e6349865a47b11.zip
- SHA256 e16cc5d4f23aaaf03939209aedf0e1b6ee02781a8b0753fc1aad42d8ca174b7e
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
T.HALK BANKASI A.Ş. 14.10.2022 Hesap Ekstresi.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
T.HALK BANKASI A.Ş. 14.10.2022 Hesap Ekstresi.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
Behavioral task
behavioral3
Sample
ruuaasgl.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
ruuaasgl.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
General
- Target e6349865a47b11.zip
- Size 282KB
- Sample260730-pjdfmaxcrd
- SHA256 e16cc5d4f23aaaf03939209aedf0e1b6ee02781a8b0753fc1aad42d8ca174b7e
- MD5 50f340eaf8a5318875801f941479897a
- SHA1 12d12953b6dbd8baa2c0333dce22f4aa931c24c6
- SHA512 dd0ed0da8b0599006affd5794e875497b9ddd0e5c7c2e0a932d834184801d8863a256d3660901948fac9ef360db5baeb467a4e52999dba002dd587209975031a
- SSDEEP 6144:CcLUG7guJPGh0Vrl1uu5WT2Yw2bKmNbM2zJkAj2E70WZCrCVw+:C4l8Guh00ucCd2b1NbBJZj2E4WIMn
- TLSH T1A154235EE70603C5D61A631CC6DB1742BD76FBCAA180FC9F554683D063F926C09A222F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/T.HALK BANKASI A.Ş. 14.10.2022 Hesap Ekstresi.exe unpack002/ruuaasgl.exe
File Explorer
-
e6349865a47b11.zip.zip 282KB
-
T.HALK BANKASI A.Ş. 14.10.2022 Hesap Ekstresi.exe.exe 296KB
-
bgmplnvgw.dr4KB
-
qdpefynex.b185KB
-
ruuaasgl.exe.exe 133KB
T.HALK BANKASI A.Ş. 14.10.2022 Hesap Ekstresi.exe
- IMPHASH 56a78d55f3f7af51443e58e0ce2fb5f6
- SHA256 2b5e0eaa1ba6de90bb95dfb7a374b9a8f7052b109e670b900f4b0e3cc5a2896c
- MD5 3ab5829c7af42cafaec6f593b1925358
- SHA1 9ae8ceaf1094cdac9146e9fd9016fdcff7a8b828
- SHA512 242bfa51ca915ae033cc6dfaa0bbc91496fc433293ed5822fda472e01cc9ec59136d3223dbfb61d1e541a2329dea3f765411a96b560584bf261f3c3884ca6642
- SSDEEP 6144:mbE/HUbUh0V5l1uu9WTMYw2bKmNbM2zJkOj2E70WFCrCWwk:mb/Uh0uuAwd2b1NbBJpj2E4W8ZB
- TLSH T1A4542224FB1082A7D163173846776B57AFBBF51A10A0ED4B034057E87BB72C94A5F32A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
13613
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
advapi32
RegCreateKeyExW
RegEnumKeyW
RegQueryValueExW
RegSetValueExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
SetFileSecurityW
RegOpenKeyExW
RegEnumValueW
shell32
SHGetSpecialFolderLocation
SHFileOperationW
SHBrowseForFolderW
SHGetPathFromIDListW
ShellExecuteExW
SHGetFileInfoW
ole32
OleInitialize
OleUninitialize
CoCreateInstance
IIDFromString
CoTaskMemFree
comctl32
ord17
ImageList_Create
ImageList_Destroy
ImageList_AddMasked
user32
GetClientRect
EndPaint
DrawTextW
IsWindowEnabled
DispatchMessageW
wsprintfA
CharNextA
CharPrevW
MessageBoxIndirectW
GetDlgItemTextW
SetDlgItemTextW
GetSystemMetrics
FillRect
AppendMenuW
TrackPopupMenu
OpenClipboard
SetClipboardData
CloseClipboard
IsWindowVisible
CallWindowProcW
GetMessagePos
CheckDlgButton
LoadCursorW
SetCursor
GetSysColor
SetWindowPos
GetWindowLongW
PeekMessageW
SetClassLongW
GetSystemMenu
EnableMenuItem
GetWindowRect
ScreenToClient
EndDialog
RegisterClassW
SystemParametersInfoW
CreateWindowExW
GetClassInfoW
DialogBoxParamW
CharNextW
ExitWindowsEx
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
FindWindowExW
IsWindow
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
ReleaseDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
EmptyClipboard
CreatePopupMenu
gdi32
SetBkMode
SetBkColor
GetDeviceCaps
CreateFontIndirectW
CreateBrushIndirect
DeleteObject
SetTextColor
SelectObject
kernel32
GetExitCodeProcess
WaitForSingleObject
GetModuleHandleA
GetProcAddress
GetSystemDirectoryW
lstrcatW
Sleep
lstrcpyA
WriteFile
GetTempFileNameW
CreateFileW
lstrcmpiA
RemoveDirectoryW
CreateProcessW
CreateDirectoryW
GetLastError
CreateThread
GlobalLock
GlobalUnlock
GetDiskFreeSpaceW
WideCharToMultiByte
lstrcpynW
lstrlenW
SetErrorMode
GetVersionExW
GetCommandLineW
GetTempPathW
GetWindowsDirectoryW
SetEnvironmentVariableW
CopyFileW
ExitProcess
GetCurrentProcess
GetModuleFileNameW
GetFileSize
GetTickCount
MulDiv
SetFileAttributesW
GetFileAttributesW
SetCurrentDirectoryW
MoveFileW
GetFullPathNameW
GetShortPathNameW
SearchPathW
CompareFileTime
SetFileTime
CloseHandle
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalFree
GlobalAlloc
GetModuleHandleW
LoadLibraryExW
MoveFileExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
lstrlenA
MultiByteToWideChar
ReadFile
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW
Name
.text
Size
26KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
172KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
64KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=165, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
bgmplnvgw.dr
- SHA256 5c2a56503f162169e7d79efafe2506c0a8cb775fbb2b17f86d17d787c3d007d8
- MD5 8747220494110a489618e1c6b4284308
- SHA1 68482be8a37973d2a0faebbd5a56f5c88ffd932c
- SHA512 abf02447c3fcdbb9704be2755e77f04af3f07fd182eb19bf73512e48b0e5d01b7fa72113289e85f11a24c6bd57b5b362f49626b2b983dd8ae402de4586c293ef
- SSDEEP 96:C9noYBj+kWl0ZhwTbrPVE2VmG5vZoDeXOSI9lcMhaoNvCLMGjZibQuLayC:Cpzdc0ZIPVz5aMAlfhaoMjZIf5C
- TLSH T1EDA19DBEDBA081DD41BD9E08895006A16FBCA687E0E2FD99F42E3533DF72D0B0806850
- MD5 SHA1 SHA512 SSDEEP TLSH
qdpefynex.b
- SHA256 36692e8eba55a9bad005cd8ac0ffb8294f3f1feb58a3c175791b336fa4d30c3c
- MD5 2310e26dd8b41169f9cbf0672440600c
- SHA1 71024c06e74bca87f45bcf3cf2de373575e274ab
- SHA512 e91e9d7a0dac600c4ddcc5b8d70e386b54cbbe7738d95fcaad18b992d9da366b9b0da8f1562041279ab9740bb40a60a60455f212bb838e2a97c3575610b7596e
- SSDEEP 3072:rbUd4M79ochivFWyXpvZhczrdw5wrq9l4suBBXXDix37aOFZJBuvUKmNOuM5oBJO:W4WocpyizJw5wrqXcLXXgFhusKmNbM2y
- TLSH T166041289BFEE028736274B47C3DD6DEE86535E79A58D1E87A6BF18C14604040A9FD30B
- MD5 SHA1 SHA512 SSDEEP TLSH
ruuaasgl.exe
- IMPHASH d1440b084c32110bfdd59b0a469766a3
- SHA256 4847e024e751c9e3c52cc8b1ed916a5603fc9feb2d85de6a0451444ff5550014
- MD5 0d25200bf9fdf1c2e1a905603f6d63b9
- SHA1 2e3044e973588592ad8011377fc8839ca1a87ddc
- SHA512 46b43d00edd561402cd4be0a1518440ef0eaa551a4c6abb8b163cf93da1635c1bd3b3d229c59e9fe3df9eb3cfcb7abb221908225d5ff336ca44c1dc79b3de43f
- SSDEEP 3072:ACsPEvMCi32nCnQCRkDs1nVZwTOguR0LSAQSy3/DH:A9PkKuKkDQPwTQXH
- TLSH T1D2D39E5131C2917FD972A97155688AE0C9AFFE312E548FCB634C253ECE382E14736D2A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
59750
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
shlwapi
StrChrA
StrChrW
StrCmpNW
StrRChrW
kernel32
ReadFile
GetTempPathW
VirtualAlloc
lstrcatW
EnumResourceTypesW
GetConsoleWindow
GetFileSize
FindFirstFileExW
FindClose
HeapAlloc
HeapFree
GetCommandLineW
CreateFileW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
RaiseException
DecodePointer
WriteConsoleW
CloseHandle
SetFilePointerEx
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
HeapReAlloc
HeapSize
GetProcessHeap
LCMapStringW
CompareStringW
GetCommandLineA
GetModuleHandleExW
ExitProcess
GetModuleFileNameW
WriteFile
GetStdHandle
LoadLibraryExW
GetProcAddress
FreeLibrary
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetCPInfo
LeaveCriticalSection
EnterCriticalSection
SetLastError
GetLastError
RtlUnwind
TerminateProcess
GetCurrentProcess
GetStringTypeW
GetFileType
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetModuleHandleW
WideCharToMultiByte
MultiByteToWideChar
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
mpr
WNetGetUserA
WNetGetLastErrorA
MultinetGetConnectionPerformanceW
WNetGetResourceInformationW
WNetGetProviderNameW
WNetGetConnectionW
comdlg32
GetSaveFileNameA
PrintDlgExW
GetSaveFileNameW
PrintDlgW
PageSetupDlgA
FindTextA
winmm
waveInStop
mixerGetLineControlsW
waveOutWrite
mmTaskBlock
wsnmp32
ord901
ord105
ord900
ord300
ord102
ord200
ole32
OleCreateLinkToFileEx
ReadFmtUserTypeStg
HWND_UserUnmarshal
IsEqualGUID
BindMoniker
WriteStringStream
StgOpenStorageOnILockBytes
HPALETTE_UserFree
CreateDataCache
resutils
ResUtilFindSzProperty
ResUtilVerifyService
ResUtilSetPropertyParameterBlock
ResUtilGetSzProperty
ResUtilVerifyResourceService
ResUtilStartResourceService
ResUtilSetPrivatePropertyList
ResUtilVerifyPrivatePropertyList
ResUtilSetBinaryValue
oleaut32
VarR4FromBool
VarR4FromDisp
VarUI2FromUI1
VarCyFromUI2
SafeArrayGetIID
VarAbs
VarR4FromDec
OleLoadPicture
VarAnd
VarUI4FromCy
shell32
SHAddToRecentDocs
FindExecutableA
DoEnvironmentSubstW
msi
ord15
ord115
ord14
ord91
ord56
ord158
user32
ShowWindow
Name
.text
Size
100KB
Virtual Size
100KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
24KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.gfids
Size
512B
Virtual Size
180B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=9, id=259, version=27412,
count=138, id=261, version=27412,
count=18, id=260, version=27412,
count=16, id=259, version=24237,
count=29, id=261, version=24237,
count=17, id=260, version=24237,
count=25, id=257, version=27412,
count=150, id=1, productName=Unmarked objects,
count=1, id=260, version=24245,
count=1, id=255, version=24245,
count=1, id=258, version=24245,