oeinternal.rar
- SHA256 81da8b1a5ff5f7cd3db0a25a7d5464be28d610aea36cef0c781d2210e067d32b
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Growzernal.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
Growzernal.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
Inzector.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
Inzector.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral5
Sample
loader.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
loader.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target oeinternal.rar
- Size 1.5MB
- Sample261030-wb591ady4x
- SHA256 81da8b1a5ff5f7cd3db0a25a7d5464be28d610aea36cef0c781d2210e067d32b
- MD5 6e7d4c1b3f893e11bffc844ffa6b7644
- SHA1 5d9df5904b288d88ef073e0071f630a11f352578
- SHA512 1700fdeeccb65aa4bea0eced4efc7124b1e0f7ad6f5c16b119f6fd0d5c51a47b54029a614bc308a20fb63ef37c81876a965e5013b7dcb9ce206be4d78c7b4622
- SSDEEP 24576:DkU0jyt3I9gw80iN5ATSi3Jbz5G/F+KEXCUjnhBP//Gl7yBHnsmwV5i+CDBAtnsT:4fkxAT/3JBG8KMCAhBn/Gl74nWVotAtM
- TLSH T1A3753370CDF0C02FE51BE96217C809502F9FB44729A52B3B499CF7D1EA5DE9460AFA90
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/Growzernal.dll unpack001/Inzector.exe unpack001/loader.exe
File Explorer
-
oeinternal.rar.rar 1.5MB
-
Growzernal.dll.dll 3.4MB
-
Inzector.exe.exe 15KB
-
loader.exe.exe 14KB
Growzernal.dll
- SHA256 25b880b1ec74f5a4d7d35e7552b50f6abca58b3eb86273617c65c916cde4796c
- MD5 fc4366d4d9367608fd29f8ce54dc4475
- SHA1 53792dbd42a13ca745c521be6c44eb9d951921f0
- SHA512 2bc1f2627945309391b1611b04e77a0b46e29a55620d77e92425b7d8cd3a9848b0fa47c9ff60f047177cdc64b5618eea549e430cf41e8cde5ef5c1fd91ac40f2
- SSDEEP 49152:9T8pL8UmgIuJn+oILiOhUgciwT/o8PSkrhT3Wf6KqUHTYk2aiFbIvGt3n8T8+HEl:4WLiO+qaWf6KqUHTYkicY
- TLSH T1A2F5BF56B6A900ACD1B3C27CCA575703E7B2B45803709ADF13A04AA62F637E45B7FB11
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
2054336
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
dll
Name
.text
Size
2.3MB
Virtual Size
2.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
867KB
Virtual Size
866KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
234KB
Virtual Size
476KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
103KB
Virtual Size
103KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
48B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=226, id=261, version=33145,
count=47, id=260, version=33145,
count=33, id=259, version=33145,
count=13, id=259, version=35721,
count=17, id=260, version=35721,
count=98, id=261, version=35721,
count=147, id=260, version=36252,
count=5, id=261, version=36252,
count=329, id=1, productName=Unmarked objects,
count=29, id=257, version=33145,
count=15, id=260, version=36256,
count=77, id=261, version=36256,
count=1, id=256, version=36256,
count=1, id=255, version=36256,
count=1, id=258, version=36256,
Inzector.exe
- IMPHASH 250242fa44bd4023be122d647a556634
- SHA256 67571eb8431d1672f94f85214508a287069b8fb1d235e8fbaab1d5a6514db4f3
- MD5 90db44b73a8034b2520d078f1e62bd8f
- SHA1 b6ab062d5b7e466be4bd1a3539c05941b3099ffd
- SHA512 9f6d2dd3144e5fcf6230597bf8eef0e9c86be8002e8a9b76eeca2e0db94d3f43aef91107ed52d353c81987004226b47bdc8610f44e2902f1d73b9d9e1d481712
- SSDEEP 192:UU1FAot1z/afrI1eTIOT+wNjnPSX6W0nEaPAVVS7K3Q5tfdLxADe04:3ndHz/afrU1OT+wZaqWIU3CAd4
- TLSH T1E6624B8BB3564CDDD0A99171C8334A15D2B3F82817F292DF239094190F3D2927E7AF85
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
6528
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
shlwapi
PathRemoveFileSpecA
kernel32
GetCurrentProcess
WaitForSingleObject
GetModuleHandleA
OpenProcess
LoadLibraryA
CloseHandle
GetProcAddress
WriteProcessMemory
CreateRemoteThread
CreateProcessA
VirtualFreeEx
IsDebuggerPresent
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
GetModuleFileNameA
RtlLookupFunctionEntry
VirtualAllocEx
RtlCaptureContext
IsProcessorFeaturePresent
QueryPerformanceCounter
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetModuleHandleW
GetCurrentProcessId
user32
WaitForInputIdle
GetWindowThreadProcessId
FindWindowA
advapi32
LookupPrivilegeValueA
OpenProcessToken
AdjustTokenPrivileges
shell32
SHGetFolderPathA
msvcp140
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?good@ios_base@std@@QEBA_NXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
?uncaught_exception@std@@YA_NXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__current_exception
__std_terminate
__C_specific_handler
__current_exception_context
memset
memcpy
api-ms-win-crt-runtime-l1-1-0
_crt_atexit
terminate
_cexit
_register_onexit_function
_c_exit
_register_thread_local_exe_atexit_callback
__p___argc
_seh_filter_exe
_exit
exit
_initterm_e
_initterm
_get_initial_narrow_environment
_initialize_narrow_environment
_configure_narrow_argv
_initialize_onexit_table
_set_app_type
__p___argv
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-stdio-l1-1-0
__p__commode
_set_fmode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-heap-l1-1-0
_set_new_mode
Name
.text
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1024B
Virtual Size
528B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
488B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
48B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=259, version=35207,
count=10, id=260, version=35207,
count=19, id=261, version=35207,
count=6, id=257, version=35207,
count=11, id=257, version=33140,
count=86, id=1, productName=Unmarked objects,
count=1, id=265, version=35215,
count=1, id=255, version=35215,
count=1, id=258, version=35215,
loader.exe
- SHA256 5b35be1afbecb34ea4c1d73587070397c9cc877e2f67a444d07d4e52980ae442
- MD5 72cd79f3fb251e971c6a4fbb02829472
- SHA1 0fb832fca6859fda2d69e4138e14a9d860036541
- SHA512 3287841c3355ba9e3a1201500c18c6ba07624d740f65d0e3f00d9f2a2880f471a53567f431dab9f1556383844a286b14ecbb24499501e43af5fd9442feaa1d27
- SSDEEP 192:EGsy159/j/H3nCCBc21q5efqBF1EV0A5TVZcfm0WxHOCgP4B+G77sqaFw2PAJGp:EGsy1597/H3CCBcNmqBF+VVySQMJ0
- TLSH T170624C8B77494CEAC0698275C9934B16D575B93403B1EAEF13C0A4280FBD6C07B3DB59
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
6400
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Name
.text
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
492B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
488B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
48B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=19, id=261, version=31823,
count=10, id=260, version=31823,
count=3, id=259, version=31823,
count=6, id=257, version=31823,
count=9, id=257, version=27412,
count=85, id=1, productName=Unmarked objects,
count=1, id=265, version=31937,
count=1, id=255, version=31937,
count=1, id=258, version=31937,