DOC6010038709-PO[.]exe

resource
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/nsExec.dll

DOC6010038709-PO.exe

IMPHASH e2a592076b17ef8bfb48b7e03965a3fc
SHA256 52dd1ddf925baa01a172d0e420ec8833a10726ee7a7dcfc2a55f1e04f47c6a63
MD5 5ad5fcac5705acde3ed51ae6b3c2c0b1
SHA1 77a26b80323ac8e1f172d8ce980120454ed53939
SHA512 1b472fc9a53b6a8864176dbd7e1ce91dccdae9c6dcf9716274c80011368275dc1f3c2098287bd32d708ce18214b048113fdc59cefd3a106a1d2b6ddaee304a27
SSDEEP 12288:3kvqcSBHwEbBn+mDZVKxRu2GfWLpcCoJt:9wOTZVKbgWLCCat
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

cc:43:26:60:6d:60:bd:87:2d:94:97:2c:c4:87:e8:dc:b0:1d:04:5d:83:5c:a4:6f:a9:c8:7b:44:9f:1b:67:72

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Forbigaaelsens,O=Forbigaaelsens,L=Bethel,ST=Pennsylvania,C=US,1.2.840.113549.1.9.1=#0c17416c676f6c73323230405068696c69737469616e2e4976

Chains

Jan 19, 2024

Minor OS version

0

Major OS version

4

Entry point

13054

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetCurrentDirectoryW GetFileAttributesW GetFullPathNameW Sleep GetTickCount GetFileSize GetModuleFileNameW MoveFileW SetFileAttributesW GetCurrentProcess ExitProcess SetEnvironmentVariableW GetWindowsDirectoryW GetTempPathW GetCommandLineW GetVersion SetErrorMode lstrlenW WaitForSingleObject CopyFileW CompareFileTime GlobalLock CreateThread GetLastError CreateDirectoryW CreateProcessW RemoveDirectoryW lstrcmpiA CreateFileW GetTempFileNameW WriteFile lstrcpyA lstrcpyW MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GlobalFree GlobalAlloc GetShortPathNameW SearchPathW lstrcmpiW SetFileTime CloseHandle ExpandEnvironmentStringsW lstrcmpW GlobalUnlock lstrcpynW GetDiskFreeSpaceW GetExitCodeProcess FindFirstFileW FindNextFileW DeleteFileW SetFilePointer ReadFile FindClose MulDiv MultiByteToWideChar lstrlenA WideCharToMultiByte GetPrivateProfileStringW WritePrivateProfileStringW FreeLibrary LoadLibraryExW GetModuleHandleW

user32

GetSystemMenu SetClassLongW IsWindowEnabled EnableMenuItem SetWindowPos GetSysColor GetWindowLongW SetCursor LoadCursorW CheckDlgButton GetMessagePos LoadBitmapW CallWindowProcW IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard wsprintfW ScreenToClient GetWindowRect GetSystemMetrics SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharPrevW CharNextA wsprintfA DispatchMessageW PeekMessageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow LoadImageW SetTimer SetWindowTextW PostQuitMessage ShowWindow GetDlgItem IsWindow SetWindowLongW FindWindowExW TrackPopupMenu AppendMenuW CreatePopupMenu DrawTextW EndPaint CreateDialogParamW SendMessageTimeoutW SetForegroundWindow

gdi32

SelectObject SetBkMode CreateFontIndirectW SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW ShellExecuteW SHFileOperationW

advapi32

RegDeleteKeyW SetFileSecurityW OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges RegOpenKeyExW RegEnumValueW RegDeleteValueW RegCloseKey RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumKeyW

comctl32

ImageList_AddMasked ord17 ImageList_Destroy ImageList_Create

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb
MD5 17ed1c86bd67e78ade4712be48a7d2bd
SHA1 1cc9fe86d6d6030b4dae45ecddce5907991c01a0
SHA512 0cbed521e7d6d1f85977b3f7d3ca7ac34e1b5495b69fd8c7bfa1a846baf53b0ecd06fe1ad02a3599082ffacaf8c71a3bb4e32dec05f8e24859d736b828092cd5
SSDEEP 192:eY24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35Ol+Sl:E8QIl975eXqlWBrz7YLOl+
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10183

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsDialogs.dll

IMPHASH e2ee55bddad4241d619d6a8a38e2d869
SHA256 c13104552b8b553159f50f6e2ca45114493397a6fa4bf2cbb960c4a2bbd349ab
MD5 42b064366f780c1f298fa3cb3aeae260
SHA1 5b0349db73c43f35227b252b9aa6555f5ede9015
SHA512 50d8f4f7a3ff45d5854741e7c4153fa13ee1093bafbe9c2adc60712ed2fb505c9688dd420d75aaea1b696da46b6beccc232e41388bc2a16b1f9eea1832df1cd7
SSDEEP 192:o68cSzvTyl4tgi8pPjQM0PuAg0YNyoIFtSP:LBSzm+t18pZ0WAg0RoIFg
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

7443

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsExec.dll

IMPHASH 0b75f1007d3cc8e457970ae3e3fd53c3
SHA256 c4c6fe032f3cd8b31528d7b99661f85ee22cb78746aee98ec568431d4f5043f7
MD5 b55f7f1b17c39018910c23108f929082
SHA1 1601f1cc0d0d6bcf35799b7cd15550cd01556172
SHA512 d652f2b09396ef7b9181996c4700b25840ceaa6c1c10080a55ce3db4c25d8d85f00a21e747f9d14a3374be4cdd4ea829a18d7de9b27b13b5e304447f3e9268fa
SSDEEP 96:L7fhfKaGgchPzxK6bq+pKX6D8ZLidGgmkN538:RbGgGPzxeX6D8ZyGgmkN
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4231

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Diskforbruget/Hjemgivelsers/Dydsprmier/Hldningskoefficienterne101/syntan.kon

SHA256 b2ea5f1618e5d8f73b4bc4293816a55962498dfeb23abd9f831189412cc380bb
MD5 b21b4e1d03908e73507050d7a07493b2
SHA1 1d6ed5f6ac2157987dc9665d63613687d8b495b8
SHA512 fcd4110db58cf1026e5a0ae197bb16f473152d433cb195402e3c677092b49f218e1de0b1b8a0a5ca1fed2fdcebb113c180bbb997567a9b42cd9ac4c4f13ae133
MD5 SHA1 SHA512

Diskforbruget/Hjemgivelsers/Dydsprmier/Hldningskoefficienterne101/tbrudsskader.pis

SHA256 c6aee416ef4ea70430db6d49e7b6d75d9c44e0fd78da43f57aa297e714963164
MD5 2d1e1474219da761d2d0a57fb65e35ae
SHA1 18810883dec830a18b9edd7ea5842e8385e1bfa2
SHA512 90fbe5493ba699959291527a847e1c0958fd22bb63f5de654fb228c70aa259e062414147438eece47c4ea8dd6e0d458605fde74f150542661f093da6f59b916a
SSDEEP 192:u/qIAkdhSP8SSZQY/6M9+v/yPvNwowf1if7LTRuaoV:u/cuhSU1uw6M97PFwowdsLTRvoV
MD5 SHA1 SHA512 SSDEEP

Jukeboksenes/gr/Mouldwarp32.ant

SHA256 51aee683e4e27de8b5ea1d39446fdc1628a151105c46e5825a76ff33922ec645
MD5 187de0bdcbe4a176e40164b1e3cb1121
SHA1 53523f2fa7e06c1c127069b90940c4651c9e1b6a
SHA512 d016f843e8614af7bfd10c6b84659f4e8b2a49d5bee80da9c05e039361330e331962e8691c5b33074962e2916371bb4edcfd142fcb79afd9fc3928c96f6359fb
SSDEEP 384:lKvYFpKANBqXa9d0TvlCAhQFiqsu2jyCR61Mk3S5y9BEBAJyQo25xW3p8:likLP9WCAhk2jB8pi89BDJyQo2i3e
MD5 SHA1 SHA512 SSDEEP

Lingvisterne.rid

SHA256 66a9c3ff99438e854f91c5a3fb7fcb9011a43c2a7b5e0eb7341e6aff44743ae3
MD5 34ff972a79fff5553089f6ecc55b2252
SHA1 1701f2a5f5133e36546dcd5e51a95eac4031b848
SHA512 a3b62852c78003de11fa72cbb959e7423ab159ecc55b1ebcf6e2a66a329cb5d4aacce562243310bb4aa5c23678d36fbeef069a972300fcf317718d25e0efc384
SSDEEP 192:hEFicyPPMAsPI6Dk/1ju0Ryv8KLBFLOI3VO3QzGZ0:hMiRkAsw3/1jup/ddVOgk0
MD5 SHA1 SHA512 SSDEEP

Loebes23.Uag

SHA256 4dd48b96e2eb32e00b030e290d3369dad5417bbf64bb9878b5e3306e2b429e57
MD5 c17aa2dc420c8eaca2a135deceb81385
SHA1 65dfc6587155b6f14fc84dd7a9b7916631e78dd1
SHA512 bb434cac58a0f123e2e8587941ecff6f3417e0ebc86cd1fa0ebff240b921270111d2cb10654592bd1d553aa0e6c96d6a4e65001def073879a0581435b5128111
SSDEEP 3072:ifRVWC3rzXj+LDb6sausmZmbr66JdRuIIgHqEJaMlE:jC3fKLDbqbVjHpLc
MD5 SHA1 SHA512 SSDEEP

Monotonises226.ami

SHA256 771aa254579cdd1d8cf2b45336544c286c699e40aaac992745532e7b8acc09b2
MD5 449a78d0a7380172941f7f4f3e3ed99a
SHA1 3ac459e20d64e19d83ae674e9d33070436acbcf0
SHA512 816ebc295eb5c359fe7531dd16c922f97e7d17ff4753caa02244b07616e16672294185daf02043b88a752940ce07408800bc991330cb6ed34de9dabbaae86e03
SSDEEP 384:vakGf5H+shCZQHdpGJVDhxxp70XmAPa9xkZsezksoZm3B3E/MFf50zedoqeRRd2v:1a5H+iC2HbGLkxyc+eA23ZE0f50it
MD5 SHA1 SHA512 SSDEEP

Proctodynia/forretter.txt

SHA256 983194a333c21f33d12dd8b0c393abc55d1ed47e3131ba31ea39649262067fc5
MD5 0bd45be1f61f9e1e7ed78fefd892f31f
SHA1 c6f3b7fbcebb3d09aae882d9b8f65fba8d0a72bd
SHA512 af1cf7f9960d73345acf1b1b6634424db7b7e981f8c66ff594b6a6b0208e612b03dad16e094e4494402b9bc63f14cc0de0e0bbe51f7301f10deb682edc3a2fff
MD5 SHA1 SHA512

Proctodynia/megapode.app

SHA256 a3a45b243179f04a923e01a8f360aafa9d628b32354453f08c0b1c31797a534b
MD5 6e941ea97a92ac8ee4ac713c354c58f6
SHA1 3f23f03bf6547b2bf4b8a6eb00777a55aaf999ce
SHA512 d2b43f6cf6d7e74c1053416213fcc35c30ca029c0c2f34de9553ad2adb92b923daf83611ba9b7b9d905ad1e60c53434dcd7ea58d3c0bf47ffa8b0e59b6cea489
SSDEEP 384:U5FKcGSrXmxrPAn8EFGftXcMOxFILjA1BoLSw9QVN/Nr:IFUAYDEwftXcMkujKo6/Nr
MD5 SHA1 SHA512 SSDEEP

macos

DOC6010038709-PO.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

$PLUGINSDIR/nsExec.dll

kernel32

user32

advapi32

generic

Diskforbruget/Hjemgivelsers/Dydsprmier/Hldningskoefficienterne101/syntan.kon

Diskforbruget/Hjemgivelsers/Dydsprmier/Hldningskoefficienterne101/tbrudsskader.pis

Jukeboksenes/gr/Mouldwarp32.ant

Lingvisterne.rid

Loebes23.Uag

Monotonises226.ami

Proctodynia/forretter.txt

Proctodynia/megapode.app

Sharing

General

Malware Config

Signatures

File Explorer

DOC6010038709-PO.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

$PLUGINSDIR/nsExec.dll

kernel32

user32

advapi32

generic

Diskforbruget/Hjemgivelsers/Dydsprmier/Hldningskoefficienterne101/syntan.kon

Diskforbruget/Hjemgivelsers/Dydsprmier/Hldningskoefficienterne101/tbrudsskader.pis

Jukeboksenes/gr/Mouldwarp32.ant

Lingvisterne.rid

Loebes23.Uag

Monotonises226.ami

Proctodynia/forretter.txt

Proctodynia/megapode.app