09022026_1221_Outstanding Invoices.bat.zip
- SHA256 eec019a58f08db6ab041a94298636ed5e4614d3042363705a8565afaa977cef7
Password
infected
Behavioral task
behavioral1
Sample
Outstanding Invoices.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
17 signatures
300 seconds
Behavioral task
behavioral2
Sample
Outstanding Invoices.exe
Resource
win11-20260130-en
windows11-21h2-x64
17 signatures
300 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
3 signatures
300 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
300 seconds
Behavioral task
behavioral5
Sample
Skihop.scr
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral6
Sample
Skihop.scr
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
General
- Target 09022026_1221_Outstanding Invoices.bat.zip
- Size 447KB
- Sample260209-pjs63set7h
- SHA256 eec019a58f08db6ab041a94298636ed5e4614d3042363705a8565afaa977cef7
- MD5 f9e4c2d4e40f3563a98767c7bb45cb78
- SHA1 e5dd9dbb0aef4e00fa0c2f152d6352652d1407a8
- SHA512 810c45311d3ccf04e286c96418a2fed19a6f237d859c7d36598e05cf8577c011b90adc12c54ad0cb903fb1f32dbd89e2a206b2943e1f4454a85c9ab15fbfcc45
- SSDEEP 12288:VAXbe7PU/s1Na1eKmmiegeF5tete8Z2k+ecAuNVGNsq4D:VAXbe7PUuNa1xKs5tekNzVGNp4D
- TLSH T196A423B7C311945EB0921E3B4F525A664ADD2240AC79C63E8BD1DEA07DD037840BF766
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/Outstanding Invoices.bat unpack002/$PLUGINSDIR/System.dll - NSIS installer 2 IoCs
resource yara_rule static1/unpack001/Outstanding Invoices.bat nsis_installer_1 static1/unpack001/Outstanding Invoices.bat nsis_installer_2
File Explorer
-
09022026_1221_Outstanding Invoices.bat.zip.zip 447KB
-
Outstanding Invoices.bat.exe 468KB
-
$PLUGINSDIR/System.dll.dll 12KB
-
Huckleback.Jor107KB
-
Skihop.scr13KB
-
dematerialiserendes.bad89KB
-
teaboards.skr61KB
-
tracer.lim60KB
-
turbary.Mle246KB
Outstanding Invoices.bat
- IMPHASH 671f2a1f8aee14d336bab98fea93d734
- SHA256 d2ec22b6ddbe0229ed41c7dbd8238504c541d4f8aa6005fb88062d470dffc145
- MD5 5d76159418ae5aa23d5d9642afbb2c04
- SHA1 9e9136d88c2ccb77096bd6bc5552cfdc314bad79
- SHA512 a5960b0d4967c112c552d5cc55d5c3a8ce058d029a0b6670cee4092580cea10f8a00ac5f1784a670a39662d2ee83ed6f81ebd8e410a2e0ba9abc4358168e64d2
- SSDEEP 12288:DnVbe7PYad+y0qXl4a/L9iegsFhte3eEZ2Y+ecA4NVGNsD4/:DnVbe7PYajS6LaShteOljVGN+4/
- TLSH T109A4129367B0D46FD95253B3CA36D9FA1BE54E00C879831B4B42BFB839701A1491F2A7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
-
NSIS installer
Password
infected
Minor OS version
0
Major OS version
4
Entry point
13186
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
advapi32
RegEnumValueA
RegEnumKeyA
RegQueryValueExA
RegSetValueExA
RegCloseKey
RegDeleteValueA
RegDeleteKeyA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegOpenKeyExA
RegCreateKeyExA
shell32
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
SHFileOperationA
ShellExecuteExA
ole32
OleUninitialize
OleInitialize
IIDFromString
CoCreateInstance
CoTaskMemFree
comctl32
ImageList_Destroy
ord17
ImageList_AddMasked
ImageList_Create
user32
SetDlgItemTextA
GetSystemMetrics
CreatePopupMenu
AppendMenuA
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
IsWindowVisible
CallWindowProcA
GetMessagePos
CheckDlgButton
LoadCursorA
SetCursor
GetSysColor
SetWindowPos
GetWindowLongA
IsWindowEnabled
SetClassLongA
GetSystemMenu
EnableMenuItem
GetWindowRect
ScreenToClient
EndDialog
RegisterClassA
SystemParametersInfoA
CreateWindowExA
GetDlgItemTextA
DialogBoxParamA
CharNextA
ExitWindowsEx
DestroyWindow
CreateDialogParamA
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
ReleaseDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
MessageBoxIndirectA
CharPrevA
PeekMessageA
GetClassInfoA
DispatchMessageA
TrackPopupMenu
gdi32
GetDeviceCaps
SetBkColor
SelectObject
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
kernel32
CreateFileA
GetTempFileNameA
ReadFile
RemoveDirectoryA
CreateProcessA
CreateDirectoryA
GetLastError
CreateThread
GlobalLock
GlobalUnlock
GetDiskFreeSpaceA
lstrcpynA
SetErrorMode
GetVersionExA
lstrlenA
GetCommandLineA
GetTempPathA
GetWindowsDirectoryA
WriteFile
ExitProcess
CopyFileA
GetCurrentProcess
GetModuleFileNameA
GetFileSize
GetTickCount
Sleep
SetFileAttributesA
GetFileAttributesA
SetCurrentDirectoryA
MoveFileA
GetFullPathNameA
GetShortPathNameA
SearchPathA
CompareFileTime
SetFileTime
CloseHandle
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
GetModuleHandleA
LoadLibraryExA
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
MulDiv
lstrcpyA
MoveFileExA
lstrcatA
WideCharToMultiByte
GetSystemDirectoryA
GetProcAddress
GetExitCodeProcess
WaitForSingleObject
SetEnvironmentVariableA
Name
.text
Size
25KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
105KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
96KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
178KB
Virtual Size
177KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=158, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
$PLUGINSDIR/System.dll
- IMPHASH 240ca92ecc1c291801c451c447e16c12
- SHA256 7fb0f8d452fefaac789986b933df050f3d3e4feb8a8d9944ada995f572dcdca1
- MD5 dd87a973e01c5d9f8e0fcc81a0af7c7a
- SHA1 c9206ced48d1e5bc648b1d0f54cccc18bf643a14
- SHA512 4910b39b1a99622ac8b3c42f173bbe7035ac2f8d40c946468e7db7e2868a2da81ea94da453857f06f39957dd690c7f1ba498936a7aaa0039975e472376f92e8f
- SSDEEP 192:VFiQJ77pJp17C8F1A5xjGNxrgFOgb7lrT/993:97pJp48F2exrg5F/9
- TLSH T1C5425C1583618EF3F5961E3C00667E2F2B79BE3416F100A39FE34481A99A1CF99B5392
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
4
Entry point
10673
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GlobalAlloc
GlobalFree
GlobalSize
lstrcpynA
lstrcpyA
GetProcAddress
VirtualFree
FreeLibrary
lstrlenA
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
WideCharToMultiByte
VirtualAlloc
VirtualProtect
GetLastError
user32
wsprintfA
ole32
StringFromGUID2
CLSIDFromString
Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc
Name
.text
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
867B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
104B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1024B
Virtual Size
654B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=14, version=7299,
count=19, id=1, productName=Unmarked objects,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=4, id=48, version=9044,
count=1, id=42, version=8803,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
Huckleback.Jor
- SHA256 1fcae541c2bb315f3b7605b7303f762a69baf4d1d6b9295267fb9daac8144771
- MD5 fbccd11c99e4e41be3fc0ef4baaef245
- SHA1 8f374e201329fb92659b701ef8f2b8c514d0fb4d
- SHA512 cf6dce988de2b962c690bbc917460f9941c784170b972a190723c712e3d058e046c171e316aa9a0b12fef76067f251b72e2d8a34563cec6dec0c90d23886359d
- SSDEEP 1536:ZekG/1aRhbvjVEJNcfJ7XgTRUXrsT6Zli/b7tYt9xAILl3FFRVz+PzB:sk5VEYfG+Gg/tLl3lI9
- TLSH T17CB3C156DF769CFBCC0BC53CC16E62955D647007870FE4AD7276A818C24B2E32B246AE
- MD5 SHA1 SHA512 SSDEEP TLSH
Skihop.scr
- SHA256 d6d85a2c6db3d717997bb14fa1354aab2b89fbc21032c821d823cdfb396a2571
- MD5 7d5a59237576df796b319511e5ad1c87
- SHA1 ba170ef37e9993bb51cb97cec45e5fa6efba0d0f
- SHA512 d5af0150cb47e66ac4fd28a02c7109b235f837f8c562761ef2f9380582261105b7dae0b0b10eb85813543fd9ce0108acf4a342638f6e0de37f332a3c0fd762a0
- SSDEEP 12:v7DZvDCuqH4EGMJ7DT++5mjA+D1GCdJDnpF6l:jZ+iMR/+s8kgrpFK
- TLSH T1DB5223D4D4CBC13E01C31D040B960095B3117759B1E014F86A0810B249282AC31DC186
- MD5 SHA1 SHA512 SSDEEP TLSH
dematerialiserendes.bad
- SHA256 98c37f637e7780e548bb0b56f0151d19a9434b2eb57ad843d913718a4c27f35a
- MD5 51c888f908e792106807f36999b7dfc1
- SHA1 57f55c04c9363805c7d8348112c4bf504998d424
- SHA512 1e4953f451a3c2d7cbbf9318b521740bae6e036c9e36705b6fc8ea9135222a8a2b41886eb349e25fff61d73d10c9654b5a1482a84f32058791f5169251191453
- SSDEEP 96:ResNHZY3dGnVMHcKplUK+JyESB2kA3wEn/2GtQ:RPNH+wnqceUX0ES8kA3T/2GtQ
- TLSH T1EA936CA20C9E5045D8A70CFF6A619ED2B5A887541721354E03762EC17F0A7E5D0BB8A0
- MD5 SHA1 SHA512 SSDEEP TLSH
teaboards.skr
- SHA256 a70db6a23ebdface7eb467339e38edb8f941a7f81339c49f7fdeca84134f9bd0
- MD5 f6c1f133ae51606861d425b6f6332801
- SHA1 181f6dc76b417464880d0d4bd2f6f70fad790889
- SHA512 1c3c11dc076bb2083ffeb2b5425b4dabcd7b66fbcedc079c19babf9aadacf64596ac9a4764977638dae5c82dddcca3606382c33b2cb0f76e5f9df676ec2b5cfb
- SSDEEP 48:suqvPbIA28a8sKfFLPEOZcebiKHmNpajcGioSQwqgK/AEOORRCFbjJvbxKS:sVb3RDseFTDcAKAqqFD3RRExL
- TLSH T1B85328B1BD3AC61BF52578490A0B4D7AE83BED18C5812483CF257B12C1E8C014BA7D01
- MD5 SHA1 SHA512 SSDEEP TLSH
tracer.lim
- SHA256 6703e4fbcfe3b6ed82e3e57d888458620d3aa6f970252b63be7ccfa726305350
- MD5 306e4efbe3cb428b153d9074743d2cbe
- SHA1 375304e2e291441baac72aeba7197b61e0f4676f
- SHA512 a445965324ae89d4489fded317fa30e361e4e7b6999cee9f5dffe0fb8022f155cca630f4ceef667845ce65d98636b46549488f17f1108e7ff6fa9fb9ee345673
- SSDEEP 48:oJEBW0ACr9OaKNDchdO3Gh/tVwYPe94o0CCwf0kH4vNLWn:tBWAMNwhlpe9B0CCK8Wn
- TLSH T15F533A9463EB2E34694419713ADA4AD6D0FD62E9631432514303FE4B34CDCDE2A83C4C
- MD5 SHA1 SHA512 SSDEEP TLSH
turbary.Mle
- SHA256 330d594826a51c3e05cfbbb6522acf4bf97c6c8b0bbd4c6957ed4a4160fa73bc
- MD5 09251a97766a6ba8dc241049ea2302c2
- SHA1 4cb24bc3e7530c58f52c2e120c022fc8e0a9480e
- SHA512 fca8edb61778085996554d98f7a4bffda9ce1751d5b37154ac9dbcbd30343a733830a18f3bf8bba7a527560158d25758263b7078edd933e833db62da4f23c0ae
- SSDEEP 6144:6fK2S/SN1Uv6pQ9QGvIKpCWAaqrM12whDa+tir8WGX:6S29pQSRRaqrMP1Qa
- TLSH T16C34F0E315FB948CE7E650B1E7A4734DCB20FF42C1A2A13B8589BC5B58216CB58DD81B
- MD5 SHA1 SHA512 SSDEEP TLSH