FRA00008108000002374.rar
- SHA256 f4e8fc5b3633b9bbe2246dbdf429e954cef6faa5cccaa0b5494d8f3a0a5849ad
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
FRA00008108000002374.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
FRA00008108000002374.exe
Resource
win11-20260513-en
windows11-21h2-x64
9 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
General
- Target FRA00008108000002374.rar
- Size 795KB
- Sample260521-sdtgfagv5p
- SHA256 f4e8fc5b3633b9bbe2246dbdf429e954cef6faa5cccaa0b5494d8f3a0a5849ad
- MD5 d807f790b8f24d99759b44e64d5ac2a3
- SHA1 c4ee9fba76827d0df6c5383b9b6887d93adb240f
- SHA512 6e447a73052781e0cda3bfbe027273ab577f10de1b907326072e3d2b4f6bb8a74dc369a184793c6b33be6855a2fd7863fa841a67a06424ac02143f0d5cbf5835
- SSDEEP 24576:QBTfjAuooYKHD5r1COPTtWJf1KZYoJyWczxX:OTNoFUEtKCoYd9X
- TLSH T1B20533E26061D43973DB0BE6FD4E705E48F02E122E3E4247295FED21930D6F749AA85B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/$PLUGINSDIR/System.dll - Untrusted Codesign Signers 1 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/FRA00008108000002374.exe
File Explorer
-
FRA00008108000002374.rar.rar 795KB
-
FRA00008108000002374.exe.exe 823KB
-
$PLUGINSDIR/System.dll.dll 11KB
-
Gingerbreads/Packetize/tyktflydenhed.ove361KB
-
Gingerbreads/Prostituerings.pul297KB
-
Gingerbreads/Taxless.soc286KB
-
Gingerbreads/Tripenny.cop441KB
-
Gingerbreads/populariseringers.dis290KB
-
Gingerbreads/siouxs.kas315KB
-
Gingerbreads/straffelovsovertrdelsernes.txt568B
-
Sunsetting.Per267KB
FRA00008108000002374.exe
- IMPHASH 7ed0d71376e55d58ab36dc7d3ffda898
- SHA256 24de759c141ec60a2d89352e581ccc47b83d0240702283903e8cbdd1d9745265
- MD5 e094f4ca0bcf4795c43c37b71cd65001
- SHA1 dbe62e4ab2ba669fc5670b2aacbefca1784798f4
- SHA512 40d8df1697890ad77cbe6bb4e47cd111890b4ed4f99abbd984dc0341b006ec947c0af37e951852a2fa32c8562e1085060a1e14d677461ef2a773ba88f92696fb
- SSDEEP 24576:vbDc7+6xit+u3UjQqNATwJe9YESd4+/dD+la:vbDcUxOSBdSd4XM
- TLSH T1F7052317DE90F171C82605B2756F82BD1BA9EC125FC0040313607FE9EA3FA47A9B9B59
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
42:f6:a2:52:fa:34:30:ff:9e:a1:be:53:3e:d8:31:f0:b8:b5:89:5b:23:7f:09:68:54:78:8a:8e:d6:da:f1:30
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Kortestes,O=Kortestes,L=Outreau,C=FR
Chains
May 20, 2026
CN=Kortestes,O=Kortestes,L=Outreau,C=FR
Subject
CN=Kortestes,O=Kortestes,L=Outreau,C=FR
Serial Number
75:b9:d9:c7:74:b6:51:7a:1b:9c:46:4e:42:4b:f5:69:ed:ed:31:ee
Issuer
CN=Kortestes,O=Kortestes,L=Outreau,C=FR
Revocation Status
Not revoked
Timespan
Sep 12, 2024 - Sep 12, 2027
Minor OS version
0
Major OS version
4
Entry point
12841
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
CompareFileTime
SearchPathW
SetFileTime
CloseHandle
GetShortPathNameW
MoveFileW
SetCurrentDirectoryW
GetFileAttributesW
GetLastError
GetFullPathNameW
CreateDirectoryW
Sleep
GetTickCount
GetFileSize
GetModuleFileNameW
GetCurrentProcess
CopyFileW
ExitProcess
SetEnvironmentVariableW
GetWindowsDirectoryW
GetTempPathW
SetFileAttributesW
ExpandEnvironmentStringsW
LoadLibraryW
lstrlenW
lstrcpynW
GetDiskFreeSpaceW
GlobalUnlock
GlobalLock
CreateThread
CreateProcessW
RemoveDirectoryW
lstrcmpiA
CreateFileW
GetTempFileNameW
lstrcpyA
lstrcpyW
lstrcatW
GetSystemDirectoryW
GetVersion
GetProcAddress
LoadLibraryA
GetModuleHandleA
GetModuleHandleW
lstrcmpiW
lstrcmpW
WaitForSingleObject
GlobalFree
GlobalAlloc
LoadLibraryExW
GetExitCodeProcess
FreeLibrary
WritePrivateProfileStringW
SetErrorMode
GetCommandLineW
GetPrivateProfileStringW
FindFirstFileW
FindNextFileW
DeleteFileW
SetFilePointer
ReadFile
FindClose
MulDiv
MultiByteToWideChar
WriteFile
lstrlenA
WideCharToMultiByte
user32
EndDialog
ScreenToClient
GetWindowRect
RegisterClassW
EnableMenuItem
GetSystemMenu
SetClassLongW
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongW
SetCursor
LoadCursorW
CheckDlgButton
GetMessagePos
LoadBitmapW
CallWindowProcW
IsWindowVisible
CloseClipboard
SetClipboardData
wsprintfW
CreateWindowExW
SystemParametersInfoW
AppendMenuW
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextW
GetDlgItemTextW
MessageBoxIndirectW
CharPrevW
CharNextA
wsprintfA
DispatchMessageW
PeekMessageW
ReleaseDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
GetClientRect
FillRect
DrawTextW
GetClassInfoW
DialogBoxParamW
CharNextW
ExitWindowsEx
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
GetDC
SetWindowLongW
LoadImageW
SendMessageTimeoutW
FindWindowExW
EmptyClipboard
OpenClipboard
TrackPopupMenu
EndPaint
ShowWindow
GetDlgItem
IsWindow
SetForegroundWindow
gdi32
SelectObject
SetBkMode
CreateFontIndirectW
SetTextColor
DeleteObject
GetDeviceCaps
CreateBrushIndirect
SetBkColor
shell32
SHGetSpecialFolderLocation
SHGetPathFromIDListW
SHBrowseForFolderW
SHGetFileInfoW
ShellExecuteW
SHFileOperationW
advapi32
RegCloseKey
RegOpenKeyExW
RegDeleteKeyW
RegDeleteValueW
RegEnumValueW
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW
RegEnumKeyW
comctl32
ImageList_Create
ImageList_AddMasked
ImageList_Destroy
ord17
ole32
CoCreateInstance
CoTaskMemFree
OleInitialize
OleUninitialize
version
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
Name
.text
Size
24KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
171KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
176KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
134KB
Virtual Size
133KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=166, id=1, productName=Unmarked objects,
count=17, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
$PLUGINSDIR/System.dll
- IMPHASH fc0224e99e736751432961db63a41b76
- SHA256 5a1c20a3e2e2eb182976977669f2c5d9f3104477e98f74d69d2434e79b92fdc3
- MD5 7399323923e3946fe9140132ac388132
- SHA1 728257d06c452449b1241769b459f091aabcffc5
- SHA512 d6f28ba761351f374ae007c780be27758aea7b9f998e2a88a542eede459d18700adffe71abcb52b8a8c00695efb7ccc280175b5eeb57ca9a645542edfabb64f1
- SSDEEP 192:eF2HS5ih/7i00dWz9T7PH6lOFcQMI5+Vw+bPFomi7dJWsP:rSUmlw9T7DmnI5+N273FP
- TLSH T1AC326C05536081F2F5909578942BBB271B3D1115A7BA8F87DFE38483BD282E6AE3D613
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
10134
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetModuleHandleW
GlobalFree
GlobalSize
lstrcpynW
lstrcpyW
GetProcAddress
WideCharToMultiByte
VirtualFree
FreeLibrary
lstrlenW
LoadLibraryW
GlobalAlloc
MultiByteToWideChar
VirtualAlloc
VirtualProtect
GetLastError
user32
wsprintfW
ole32
StringFromGUID2
CLSIDFromString
Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc
Name
.text
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
835B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
120B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1024B
Virtual Size
578B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=14, version=7299,
count=20, id=1, productName=Unmarked objects,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=4, id=48, version=9044,
count=1, id=42, version=8803,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
Gingerbreads/Packetize/tyktflydenhed.ove
- SHA256 8d2a30cfc7f37eb7df47bfd3a5139f970a8e541504b808353ac7d4e5c43eedf1
- MD5 03c8b52923bad9659d7300d16e00a1b2
- SHA1 c0d6529ea5688422e959967c79aacc448a1a00f7
- SHA512 d1b1c381afa2104d8fa900ec98d03d413337d6ca72e9c06b09eaeeb6220639d7eb3bd75a5c1a8e4e5df4c1e3756d1b9f1c4172d1fed7b8fa86be42f046bee1f4
- SSDEEP 768:OfMzOzm3hXtnegwJKA/t84tdxaDekd6G2j34LKc0K2S2OixJ2uMP6a11b1OBXnQe:Dqb/xsbalfmPN1ZOhvDDEDptVYLiE
- TLSH T18C74129025C88A38C8A28DB1D4B4D12D1BA9F9030D3EDF47E5892D734E5FE4A257EF61
- MD5 SHA1 SHA512 SSDEEP TLSH
Gingerbreads/Prostituerings.pul
- SHA256 446c5d4c61fadf7ce6443b8078f6b48dabb52b5d79c47b5688352be14cd267e7
- MD5 5dee2f4ac69719ec21a77f7885ccfdb7
- SHA1 5622658979460553d0751322f2a41a65c4086ca0
- SHA512 845c4c1b5c10553c949b26fb3c61a55a702848d256487b5b280f376cc36631f8c4650dad6cbe013ccca06792f316433f8228e2cab8bdfc3a0453eec45fd95e21
- SSDEEP 1536:/mOJ/3pPaIWTJCQt5poF25UNeZ9wKLjszmrL:1Z3pPW5pRaIZ9wKrL
- TLSH T1CC5412524AB3A4FADA97483E072FA9D9CFCBD2722434DC85438121652C7D8D9CD93BD4
- MD5 SHA1 SHA512 SSDEEP TLSH
Gingerbreads/Taxless.soc
- SHA256 8400c18d0c30128368514f70405de9cb719a2f6f97b92f9fb292762e9626fe93
- MD5 491e989d64439845762f5f4b49c45e7e
- SHA1 5247d84155fc0622249d91653fa9a18ec3f4f8c1
- SHA512 9d0e37caf73d19157c6fbe2736859a41f20dded7afa4269083f1a0840383f9943d4d0b2717d783a77dff634edca4248bc6e210f94bf7f06a01928937d4dcb6db
- SSDEEP 768:iox3vIWbbnnmzgswnhACmnnny6+b3HQVVz0nezRxNzMO9HJ0ZYlfXMMYcxiIGgKt:ieDuBnpfXrx4I/jP
- TLSH T15A5412A0D23CB1DDF36D303C40A2DB1B431AEFF600814076A58B2F7B5C8957A16AC79A
- MD5 SHA1 SHA512 SSDEEP TLSH
Gingerbreads/Tripenny.cop
- SHA256 81b8936e55b248b213493700d27d13cd723dbb94d255ba266dc16e89a70b0c66
- MD5 336988c512cafc63dbea7bb43b128bae
- SHA1 019a1bcf35d321ec1d825f2651f2c6a5d63c7666
- SHA512 de50e2bd648e9be5f6c2d29b0de064a2d6d75af17469bc9b54c1b90ff2a0cc86f3eea3ea51f9378a78f3792bf2e59441a1af16abaf6ddceb8837274ffa1d7860
- SSDEEP 1536:BISQ8vKf2N5B3V5nWHY9oq8PR9WHXxCqVxIigaIUBheJ:B1Q2FvWHYSq8Dx51/
- TLSH T1AFA412970CAD4E90C44C2DB397CCB08CA6795B6A3F52DC249105B22DFE74E55FCA3866
- MD5 SHA1 SHA512 SSDEEP TLSH
Gingerbreads/populariseringers.dis
- SHA256 1848400f0d328efd451143c3bdb8a917b913812dc925dadaff51e10ff6e12c2a
- MD5 1855e5b92348057024c111fcfe124ca9
- SHA1 1991e9ef414c0724e2b82c92f2e049c08e9db40d
- SHA512 b4c680b986c3b8d27483ba0a491b7ccceea979abce68e523404c084bbb075c55768cf8764cb91d56bc4be78d6b29c01cbf7466da61a2b8c13333d70c96e1841e
- SSDEEP 768:A+avzrbXbO/HPb/yPx+UxycHWG3ctGIz1cjwnbdCYfj9E8DcIkuvkfbrFB2EgsXH:kuPgTxaRX44rvknFB2EvQhIgTt4SkB
- TLSH T1655402C66DA98B00C4C82375F3A17202CA99436DFE89A5D9C4D18BC3B59643F44EFD6D
- MD5 SHA1 SHA512 SSDEEP TLSH
Gingerbreads/siouxs.kas
- SHA256 e67910991c762f72dc204ee84aedc62b96309c6b8badd804c02dc6469f195093
- MD5 530e0d2de2dcf2e54d43c9ab383bd76f
- SHA1 8d965e216c775f3e6a207211a19768c6ed92bbe2
- SHA512 1f82f6f9984ad8fc3a09510a5b55d3591880d40ed844bd2d4b3bc4ee4e6b57b736d9b8090d9c3faad4678b33cca762b8a62faecca1f9af0461166d156f579432
- SSDEEP 1536:cE4OZIYEFFRyjxDpSP2mdRB1l1u5LKRLrs2c:7fZIfyjTShB1oLKVrs2c
- TLSH T1DD6412DA26DC79E2C8364778560857F752FF2F86C69F7CD10083AAA252B7E398903C51
- MD5 SHA1 SHA512 SSDEEP TLSH
Gingerbreads/straffelovsovertrdelsernes.txt
- SHA256 c21d47d9800a5ab9b033daa470c23cb91d50fed518b11c837549e3f253435231
- MD5 447fce78047fb6da6369c363dc4fdd78
- SHA1 24f96febf3647a0492278b4629c24528adacc760
- SHA512 03f2e2a0f7539a7cc70486e34a5938da98899e240546ff92e2237a1b52f526a127514c43186c686c71b558e99db05ad0fd21606d0828b260ed6b3d157fc31cf7
- TLSH T191F0E1905E901226C53B3702FD7BA33587396AABA7220546DBC4460C030B17D877A268
- MD5 SHA1 SHA512 TLSH
Sunsetting.Per
- SHA256 d60c82796d80c653abb2bd93f983644c465be0d778af2410368a4a5cb9c438ae
- MD5 673b1ea373bee3e3e7c284def0520e20
- SHA1 3051bb3d629b16f0e1e227b756df516f16c329ca
- SHA512 7007abea79c1da5521464237032569a9f837c2bef824208d8d146354000e96265431e4a4e607af8f79fe4b6a34837c094ca90aae9c5a09437fdfd7cebbb54993
- SSDEEP 6144:wIZzDbUU29lXHtQZg9bPhSBe8y3tAxoYwDYh:wIFkt9lXNQCphSBStCZx
- TLSH T18644F1F29798ADA7F014353914930D22D395FD93AAE5D1C354BBB337A21539A0EFC80A
- MD5 SHA1 SHA512 SSDEEP TLSH