchPathA
CompareFileTime
SetFileTime
CloseHandle
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
GetModuleHandleA
LoadLibraryExA
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
MulDiv
lstrcpyA
MoveFileExA
lstrcatA
WideCharToMultiByte
GetSystemDirectoryA
GetProcAddress
GetExitCodeProcess
WaitForSingleObject
SetEnvironmentVariableA
Name
.text
Size
25KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
148KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
84KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
403KB
Virtual Size
402KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=158, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
$PLUGINSDIR/System.dll
- IMPHASH 240ca92ecc1c291801c451c447e16c12
- SHA256 7fb0f8d452fefaac789986b933df050f3d3e4feb8a8d9944ada995f572dcdca1
- MD5 dd87a973e01c5d9f8e0fcc81a0af7c7a
- SHA1 c9206ced48d1e5bc648b1d0f54cccc18bf643a14
- SHA512 4910b39b1a99622ac8b3c42f173bbe7035ac2f8d40c946468e7db7e2868a2da81ea94da453857f06f39957dd690c7f1ba498936a7aaa0039975e472376f92e8f
- SSDEEP 192:VFiQJ77pJp17C8F1A5xjGNxrgFOgb7lrT/993:97pJp48F2exrg5F/9
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
10673
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GlobalAlloc
GlobalFree
GlobalSize
lstrcpynA
lstrcpyA
GetProcAddress
VirtualFree
FreeLibrary
lstrlenA
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
WideCharToMultiByte
VirtualAlloc
VirtualProtect
GetLastError
user32
wsprintfA
ole32
StringFromGUID2
CLSIDFromString
Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc
Name
.text
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
867B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
104B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1024B
Virtual Size
654B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=14, version=7299,
count=19, id=1, productName=Unmarked objects,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=4, id=48, version=9044,
count=1, id=42, version=8803,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
Hyblen.Del203
- SHA256 65dec245fddf1e3793bfdbf5eeeb2032a4a8e0a84815a3efc6c59b6caf242c33
- MD5 89f59e6f43276b777bf3130dffc80a51
- SHA1 a175af0a539285e0f61fd294291efe0d686f94ab
- SHA512 64f6fe726438cf62d7092de2c543a12759a4ea6fab05a3e80713b09b51726358290064abb94b896c4a1a4c92eea4f5ed87a028d51a4431f3e284f442c05b8a45
- SSDEEP 6144:Ax/umFqHba0jaqSn/a2HS/DOXo8VjREtEL0Un+6ibzON5LFl1wTo38NUvHDoAVvn:AF8bNSn/a2HS/yY+EaL0UnDGON5z1V37
- MD5 SHA1 SHA512 SSDEEP
Programmeringsprojekterne/zabism.txt
- SHA256 5e4dec50af3d968d4986ef8741329c2d3b035326d068fbf7d5c6576bb638ca03
- MD5 54f3e6531cbdd7caf2bb512ea2a10f08
- SHA1 baea1c810851889324061c90941c75fb23fa1f22
- SHA512 d58c8b8f47fab19d1207ad937603cd2e51566db76674e42cb50d7a7d4ca8bdd0485b6ea69015f8bd634bc8889cf35ff428e2c034a6fcc99a9aa17f851f70ca78
- MD5 SHA1 SHA512
Tandhvals/Slankes/topiarius.tan
- SHA256 c5d33d1526bba68ad6aa9cfe5019bd29c0a68240028f08daa6366ba940dd9fbb
- MD5 2a5aae2cb5c736fc5c579f54d9c1df50
- SHA1 52bf9e83c37d35b52d570a1e7346767a71fad80d
- SHA512 28ecb079c0de0610d1a6f351153183cabf4d1d833385271f277286f95616b69a4434ba50fca3c5137c2e6212db3b7d1410b7303f5a5836fd0b2b2ab959682754
- SSDEEP 1536:h5IHS+ZhcpMBDAj+v2miH1twGcbME5OyU9O13qgV3E/C5qyvVncXdbg+io+PGHno:hAWe5/JmaedVN12xB
- MD5 SHA1 SHA512 SSDEEP
Tandhvals/Slankes/trompetstdene.ini
- SHA256 0fcb039bd68214980a27e266c93895b0561ea725f4aaab63ca4d2b2cfbaff5bc
- MD5 c89a8162261b2c3cb90af6b7a416c065
- SHA1 73f6c8f299f9d9357237b8baa9145e31ff8fba07
- SHA512 1e0d904a1c8f08ab1b17c0931f8a01ba716ae184960e75f10f02e4df14c1de8fd4cb0a95bb07d5a003e08c66ce716f15effeeec0abf36349175dffee88d20d9b
- MD5 SHA1 SHA512
Tandhvals/skinnebenssaarets.txt
- SHA256 fe609850052d42df1e911c8c5cf482ca990700740822f90680043ec6e0d3da2c
- MD5 7c2a10de88fd998311ac7392da6224a7
- SHA1 a06a40ddbbd30cfe6309c588efddb91316c0e250
- SHA512 7def729724327d484a679b658635fce79f4797add0faf0dd8963a940bd0345d264997bd5914266329eeae8e697d074ffadd976aa9bf1c72b508b842d509b462c
- MD5 SHA1 SHA512
Tandhvals/synchronies.mon
- SHA256 bb4c90cda048be7f7a3e61eba6baa992f7e47e2c99421d1d3deda24953a002c3
- MD5 c0cd779d5464c56bbba3eb4cfe8d9b6f
- SHA1 708aead18efa2bd305fc6c2821693ba845ea7752
- SHA512 0481a35115d09892951bd2db43100deec9b3e0a813c16a2ec568daf5890ab8b94e511875a68c8e747a8eb3d443693937ebc698c73e3f885ca4a6840d9026f924
- SSDEEP 1536:h+GKq/WoAxhILj4NvnaAiJhCzKcxEpWAOSlSM6BvGJ+5bHnYMZrd/EiUk8XWdfXR:Rx04yAyRrn7
- MD5 SHA1 SHA512 SSDEEP
Upstare.txt
- SHA256 3724b5c5763654f4320760c73ce5c76646bdcf80a8d3906f7b03e34d22befff5
- MD5 d87a4a4bb542ea5c29d558042b6ed1ac
- SHA1 8abd21bb230e71feca97eeff2a8efc094e5ef96c
- SHA512 760be4352be6efd52473f98b1898f92540885ec063b9a8cbc7d0173f5c0256fd89f9f0384598aa9c6d15547efec05db9b453ce475a08db3da0442a35d091c233
- MD5 SHA1 SHA512
chit.tha
- SHA256 47929f3cf52875a2107d0cc63d19fc7e46046408f783d4f543f53761560ddc22
- MD5 78318bab9fc6d6734d907bc8600c5bb3
- SHA1 941c1ed07c213bea623d17a8b86c0c3b3e578e45
- SHA512 62601d7b570a9a8ab860ad81fd71a9d14cdf8e6af074f60328bc9562138e2bc100cb242eafe8bd94bc9e724a6d12ce90aaa57b271a50d8edc6dee383cdc1dee4
- SSDEEP 96:0axmXalPfmYLiJQ6ya+aRe/BhhGkDvoX3TDzCeBXq:0KmX6H9iJQ6z+aRehhG3zD96
- MD5 SHA1 SHA512 SSDEEP
junkboard.jpg
- SHA256 b61b91e664619948209b742a75b0e46c8540c3f4703d0ca62473251b508677dc
- MD5 5ae86b071978e8dfb17ccd2898ba65b6
- SHA1 7c8afc5723cd346b85a1a5f38a7279f782154efc
- SHA512 6ec4d87d5823c6aeefe64074b12021c0082cbc3551e6d96aadea70fa48086c2c1d4f874fde6ebba8d327102e4a92b62c282fdef3d7ff3650600b732465079754
- SSDEEP 384:N3fpyQXhVXeD0nivlZsUT4LS2UyJ7h6mWB/2eB5yMB6OOzKLqHgE+5c:N3fEQXhLaaUcLLb6zAzABEd
- MD5 SHA1 SHA512 SSDEEP