COA_8kgGabapentin_Emcure.gz.rar
- SHA256 1618d7820a4d09a45133da3bb689a9e74d4279d642277ec18b6f97c2cb104081
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
COA_8kgGabapentin_Emcure.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
COA_8kgGabapentin_Emcure.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target COA_8kgGabapentin_Emcure.gz.rar
- Size 167KB
- Sample261014-s31xtaxvbx
- SHA256 1618d7820a4d09a45133da3bb689a9e74d4279d642277ec18b6f97c2cb104081
- MD5 4bc438dcaff968677713ca35c7bd587b
- SHA1 a717c77c81f9b764f0fd6e9283e58eb2afe83962
- SHA512 a2c4de48221f8c979f734d916af7abb0fee9925be288071cab37bb97ce7f9d36c75b5fcfc0ba23dbe07102f205b1951e15adbd042468fd51ebc670a02df81158
- SSDEEP 3072:nSR4qzCA5iXeijvSo9oXRDb4jKu96j0UvIYiOpOX4IwNFIimefl16Bv/MvMCCt:nSR4KguiLHg8WuOBDIimeP6hkvMJ
- TLSH T11CF31233E2F67170F17AAE891CB95FB4815105D42E7EAE124D483A7C3792B36D8B8096
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/$PLUGINSDIR/System.dll - Untrusted Codesign Signers 1 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/COA_8kgGabapentin_Emcure.exe
File Explorer
-
COA_8kgGabapentin_Emcure.gz.rar.rar 167KB
-
COA_8kgGabapentin_Emcure.exe.exe 189KB
-
$PLUGINSDIR/System.dll.dll 12KB
-
Disappointment155KB
-
Prjudicielle.bol45KB
-
Skulapslanges165.con35KB
-
Underhandlers.mer55KB
-
sprgelystnes.pim39KB
COA_8kgGabapentin_Emcure.exe
- IMPHASH b34f154ec913d2d2c435cbd644e91687
- SHA256 d19aec3e4cdc4a3e9d59a7f535891b5d00d2cbd6cbe403800625ba5536ee4534
- MD5 8da0682a940f6fe660af38de8e003111
- SHA1 bcf93d6e09d1f50f5c32565b1e9e4486af6a5e4d
- SHA512 bb3b7ae30e1317cb6e925e8bdef3763855b13a6fd571e271ee65d43e26a3393839b1175011c20bc5b8b47b163c297818773c6723508120642d82991217c98f8a
- SSDEEP 3072:SyRSasbGzCs/Tt5uO45877Z+0P/g6t4ZVN3d2Xz7YKmhcfzmGXGDgcRq3cadv/1+:Sm5lz/Nl0Ght4DNKShc7XiDq33wHBs5g
- TLSH T15214020177A2C0B7DA719E320D7696B66BB766AC1090DB230760EB5D3D723D2C62D3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
35:a2:5f:a7:46:e0:db:a8:d8:ba:9e:4a:1f:5b:87:d9:83:b2:9c:aa
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Nobbut,OU=Dimitted Armgangens Svrindustrier\ ,O=Nobbut,C=FR
Chains
Oct 7, 2026
CN=Nobbut,OU=Dimitted Armgangens Svrindustrier\ ,O=Nobbut,C=FR
Subject
CN=Nobbut,OU=Dimitted Armgangens Svrindustrier\ ,O=Nobbut,C=FR
Serial Number
21:51:8c:e7:fa:05:da:8a:b9:36:64:c0:48:48:40:37:e5:56:74:fe
Issuer
CN=Nobbut,OU=Dimitted Armgangens Svrindustrier\ ,O=Nobbut,C=FR
Revocation Status
Not revoked
Timespan
Aug 4, 2026 - Aug 4, 2027
Minor OS version
0
Major OS version
4
Entry point
13145
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
SetEnvironmentVariableW
SetFileAttributesW
Sleep
GetTickCount
GetFileSize
GetModuleFileNameW
GetCurrentProcess
CopyFileW
SetCurrentDirectoryW
GetFileAttributesW
GetWindowsDirectoryW
GetTempPathW
GetCommandLineW
GetVersion
SetErrorMode
lstrlenW
lstrcpynW
GetDiskFreeSpaceW
ExitProcess
GetShortPathNameW
CreateThread
GetLastError
CreateDirectoryW
CreateProcessW
RemoveDirectoryW
lstrcmpiA
CreateFileW
GetTempFileNameW
WriteFile
lstrcpyA
MoveFileExW
lstrcatW
GetSystemDirectoryW
GetProcAddress
GetModuleHandleA
GetExitCodeProcess
WaitForSingleObject
lstrcmpiW
MoveFileW
GetFullPathNameW
SetFileTime
SearchPathW
CompareFileTime
lstrcmpW
CloseHandle
ExpandEnvironmentStringsW
GlobalFree
GlobalLock
GlobalUnlock
GlobalAlloc
FindFirstFileW
FindNextFileW
DeleteFileW
SetFilePointer
ReadFile
FindClose
lstrlenA
MulDiv
MultiByteToWideChar
WideCharToMultiByte
GetPrivateProfileStringW
WritePrivateProfileStringW
FreeLibrary
LoadLibraryExW
GetModuleHandleW
user32
GetSystemMenu
SetClassLongW
EnableMenuItem
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongW
SetCursor
LoadCursorW
CheckDlgButton
GetMessagePos
LoadBitmapW
CallWindowProcW
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
ScreenToClient
GetWindowRect
GetDlgItem
GetSystemMetrics
SetDlgItemTextW
GetDlgItemTextW
MessageBoxIndirectW
CharPrevW
CharNextA
wsprintfA
DispatchMessageW
PeekMessageW
ReleaseDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
GetClientRect
FillRect
DrawTextW
EndDialog
RegisterClassW
SystemParametersInfoW
CreateWindowExW
GetClassInfoW
DialogBoxParamW
CharNextW
ExitWindowsEx
DestroyWindow
GetDC
SetTimer
SetWindowTextW
LoadImageW
SetForegroundWindow
ShowWindow
IsWindow
SetWindowLongW
FindWindowExW
TrackPopupMenu
AppendMenuW
CreatePopupMenu
EndPaint
CreateDialogParamW
SendMessageTimeoutW
wsprintfW
PostQuitMessage
gdi32
SelectObject
SetBkMode
CreateFontIndirectW
SetTextColor
DeleteObject
GetDeviceCaps
CreateBrushIndirect
SetBkColor
shell32
SHGetSpecialFolderLocation
ShellExecuteExW
SHGetPathFromIDListW
SHBrowseForFolderW
SHGetFileInfoW
SHFileOperationW
advapi32
AdjustTokenPrivileges
RegCreateKeyExW
RegOpenKeyExW
SetFileSecurityW
OpenProcessToken
LookupPrivilegeValueW
RegEnumValueW
RegDeleteKeyW
RegDeleteValueW
RegCloseKey
RegSetValueExW
RegQueryValueExW
RegEnumKeyW
comctl32
ImageList_Create
ImageList_AddMasked
ImageList_Destroy
ord17
ole32
OleUninitialize
OleInitialize
CoTaskMemFree
CoCreateInstance
Name
.text
Size
25KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
128KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
176KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
18KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=165, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
$PLUGINSDIR/System.dll
- IMPHASH fc0224e99e736751432961db63a41b76
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
10643
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetModuleHandleW
GlobalFree
GlobalSize
lstrcpynW
lstrcpyW
GetProcAddress
WideCharToMultiByte
VirtualFree
FreeLibrary
lstrlenW
LoadLibraryW
GlobalAlloc
MultiByteToWideChar
VirtualAlloc
VirtualProtect
GetLastError
user32
wsprintfW
ole32
StringFromGUID2
CLSIDFromString
Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc
Name
.text
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
867B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
120B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1024B
Virtual Size
648B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=14, version=7299,
count=20, id=1, productName=Unmarked objects,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=4, id=48, version=9044,
count=1, id=42, version=8803,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
Disappointment
- SHA256 e804ed0360ac3714bb4f5bc59c28a8dea2ca262ac581c460c026a4e5ab56c00f
- MD5 8ff0053c8a56a44bfa0596496a4ea1b3
- SHA1 82e0b23d2adc76d52ae0a21ee0888658446b38c5
- SHA512 81ff0ccb0c3716e40f04ee1e6d211c533451a291a21aa33158eccfad2e0f5462831161008ca9a9420bc459ec1e06bb8b162a64b6964e510cdb4ab0a942f4fd85
- SSDEEP 3072:vGynZ/xOgWvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvsOxKFtP/7twY51J8inZGb5z:etBItP/JJ5Eb5CJLf63EStz
- TLSH T115F3E1106F20497FC422C634DBB8D63647A1363FB61DD9CE9970E9D480A37DAD8921AA
- MD5 SHA1 SHA512 SSDEEP TLSH
Prjudicielle.bol
- SHA256 dc8f3843f510cb52a187e138893826ade21a6f319fc5775dc937a6910c67c32e
- MD5 a8a2aa1d79f02338ed00de8dca1cd224
- SHA1 e5827b97697f6b36d72be3c638a6e9fa37e16077
- SHA512 a2b76196cb70bca438ff8dd69e58cec4bb787440a5f8ffd846b00bc81133121519e98ceac3dce99ed4beb9e09a116587a727a86492dac5ea5cd5fb2f5f21a0ad
- SSDEEP 48:rAei+v8YNN5M2/LdnPlZvuTkNV5Ow8S9WXNixKlhmJgn:rzTvbNN5X/LdnPlZvCklOwtWdipY
- TLSH T1522395C5F9F19FD85252A260460D0039EA4F94A24290A360FB1D3E63B37BD8A947A2D6
- MD5 SHA1 SHA512 SSDEEP TLSH
Skulapslanges165.con
- SHA256 30e34ee81ce179874b22f5c641c4ddb11337ab0dbb670f33edbc2784ffb404c9
- MD5 e2af0416cfe1e2ec20e26b41395758a8
- SHA1 eb10c169529dcf4a034b27870fdd730316435dcc
- SHA512 40025dea3074c318882afdaf2cf3859d70d4a3278415d0494615d5dd33a8e420eb56c9e18909018c5dfdff2f9b80a2348c9c9739ef8407ad8353399720cd150e
- SSDEEP 24:6UYlfHK3oRvo/it/6EffF9rHKsJ+nwXoSbN:to/6EHPHKB4oA
- TLSH T14BF2867BD2289D9321844F7011A74A2FB080498F62CB15DAE6B5B1C374BA6E2F8F15F1
- MD5 SHA1 SHA512 SSDEEP TLSH
Underhandlers.mer
- SHA256 592f38bbd70fa12ee2e589371d1803be6151c0e97dfca2c8c8ceae9c0ffa6766
- MD5 91eb9c51df63816c063088c44f995116
- SHA1 6625cd0166e00b84f35d2fca4c59478f7427945a
- SHA512 f588b2d3a95002232b93e4d0a479c1834415eb2126ab17459e1ce50718ee9239943f0b360fc78160a59dc3c2558d2ec743257a5feecf0a1e3d78a5bfaeee2901
- SSDEEP 48:yO+eqQ6WC0N8YZr4Pw2Ii8X28Y8/JzuFtEJMA6HQ:qK630N8YZ0PiicVY0JztJMA6HQ
- TLSH T170432BD2056AD62DCD9D3563EF161454397954B308D5C401F84FC914046B9457EEDBB0
- MD5 SHA1 SHA512 SSDEEP TLSH
sprgelystnes.pim
- SHA256 155c0fe268f1ab6edf6b9936faab6b6267283f4e166b345414f773d3b327ba5b
- MD5 5e57f0a8e59108f57443b15f6361ebca
- SHA1 1da1c3a1b332bc5e0cf0a78dc1ba374ac501b49a
- SHA512 50a07b7be4177b44a25061add0341a097a994d22fcb6562de3310c8d2a2719bf9e5e033432eaf88f3f777c64b3adbec474fe6b426f1cfaeb89ea8b98d216cab3
- SSDEEP 48:Xvx9v9vv3ZuGQRq29HyNIXyyQRSn/wbWraJMlJjJUsQxJ3G9:Xvvvxv3Z1Ql9H4NyQS/wSrdJjp9
- TLSH T14903DA1074B310A3CCDAD3983C1C1E6CBD29C2932A3CD2D59CCD54506CCA4627C34771
- MD5 SHA1 SHA512 SSDEEP TLSH