e28803a95494f035476d34f4820a378b009fe5387b1369b32d60958248114c46
- SHA256 e28803a95494f035476d34f4820a378b009fe5387b1369b32d60958248114c46
Password
infected
Behavioral task
behavioral1
Sample
SOA with double PO.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
SOA with double PO.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/zmmnoeym.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/zmmnoeym.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
General
- Target e28803a95494f035476d34f4820a378b009fe5387b1369b32d60958248114c46
- Size 414KB
- Sample260812-payeface33
- SHA256 e28803a95494f035476d34f4820a378b009fe5387b1369b32d60958248114c46
- MD5 9db830f213ba455a018500f86d819c43
- SHA1 06c736cf0937aceb0c6ada9f835b301d1806ff21
- SHA512 ed9ca8043bc760e9d4099cabfa8795c9db2ad7f49a15c2a4c70500fa796ce82ead5b6f841ec75de2c7f75790048b611e5ea2e451f97b68661762e2d4de45b2a7
- SSDEEP 6144:bf2E9Ibwh04kqWg512FJhiTzGa3g3SMM8xspfm8cmpf3q8gOasd3Htyh8fXqdQ:d9Ibw4jbSUifm8bF3zw4whRq
- TLSH T1AD9423432B2ADD9553E9C03B0359C19651D1F00B7A323D0ABFE825926D9F37870A6D6A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack002/SOA with double PO.exe unpack003/$PLUGINSDIR/zmmnoeym.dll - NSIS installer 3 IoCs
resource yara_rule static1/unpack001/746066e71e9f0b8e5efc5c3aa7b782122d0f1454637b9a96fec379d08dd67327.iso nsis_installer_2 static1/unpack002/SOA with double PO.exe nsis_installer_1 static1/unpack002/SOA with double PO.exe nsis_installer_2
File Explorer
-
e28803a95494f035476d34f4820a378b009fe5387b1369b32d60958248114c46.zip 414KB
-
746066e71e9f0b8e5efc5c3aa7b782122d0f1454637b9a96fec379d08dd67327.iso.iso 494KB
-
SOA with double PO.exe.exe 432KB
-
$PLUGINSDIR/zmmnoeym.dll.dll 319KB
-
6rrxx30t909wrke7214KB
-
eyeslrmrf4KB
746066e71e9f0b8e5efc5c3aa7b782122d0f1454637b9a96fec379d08dd67327.iso
- SHA256 746066e71e9f0b8e5efc5c3aa7b782122d0f1454637b9a96fec379d08dd67327
- MD5 3612d1684c02f075465c289faa8a43ce
- SHA1 2cb4176cbb05e30421b06c665a4a07cf30827669
- SHA512 f4ca7f5114b9447eaa63e6dbe55123a82521333a738a55a07a9d5edc9c98bdb963dba1b9b927ebca6f852b9a04aae3301c273a0f6187ebf057760205b2296077
- SSDEEP 6144:mybLOp/vh5sRX9o4ud5V+ivLhrC1lXxVwVY/i1kWKj4ckrwCbQOloqnqJk:DbLSnWto4U+ivLNC1FobJKjhabtoqnx
- TLSH T1B7B4123EF5044476DB66AB384862AA7E86734E195CE01D53B72D3F491BF22C31A1F742
- MD5 SHA1 SHA512 SSDEEP TLSH
-
NSIS installer
SOA with double PO.exe
- IMPHASH 7fa974366048f9c551ef45714595665e
- SHA256 fb044c8fa8bfb5f24763dbdd20d1b4b0e92af79c8aeea83839b768eb78c3b8b6
- MD5 644bd3b7386495827c80923bd3762e09
- SHA1 3b427dbde751b25846ec01710cce82d749639b95
- SHA512 adaa993feaefcd23095729a22093ba70f91852760fe54f65df92d9bb7b762a785b1d656cc2cb53d151ae47ac6d61bbddd086e0baaa8f50e927bcc8b8c0d7d4b4
- SSDEEP 6144:OybLOp/vh5sRX9o4ud5V+ivLhrC1lXxVwVY/i1kWKj4ckrwCbQOloqnqJkm:7bLSnWto4U+ivLNC1FobJKjhabtoqnxm
- TLSH T10B94127EF4048477DB66EB384862AA7EC6724E195DC01D53972D3F892AF06C31A1F742
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
-
NSIS installer
Minor OS version
0
Major OS version
4
Entry point
12487
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetTickCount
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
GetWindowsDirectoryA
SetFileTime
GetCommandLineA
SetErrorMode
LoadLibraryA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
CreateFileA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
GetVersion
CloseHandle
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GetModuleHandleA
LoadLibraryExA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
MulDiv
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetTempPathA
user32
EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
DestroyWindow
CreateDialogParamA
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
OpenClipboard
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
ShowWindow
gdi32
SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject
shell32
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation
advapi32
RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA
comctl32
ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create
ole32
CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
Name
.text
Size
22KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
3.6MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, version=2190,
count=155, id=1, productName=Unmarked objects,
count=17, id=93, version=2179,
count=11, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
$PLUGINSDIR/zmmnoeym.dll
- IMPHASH 0a195fb0b2ee4faca766343f663baa43
- SHA256 ae79c51f045095224baf88f4786b7f023079d0f76dc6a273b8a3a58a1f6930cc
- MD5 a84e9af5ad4cf4426e8c1989ef86df48
- SHA1 1adb82d2cdf4d96bfda7372c9a49488bf8380031
- SHA512 198a7e58099d31ea7ac75422f85d954a67dbbe15e368fbd9c2e915876dc24744b3ae1c7c9067c44855b2fcdedd731a857b9de280144ceae62dcb472e8da8a93d
- SSDEEP 6144:cBzBdFTNmk0fGTeus3iyWOFNR3Uf2O5xFcDvHgNI5r3JWniY543hiXbY89kEwNM2:cd3NL0fGTrCAyNR3O5xFevHkI5zUniYK
- TLSH T1C464296585D3003FDA91E1F1E68A5182D3EB2D0879CADFE6E91E087FBC50125927EE0D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
CreateFileW
ReadFile
GetTempPathW
VirtualProtect
mapi32
ord191
ord154
ord148
ord176
ord16
ord200
ord203
ole32
CreateDataAdviseHolder
OleCreateStaticFromData
HWND_UserUnmarshal
OleCreateEmbeddingHelper
CreateOleAdviseHolder
HBITMAP_UserUnmarshal
HPALETTE_UserSize
StgOpenStorage
OleCreate
crypt32
CryptSignAndEncodeCertificate
CertVerifyCRLRevocation
CryptMsgGetAndVerifySigner
CryptDecryptMessage
msacm32
acmDriverAddW
acmFilterChooseW
acmStreamOpen
acmDriverAddA
acmDriverPriority
user32
EnumDesktopsA
SetMessageExtraInfo
MapVirtualKeyA
ArrangeIconicWindows
GetUserObjectSecurity
SetMenuItemInfoW
GetListBoxInfo
ExitWindowsEx
msi
ord86
ord45
ord165
ord121
ord110
ord170
ord74
gtkkuojjkk
inehp
neso
pwxeg
rcjpxyf
rtrspidj
tamv
thourkeuy
uiboptbxvo
ulmadtulgw
uwvmdzh
uytwqmyiwdo
vzezbhdfgc
ynrrtc
Name
.text
Size
315KB
Virtual Size
315KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
504B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=223, productName=VS2013 build 21005, version=21005,
count=15, id=257, version=27412,
count=44, id=1, productName=Unmarked objects,
count=1, id=260, productName=VS2019 v16.10.3 build 30038, version=30038,
count=1, id=256, productName=VS2019 v16.10.3 build 30038, version=30038,
count=1, id=255, productName=VS2019 v16.10.3 build 30038, version=30038,
count=1, id=258, productName=VS2019 v16.10.3 build 30038, version=30038,
6rrxx30t909wrke7
- SHA256 3060ddd995c9a813382d95db5cc5a49652a2c2e163b5cca29f9c787a4209cccd
- MD5 8e84bb1808e5f7da8f3102eabb2d6d0a
- SHA1 1989b9650d72b3fb795fef105f6f3ed0f645eaf5
- SHA512 1d40c7c3e03d3b8e631466b3aad80604e5e29903421db8cc718629209028abdf39e35f069c27ac7fc989d53cebd3a6e30da330e3931363d46de9b388baf92385
- SSDEEP 6144:SF3kPJI11We4FmbzxzodtSMp9shTVCJd1WMUsa:4qJvFClzoKMjshhS14sa
- TLSH T13E24120C2AD7D99CFAB8D49FF671022BC5DBFC5D9D38492AC0D92B04AF53922114E8E5
- MD5 SHA1 SHA512 SSDEEP TLSH
eyeslrmrf
- SHA256 355d2d2d81fcbd8e4b1a3b59f3340901cab27ecb9f9fe3fcf65eab9c5ea5ca21
- MD5 8d32443317ded659acae8b66a24469b5
- SHA1 b5272eec6c41bb4e98df7560504ffd8221c18184
- SHA512 5545408e3fe7b06a9964be702c0747fb47b2810c1078ad614c771f137a84f16859c80f6caf330a34ff101a72da7355ef14be1b79d6319ebef251116dc1793940
- SSDEEP 96:ZV6mYDNnAmIvnMJgtTwhNEnDnRyRUdjNhHRx+OuVLQFnfhzT66YYlnc8V:/ZxvMNEDRyKdjNhxx+DLQpzT66vlnc8V
- TLSH T113A1A788394180FB7348684876E14B4D566EF7A16B4FE53DDE3C9A785D0EE08CDEA805
- MD5 SHA1 SHA512 SSDEEP TLSH