Salary_Increase_Sheet.zip
- SHA256 a853d305a3ca55138f9d1ad78e0991cb5bcdfb4e45e42873e46a88e74cc71c8b
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Salary_Increase_Sheet-Pdf.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
Salary_Increase_Sheet-Pdf.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target Salary_Increase_Sheet.zip
- Size 262KB
- Sample260910-pssa5scl7w
- SHA256 a853d305a3ca55138f9d1ad78e0991cb5bcdfb4e45e42873e46a88e74cc71c8b
- MD5 8cba58f1a25d0932cb5cbea54d06573e
- SHA1 34b0dc2bd5f80c529584efdf8576bb3c6acc956d
- SHA512 6c75a1fd39b9567505ad189f2425af7e69fc9bf0db4a8d79465084ec125c63f7ffa369347b844e1cd7461e32247abd2ff39eb05d9f878a2e27dad23da97cf927
- SSDEEP 6144:CVj8lKEQz3AhTUyA/qBE2nFX+e22YWy1lgDsJgTDKC:URrCFH2/Wy1yDsJgTWC
- TLSH T1AE442331594E3F080D6B9D3B7C03FA3A7BE9942B470FA2795B5F964C10800DE62B6AD5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack002/Salary_Increase_Sheet-Pdf.bat unpack003/$PLUGINSDIR/System.dll
File Explorer
-
Salary_Increase_Sheet.zip.zip 262KB
-
Salary_Increase_Sheet/Salary_Increase_Sheet_Pdf.gz.zip 261KB
-
Salary_Increase_Sheet-Pdf.bat.exe 291KB
-
$PLUGINSDIR/System.dll.dll 12KB
-
Dinglet66KB
-
Skarphedsdybdens219KB
-
Skraatstilledes.tra6KB
-
Zabism97.imi37KB
-
dumping.gau70KB
-
venire.ove64KB
Salary_Increase_Sheet/Salary_Increase_Sheet_Pdf.gz
- SHA256 156300dfe874fb72b20c4c95fcefe744035ee6d936bd8407afb6126c348012c7
- MD5 d9da7ae8e46d01cee04746e1f0f1462d
- SHA1 c069974d506b951d3ae7d05633105744f3ad7395
- SHA512 9f4796645d89c7d99f5a2c495a4b9cae47e1e012f1af7ca4fc3daa89a0fe77f3ba346e2c81b3b543a480cee24b9871687e7d912955ec5a223f8e85fcddee89ec
- SSDEEP 6144:KVj8lKEQz3AhTUyA/qBE2nFX+e22YWy1lgDsJgTDKe:MRrCFH2/Wy1yDsJgTWe
- TLSH T1124423315A4E3F080D6B9D277C03FB3977EA942B470FA2695B5F964C10800DE62B6AD5
- MD5 SHA1 SHA512 SSDEEP TLSH
Salary_Increase_Sheet-Pdf.bat
- IMPHASH 573bb7b41bc641bd95c0f5eec13c233b
- SHA256 c2c92d04719006818e5ddddece2df924dfbd1b8441ec4a43aca487c876538d19
- MD5 65e130eb9ca48fb34ac8acf2fddaf451
- SHA1 7dd9b6ec16bfe16eeb48a829f3339ab7e488b2ac
- SHA512 dcaaabe3f131c75a9a89b02504482103939d9062f090db70b65a43170163da39877de3d2bff2bf7349eaadad5df236c751910931085e9cdd1e97397da828fa54
- SSDEEP 6144:F+MvoJXYsbLSYYdtqcVnTUyA/2BE2nFXue22YWyblRDsJgTDKg:F+FHbLSftVQr+F32/WybvDsJgTWg
- TLSH T14C5401117BC4DA2BCA661631AC73D7322BB9B936875B570B77847F0C7CA22C19D1D282
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
13655
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
advapi32
RegEnumValueW
RegEnumKeyW
RegQueryValueExW
RegSetValueExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
RegOpenKeyExW
RegCreateKeyExW
shell32
SHGetPathFromIDListW
SHBrowseForFolderW
SHGetFileInfoW
SHFileOperationW
ShellExecuteExW
ole32
CoCreateInstance
OleUninitialize
OleInitialize
IIDFromString
CoTaskMemFree
comctl32
ImageList_Destroy
ord17
ImageList_AddMasked
ImageList_Create
user32
MessageBoxIndirectW
GetDlgItemTextW
SetDlgItemTextW
CreatePopupMenu
AppendMenuW
TrackPopupMenu
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
IsWindowVisible
CallWindowProcW
GetMessagePos
CheckDlgButton
LoadCursorW
SetCursor
GetSysColor
SetWindowPos
GetWindowLongW
IsWindowEnabled
SetClassLongW
GetSystemMenu
EnableMenuItem
GetWindowRect
ScreenToClient
EndDialog
RegisterClassW
SystemParametersInfoW
CharPrevW
GetClassInfoW
DialogBoxParamW
CharNextW
ExitWindowsEx
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
FindWindowExW
IsWindow
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
ReleaseDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
GetClientRect
FillRect
DrawTextW
EndPaint
CharNextA
wsprintfA
DispatchMessageW
CreateWindowExW
PeekMessageW
GetSystemMetrics
gdi32
GetDeviceCaps
SetBkColor
SelectObject
DeleteObject
CreateBrushIndirect
CreateFontIndirectW
SetBkMode
SetTextColor
kernel32
lstrcmpiA
CreateFileW
GetTempFileNameW
RemoveDirectoryW
CreateProcessW
CreateDirectoryW
CreateThread
GlobalLock
GlobalUnlock
GetDiskFreeSpaceW
WideCharToMultiByte
lstrcpynW
lstrlenW
SetErrorMode
GetVersionExW
GetCommandLineW
GetTempPathW
GetWindowsDirectoryW
SetEnvironmentVariableW
WriteFile
ExitProcess
GetCurrentProcess
GetModuleFileNameW
GetLastError
GetFileSize
GetTickCount
Sleep
SetFileAttributesW
GetFileAttributesW
SetCurrentDirectoryW
MoveFileW
GetFullPathNameW
GetShortPathNameW
SearchPathW
CompareFileTime
SetFileTime
CloseHandle
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalFree
GlobalAlloc
GetModuleHandleW
LoadLibraryExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
lstrlenA
MultiByteToWideChar
ReadFile
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW
MulDiv
lstrcpyA
MoveFileExW
lstrcatW
GetSystemDirectoryW
GetProcAddress
GetModuleHandleA
GetExitCodeProcess
WaitForSingleObject
CopyFileW
Name
.text
Size
25KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
126KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
192KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
40KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=163, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
$PLUGINSDIR/System.dll
- IMPHASH 509a34b3a68a773e0afb4259e68f9f82
- SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
- MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
- SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
- SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
- SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
- TLSH T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
10879
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GlobalAlloc
GlobalFree
GlobalSize
lstrcpynW
lstrcpyW
GetProcAddress
WideCharToMultiByte
VirtualFree
FreeLibrary
lstrlenW
LoadLibraryW
GetModuleHandleW
MultiByteToWideChar
VirtualAlloc
VirtualProtect
GetLastError
user32
wsprintfW
ole32
StringFromGUID2
CLSIDFromString
Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc
Name
.text
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
867B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
120B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1024B
Virtual Size
662B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=14, version=7299,
count=20, id=1, productName=Unmarked objects,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=4, id=48, version=9044,
count=1, id=42, version=8803,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
Dinglet
- SHA256 942721f9dafb2371361ece703ad7132e746a9db8a63ef5327543ad9c9750d788
- MD5 f35e2c77c23a4746f46c2a2bc232b732
- SHA1 155d1b92f22c8b0a9f10491da62d8d3801bc385e
- SHA512 d51d305115823538314dff90c6f0a2c25a110e7bb395eda30c79412d1c3b4060f0b79d3e3dcb8bf0fb0174c2e40c73678ba0dd1eef320454171e6b4b76277265
- SSDEEP 768:LZtoyP9a8hRcFf3R+REmovMspMPUqFADgjzyl0lKXyOARkjvVNNqTAsGxe0Eb2:joy/hR4bm7NPRcy2l/XytRGUAFG2
- TLSH T1E763AFD1C76A9CFBCC07D534D5AA15AA4C94B0225B8FE0BFE161AC24C05A6D263707EE
- MD5 SHA1 SHA512 SSDEEP TLSH
Skarphedsdybdens
- SHA256 3386d0c37865147a24f5e39b3b7b2295f3d4ad54bde615beccbd99e1cc6c8c90
- MD5 0f19dbd1e170d4afe0b70b3fe9eec0f8
- SHA1 794579ea0eae75f590ca826d38305d3da18021c2
- SHA512 3446145645434876d59def7abb92e13fb258f6d9f12add21077aae15dd36ca38b3d363c58e903382a28407a6d07e7919c77659b541a5da964f943df783b46983
- SSDEEP 6144:pPvmHilZRyjUKVkIbiwe3UmAAbW9uOK7fX:pPvttyjXbXekmAA0u/
- TLSH T12924D0055FB995A8CD80843DD58B416CB6B0FDC0AE590DB321693EFFABB107B710B889
- MD5 SHA1 SHA512 SSDEEP TLSH
Skraatstilledes.tra
- SHA256 a640e9c0c32704edc8892f2a0233247a34ce14ccd5000f915e759352cc27511b
- MD5 3a13747e6e8c0835b44f319c184c47b8
- SHA1 31734441231545c81c4dd7cdcba5d9ed78946d8f
- SHA512 4fe482e4dab7847d7d05de0d09180a35e528b985f2fa59a210c3394ab518f9977b74333006741338dccd09fe61a617bf7a64e15ca289da5632043fd49d7a21da
- SSDEEP 6:yswgqyUndYinYWnnmKn+nnwnLsEwUM+WEnnSc:yswgFO3YWnf+nwLR1M+WEnSc
- TLSH T134E1807ED90064496B9C758300D51773A553F5846587CF1434560719974795BFD84250
- MD5 SHA1 SHA512 SSDEEP TLSH
Zabism97.imi
- SHA256 814203249daf8ad8cdd32ba983a3a05adcbe81282b7af07b1f18d4f8fbb7af08
- MD5 65c1d02475825597ddcd2fa037f2e8ed
- SHA1 120d401357f3e00b1ceeef3ba3a6a9347357c5dc
- SHA512 3e53248b30c470bb9d74ae381fa447aa1fb3ae7b8aa9c67556dec82913843972dac27450ee5009f51e0ceac962eb12b7385018cf77e6a696262235e621607843
- SSDEEP 12:J4jYYXSxXT497OeXCZdtL3KehAX5gSY1XZ4Uz4slUa/X5IgK2QXkXKussouogUbX:JuPI2CZr6t56d9lH5cDneSaVVkT+g3
- TLSH T19303C87A144D55C4460836B90AB5C3EB5F0550DEBF5D82D23FEC11E57749E407393D10
- MD5 SHA1 SHA512 SSDEEP TLSH
dumping.gau
- SHA256 7dafca89d92b505e37e7fc7c8a58b67734eea7d1959be661fd4c855b732088cd
- MD5 44de0ecfc069cff4504a830ddacab473
- SHA1 53e9a1524d60af7a45f79fe25eb2ce0e3cbc9e43
- SHA512 83fc1cce55dc375157fd2c7edf7b32051b46ffc35b1563b1cf32ee61585b2c08b1cccfdc866ffac2009de0038df39221497b60ed2034c179160211f7ba49006e
- SSDEEP 48:hmBp3yIBUNWuQ6nP8B6QVDDQ/RzHUKokWbF:q+dQ6nPVQVXeHWTJ
- TLSH T18E63FA6B51208D2082042DF48652176F21678D83992D3A86AF639F97B595C57CC80EED
- MD5 SHA1 SHA512 SSDEEP TLSH
venire.ove
- SHA256 5063e136fb2bf3da37fe67295e07e25bd95432c2b106c432a1ea062752fa50b2
- MD5 abae955e1f253b558c033477bdfa7457
- SHA1 2acbabf8864f4dc49d19dd98bf7ad0e42592eba8
- SHA512 57f5f5b57027aa8c381f5c398453066508d2964b14434453861ab7d5ef694428872d8d8c3802a26824fa2cf56ab93259d23d8637049da412a1cd79cf4b5bd5e0
- SSDEEP 48:YAQGOUZoNEf9zZIyr6J9nd/ILom+MCb3mdvu/2CP+a3WoM//jHO:PwNQO9dAL8Lv/2I8HO
- TLSH T111532A4DD89F2163A76F05F23AB09D52D0B056DDF8DE34176C1D51EEA89CC780A12052
- MD5 SHA1 SHA512 SSDEEP TLSH