MDU9342434[.]exe | Triage™

resource
unpack001/$PLUGINSDIR/System.dll

MDU9342434.exe

IMPHASH e2a592076b17ef8bfb48b7e03965a3fc
SHA256 cbfc10741fb440a5c351bb62a9ffbe13d8fb90304925bee56ac6dd54a8e001ac
MD5 2ac9cd56e3877efa00a0353cde71186f
SHA1 d0460a2b1fe30c342216048c4390af045b120146
SHA512 e78d405d9b92319d396d488e4c104021a224789fabf09a278d252e1aa407cae1ce4d3562f1e6a18bc3151e16049a1a6d3687b6a4578fc4c946349d5292eb9e2d
SSDEEP 24576:oS5HuMJiUsl/f4g0lnQFpy54j3BjqgMQUWhypBj:B5o/falnQ+54j3ZftUNBj
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

e9:2b:74:40:91:91:6b:fa:22:28:c9:f8:89:d2:e7:9c:35:55:e9:66:80:8c:f7:ed:bc:93:8d:4f:38:f0:7f:93

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Betjeningsafgifters,OU=Specialtastens Fatnesses arboreta\ ,O=Betjeningsafgifters,L=Coquelles,ST=Hauts-de-France,C=FR,1.2.840.113549.1.9.1=#0c17426f6e64656f707374616e644043726f74616c2e537973

Chains

Feb 12, 2024

PE Signature issue

Digest

5a:07:73:00:c4:6d:65:03:fb:8c:dc:1a:76:71:de:bf:06:e2:ba:af

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Betjeningsafgifters,OU=Specialtastens Fatnesses arboreta\ ,O=Betjeningsafgifters,L=Coquelles,ST=Hauts-de-France,C=FR,1.2.840.113549.1.9.1=#0c17426f6e64656f707374616e644043726f74616c2e537973

Chains

Feb 12, 2024

Subject

CN=Betjeningsafgifters,OU=Specialtastens Fatnesses arboreta\ ,O=Betjeningsafgifters,L=Coquelles,ST=Hauts-de-France,C=FR,1.2.840.113549.1.9.1=#0c17426f6e64656f707374616e644043726f74616c2e537973

Serial Number

0e:c9:8b:25:f3:3d:e4:c3:c5:62:8c:25:b8:41:72:65:76:dc:11:f0

Issuer

CN=Betjeningsafgifters,OU=Specialtastens Fatnesses arboreta\ ,O=Betjeningsafgifters,L=Coquelles,ST=Hauts-de-France,C=FR,1.2.840.113549.1.9.1=#0c17426f6e64656f707374616e644043726f74616c2e537973

Timespan

Feb 15, 2023 - Feb 14, 2026

Subject

CN=Betjeningsafgifters,OU=Specialtastens Fatnesses arboreta\ ,O=Betjeningsafgifters,L=Coquelles,ST=Hauts-de-France,C=FR,1.2.840.113549.1.9.1=#0c17426f6e64656f707374616e644043726f74616c2e537973

Serial Number

0e:c9:8b:25:f3:3d:e4:c3:c5:62:8c:25:b8:41:72:65:76:dc:11:f0

Issuer

CN=Betjeningsafgifters,OU=Specialtastens Fatnesses arboreta\ ,O=Betjeningsafgifters,L=Coquelles,ST=Hauts-de-France,C=FR,1.2.840.113549.1.9.1=#0c17426f6e64656f707374616e644043726f74616c2e537973

Timespan

Feb 15, 2023 - Feb 14, 2026

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 23, 2017 - Mar 22, 2029

Minor OS version

0

Major OS version

4

Entry point

13054

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetCurrentDirectoryW GetFileAttributesW GetFullPathNameW Sleep GetTickCount GetFileSize GetModuleFileNameW MoveFileW SetFileAttributesW GetCurrentProcess ExitProcess SetEnvironmentVariableW GetWindowsDirectoryW GetTempPathW GetCommandLineW GetVersion SetErrorMode lstrlenW WaitForSingleObject CopyFileW CompareFileTime GlobalLock CreateThread GetLastError CreateDirectoryW CreateProcessW RemoveDirectoryW lstrcmpiA CreateFileW GetTempFileNameW WriteFile lstrcpyA lstrcpyW MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GlobalFree GlobalAlloc GetShortPathNameW SearchPathW lstrcmpiW SetFileTime CloseHandle ExpandEnvironmentStringsW lstrcmpW GlobalUnlock lstrcpynW GetDiskFreeSpaceW GetExitCodeProcess FindFirstFileW FindNextFileW DeleteFileW SetFilePointer ReadFile FindClose MulDiv MultiByteToWideChar lstrlenA WideCharToMultiByte GetPrivateProfileStringW WritePrivateProfileStringW FreeLibrary LoadLibraryExW GetModuleHandleW

user32

GetSystemMenu SetClassLongW IsWindowEnabled EnableMenuItem SetWindowPos GetSysColor GetWindowLongW SetCursor LoadCursorW CheckDlgButton GetMessagePos LoadBitmapW CallWindowProcW IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard wsprintfW ScreenToClient GetWindowRect GetSystemMetrics SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharPrevW CharNextA wsprintfA DispatchMessageW PeekMessageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow LoadImageW SetTimer SetWindowTextW PostQuitMessage ShowWindow GetDlgItem IsWindow SetWindowLongW FindWindowExW TrackPopupMenu AppendMenuW CreatePopupMenu DrawTextW EndPaint CreateDialogParamW SendMessageTimeoutW SetForegroundWindow

gdi32

SelectObject SetBkMode CreateFontIndirectW SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW ShellExecuteW SHFileOperationW

advapi32

RegDeleteKeyW SetFileSecurityW OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges RegOpenKeyExW RegEnumValueW RegDeleteValueW RegCloseKey RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumKeyW

comctl32

ImageList_AddMasked ord17 ImageList_Destroy ImageList_Create

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb
MD5 17ed1c86bd67e78ade4712be48a7d2bd
SHA1 1cc9fe86d6d6030b4dae45ecddce5907991c01a0
SHA512 0cbed521e7d6d1f85977b3f7d3ca7ac34e1b5495b69fd8c7bfa1a846baf53b0ecd06fe1ad02a3599082ffacaf8c71a3bb4e32dec05f8e24859d736b828092cd5
SSDEEP 192:eY24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35Ol+Sl:E8QIl975eXqlWBrz7YLOl+
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10183

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Doktorerede/dircaean.tra

SHA256 9a53055b855823f54d1eeed875f5537ca575276aed9dc3a80dac6b9d6bf4d6b7
MD5 67e1fa3676278fdd1527fe5f1e7a106c
SHA1 193469c5774911d1fc001a56fcf821a31889efd2
SHA512 d94316b69a10d51e0e280d88c1a5c2caa63dfbf1b158afc4a0aa8f559918fa2e1ee8c48ee5fb9ed0f23d046c346a7e794e4f17233a44da5ac88034e36fb98976
SSDEEP 768:T2UPoh2JTzVXcvcorx5DyrCmJrkBn9P0KN+PsCG+kHfNTJj:QYTs+Q
MD5 SHA1 SHA512 SSDEEP

Doktorerede/exclaustration.att

SHA256 3745d04b6430ef2332d844cbee1a1762e21063b0806b3af76f9310373eba395d
MD5 42868e711ccf42253ab8c3961a0d8160
SHA1 21e06f6b0246e2d2897f9716182b0e4de5163647
SHA512 26534f30969fc5bc52b569b78888a394eb5eb6970c9734867f3639e2664ef6c32b4e1d9810da310eceb18e970f236d7a31533dc5bccb0eedf300e7e2ada41b05
SSDEEP 768:4KPYnxvXfFChe8+Taeu6vbZvkysS6WugeBaGwx1Z4lkzzI4u4I21j9TnM4zx5rxx:SGgiquE7xN
MD5 SHA1 SHA512 SSDEEP

Doktorerede/fordringer.maa

SHA256 d282282ef568fc10ebfbf7320052fa085a918475da5388693c6292d425c3b1c3
MD5 5e3a26fc26672be273b700ba47c59717
SHA1 0d6f50523f7ba77289b7c8982218e221a63a3b8d
SHA512 2a5e6af70f70ababa027eca48c49c6c9829e83e6eacc1dc7a5a3ddb07de14e1a3d41e5a693c2ccb9ff08f10f61d17ac33b33b5ce0e402157b3bfb0da225d3057
SSDEEP 768:cg4gzuPCy3DX1gqeVE2k3+BIZHiFE8BdBC5ZqblgR37/bgM5tGIP7MUgnjwNvNZF:xGBNTBL
MD5 SHA1 SHA512 SSDEEP

Doktorerede/leviticalism.vor

SHA256 54736102231b5debff54849577a27cf00f42406e59723dd27dae0bab6e70e383
MD5 be29dbda10c1b3b82784efa989945562
SHA1 b13ca47e7caf1e2f62d87af58e1ad7b895124ec0
SHA512 b695ed0ae075b9431abe30553d6bbc669f65fa717d2e3ddec697e795df88a8b1d056cb22fc2628f53965f7de5651831620ef15cfd5b47bb5d18e40e83e9ac2ea
SSDEEP 768:/JF7BWSf0Ul3ZLkmxslnKZGJwBdluFavA5yzvt9ML3oKcVlPj9hAuNRMQVtqwRXc:V3hvrVpn+9q48NFMAVVuD
MD5 SHA1 SHA512 SSDEEP

Doktorerede/mauritius.chr

SHA256 00dce87c0c6f04fd0e6fd8f06c7332adb7d2fff1d361653e07a6fd3a999fedf0
MD5 d6ad076141c50de4f38c153460285801
SHA1 296c27c4b693aeaf4c6348f9af96462c07a1f2a8
SHA512 b152b1be9ab3d432c3a9303ef515ccbaaa1620a436fe3dfd68f91a8f3e78f02ba65d8800d4c787903898b1b73d7ce31286978df4f3ef427277f575c611c374e3
SSDEEP 768:qzj4NrayiZ8aVuMJT/EImvlRRb+W+IP16g58LYi0wxf6Ki:abDNI
MD5 SHA1 SHA512 SSDEEP

Doktorerede/skruetvingernes.dan

SHA256 c7d598ef57f75732e168829a593f668574707f05ad5c53383241f8c265658f3c
MD5 88e6f82a36a54a57a8bb4f14e7c695ed
SHA1 31449ccd1eb7f08254939c80085183022da75805
SHA512 d5a8d1fab87ff7dfaca542f8c51982619bd90c0dcab1bcb61950404a9f6593f8c4ce999ad6d66e7abe5f2a1816cc2ad51da4d4e8bb3c83fda70d4f9b11d2ae6a
SSDEEP 768:Pa1cE1QObLvS0gs1HiXl75trF1v05fuLIqMNITlBt4khZx:S7
MD5 SHA1 SHA512 SSDEEP

Doktorerede/soils.ext

SHA256 0a7a0b2fbcaf52f81ebfeb42fa5658ddb6f60e4e86a89c5097d0f9780b678994
MD5 8c6d0824df3f2698a042d4314bf6b3b5
SHA1 769ab62d92618562ff46033e9dc9fb515cb96663
SHA512 7c56515cfbf562cbdd5796d2eff49091986d90af840a8e146541710c39e2b1e0d77e5c0c2a2f448ad2c48af08ab55f43d2872f498ae7a482ce69dc6c5f361af6
SSDEEP 768:LWv/0l1DE3BJkYiYTSbunP6QUz2eAnupSVZMTJvrztcoOO:K8kP2gAvD
MD5 SHA1 SHA512 SSDEEP

Doktorerede/viften.txt

SHA256 575862190bc973d2ff61238bf3a657c6fda0c19c2c2365e4f423982081d9e1e8
MD5 ad00be6f8e4bb0ee1c15bc5a4a02b550
SHA1 c37fdb362668931d1a47c300ac35a3a1e96f2f0f
SHA512 9ab65d394d307d6d42f499ac66b93f0f7276e064a8efc14a84a46f9c5abef45d204647a23ec87d7eba932ada14e22355d8c5c991383673aff75b36a5fbbc3611
MD5 SHA1 SHA512

Forkmper231/Glorifikationers/Aster/Sstridskrfter/zincide.rev

SHA256 65c6c0d242025b812521d42afb731a4fee184da529f40cdf7afca908db6e441b
MD5 353dd3b277e641be984ad4d58cbf82d4
SHA1 d07d17ff60ef4126e0e183a951592b4fd4fd0b54
SHA512 0b7e77d16121ad004ecf0449612eae68de1b30b1f2dcd7af77b0581e5dfa9c69c47c63ff0f74963ddce2cefcb3d42de6101ed6a5e0efe8dcef59d2cf2b6bf2fd
SSDEEP 768:wruD3wXnXznF1GdiX8Ngim/NEZ8QqIGI7eMfRpVr9Zp7Ge0u7V2xp2IqiqUcovDa:WnDN66g
MD5 SHA1 SHA512 SSDEEP

Pseudoviaduct/Bloddraaber/Levertranpille/Hypersensitized/Brontolith.ref

SHA256 2c6d763130d06483702e5193d602225fbf53e4a564f58a464702c22fca7c7d1e
MD5 cee2ba08af0f3dd3fa4c837a0c8bc50b
SHA1 2686b8d359973bd733309f7b4e3513dd09adad97
SHA512 3da2155b57500ea417311464f1d47ccd8168c42bd07e27a2ab7964baf5d202888db308555920892cb1b42dcfe73f8a737034404c6b450f5cab0e4fe0a0061b75
SSDEEP 768:G1Qnyfwumt0TItaphuCkMyUzPHdg0JCieCfUJJWlLVA6A2EVolnIxbfS/LQ8rtSJ:AQAcGTLWR3
MD5 SHA1 SHA512 SSDEEP

Pseudoviaduct/Bloddraaber/Levertranpille/Hypersensitized/Vragedes.str

SHA256 da73634aa3a113ced84716f6284e1940b738cf6dcfeb0f7cebecbd984741b83a
MD5 fc38f61738a3f9611bf0e63a97531371
SHA1 ae0478b2b9242bc2b51e1976ca9c9de09d8e85fa
SHA512 ba704a1aec68b229f6c283c00e505ca4f03e0d46ec1c4e8d7c213891e24e7467fba749b06aea13cdaacfda0f2625901a9a7da6b1f258e8257b2839a1085df6e9
SSDEEP 768:9Eblfq5Gz2jA5g5oQjPU7PBvi2RID6q84N1M9s:InqUBSis
MD5 SHA1 SHA512 SSDEEP

Traerester.Udk

SHA256 69946d6e76a8aaf125548695c7d4c11e78309f18fc9b437cdcfe810807341281
MD5 bdc3a50f5aa45a0cd9260db2667056d1
SHA1 0b72817adf7cef998d5001a92a4e763a39b6117b
SHA512 e455946fd4c53cf9cbe06e03cddbe8b6a93e779c8f3f1c11df95b5df9b4a5148c89c7419067e5857731f9f25a201f1bb5c833068401b7c1aa7545f3909ad303a
SSDEEP 12288:+14bAkg2FTf68/m447wg1dKlsgCSigbdup+Al8ch:04bAkg2FD68/m4kGsjSDbduBllh
MD5 SHA1 SHA512 SSDEEP

glyptoteks/Sedimentationers/Tuttede/bldgrerne.nav

SHA256 2e6f71147d01180f82cbf245083b92595b6626046430589baf451b6851fd72b6
MD5 b1801711df7fbace3e566b413fcbeb85
SHA1 5043a43eee7b96559e90570f8b188b54c2a353c0
SHA512 55d485ccbb600b85b8b5b149373f5c897f14657cec218af830bbac0a884e2db13c903eeaa23fabf90831425fc5c384f61d081da3de3be343532ffe4a95732669
SSDEEP 768:OYQ0i4/32PCWPEAPPx/TM3Bfphy2e2Aos4bz8G7lJo+tbS:BC/
MD5 SHA1 SHA512 SSDEEP

MDU9342434.exe

PE Signature issue

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Doktorerede/dircaean.tra

Doktorerede/exclaustration.att

Doktorerede/fordringer.maa

Doktorerede/leviticalism.vor

Doktorerede/mauritius.chr

Doktorerede/skruetvingernes.dan

Doktorerede/soils.ext

Doktorerede/viften.txt

Forkmper231/Glorifikationers/Aster/Sstridskrfter/zincide.rev

Pseudoviaduct/Bloddraaber/Levertranpille/Hypersensitized/Brontolith.ref

Pseudoviaduct/Bloddraaber/Levertranpille/Hypersensitized/Vragedes.str

Traerester.Udk

glyptoteks/Sedimentationers/Tuttede/bldgrerne.nav

Sharing

General

Malware Config

Signatures

File Explorer

MDU9342434.exe

PE Signature issue

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Doktorerede/dircaean.tra

Doktorerede/exclaustration.att

Doktorerede/fordringer.maa

Doktorerede/leviticalism.vor

Doktorerede/mauritius.chr

Doktorerede/skruetvingernes.dan

Doktorerede/soils.ext

Doktorerede/viften.txt

Forkmper231/Glorifikationers/Aster/Sstridskrfter/zincide.rev

Pseudoviaduct/Bloddraaber/Levertranpille/Hypersensitized/Brontolith.ref

Pseudoviaduct/Bloddraaber/Levertranpille/Hypersensitized/Vragedes.str

Traerester.Udk

glyptoteks/Sedimentationers/Tuttede/bldgrerne.nav