Ordine_Nr.2609301180.img
- SHA256 04b096e91da80e2359cadb83d2793e55c4916e8cd0696f89306bb8541524577a
Overview
overview
7Static
static
3Ordine_Nr....80.iso
windows10-2004-x64
3Ordine_Nr....80.iso
windows11-ltsc_2024-x64
3out.iso
windows10-2004-x64
3out.iso
windows11-ltsc_2024-x64
3Ordine_Nr....80.exe
windows10-2004-x64
7Ordine_Nr....80.exe
windows11-ltsc_2024-x64
7$PLUGINSDI...em.dll
windows10-2004-x64
1$PLUGINSDI...em.dll
windows11-ltsc_2024-x64
1Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Ordine_Nr.2609301180.iso
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
Ordine_Nr.2609301180.iso
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
out.iso
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
out.iso
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral5
Sample
Ordine_Nr.2609301180.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral6
Sample
Ordine_Nr.2609301180.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target Ordine_Nr.2609301180.img
- Size 1.2MB
- Sample261002-ldf3saeh25
- SHA256 04b096e91da80e2359cadb83d2793e55c4916e8cd0696f89306bb8541524577a
- MD5 9d46ae8a7a1921e597eb92040ea1a78d
- SHA1 14bafc092261f218e25083e89fbeb0bf77782469
- SHA512 5fc76ac5f50fd765d6a0bffc4b4f875385c7991108ece38403e6837f5477f8e4a200055781c06e8a8ea281704283eb12164af5c2e8b7903003f230d2fbe06fa6
- SSDEEP 12288:sLiFef3nrPwyr2wiNmVcPmqwK7J9NU3oiHIz:sECnIwiE+7rNU3oiHIz
- TLSH T15645F101FB0AA8CAD8B9853254BF41530930FCBD5660A25F739DFB2F9E70551CA3BA49
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack002/Ordine_Nr.2609301180.bat unpack003/$PLUGINSDIR/System.dll
File Explorer
-
Ordine_Nr.2609301180.img.iso 1.2MB
-
out.iso.iso 1.2MB
-
Ordine_Nr.2609301180.bat.exe 517KB
-
$PLUGINSDIR/System.dll.dll 25KB
-
Aas101.sab11KB
-
Sandweed457KB
-
Soliloquizers35KB
-
karkasse.inl1KB
-
militaristgr.gra83KB
-
ossein.mot14KB
out.iso
- SHA256 04b096e91da80e2359cadb83d2793e55c4916e8cd0696f89306bb8541524577a
- MD5 9d46ae8a7a1921e597eb92040ea1a78d
- SHA1 14bafc092261f218e25083e89fbeb0bf77782469
- SHA512 5fc76ac5f50fd765d6a0bffc4b4f875385c7991108ece38403e6837f5477f8e4a200055781c06e8a8ea281704283eb12164af5c2e8b7903003f230d2fbe06fa6
- SSDEEP 12288:sLiFef3nrPwyr2wiNmVcPmqwK7J9NU3oiHIz:sECnIwiE+7rNU3oiHIz
- TLSH T15645F101FB0AA8CAD8B9853254BF41530930FCBD5660A25F739DFB2F9E70551CA3BA49
- MD5 SHA1 SHA512 SSDEEP TLSH
Ordine_Nr.2609301180.bat
- IMPHASH 9be4f90f50c714bc00cc8beb2e137299
- SHA256 fc26d8cad2f9ca3a14fa4b18b008a0bfb172fe864eaa3a30a264936f0fda004d
- MD5 3a9088219d05fa133928e933f83be3e6
- SHA1 a53ee472be0b818d6a8c2528cd200cb01bac5f65
- SHA512 5cd20a967606dd56b404d62d2d3dcea4b2290e00232c341cc54e6a3edef506805e6cc552e2b7736f31897f6dbc230b78bd1b422a476df157f432f83c60374ebb
- SSDEEP 12288:yLiFef3nrPwyr2wiNmVcPmqwK7J9NU3oiHIzq:yECnIwiE+7rNU3oiHIzq
- TLSH T199B40101FB0AA8CAD8B9853264BF41530920FCBD4664A25F6399FB3F9C70551DA3FB49
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
17760
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
advapi32
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
RegCloseKey
RegCreateKeyExW
RegDeleteKeyExW
RegDeleteValueW
RegEnumKeyW
RegEnumValueW
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
comctl32
ImageList_AddMasked
ImageList_Create
ImageList_Destroy
InitCommonControls
gdi32
CreateBrushIndirect
CreateFontIndirectW
DeleteObject
GetDeviceCaps
SelectObject
SetBkColor
SetBkMode
SetTextColor
kernel32
CloseHandle
CompareFileTime
CopyFileW
CreateDirectoryW
CreateFileW
CreateProcessW
CreateThread
DeleteFileW
ExitProcess
ExpandEnvironmentStringsW
FindClose
FindFirstFileW
FindNextFileW
FreeLibrary
GetCommandLineW
GetCurrentProcess
GetDiskFreeSpaceExW
GetExitCodeProcess
GetFileAttributesW
GetFileSize
GetFullPathNameW
GetLastError
GetLocalTime
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetPrivateProfileStringW
GetProcAddress
GetShortPathNameW
GetSystemDirectoryW
GetTempFileNameW
GetTempPathW
GetTickCount
GetUserDefaultUILanguage
GetVersionExW
GetWindowsDirectoryW
GlobalAlloc
GlobalFree
GlobalLock
GlobalUnlock
LoadLibraryExW
MoveFileExW
MoveFileW
MulDiv
MultiByteToWideChar
ReadFile
RemoveDirectoryW
SearchPathW
SetCurrentDirectoryW
SetEnvironmentVariableW
SetErrorMode
SetFileAttributesW
SetFilePointer
SetFileTime
Sleep
WaitForSingleObject
WideCharToMultiByte
WriteFile
WritePrivateProfileStringW
lstrcatW
lstrcmpW
lstrcmpiA
lstrcmpiW
lstrcpynW
lstrlenA
lstrlenW
ole32
CoCreateInstance
CoTaskMemFree
OleInitialize
OleUninitialize
shell32
SHBrowseForFolderW
SHCLSIDFromString
SHFileOperationW
SHGetFileInfoW
SHGetPathFromIDListW
ShellExecuteExW
user32
AppendMenuW
BeginPaint
CallWindowProcW
CharNextA
CharNextW
CharPrevW
CheckDlgButton
CloseClipboard
CreateDialogParamW
CreatePopupMenu
CreateWindowExW
DefWindowProcW
DestroyWindow
DialogBoxParamW
DispatchMessageW
DrawTextW
EmptyClipboard
EnableMenuItem
EnableWindow
EndDialog
EndPaint
ExitWindowsEx
FillRect
FindWindowExW
GetAsyncKeyState
GetClassInfoW
GetClientRect
GetDC
GetDlgItem
GetDlgItemTextW
GetMessagePos
GetSysColor
GetSystemMenu
GetSystemMetrics
GetWindowLongPtrW
GetWindowRect
InvalidateRect
IsDlgButtonChecked
IsWindow
IsWindowEnabled
IsWindowVisible
LoadCursorW
LoadImageW
MessageBoxIndirectW
OpenClipboard
PeekMessageW
PostQuitMessage
RegisterClassW
ReleaseDC
ScreenToClient
SendMessageTimeoutW
SendMessageW
SetClassLongPtrW
SetClipboardData
SetCursor
SetDlgItemTextW
SetForegroundWindow
SetTimer
SetWindowLongPtrW
SetWindowPos
SetWindowTextW
ShowWindow
SystemParametersInfoW
TrackPopupMenu
wsprintfW
wvsprintfW
Name
.text
Size
35KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
352B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
35KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
240KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
512B
Virtual Size
840KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
96KB
Virtual Size
96KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
$PLUGINSDIR/System.dll
- IMPHASH cf8eee620b3371ff06e99c34f39ea84c
- SHA256 29379ece432ccb81e22e57d7b5a8a77951c985495a931827f01771cf60b8b438
- MD5 9b3a5adad3c54468b976f683ef28aae4
- SHA1 e6ce3ed9fa51474ca560c41075be8cd52ae81e46
- SHA512 338ac47163f4c74af5c46318abf9d2a86febeeba4966ba2f3bcc5edc95ca373e253b3214fdcf349a13d431852b052d5910947ee9a63797ca4da0ba8333db4929
- SSDEEP 384:5Z2pfUx9eVLwDKO9XYD/isN7lCEjgwMU/ktKi+R45Duwomq8pqdDvHG1Q:5r96YIrx7lC7vU/kaG9uLmCdb
- TLSH T1A8B24C07F38398BFC50BC17186EF5772AA32BE211B616F6F1220F5756E24E90871DA14
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
12726
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
PDB paths
kernel32
DeleteCriticalSection
EnterCriticalSection
FreeLibrary
GetLastError
GetModuleHandleW
GetProcAddress
GlobalAlloc
GlobalFree
GlobalSize
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryW
MultiByteToWideChar
Sleep
TlsGetValue
VirtualFree
VirtualProtect
VirtualQuery
WideCharToMultiByte
lstrcpyW
lstrcpynW
lstrlenW
msvcrt
__iob_func
_amsg_exit
_initterm
_lock
_unlock
abort
calloc
free
fwrite
realloc
strlen
strncmp
vfprintf
ole32
CLSIDFromString
StringFromGUID2
user32
wsprintfW
Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc
Name
.text
Size
14KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
112B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
1024B
Virtual Size
916B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
384B
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
512B
Virtual Size
179B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
88B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
104B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
Aas101.sab
- SHA256 6f67651bd6eb3983955725be71aac668a82bd7de6b1565037a68b8f13842b644
- MD5 90acd6579ce9293530af30a2ac223848
- SHA1 993ee148d98739a73be91587aae80b4d496e3568
- SHA512 5e07fa0a9bd3399211b38472a3203321e85a5889d3bdb4074110a733b76e14665689961357f6b86cf7e7620ccef283222f5a7378d434050549aecf43f05898ed
- SSDEEP 12:KMubs5jT+vYUc4ynia4AnA9QnusMWdS6tNvtEO0nn:KMuwF2ToiIJnus3dBjB0nn
- TLSH T19D32C0D88E8E5A836729229395845B51D527D936890A2833F61A06287A710A430B3257
- MD5 SHA1 SHA512 SSDEEP TLSH
Sandweed
- SHA256 f0f8cce690ee3c56f372a3f11fcda78384b87d264220bff60b264c646601e4ad
- MD5 93cc713b6dc889abc74e34a617439e4b
- SHA1 97a5df7ac825ffb827081dd430f884f4b43c4ce1
- SHA512 cb21c933ece069a67762eb3673a683ce54c29b4942292771b29ef67b9d8cc88aef7b6653590c69e8839f815fa524f9e1027a2db8037fd086f94d3cd6f6193ff9
- SSDEEP 12288:bHmNXJFsNQ96/rLQokzjimJvoe2BZyIUdU7:bHcXJF8b/rUoUbtIUde
- TLSH T114A4AD742CA61921FEB19DF7CC6D61D1808C01BE4209FC8566B68BA0B6DF064B9F7DD2
- MD5 SHA1 SHA512 SSDEEP TLSH
Soliloquizers
- SHA256 fa2d8492eee1068816a955aa2a2d08f3b04575786a6919e3b85b89ba606f95ae
- MD5 4e44b159d197ea81ea3e529ebde9a8fc
- SHA1 a415347c9254c461c552169ef8eb7a9c585ed603
- SHA512 61b36f7666c24bb8a361753a84cb954013af6d681183138a97bb4c9b7b755211612a98fe11b622e40889a13113c491b8d7aa71f67e820b177f81db6b9ccf2c2f
- SSDEEP 768:wDX3Yg9ExtiMKjFokLnQSV/EmgUE6S7HVdFKbhVwRxIz4ZefXPJOCidXEx:wDH0ixoynDEtv4mhRRE
- TLSH T17DF24A5071CD89E0F61A5984BA74FF7202733973AFCA1CD22224F6408ABF6553A4DA5F
- MD5 SHA1 SHA512 SSDEEP TLSH
karkasse.inl
- SHA256 0b632f104095dd6b65eea75820606163e02d33f8a13e1dbe36fa476bf743054f
- MD5 ec90cfd50b88cabb63033549bd5e6f66
- SHA1 bd8b95785589ca84c07a8c3a48c0568f0340fb9c
- SHA512 99b8a72581c5b8784974878f6cb87d926130f4afc2fc83004357f8ec2738710daad70f0e1631380f1be656c3c7ec939be47114f8f8b698c993605dfb3cb9bd00
- TLSH T11D310208427204E51CCC4E9A4233023347320543177CEA215D00115A12C35D91368089
- MD5 SHA1 SHA512 TLSH
militaristgr.gra
- SHA256 40575066a8be661cdf008bb843b6ca430a4a8e2f55fb2113e1ba4ee827ac9acf
- MD5 b87bf0bebeeb1763c949ef29b80b3ba1
- SHA1 b2496f97dfa48c3772615193c9a17f84288c6867
- SHA512 50f31a53c6ab181a3105820ecd280d9c0367968df3f1d50a2aabf7e96612067dbbd2c4b8afe1fbafa9e245625241ea479431239daec6ed0971eb3338f836856d
- SSDEEP 48:I5MwPTQZwSBTIYTenIZscVtt6cAov9Re2bqfch0CrIeXCABqZ3XT:5HIYKnEt6cAW9Fbqfch0BezUVXT
- TLSH T1418319719960B64C3D0641E9E0BFA5A3528DA290AB51DC95D1E3BF47B8F0FC31F51821
- MD5 SHA1 SHA512 SSDEEP TLSH
ossein.mot
- SHA256 51f51826991b79c995ce3759775da09ace60376e261bd0b54d3c769cdb8778f1
- MD5 bb087160bb6d683d466a7e002f893b4a
- SHA1 a02154db058f46f4b25e4ba4c1638c1049e7e23b
- SHA512 81cbf69cd12277d63095a899ae50a360b6085cd2ba1671fd71b14664c595bf6b08143163bbbc08544069f63f383c1acf74d22d15b9ad7d21bd3cfa44eb14a5c1
- SSDEEP 6:wf8NOvwrEwOOlOP8ews8FZwwi8e+8OwhOR8tsjgOZOI8xVSs8ttQD8kXQ8OfO1WQ:wfQ9wss01iA6AOs//sOA/776xgqEh
- TLSH T1A862A3A86BC1F6E919FCBD71C47CAF04C58474119DD8EB5099C56222F33C9945006E55
- MD5 SHA1 SHA512 SSDEEP TLSH