PO-001[.]exe | Triage™

resource
unpack001/$PLUGINSDIR/System.dll

PO-001.exe

IMPHASH 61259b55b8912888e90f516ca08dc514
SHA256 6a861eb0176a0f7e0c4d69f2a65856d739bd4829448e72add40fabb9bf439634
MD5 5c18ec65c8c26f3757e9d19cc7f37fc3
SHA1 ace21507a35a9db273a704cfa741c606bb4f166d
SHA512 b460fed22286b245e9558be50161dd5eca79096cd91bcf88467695f804f0f2c9ba956ba1a406d6502d73ea9914d43aeff0fc1ae0f842dbafbfe83ee84e22c5d9
SSDEEP 12288:NYsmTCSUa1J3kR77kWX2h0hChIep9sO73QV4hdts2tCSgu:NY8SX1J3kVkv0hCvb3dtsIbgu
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

65:56:81:a6:c4:f0:51:20:d1:24:cc:12:1f:eb:b8:24:ce:4e:93:e5:be:ae:86:3e:5e:f2:7b:b8:21:98:87:de

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Quinoxaline,OU=duelighedsprverne Natica\ ,O=Quinoxaline,L=Ringstedt,ST=Niedersachsen,C=DE,1.2.840.113549.1.9.1=#0c21506172746572726574733137374047726e73656f76657267616e673131332e5976

Chains

Jan 9, 2024

Minor OS version

0

Major OS version

4

Entry point

13888

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCreateKeyExW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken SetFileSecurityW RegOpenKeyExW RegEnumValueW

shell32

SHGetSpecialFolderLocation SHFileOperationW SHBrowseForFolderW SHGetPathFromIDListW ShellExecuteExW SHGetFileInfoW

ole32

OleInitialize OleUninitialize CoCreateInstance IIDFromString CoTaskMemFree

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

GetClientRect EndPaint DrawTextW IsWindowEnabled DispatchMessageW wsprintfA CharNextA CharPrevW MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW GetSystemMetrics FillRect AppendMenuW TrackPopupMenu OpenClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW PeekMessageW SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint EmptyClipboard CreatePopupMenu

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateFontIndirectW CreateBrushIndirect DeleteObject SetTextColor SelectObject

kernel32

GetExitCodeProcess WaitForSingleObject GetModuleHandleA GetProcAddress GetSystemDirectoryW lstrcatW Sleep lstrcpyA WriteFile GetTempFileNameW lstrcmpiA RemoveDirectoryW CreateProcessW CreateDirectoryW GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW CopyFileW ExitProcess GetCurrentProcess GetModuleFileNameW GetFileSize CreateFileW GetTickCount MulDiv SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW MoveFileExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
MD5 cff85c549d536f651d4fb8387f1976f2
SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Gothlander/Blacksmithing/soeskendeflokken.sig

SHA256 9a987375c95d4ed4a176df725f5593b9c98a5b25bbd0417f3d7cfb66f3b95111
MD5 35a80d936a9565c55b1cb5f31cc1532f
SHA1 fbc42a3ab3631c8053e0e5fdd8fbb28629056e7d
SHA512 c8afea95d8fba8570b840afae9cb817e90ac26963eeb8fc8bbdc336ddcbec6de9a750dbd84c4f1cc54665d2c69285c3d4770ce760ad598435d4ff63d12115120
SSDEEP 768:cs4XhgBbsxxj5oegGKFfB6a7fNPpJnIL/X:+8xpd
MD5 SHA1 SHA512 SSDEEP

Gothlander/Blacksmithing/udviklingsopgave.txt

SHA256 9f06c28036f727d067cfcf31e568dcbb76ecf9466aae9224fde6dd5ea3041f5f
MD5 e8cb88608f665d4e496b30f1b5a4cfed
SHA1 4b72358aae0ab6d25f0831edc674d47df0ca7860
SHA512 a23c913ebbc9643e415acb8a85c47c79d18350af660057428992970cd1e93f4cbc0c63bbfb5bd79fd574ab1172835239eb79fe5cf98d6e8aa33ff5df61273144
MD5 SHA1 SHA512

Kviltningernes/hydrocolloidal/Stimulatoren/Patronizers/behusband.law

SHA256 5b3a4d42930c4cfe75af1a4a68403a4a94650d86a84d07bd101935ac4b0d165e
MD5 0e1537d10eb11ddb6da5d5597b8858f6
SHA1 89d7b89f541b1eea56f1b07eaf05cdb761270f7b
SHA512 0684bf807d1555432e31b1c71946186ebd40a5ecfedf51d3edd9d35eb457facea231fee534e54f154dd1d23c2b64878ae64ecb9db6d55bf248d037208a962971
SSDEEP 384:NkqGLdknin8hGWgcAucz4h0Hnny7OG2o8CNeLS+wKvlj2iw5:i6uzwAfMsqOON8Zdvlj25
MD5 SHA1 SHA512 SSDEEP

Logins.fut

SHA256 1db2bb90362c41aaf01197d67c5b9462941ea0efdbbd50675b3acfe59f370240
MD5 591a2fe7b84093ba174736fd0a879270
SHA1 e7428732ff89a87f49544d7185d16c1560f85114
SHA512 a4ced95601e4a71f4e1a63582e6192a2366486af47019ef0aaad27a383541c63797ec5b6adfea3b9245363788c9bc824e7c10735e92e71467802851e4fa0395b
SSDEEP 768:5K9zSZjO3wQ8GiQD12cXeX/NCMBk5k4mW:FGiyW
MD5 SHA1 SHA512 SSDEEP

Mobilometer170/Finnjolles/blameworthy.aph

SHA256 fb5c4165da39ea581ed231e4a72461411a35f3f2e6d23888ac8aa4f4b86a2d83
MD5 d96a9738b5aec51ecf03b8cac46d63a1
SHA1 30adfa7b2985a8649248fa2dfd9fbe8d29bc1e34
SHA512 197f7e965e428b9d6bfac816ce6cf7f64c6e53be8cb7fa9ea1caec33cb917ca5edb39dd30e8d52fe4747b833ee87678c22bf8a0f23f7c1ce334e68ad0a0acc8e
SSDEEP 192:jykbtYbCSfhJGwuanswLQTRJ2qugDSHuIU+yDcwH:jykbtYbhPIannLm/2qBSuIU7DcwH
MD5 SHA1 SHA512 SSDEEP

Mobilometer170/Finnjolles/danderende.unr

SHA256 5a7ed5158887c40738dd4e30e633ace9595b5e2dd47787fed17835ab2ebdaf96
MD5 e88187779bb7bb7cd9676dd55bcd90c3
SHA1 239f5ee92c4ee0248454b4146daad80606306e8b
SHA512 4d498525ea658e0157b333d25143e88eba93450fad5d845a33d196ca5ccbfc611812e63c7bb90360005addaa73d2f616ddbcdf7c580ddb792915360aa0212112
SSDEEP 768:4KbbF/nx67oNPHUphI7fp8meGsR+Tc5tXHbO/lyYPuE60o1kJEgVmYD7l9QliMGR:tlB
MD5 SHA1 SHA512 SSDEEP

Mobilometer170/Finnjolles/delitous.pan

SHA256 ba0b72a0d90147afeadb0b49c1eae10d91d0b736676f55e05e29f4ed3c9ed3b6
MD5 9bb2a62508d6bea774cae65c9f9ccb61
SHA1 a518ced7d47344706749dd3528075a9bdde41688
SHA512 48e833918464a17b03f193960d2b166e60b1714a21abefa9cc96c7ac857fcedef8d3d4131dc61970b67680bc99fe348b85559e03a9694dc344011b8e48ebc086
SSDEEP 768:B0fTJdpObee4kAKdkx4dUpIc6T2ghOIULGmWOYmdQ+/wCK:HUmGwR
MD5 SHA1 SHA512 SSDEEP

Rrfringerne.Lad

SHA256 0138a9b293846f1abebb02aaa45608c2a8599a3b1ad1ac4750dd67700f029246
MD5 3020ee256dacce3540536d2e173151f6
SHA1 6cb4185f90f83ddd6362439ce55d5b493b3a3545
SHA512 7e0e255ab010522b682971ab2f9605279116e9b4f5bdbf22f95e06a3ea7d56f9a67fb065c40ebd04746a9bdfa86b786392d6766d38395ee24936b890460f4492
SSDEEP 3072:3D/jI5OJhbitzNXZK5hDBNRmVr7QpAGtE0BmZVQ3o8gDUMskTZ5CD00gLXHioCpd:3DU00tzNJK5h/RqrU5F6K48gDUVErCDF
MD5 SHA1 SHA512 SSDEEP

Sandsugeres/Drueligs/Afvikleren/Drmmeriers/jordemoderkaffe.mod

SHA256 b7652e6aadd9d4b66628a8366aa96360c1574588f3e3b4a6b84829494efe2be5
MD5 47c2439cb2b99fc559a472f952bb0e81
SHA1 576bc1be7c8ebf2b47b546221da1a192c0547e57
SHA512 9ad683acac29f9c479630d798d572fe701c8879245887ec71cb85a52b1ff49306c48f0e20ccf609be9f2d0c8f099fa9e11285af2a39b8f5ae73647e5c5b92d69
SSDEEP 768:Bie3nfwJG3MWxa26K/tFACPVCKiOASRe2FtiFV3ij/H0hN5Mqdgg:5DJR+b
MD5 SHA1 SHA512 SSDEEP

Sandsugeres/Drueligs/Afvikleren/Drmmeriers/marcanthony.cur

SHA256 e591223c7414e6fe9a2bad7a0f75234bba535cd1f4c75eab4152eaa4124f7d4b
MD5 78c6a1d867c24a8ef595def3eb2e8c32
SHA1 4fbaf82ee8ff08cd0b4d2ccd27345b9cd4728774
SHA512 cc89b94129ea9cf890c816b3df5be482b8509f1c408635f3b438ca09ff92cf8ac5d30436fd236ca2e543c1cbd66f8773448305dd51cea91d29c42b473caf017f
SSDEEP 192:IFtdgJ37/K4vP8QEc/hoqfWO0WCGF1LB5:4tdgJ37/K4vk7c/hoq+OjCGF1LB5
MD5 SHA1 SHA512 SSDEEP

Scentless/Venindernes/alkoholer.out

SHA256 2ebfd38d0a12d9375e997f18abf833a1206c32e5338e02deda9e70a3ec04639c
MD5 5c52f2ff7b5f873909bbf737b42568ed
SHA1 2de649da6584057399a6df957c1f7c6fd98a40ca
SHA512 0531702f88a5e4120952f0607cacc26654a29ecb00302f341d4840ea9887e99ede865c7b628e0d17e0b0c9a6b52974bc06c7ebba02c65ada8a9ca77a78c0979f
SSDEEP 768:cMhSQFBpazMuJ9o48HUb8vqgXA9OYlMzVgS5AFN3:nVQN
MD5 SHA1 SHA512 SSDEEP

Stamgstens.Fka

SHA256 1e7cf2e0d7f6428ff4e52e230b158730a20508a030151957000e50856f90c8fc
MD5 62abce7af57261d794c6d7bbde0ef59c
SHA1 a93496d696a63e4d67c0bc3c334bc2245a4be1d4
SHA512 d487e8728da88b49f7692ed72dbf1f43a6bbfee84d1565cbd5da5f0dfc498dd9adbb4f071f1551c545a889396ea68d157de38e1da3148474c0644fb9b3b1aa00
SSDEEP 384:QgHZt+8vXsLOoT33Hw9E83RZDFUjjl+CziXc18HuI:Ht+7O4nQ53zFgl9mM1yf
MD5 SHA1 SHA512 SSDEEP

adan.thi

SHA256 e2ffa933f008368b6acc10224572dca538a0f21bdd7cefb836ac044f1a3f0f52
MD5 b41bbf3ff28f671b81552956ec0ce083
SHA1 cdc379cd0f8cef7c04a9489bef29e9b3fb34f6f3
SHA512 80ef1b46a016debc42c57650d0024746724aad4195dca5831c14a12759154636ff1dda1f3a2438a69992eb5a7068cf0336022509c1646b724420ae13f7adc69d
SSDEEP 768:h4rDjmVMGHRMksQQgAjVYrUZBUUwkAi4JmMwamEk3zJtHM/GAOgulZfdQo9+vc57:qM6baG9
MD5 SHA1 SHA512 SSDEEP

phyllomes.dem

SHA256 14cab8a8fd785f23d3a98ac2d081b851a5ffacf29abf99605ddee773bbd63eb8
MD5 c3c1c898e4b46075ffcc56517d397144
SHA1 0630b62ce06e67c8acad7ac56d524b73e9969021
SHA512 73f295e0697ae89c6fa8dd01f26ef59302b20d74c7bdd8d4808fddc317d07e5a65588d396d682d76bdef2c628cc6d8b8d2c9bfe0680ff9c3bef46a7f2849997a
SSDEEP 768:m91xRX9mpOJ1pU2jivfET4GoRdupfw8UZ8uM+I6eleLuLF:Vf8O
MD5 SHA1 SHA512 SSDEEP

PO-001.exe

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Gothlander/Blacksmithing/soeskendeflokken.sig

Gothlander/Blacksmithing/udviklingsopgave.txt

Kviltningernes/hydrocolloidal/Stimulatoren/Patronizers/behusband.law

Logins.fut

Mobilometer170/Finnjolles/blameworthy.aph

Mobilometer170/Finnjolles/danderende.unr

Mobilometer170/Finnjolles/delitous.pan

Rrfringerne.Lad

Sandsugeres/Drueligs/Afvikleren/Drmmeriers/jordemoderkaffe.mod

Sandsugeres/Drueligs/Afvikleren/Drmmeriers/marcanthony.cur

Scentless/Venindernes/alkoholer.out

Stamgstens.Fka

adan.thi

phyllomes.dem

Sharing

General

Malware Config

Signatures

File Explorer

PO-001.exe

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Gothlander/Blacksmithing/soeskendeflokken.sig

Gothlander/Blacksmithing/udviklingsopgave.txt

Kviltningernes/hydrocolloidal/Stimulatoren/Patronizers/behusband.law

Logins.fut

Mobilometer170/Finnjolles/blameworthy.aph

Mobilometer170/Finnjolles/danderende.unr

Mobilometer170/Finnjolles/delitous.pan

Rrfringerne.Lad

Sandsugeres/Drueligs/Afvikleren/Drmmeriers/jordemoderkaffe.mod

Sandsugeres/Drueligs/Afvikleren/Drmmeriers/marcanthony.cur

Scentless/Venindernes/alkoholer.out

Stamgstens.Fka

adan.thi

phyllomes.dem