8f9f19c65df6678146db36936b5cfe5beb56730cd846cce86d4185352cd5208b.rar
- SHA256 8f9f19c65df6678146db36936b5cfe5beb56730cd846cce86d4185352cd5208b
Behavioral task
behavioral1
Sample
transaction report.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
transaction report.exe
Resource
win11-20260130-en
windows11-21h2-x64
19 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260129-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
150 seconds
General
- Target 8f9f19c65df6678146db36936b5cfe5beb56730cd846cce86d4185352cd5208b.rar
- Size 245KB
- Sample260331-3es76sh13s
- SHA256 8f9f19c65df6678146db36936b5cfe5beb56730cd846cce86d4185352cd5208b
- MD5 759630eb96519c9aa92256e9aed156f2
- SHA1 dd494af05d4386540e84cba7ecdaa9b39829be1e
- SHA512 cc7f1cdac0c62073750c7b94fe34efaf8b7ef52803eb8683dd77b78d9a3c468391f53552a53ca505454d077ae89866c23844efce054919f9daa0194f3c1bce70
- SSDEEP 6144:nTAVP9jwa1W1/QSHDf7v2fJT4WFnVOuCN+K2mKYJosbx/:nTAXkx/f0dVaamKUtR
- TLSH T1943423B0ACDB4F43203EAC9493AA05B02D96A65452FD1A848D069971FF803BDDFF56D4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/$PLUGINSDIR/System.dll - Untrusted Codesign Signers 1 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/transaction report.exe - NSIS installer 2 IoCs
resource yara_rule static1/unpack001/transaction report.exe nsis_installer_1 static1/unpack001/transaction report.exe nsis_installer_2
File Explorer
-
8f9f19c65df6678146db36936b5cfe5beb56730cd846cce86d4185352cd5208b.rar.rar 245KB
-
transaction report.exe.exe 267KB
-
$PLUGINSDIR/System.dll.dll 11KB
-
Essayet148.bue29KB
-
Pre61KB
-
Ventepositions215KB
-
agons.pro121B
-
discrepate.out1KB
-
haandvrksbagerens.tek26KB
-
subtraktionsmaskinens.pak47KB
-
tilbagevistes.cat14KB
transaction report.exe
- IMPHASH ced282d9b261d1462772017fe2f6972b
- SHA256 bfd37bd93dd704927aa58505d0d8215b2e1dd8dc6e69cde508531f1df6cf2d17
- MD5 ca548c25b30ed6b6ed3a53ba26abb244
- SHA1 d4c9c3707e2634ed5f995667892e091e58726392
- SHA512 4779b6212464c4def91ff28d5635ba2c07af17165c4a7763f66c8c029298b9c4fb299208d3470c7423543e303b64228f6c0fd6ddf88bf6d289b2de85e06ef739
- SSDEEP 6144:VqjIcRumlc/yvGdj3FEfOZLJBpeGt6eoOH/1W1Rvw1oKd7:cVRuMcKvGd3FoWBpPt6eoOH/1W0o67
- TLSH T1844412A7F1A0C503D3765132103F56BE97EAEA0310625FCF63D046AFF925B62852F962
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
-
NSIS installer
PE Signature issue
Digest
47:97:f0:e6:30:13:e5:75:2d:ae:13:f5:16:3c:ae:d1:2a:42:d4:b3:c4:bb:64:2d:cc:8c:94:82:a5:0b:3c:22:28:11:1f:1a:de:f8:93:ee:88:6e:43:c0:cf:a7:0b:f4
Digest Algorithm
sha384
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Caml,OU=Slutlnnens Sokkeholderen\ ,O=Caml,C=FR,1.2.840.113549.1.9.1=#0c134d6964646c65746f6e405363757465732e4d75
Chains
Mar 26, 2026
CN=Caml,OU=Slutlnnens Sokkeholderen\ ,O=Caml,C=FR,1.2.840.113549.1.9.1=#0c134d6964646c65746f6e405363757465732e4d75
PE Signature issue
Digest
01:9f:a2:90:df:ac:9c:ae:ff:59:6c:56:7b:66:60:7e:c2:bb:c2:61:2c:1e:d6:1c:c5:f5:b5:49:0b:a7:70:2b
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Caml,OU=Slutlnnens Sokkeholderen\ ,O=Caml,C=FR,1.2.840.113549.1.9.1=#0c134d6964646c65746f6e405363757465732e4d75
Chains
Mar 26, 2026
CN=Caml,OU=Slutlnnens Sokkeholderen\ ,O=Caml,C=FR,1.2.840.113549.1.9.1=#0c134d6964646c65746f6e405363757465732e4d75
Subject
CN=Caml,OU=Slutlnnens Sokkeholderen\ ,O=Caml,C=FR,1.2.840.113549.1.9.1=#0c134d6964646c65746f6e405363757465732e4d75
Serial Number
30:0b:79:a1:c7:c1:c8:ae:63:c0:43:24:16:09:c0:dd:0a:06:00:6d
Issuer
CN=Caml,OU=Slutlnnens Sokkeholderen\ ,O=Caml,C=FR,1.2.840.113549.1.9.1=#0c134d6964646c65746f6e405363757465732e4d75
Revocation Status
Not revoked
Timespan
Mar 15, 2026 - Mar 15, 2027
Minor OS version
0
Major OS version
4
Entry point
13074
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
advapi32
RegCreateKeyExA
RegEnumKeyA
RegQueryValueExA
RegSetValueExA
RegCloseKey
RegDeleteValueA
RegDeleteKeyA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
SetFileSecurityA
RegOpenKeyExA
RegEnumValueA
shell32
SHGetFileInfoA
SHFileOperationA
SHGetPathFromIDListA
ShellExecuteExA
SHGetSpecialFolderLocation
SHBrowseForFolderA
ole32
IIDFromString
OleInitialize
OleUninitialize
CoCreateInstance
CoTaskMemFree
comctl32
ord17
ImageList_Create
ImageList_Destroy
ImageList_AddMasked
user32
SetClipboardData
CharPrevA
CallWindowProcA
PeekMessageA
DispatchMessageA
MessageBoxIndirectA
GetDlgItemTextA
SetDlgItemTextA
GetSystemMetrics
CreatePopupMenu
AppendMenuA
TrackPopupMenu
FillRect
EmptyClipboard
LoadCursorA
GetMessagePos
CheckDlgButton
GetSysColor
SetCursor
GetWindowLongA
SetClassLongA
SetWindowPos
IsWindowEnabled
GetWindowRect
GetSystemMenu
EnableMenuItem
RegisterClassA
ScreenToClient
EndDialog
GetClassInfoA
SystemParametersInfoA
CreateWindowExA
ExitWindowsEx
DialogBoxParamA
CharNextA
SetTimer
DestroyWindow
CreateDialogParamA
SetForegroundWindow
SetWindowTextA
PostQuitMessage
SendMessageTimeoutA
ShowWindow
wsprintfA
GetDlgItem
FindWindowExA
IsWindow
GetDC
SetWindowLongA
LoadImageA
InvalidateRect
ReleaseDC
EnableWindow
BeginPaint
SendMessageA
DefWindowProcA
DrawTextA
GetClientRect
EndPaint
IsWindowVisible
CloseClipboard
OpenClipboard
gdi32
SetBkMode
SetBkColor
GetDeviceCaps
CreateFontIndirectA
CreateBrushIndirect
DeleteObject
SetTextColor
SelectObject
kernel32
GetExitCodeProcess
WaitForSingleObject
GetProcAddress
GetSystemDirectoryA
WideCharToMultiByte
MoveFileExA
ReadFile
GetTempFileNameA
WriteFile
RemoveDirectoryA
CreateProcessA
CreateFileA
GetLastError
CreateThread
CreateDirectoryA
GlobalUnlock
GetDiskFreeSpaceA
GlobalLock
SetErrorMode
GetVersion
lstrcpynA
GetCommandLineA
GetTempPathA
lstrlenA
SetEnvironmentVariableA
ExitProcess
GetWindowsDirectoryA
GetCurrentProcess
GetModuleFileNameA
CopyFileA
GetTickCount
Sleep
GetFileSize
GetFileAttributesA
SetCurrentDirectoryA
SetFileAttributesA
GetFullPathNameA
GetShortPathNameA
MoveFileA
CompareFileTime
SetFileTime
SearchPathA
lstrcmpiA
lstrcmpA
CloseHandle
GlobalFree
GlobalAlloc
ExpandEnvironmentStringsA
LoadLibraryExA
FreeLibrary
lstrcpyA
lstrcatA
FindClose
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
SetFilePointer
GetModuleHandleA
FindNextFileA
FindFirstFileA
DeleteFileA
MulDiv
Name
.text
Size
24KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
106KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
92KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
17KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=160, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
$PLUGINSDIR/System.dll
- IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
- SHA256 6fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e
- MD5 fccff8cb7a1067e23fd2e2b63971a8e1
- SHA1 30e2a9e137c1223a78a0f7b0bf96a1c361976d91
- SHA512 f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c
- SSDEEP 192:xPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4v:g7VpNo8gmOyRsVc4
- TLSH T116326D5503504AF3E996863C00263B7FAF796A2095F14D53CFA394C0FE2E5C9AD38352
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
10529
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
MultiByteToWideChar
GlobalFree
GlobalSize
lstrcpynA
lstrcpyA
GetProcAddress
VirtualFree
FreeLibrary
lstrlenA
LoadLibraryA
GetModuleHandleA
GlobalAlloc
WideCharToMultiByte
VirtualAlloc
VirtualProtect
GetLastError
user32
wsprintfA
ole32
StringFromGUID2
CLSIDFromString
Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc
Name
.text
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
867B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
104B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1024B
Virtual Size
636B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=14, version=7299,
count=19, id=1, productName=Unmarked objects,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=4, id=48, version=9044,
count=1, id=42, version=8803,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
Essayet148.bue
- SHA256 0cf544317fb533537ac7e3e1249a70a4d30433b7cae3b2d591106e0353f64d25
- MD5 c2f61a391a30c7137c4c5b66744a4e18
- SHA1 bb4c717ad110daa40f75a28e149bd3e1d5525068
- SHA512 b0018a9bf36132523b803b93de72c2550b0be819fe335c4480c229ca3796a90a7b9ce27a024857429041dc1506fb5cafbbb37e97969139431ff6df27329f12f2
- SSDEEP 48:dB1u87CJ8zB4Abv0gCLbiSpn++VO2XWfrtZMlj/4:d7fyk9T0gCL7krtZ24
- TLSH T1A5D20D618A5CDFC7A2C56D5453CB43408866F4BF77327575156537B5010F7887531C4E
- MD5 SHA1 SHA512 SSDEEP TLSH
Pre
- SHA256 4c238920ccf51a28c246f635585d9fca09a91f210939b5561d71a7a1c085ad86
- MD5 2587228d3108140ffcf9938d58f98fdb
- SHA1 aded351dc7ed90d29bdd0b2e58a51f4715862ba1
- SHA512 6fd37b8ea88a5087cef0fc1a80661cf89c7da2f2596364877853771b8179e8fef55db8484a6ddc74597faeba6965e3173cd45fcad8f765e1fc703713afc32446
- SSDEEP 768:faacV17mYDbC0MXyfKKknDoxJanbOHNsuMNZbgvIJ8Ot8J0ZVYtEFizATkfq:fOHUXskcqbOMbg1Ju3SJq
- TLSH T1DB53B082E7258CBACC06D13CD96A21A949B870165F0FE4FEF1699504C3975F31B243AE
- MD5 SHA1 SHA512 SSDEEP TLSH
Ventepositions
- SHA256 e40f302de4ecaafce67aa4b725ee09d288095a199cc0dcd22b2bc4518cfc4ab2
- MD5 f7d47d008d479f327de942c89cb20f7c
- SHA1 b6abdc0eb741b14ed264c4b3e3e1461e40811d02
- SHA512 0c77420e6064f220a3018133b254667369f7807cb71d0b10292b44fd0c981b79f124744f4c8d15bf4ee1ad6418ada9638ca686f1e467b8cc81717c7b90674410
- SSDEEP 6144:Nq2K7gmgXTr9udpYWmybofHzCJDQl1ZJiH0U022qOFG8wn:4CdXTxapJmF31SQpFGnn
- TLSH T15324D012A4850184DD563A3AD03F1A5EA3B9FC56A3834B6F2846DA9F7BDFF20510BCC5
- MD5 SHA1 SHA512 SSDEEP TLSH
agons.pro
- SHA256 aa0d01d8c1f447e6b68c52a559940335ed0e36ab95326aa7b3bab6e451568e3e
- MD5 8dbaf272dc1205556e0389c4848f4287
- SHA1 e22f0e1a9def9e5761f0222b8f216e783da86ff3
- SHA512 6eb9ca8c5017ecd8e0c1f69ed6176396a3bf3bd4fab5f5cb7854ed90eaf26b063f4d6967cf9c075dba6583b5d0c1af97550463451a49841f2293ff0cc88fabdc
- MD5 SHA1 SHA512
discrepate.out
- SHA256 5d036a00588c5b7bef7479653e823ff4912b9621d19d611fa086ab09617f897e
- MD5 19dd9d60a5c5563faaca34d8cb6d2114
- SHA1 528516cbe1438921c7e63b52f7a70dcc6e86b962
- SHA512 0bc72ae1e418ee752075a320a8ac4544e56f99e41a7211a86b3cb772a6d486b29d6d178d88a130d4faa343dba6b516037e226e5dd38112d1d7ea21cc077a369f
- TLSH T1C53112046A02E0B4043451C498885C46658650C308148063DF4C98E4001DC614457171
- MD5 SHA1 SHA512 TLSH
haandvrksbagerens.tek
- SHA256 0b99322c14ebbf72ade7b7fd12b76a2984c871202986d3d14a849427f46fcace
- MD5 70018e219e0496582908fac172d313ef
- SHA1 a04ac8a7d04faa383149f266af8959c178727756
- SHA512 6d097aded5c8c8541c779ceba6098def88ffc1d9161a4083472d8c9662aa3f20a2b942b0cccdab614b94fe0a54056534a20fa80ef3044a0682f57b3d8833ad0a
- SSDEEP 48:nKtWr2yVEfvXEND1R/kLd3ARICGoO87uYd0248:nIW2vUNj/Ud3ARICPfK80q
- TLSH T176C22A78D1B6018DFFB260D1113CEEF135879BCA92CE726D44828791FB00460ED26A2D
- MD5 SHA1 SHA512 SSDEEP TLSH
subtraktionsmaskinens.pak
- SHA256 919116dd5d6d51974f443b9ac8a57886d5f1e8b01499d941f31fa3b3c022932b
- MD5 42f77eb1c962ba740f59afe0e01355da
- SHA1 6ad6d0f61371a09f10de7cdcdbe90cd846ff5f40
- SHA512 a25ccfce76f9819c2449606d3da3676486440f6300a26e10697fb160c163f6d422719823c8c98ce0ff79dee05c84666fc60fac9b9026b36d5c4516243dd24fe8
- SSDEEP 96:hMdzB62BKTwuumfbCHshbnaXToRog6Wz4njNGLzpWgLVG93l:hQzB6CK0Mf2Hs1ajo2WWjCx63l
- TLSH T1DE232B61D682B8E374C16808412792F5B2509D665CAFFBD553C788842B81D1C6D6F2BA
- MD5 SHA1 SHA512 SSDEEP TLSH
tilbagevistes.cat
- SHA256 5956133656faf7c9e1c19910416f1cfaa7ff0f5d0d6c4dd3f51d90c43ec11629
- MD5 51d949901193e2fa5443fcdfd9292714
- SHA1 cc1981e68eea89723ce20907a8f46180a9d86268
- SHA512 d104307db845d63c2ab3613dfb67051907946a2b48c2d5b60e4bde542f714c4a0d55bd8e30d03f735ad717d83ab56a7aaed5701bc8ff99be54b3f23b620412ed
- SSDEEP 24:m5xHjhfcQEXh0l3/q7y+LU+Ejq4gv8g5YvwAX91Ng2nhQ:m7HFfPExa3/Opgve982YvwyPmshQ
- TLSH T1A462DA32FB1013FADDF1485B814D342DD9889D59944021A75C39F5E276B03AF913F754
- MD5 SHA1 SHA512 SSDEEP TLSH