4da763a0eb644c905550a0f5964465f18d4354fd3216404d1542c12d8378e205
- SHA256 4da763a0eb644c905550a0f5964465f18d4354fd3216404d1542c12d8378e205
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Прошу оплатить вложенный счет на поверку счетчика_ 2109251046.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
Прошу оплатить вложенный счет на поверку счетчика_ 2109251046.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target 4da763a0eb644c905550a0f5964465f18d4354fd3216404d1542c12d8378e205
- Size 153KB
- Sample260720-syf2vaew6m
- SHA256 4da763a0eb644c905550a0f5964465f18d4354fd3216404d1542c12d8378e205
- MD5 179861b6481b2ff2910bc8e3121bac12
- SHA1 7ca93591a1f77d721bc175b5cc0d44eddbcb5d5b
- SHA512 6d95840e624f634e5044d2a68613a490480f97b1da8f3e0ee04acc444274b19d232fbcc1755c0a74c8b5af8c3eb25f5e03eee5508bc7d3d7a29a815cc96c9c64
- SSDEEP 3072:/a3zfUALhPtg9NLgtd9B6nG5tGh0zXBlKBiu8ow6zudPMxkuu:/arJL4Lgt0G7LXy0uUvuu
- TLSH T117E3120D0A0805B89D5BF16842C809F7AA72D6611B2D3F7B13CF5FC057B95E1822BB9A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/Прошу оплатить вложенный счет на поверку счетчика_ 2109251046.ba_ unpack002/$PLUGINSDIR/System.dll
File Explorer
-
4da763a0eb644c905550a0f5964465f18d4354fd3216404d1542c12d8378e205.zip 153KB
-
Прошу оплатить вложенный счет на поверку счетчика_ 2109251046.ba_.exe 172KB
-
$PLUGINSDIR/System.dll.dll 11KB
-
Kapninger23KB
-
Pejlstoks218135KB
-
aandsfriskes.spi41KB
-
afvaskning.sen26KB
-
institutionalize.bug21KB
-
trettenaarsdage.vaa18KB
Прошу оплатить вложенный счет на поверку счетчика_ 2109251046.ba_
- IMPHASH e221f4f7d36469d53810a4b5f9fc8966
- SHA256 81850fd796e155b48ca148b0938af3a2bd36181ee7043ff11b9e6b186ae2dfe2
- MD5 25b88362ca18c877ffb38e3d711ae479
- SHA1 dca3709b9f13ae94e072700b72af4c0c43b35238
- SHA512 7ce889cbde85a686d06e75d93fbd0dc6d589d5569c0f17e25ce9c326a0cfb9b6df48218c7bbb634ff5b90c0b6f6f5d6babb8e1afc944c56193666788434431ab
- SSDEEP 3072:1LfVxlyEZfp9zIb45zUT+T9B6nGhtGh0zXBlKZiu8ow6zudPM+ku1:ltXZXcMjKGDLXy8uUwu1
- TLSH T15904020977C0C07AC69396300EB6CBFAE673E76406291B3B2744AF6D7E702C1DA09795
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
13144
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
CompareFileTime
SearchPathW
SetFileTime
CloseHandle
GetShortPathNameW
MoveFileW
SetCurrentDirectoryW
GetFileAttributesW
GetLastError
GetFullPathNameW
CreateDirectoryW
Sleep
GetTickCount
CreateFileW
GetFileSize
GetModuleFileNameW
GetCurrentProcess
CopyFileW
ExitProcess
SetEnvironmentVariableW
GetWindowsDirectoryW
SetFileAttributesW
ExpandEnvironmentStringsW
SetErrorMode
LoadLibraryW
lstrlenW
lstrcpynW
GetDiskFreeSpaceW
GlobalUnlock
GlobalLock
CreateThread
CreateProcessW
RemoveDirectoryW
lstrcmpiA
GetTempFileNameW
lstrcpyA
lstrcpyW
lstrcatW
GetSystemDirectoryW
GetVersion
GetProcAddress
LoadLibraryA
GetModuleHandleA
GetModuleHandleW
lstrcmpiW
lstrcmpW
WaitForSingleObject
GlobalFree
GlobalAlloc
LoadLibraryExW
GetExitCodeProcess
FreeLibrary
WritePrivateProfileStringW
GetCommandLineW
GetTempPathW
GetPrivateProfileStringW
FindFirstFileW
FindNextFileW
DeleteFileW
SetFilePointer
ReadFile
FindClose
MulDiv
MultiByteToWideChar
WriteFile
lstrlenA
WideCharToMultiByte
user32
EndDialog
ScreenToClient
GetWindowRect
RegisterClassW
EnableMenuItem
GetSystemMenu
SetClassLongW
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongW
SetCursor
LoadCursorW
CheckDlgButton
GetMessagePos
LoadBitmapW
CallWindowProcW
IsWindowVisible
CloseClipboard
SetClipboardData
wsprintfW
CreateWindowExW
SystemParametersInfoW
AppendMenuW
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextW
GetDlgItemTextW
MessageBoxIndirectW
CharPrevW
CharNextA
wsprintfA
DispatchMessageW
PeekMessageW
ReleaseDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
GetClientRect
FillRect
DrawTextW
GetClassInfoW
DialogBoxParamW
CharNextW
ExitWindowsEx
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
GetDC
SetWindowLongW
LoadImageW
SendMessageTimeoutW
FindWindowExW
EmptyClipboard
OpenClipboard
TrackPopupMenu
EndPaint
ShowWindow
GetDlgItem
IsWindow
SetForegroundWindow
gdi32
SelectObject
SetBkMode
CreateFontIndirectW
SetTextColor
DeleteObject
GetDeviceCaps
CreateBrushIndirect
SetBkColor
shell32
SHGetSpecialFolderLocation
SHGetPathFromIDListW
SHBrowseForFolderW
SHGetFileInfoW
ShellExecuteW
SHFileOperationW
advapi32
RegCloseKey
RegOpenKeyExW
RegDeleteKeyW
RegDeleteValueW
RegEnumValueW
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW
RegEnumKeyW
comctl32
ImageList_Create
ImageList_AddMasked
ImageList_Destroy
ord17
ole32
CoCreateInstance
CoTaskMemFree
OleInitialize
OleUninitialize
version
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
Name
.text
Size
24KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
128KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
196KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
19KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=166, id=1, productName=Unmarked objects,
count=17, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
$PLUGINSDIR/System.dll
- IMPHASH fc0224e99e736751432961db63a41b76
- SHA256 5a1c20a3e2e2eb182976977669f2c5d9f3104477e98f74d69d2434e79b92fdc3
- MD5 7399323923e3946fe9140132ac388132
- SHA1 728257d06c452449b1241769b459f091aabcffc5
- SHA512 d6f28ba761351f374ae007c780be27758aea7b9f998e2a88a542eede459d18700adffe71abcb52b8a8c00695efb7ccc280175b5eeb57ca9a645542edfabb64f1
- SSDEEP 192:eF2HS5ih/7i00dWz9T7PH6lOFcQMI5+Vw+bPFomi7dJWsP:rSUmlw9T7DmnI5+N273FP
- TLSH T1AC326C05536081F2F5909578942BBB271B3D1115A7BA8F87DFE38483BD282E6AE3D613
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
10134
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetModuleHandleW
GlobalFree
GlobalSize
lstrcpynW
lstrcpyW
GetProcAddress
WideCharToMultiByte
VirtualFree
FreeLibrary
lstrlenW
LoadLibraryW
GlobalAlloc
MultiByteToWideChar
VirtualAlloc
VirtualProtect
GetLastError
user32
wsprintfW
ole32
StringFromGUID2
CLSIDFromString
Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc
Name
.text
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
835B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
120B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1024B
Virtual Size
578B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=14, version=7299,
count=20, id=1, productName=Unmarked objects,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=4, id=48, version=9044,
count=1, id=42, version=8803,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
Kapninger
- SHA256 2654e9a871d5b26aa91a2f8aee3953e2634edc70ee3aeba223fc7137b2e76b1e
- MD5 9c39c1c50676366fbdb550b09c5f5fea
- SHA1 06259c8f7b5b209285e422e48662f48a3ffd194a
- SHA512 9c566ac1223afaeed39782b0676364314b4eeef82db85ad6e029bb5748ed87ba8b7a682daad0eb38a41eee92711c99841e3292019f52d91331d10b54d6d7413f
- SSDEEP 384:4xXu6TWWwyntVklTLDuBqd4IVmilvNDqWk/vdvxGyVX:4xOynodsBwmilvRqX1vxGyVX
- TLSH T1B6B29E0746569CEBCD16C238847F62E68DED301A871F949DA329ED19C2073D2B521BFD
- MD5 SHA1 SHA512 SSDEEP TLSH
Pejlstoks218
- SHA256 67ddadc3bb8481d01dc7e1d65c89ab3c384ae2be60f058a54c4d53ff9ef89e06
- MD5 5b9929958c7afbd985bd2e1dc6229fbf
- SHA1 d4c1f8ed457f84547157d6df32d02fc3c031fa9b
- SHA512 7b0282f28a453c23a7416d75d6d8ce807cfc83028b9e54e2608edfffcd3581c9efc5922e7b3a53dd5e29a111c1d259cf3cc385ff481aded296b95507189383b8
- SSDEEP 3072:yCo0pxYz/FFrV2AzT1hMihM5G7LsuaCiWI/k+M40lTkKBM4qTdz:yS0uMVS0sky0hkKGDpz
- TLSH T17CD3F16F9C1DFA0BD9CB7339200E9553E179049851FB60BB9AF05ED1C2872C637AC962
- MD5 SHA1 SHA512 SSDEEP TLSH
aandsfriskes.spi
- SHA256 9fdc615dbb9134b82fb34e665b7d0683c5f3385be55dae426c4161472074ff22
- MD5 d06dd4919f22207d54781404950572b3
- SHA1 01d5cdb1040f07f060c950ed9f7228a6ed89024f
- SHA512 24e699c07e8256c3ab8bcdc13158714dbb5b5b0d14107e69818e2a1ed94eb27349b0ab4c581396cb31bd7947836cba4bc915fccaf1b282735bc623ff0e591f22
- SSDEEP 24:SyDpXT9wB07qDzwilFW+2b89E8LJu3Gv0ns72g/qWbfdaXLCO0EpsEXNDJGprBYf:NSmtiDe8NLoI0qyWbfSLlis81S
- TLSH T1C913C8BA30B460D0189DFD7C27A1190627A712AD576D9E57B34CFD818102F9E4DA403F
- MD5 SHA1 SHA512 SSDEEP TLSH
afvaskning.sen
- SHA256 384bbe2a6a568d5352eada0204f47947e801c5823e83fcffe1a3a66447d27f6e
- MD5 421469c58233adac045e9877e2eeb0c0
- SHA1 984d23035373e846c29e2311368294be0e818520
- SHA512 67a476fa5aa62f1d6f2630d1bae58cbd7ee8a4e15874d271614973a3d649b540c4ba0f35d9a829c7e7ef73fb75d7e841701bf7e85f7e6b2c250fbd43d931797c
- SSDEEP 24:okX9apMBMVgongSwLSr/oeDUuWNzpyDyRmtDv96EyLWu+ht:rXMpWMVgCS2zxDUvBpyDyRgTRtf
- TLSH T138C260E0D5D7D15ECAEA009AC8C25A30A6CD2AF0D7727585D40B423A4CE22B198E181F
- MD5 SHA1 SHA512 SSDEEP TLSH
institutionalize.bug
- SHA256 5c42d68ec159e8a3dad354fdc79f77e28174957111f523a0cb26ea6305005e0b
- MD5 e03f5de3fd44a50ed7966589dba038b1
- SHA1 5b57d617d058f30d4303a3d00bd20dc61acd02af
- SHA512 80e062e77c1d1c99c129f24df9882fd5aaa9c0a399e1e90e66d5e341c63db96ae81a28bbb3456906117c54ab316a97fb69586dde2d191a1526634f3bebe49326
- SSDEEP 24:OUc+8xA2jOECJPw6uGj+OxZOsbyvTNcXwyDzwBea1USUr:OUcHA2jOEow6uAZOs2TNm3wM
- TLSH T198A288C8D13D4BC2D48952031514EE5CDB86329F464FAEB7CEFB455DE0F9D061A910AB
- MD5 SHA1 SHA512 SSDEEP TLSH
trettenaarsdage.vaa
- SHA256 35ec850e196e09940aee2919d0d6dbba948fedb9443ab857214c4041fa0c62ea
- MD5 a94fa5e6ebf196580fb6e38de02e79a8
- SHA1 8bd369e6c8ff02ea59d3ac23bd04a86e88ed3689
- SHA512 e9305de47f728f344ba2cebacbc43a5db3336f6decd4697c7ece9e361d92c8a146cb53694d26428d9b6ba79446c110c3551f162cd0f1e1853dcffb171570c110
- SSDEEP 12:jMwWTSIm09wmmi1XpRKeWF0rOlcXIfsWbDQeJPKgz7fWe1jWmReSMgODnn:34SImIhp8eWXCzwce5KgGRmR7MgODnn
- TLSH T15E82472DCD7961905735AD93340FE8C770D259FC59474620AAC410CFE22B452A623354
- MD5 SHA1 SHA512 SSDEEP TLSH