6.rar
- SHA256 4677c5d022166f0eeab1b1c846b686e3c73e865bf2ab868a22745392edc19ec3
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Purchase Order N0. 2026-0312.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
Purchase Order N0. 2026-0312.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target 6.rar
- Size 276KB
- Sample260814-qrn3rsvbph
- SHA256 4677c5d022166f0eeab1b1c846b686e3c73e865bf2ab868a22745392edc19ec3
- MD5 e6e475c88454e6ead70a603384e7246b
- SHA1 ec6ba586d78cd7a6d38fea4a64da338b6cc0e7f9
- SHA512 29917f971892a5d21a36e3bc6a968ca01f548796c574d8b3985768c7e3718ba9d13b3841cee2cd95fe5d72698df7499f99204ebaca7de8537606591a46b68499
- SSDEEP 6144:WYuYvfxFezlrud+Ljq2PEhjNoD5QEyBGn:NuU+lrK+Xuhq2Eycn
- TLSH T1895423A68C199161FA107E1EBD53926E25C72983705EBD07AC752897ED0B03F81EFF09
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/$PLUGINSDIR/System.dll - Untrusted Codesign Signers 1 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/Purchase Order N0. 2026-0312.exe
File Explorer
-
6.rar.rar 276KB
-
Purchase Order N0. 2026-0312.exe.exe 432KB
-
$PLUGINSDIR/System.dll.dll 12KB
-
Havkatten236KB
-
Pertainment/Quanti169KB
-
Pertainment/Tnkepausens.lon35KB
-
Pertainment/slidendes.arv60KB
Purchase Order N0. 2026-0312.exe
- IMPHASH f4639a0b3116c2cfc71144b88a929cfd
- SHA256 d1997a3d88d785e6f430522bbb1775ca361809335a9ff3b0e4ff3ef843b0e4ff
- MD5 316e2f245880ba2f31a6a32574bcc798
- SHA1 373305187f4633cd1455cf0b01c5998800d9949e
- SHA512 40260797aece3656074d90e7f1fc395bf0f29cd5da4d39d57179e009c56045f71f193f421031592ebb3ffd5366419e9ead6a624cb39bb3b39259f14018880519
- SSDEEP 6144:dXFKo5ClMKn912RmsFhH+0CeFBll7iFqI8SQFfbUTQ2+qv26fwegjW:dXE2dHOeFBllAqIfQJb2Mqu+vE
- TLSH T1F194BF14B795C85DC29016BA2A335F9805BCAE027A4DCE6362D0797D29F4EF198CE1CF
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
dc:d7:15:7c:15:e5:ea:2c:ed:55:98:e9:f7:50:1a:f6:af:cf:53:24:00:73:f8:9e:a6:ff:0a:74:86:32:5f:73
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Strmeren,OU=Melanocrate Lindormens Skadevoldendes\ ,O=Strmeren,C=FR
Chains
Aug 6, 2026
CN=Strmeren,OU=Melanocrate Lindormens Skadevoldendes\ ,O=Strmeren,C=FR
PE Signature issue
Digest
b2:01:ae:14:e8:b1:c7:69:50:d3:86:60:84:7b:24:53:68:af:cb:9f
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Strmeren,OU=Melanocrate Lindormens Skadevoldendes\ ,O=Strmeren,C=FR
Chains
Aug 6, 2026
CN=Strmeren,OU=Melanocrate Lindormens Skadevoldendes\ ,O=Strmeren,C=FR
Subject
CN=Strmeren,OU=Melanocrate Lindormens Skadevoldendes\ ,O=Strmeren,C=FR
Serial Number
0d:17:d9:0e:ec:1f:23:95:65:ad:41:bd:27:09:60:09:9f:c4:24:36
Issuer
CN=Strmeren,OU=Melanocrate Lindormens Skadevoldendes\ ,O=Strmeren,C=FR
Revocation Status
Not revoked
Timespan
Aug 11, 2026 - Aug 11, 2027
Minor OS version
0
Major OS version
4
Entry point
13564
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
advapi32
RegEnumValueW
RegEnumKeyW
RegQueryValueExW
RegSetValueExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
RegOpenKeyExW
RegCreateKeyExW
shell32
SHGetPathFromIDListW
SHBrowseForFolderW
SHGetFileInfoW
SHFileOperationW
ShellExecuteExW
ole32
CoCreateInstance
OleUninitialize
OleInitialize
IIDFromString
CoTaskMemFree
comctl32
ImageList_Destroy
ord17
ImageList_AddMasked
ImageList_Create
user32
MessageBoxIndirectW
GetDlgItemTextW
SetDlgItemTextW
CreatePopupMenu
AppendMenuW
TrackPopupMenu
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
IsWindowVisible
CallWindowProcW
GetMessagePos
CheckDlgButton
LoadCursorW
SetCursor
GetSysColor
SetWindowPos
GetWindowLongW
IsWindowEnabled
SetClassLongW
GetSystemMenu
EnableMenuItem
GetWindowRect
ScreenToClient
EndDialog
RegisterClassW
SystemParametersInfoW
CharPrevW
GetClassInfoW
DialogBoxParamW
CharNextW
ExitWindowsEx
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
FindWindowExW
IsWindow
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
ReleaseDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
GetClientRect
FillRect
DrawTextW
EndPaint
CharNextA
wsprintfA
DispatchMessageW
CreateWindowExW
PeekMessageW
GetSystemMetrics
gdi32
GetDeviceCaps
SetBkColor
SelectObject
DeleteObject
CreateBrushIndirect
CreateFontIndirectW
SetBkMode
SetTextColor
kernel32
lstrcmpiA
CreateFileW
GetTempFileNameW
RemoveDirectoryW
CreateProcessW
CreateDirectoryW
GetLastError
CreateThread
GlobalLock
GlobalUnlock
GetDiskFreeSpaceW
WideCharToMultiByte
lstrcpynW
lstrlenW
SetErrorMode
GetVersionExW
GetCommandLineW
GetTempPathW
GetWindowsDirectoryW
WriteFile
CopyFileW
ExitProcess
GetCurrentProcess
GetModuleFileNameW
GetFileSize
GetTickCount
Sleep
SetFileAttributesW
GetFileAttributesW
SetCurrentDirectoryW
MoveFileW
GetFullPathNameW
GetShortPathNameW
SearchPathW
CompareFileTime
SetFileTime
CloseHandle
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalFree
GlobalAlloc
GetModuleHandleW
LoadLibraryExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
lstrlenA
MultiByteToWideChar
ReadFile
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW
MulDiv
lstrcpyA
MoveFileExW
lstrcatW
GetSystemDirectoryW
GetProcAddress
GetModuleHandleA
GetExitCodeProcess
WaitForSingleObject
SetEnvironmentVariableW
Name
.text
Size
25KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
126KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
180KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
172KB
Virtual Size
172KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=163, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
$PLUGINSDIR/System.dll
- IMPHASH 509a34b3a68a773e0afb4259e68f9f82
- SHA256 9111099efe9d5c9b391dc132b2faf0a3851a760d4106d5368e30ac744eb42706
- MD5 4add245d4ba34b04f213409bfe504c07
- SHA1 ef756d6581d70e87d58cc4982e3f4d18e0ea5b09
- SHA512 1bd260cabe5ea3cefbbc675162f30092ab157893510f45a1b571489e03ebb2903c55f64f89812754d3fe03c8f10012b8078d1261a7e73ac1f87c82f714bce03d
- SSDEEP 192:VjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZv0QPi:B/Qlt7wiij/lMRv/9V4bvr
- TLSH T188426C1297B089F2F551493419667F2A6FBEAC5D27F405A3CFE304C63D212DBA879243
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
10879
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GlobalAlloc
GlobalFree
GlobalSize
lstrcpynW
lstrcpyW
GetProcAddress
WideCharToMultiByte
VirtualFree
FreeLibrary
lstrlenW
LoadLibraryW
GetModuleHandleW
MultiByteToWideChar
VirtualAlloc
VirtualProtect
GetLastError
user32
wsprintfW
ole32
StringFromGUID2
CLSIDFromString
Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc
Name
.text
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
867B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
120B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1024B
Virtual Size
662B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=14, version=7299,
count=20, id=1, productName=Unmarked objects,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=4, id=48, version=9044,
count=1, id=42, version=8803,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
Havkatten
- SHA256 7ad729c9837344977eea250013f9c5c28c716c7c700c7065dde0418e90534197
- MD5 52adb86612dd93777e52bad8f69e816a
- SHA1 a71f4a16bd441f12436f3e5835117d3bbfc81927
- SHA512 c70d7b4fb28aa7c28620c37c1f21c4b7e65dfbabfa263dd9259fc702bde7582ec1208a6f2e4e40ba38596d5c0e4a0b817c6844f59acc55104c7d3d7285ea3f4f
- SSDEEP 6144:wRf6Qr2r+/H7pTUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUXbTHgMzNnG:wRf5Cr+/bpTUUUUUUUUUUUUUUUUUUUU2
- TLSH T16A34A0E53E2F4CB4B44F9726104EA4F6D974DE077D8762B1F05EA881E8A2702F069DE4
- MD5 SHA1 SHA512 SSDEEP TLSH
Pertainment/Quanti
- SHA256 426ca842eae311bd4e4ebfc577ada7b82c1bbd7328c62cb04c05f73a22086500
- MD5 74043b49ec252405fd8b88cdb809a0cc
- SHA1 af43203a76958dcea8b57cd30f8925c84c12ba9a
- SHA512 35c3e55e8ee5b939a197b1b7f38f93e22cc99811d3578a818e03aa9a1458d976e9048c9bf8360c2897c8f5f266792f9850c447620ee832520702ef81da008173
- SSDEEP 3072:lp6EJyRSsVfZKo2C6ujbebwNPR3XhZCYtQB:lpDy1fZKDlbwNPlXLDQB
- TLSH T12404BE96D7568CFFCC078538C46F61E65C6970265B0FE0BDB276A914C2872E363206BE
- MD5 SHA1 SHA512 SSDEEP TLSH
Pertainment/Tnkepausens.lon
- SHA256 674851cd79721372b05a81c945ab8ff2875eb7b45e769711c1076591db963b8d
- MD5 e95273218cfab62f2018f761d4f9b36b
- SHA1 e6994fecc4778bca67e8377c6492878fb80a3e7f
- SHA512 a562b4e08bc9824cfbe18d20e3454d0d9f89d8c90c2df91c2cb320d4c5c9185613cc48ce95f4e5536cd071797d20d9ef26ff55b5a0d787b39338ba47dcc2e96e
- SSDEEP 48:KjkW1di+FoCDNcAzJLLby6lRgwXde7AwbQhrba:m1kAoCDNcAzJLLby63tkGA
- TLSH T1A5F2988154B3AE13D1E8776375AF55D4F0844C553266FA4498609D11D52F551343892F
- MD5 SHA1 SHA512 SSDEEP TLSH
Pertainment/slidendes.arv
- SHA256 478efdb2c6ae009f497201f24c35f2f2351dcdbe5724bd80c9c98e930176d5df
- MD5 94a6050f24901706a77ced0ec088e6ee
- SHA1 c16d44ef0c32bfe2fa5cc69dded567c4e3885307
- SHA512 d7324920fbc629f0fd7351f0489df9781f12e3f5a392c2cb1907c78d69ae2d0cf3a715f0b670b520b85e93c2002e4d82d8258f79000530e5d0676eca2273b37e
- SSDEEP 48:rCOd50ciWjlJlles9jirNf4uEoYRXo72tnpeFqIJy/HZR5wef:rt5hlJysjirtHEXo7qnMcNfZRJ
- TLSH T1E35309C660E51A53A09A1541FBEA1E84ED51B6918AB19B4094103F02CF87F7D6FB0B17
- MD5 SHA1 SHA512 SSDEEP TLSH