DOCS-1600017889PO400121-2024[.]exe

resource
unpack001/$PLUGINSDIR/System.dll

DOCS-1600017889PO400121-2024.exe

IMPHASH 56a78d55f3f7af51443e58e0ce2fb5f6
SHA256 4e77b03fc9937ac68121e3121cf062ba0994ba4aa06d2ccde468ce2a91cda61f
MD5 e701d67db9d3705ede459a111ccf89c6
SHA1 f08495fb38e4be8bf6bc445bf7296791d6c4db81
SHA512 eec6c54dda15ed582985ff875a091e1b09da7f1965b4fd9febf2eaa4701b73acf671b9a4226c3cd7c725c5eeaab91d144209f0fc12efc35d5e6d3673ccee1869
SSDEEP 12288:EiMpilGo/x8uusxz4Yypk8D8lK+3pvGxuqTypR6snVWvHSb:EiMSGo/x8uus2YyC8olyuqKRnVWu
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

cf:1d:ee:63:26:4c:49:bc:fc:b3:f4:e2:53:5b:42:31:42:01:3b:fb:b3:72:4f:8d:f0:48:87:a7:43:a7:09:2e

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Opraabets,O=Opraabets,L=Pinon Hills,ST=California,C=US,1.2.840.113549.1.9.1=#0c184b726967736672656e64654052656a6563746f722e466f72

Chains

Jan 12, 2024

Minor OS version

0

Major OS version

4

Entry point

13559

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCreateKeyExW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken SetFileSecurityW RegOpenKeyExW RegEnumValueW

shell32

SHGetSpecialFolderLocation SHFileOperationW SHBrowseForFolderW SHGetPathFromIDListW ShellExecuteExW SHGetFileInfoW

ole32

OleInitialize OleUninitialize CoCreateInstance IIDFromString CoTaskMemFree

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

GetClientRect EndPaint DrawTextW IsWindowEnabled DispatchMessageW wsprintfA CharNextA CharPrevW MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW GetSystemMetrics FillRect AppendMenuW TrackPopupMenu OpenClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW PeekMessageW SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint EmptyClipboard CreatePopupMenu

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateFontIndirectW CreateBrushIndirect DeleteObject SetTextColor SelectObject

kernel32

GetExitCodeProcess WaitForSingleObject GetModuleHandleA GetProcAddress GetSystemDirectoryW lstrcatW Sleep lstrcpyA WriteFile GetTempFileNameW CreateFileW lstrcmpiA RemoveDirectoryW CreateProcessW CreateDirectoryW GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW CopyFileW ExitProcess GetCurrentProcess GetModuleFileNameW GetFileSize GetTickCount MulDiv SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW MoveFileExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW

$PLUGINSDIR/System.dll

IMPHASH 4f33ea844b96a31c8f4690530ba63854
SHA256 a4ec98011ef99e595912718c1a1bf1aa67bfc2192575729d42f559d01f67b95c
MD5 d968cb2b98b83c03a9f02dd9b8df97dc
SHA1 d784c9b7a92dce58a5038beb62a48ff509e166a0
SHA512 2ee41dc68f329a1519a8073ece7d746c9f3bf45d8ef3b915deb376af37e26074134af5f83c8af0fe0ab227f0d1acca9f37e5ca7ae37c46c3bcc0331fe5e2b97e
SSDEEP 192:CVA1YOTDExj7EFrYCT4E8y3hoSdtTgwF43E7QbGPXI9uIc6w79Mw:CrR7SrtTv53tdtTgwF4SQbGPX36wJMw
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

6730

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Boblekamrets/attachemappens.sti

SHA256 8f837f048407f8f954be1c18687648c8463137b743a2470b6a58ccc4d53da2d3
MD5 2cd57088e762f36120552ee7bd4711c7
SHA1 b5dccc94851e2bee2dff80df151a26c442af0560
SHA512 3da51447600ea8a0edddb0ca9183d4adadce0e23c6f85e7e3e6b3b1251ae79a5a13dc4c92274ca8a5f38d9e0954b07975d81a1190327efe4941c8d439f6b5532
SSDEEP 384:xctLdiL4/PmyzO4/G+1d1febzRuZYbLNbrHb:Edic/PmQRUR7
MD5 SHA1 SHA512 SSDEEP

Boblekamrets/bienvenue.pre

SHA256 054ed4c915259e56a2a61b9c27131af05f847a0d4f85f12cc6a429d333e6ed35
MD5 90ae36501411f785f4d73857e3f43573
SHA1 7b812af8dbe65f65ab17485d38f2b81918788aa6
SHA512 00270a511fc9a4feb912363c658cca4a5dddf140da78a8698b090d2efbbd88e6a8d4147698a6e5b0c8b3ffa0e8dabb316729daba8f9b56edb88755ff3fae0663
SSDEEP 768:AZAAXejmpMkfZ29S4M6YzG/eIW/7Ow6nk4Ti:V2qmJTwJ
MD5 SHA1 SHA512 SSDEEP

Boblekamrets/cloten.bar

SHA256 19234543ba69da4c2db6b75f34753681f6d5bd90d0eebfab2fb6d870d7750f26
MD5 f70193bd3138f45e7812335b4d7c817a
SHA1 44626b1717957b817d86797b04969b222456975d
SHA512 c36d5e1192b11a112ae5dae2d04fad86875384f7330df64226511637c12b5dd1332b669c4fba8c73f01494b051eda1c34e6c47d8cc29f62538d93b8fd646374d
SSDEEP 768:RMsRYvnjjKuvNILBGZs0dayocR+C9k2y+l3HudMwmm1:IEGAItCm4
MD5 SHA1 SHA512 SSDEEP

Boblekamrets/comminator.can

SHA256 1b0822b016fefa0d6e90f366e1b6246495ffd390a5c302f209143c55b316a560
MD5 5132fd79c8aecf89f13039cc27883071
SHA1 15d056cceca0ec42756a7a5fa2b214588f26ad68
SHA512 b285911bc9ad60b5c59ee94126390c3c3d04888043893bc684a7d955a12e383686a41c86c3b5f6e9e42d1cfe274a20f9df93f5f27de3538df57a8c65cd501fea
SSDEEP 768:yaBsFvnfJGU0vfzyi7uOEhEY1e+eD9Wu1a95Vms4giOKhLGLnklj0L6+OB54Yn0v:CdNi1j5n/
MD5 SHA1 SHA512 SSDEEP

Povline/Vulgarist140.hed

SHA256 4f80480a6c4278c2d9b8f4541b4827c4c442761216a8873585d4deb7e10991b1
MD5 ef5926caad0cfde556dccb0b915df153
SHA1 cf1bfea1cff99403381ef61eaf47827118874764
SHA512 5e194a3f0494ad968e88f0a43de7b1e86714641d9c997555e409704efdccbe819a45e98d06fa7796e2591e77f193ff9ed495e5a882becaa03b1793bf32687e26
SSDEEP 768:pBbh5fIpRy0EoTklBrz1VutonRr766+W0TZI8MjA0/hv3orAQhCkd4mAGa51WGt9:nwkn6W9NXNvF
MD5 SHA1 SHA512 SSDEEP

Redely254/elaeocarpaceae.val

SHA256 86a0a7ec0ebb0c8f1125f6e6f06377d1b92c28cf51f1ca26f05129c6b54cd58b
MD5 462f85383a847dbbefb3ebe5638f62f8
SHA1 aab249beb5334992514cff643b0bab545e2c46c8
SHA512 8ff449cb4a2b13448d22dc567a7190e336258686eb02fd1b3b74c5e07f1ebb4b9026a96d9881420542da9c8edf6ccbdc119278cc4328098f130457f567f17bbb
SSDEEP 768:kBdwXBVjWfjQCHOiK4wXDXrC4Vjhzfqa+WjYfM+zbqPDdlUlU4yU7KYjAI7I9Ajq:enpwLH2GKSBH
MD5 SHA1 SHA512 SSDEEP

Redely254/loftrummets.neg

SHA256 3239836212e170ce2229dbc1bed345724d3d0fbbf548cde0cd7db7c47207ff8e
MD5 619778266e3eec1372582282914e895d
SHA1 77e0b083702a3586187c0d64c0cd494b0b8d75c0
SHA512 db171ec574dceb1d48113fdc2c2caada9049e0ada5a2907e5d260db5ba49ef8ba33d604c793b9d8de06e775ac76efc302455cb2faf210eb63268416936a3ab5d
SSDEEP 768:I0s5RwlBrRZRJK4DdCAHQrO5S0G/Bqq8kqKHhFCc6:zB9W6
MD5 SHA1 SHA512 SSDEEP

counterweighed/Genuine/monkeynut.bes

SHA256 eba8bfd7f57062ccfeca74dfb7c7db0a33d2af19d9760a19a69cda4bd082f7c3
MD5 5203757dfabbbe900521164fd3175bd3
SHA1 5fc2003cee26b1ca1d77b7dd29acf898978aeaa9
SHA512 d6c437b317df2ae295078249502a46e5d93676b6bedcd01c9a29e8b2d98a2cd614155e1861cb42c63013791386d10af1a15f9bef878f5dbc3f8ca5a74d876b36
SSDEEP 768:edYVKnnopAAlyFBn9MP5LlpxIRmRyDAEELwflXoMI8dbmtIwtICWW:HC0r+t9w5NIsyvIf
MD5 SHA1 SHA512 SSDEEP

counterweighed/Genuine/obsessed.hjt

SHA256 54bffcfe6a0dff03c22ec09dc79476cb9f6fd8047f7cbb9bfc0a6e4e184bedf5
MD5 37592f4d6ee03d5c9a4859eafcf4ca68
SHA1 30858deb6e28f279d843ebab2b863ed21ae05faa
SHA512 79c48f5c34a04bd4aa44891b6e04531a1ad9b7b349cdf0f6bb361b8d5a9b41cc424a9ed1a137bce1e4a11c011c7160a5f78dcce77b451fc84b492f70f95a8d41
SSDEEP 768:MggzwgvR+vgrVGLJXjdapNQo4tT3lNX57SIv7E9dWQ:MB3voNVF2KQ
MD5 SHA1 SHA512 SSDEEP

counterweighed/Genuine/soldebrors.ske

SHA256 0f1ed3efbf8ff2723ce4591d1d12a0060559416592f064b6cdc96c438d430215
MD5 3666c9fd41cf889d8f777e790ab13263
SHA1 9c8f2072aba9b5eafb096c9ca3053effdcca4c06
SHA512 6b5d32b642a5903d6826a8ea7893941a5fdf4f6b84695d544fee988513f60e1e1fce710901909ffc7658c6e4fddc0f8ea2b1c782bed38969e926ff8b6d71c0da
SSDEEP 768:2cMSrZ9+gr5nTlfp37F1Hd3pPUMXNNWrHgp2dfEBzDnRkhM1xSVT4luf4FuqHWvd:f7fZ6kkYQqjV+nh
MD5 SHA1 SHA512 SSDEEP

counterweighed/Genuine/syrings.txt

SHA256 03122361e254763eeded58bbd9cbcf983e9bfa17b2d9ceb97ab54130d6f652b2
MD5 35b7ded5b2b594bd46bd46fcd2f77503
SHA1 458e8a366bf50aa3b855adf6108dcd87c927f572
SHA512 b169094482ce3350cb412f3b27d364a4c29a2684100f93ac43c3ad3e30b049382d37dbc9630657015d9eb84aa8ec091ce434bea4f6e5db975015d13466b14c39
MD5 SHA1 SHA512

counterweighed/Genuine/udydernes.blu

SHA256 e4138f83b6ae894f908bc1a73731b025047bb80563daa864f414be3e12cec206
MD5 8829d5dc6946003cf38c265ffac11127
SHA1 f9b5d573e8aad86c6db9116844a902ce01e9495f
SHA512 6aac263963146c1c910d466bf10c97bbdd20678a8441f47199d7e3edfc7226c85ebe8fdf3c8926ac83c4cd043e303ef04aca393efeb81f54426c4e132e0b1b92
SSDEEP 768:4b2at3Oxcvm77BUP94C17TR8ytHM77uxFlLxCFR6zBp8a+jEoOIc/Lltn0kw9X7i:Cwudvtho6l
MD5 SHA1 SHA512 SSDEEP

drvende.Myr

SHA256 8a6bd02073d004f6320f17a2c3c1cd002b4123d2b7366b7a7ff8b2f7cf73f723
MD5 cd5e0303d843da58f28e3bfefe24457c
SHA1 757eb5e6337bb10be754a6bb7171614877c233b8
SHA512 c132cc0bf1fc793890c416f4e7c78c0937525ecc623b0311e68da49f0456f24abe6b4a5320b8567ffabb5c3331f12ebca9e880f0aeab29fb991cb5b62261c759
SSDEEP 3072:5thVSgBXpyY1hgTSP9T4hskv4Z6CH9UoTxUkUCCjlE9kdX:5t71hlP9T4hDQLH9UoFtUCCjlE9kdX
MD5 SHA1 SHA512 SSDEEP

DOCS-1600017889PO400121-2024.exe

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Boblekamrets/attachemappens.sti

Boblekamrets/bienvenue.pre

Boblekamrets/cloten.bar

Boblekamrets/comminator.can

Povline/Vulgarist140.hed

Redely254/elaeocarpaceae.val

Redely254/loftrummets.neg

counterweighed/Genuine/monkeynut.bes

counterweighed/Genuine/obsessed.hjt

counterweighed/Genuine/soldebrors.ske

counterweighed/Genuine/syrings.txt

counterweighed/Genuine/udydernes.blu

drvende.Myr

Sharing

General

Malware Config

Signatures

File Explorer

DOCS-1600017889PO400121-2024.exe

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Boblekamrets/attachemappens.sti

Boblekamrets/bienvenue.pre

Boblekamrets/cloten.bar

Boblekamrets/comminator.can

Povline/Vulgarist140.hed

Redely254/elaeocarpaceae.val

Redely254/loftrummets.neg

counterweighed/Genuine/monkeynut.bes

counterweighed/Genuine/obsessed.hjt

counterweighed/Genuine/soldebrors.ske

counterweighed/Genuine/syrings.txt

counterweighed/Genuine/udydernes.blu

drvende.Myr