factura-022853[.]exe

resource
unpack001/$PLUGINSDIR/System.dll

factura-022853.exe

IMPHASH 1f23f452093b5c1ff091a2f9fb4fa3e9
SHA256 df09e53e0571765247faf08a316fd75c13e84be01f4db61b294e0ec95aaf1b5e
MD5 ab6efa89da33771cc27798e705a2043a
SHA1 3a3c00f5016e82599a3a2dbe1991d277374c5da2
SHA512 6e1a25d274a025844a952af4bf6c781cb3bc3244c28b2704621f67d5fd63858831f31a88a3c37fa7a52fbc4e81a44380c6b9aa66d4c66c1f1828d8d14ead1678
SSDEEP 12288:dgOiqjFk7BcQw4oxyCQYBLfoKI564aQiCyCtcgmicuiu8wgB:dgYFSBcQw4gyCQGcpakRRa
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

16:b5:13:39:ea:19:8a:34:5c:9f:36:d2:85:4a:18:11:77:06:76:fd:45:7a:53:7a:d3:60:7f:1d:d4:5d:c0:b5

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Usseliges,OU=Enkeltfagsundervisningens Generaldebatterne Rygstds\ ,O=Usseliges,L=Bilton,ST=England,C=GB,1.2.840.113549.1.9.1=#0c1553756d70746572734050696e636861626c652e416c

Chains

Mar 6, 2024

Minor OS version

0

Major OS version

4

Entry point

13477

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

ExitProcess SetFileAttributesW Sleep GetTickCount CreateFileW GetFileSize GetModuleFileNameW GetCurrentProcess SetCurrentDirectoryW GetFileAttributesW SetEnvironmentVariableW GetWindowsDirectoryW GetTempPathW GetCommandLineW GetVersion SetErrorMode lstrlenW lstrcpynW CopyFileW GetShortPathNameW GlobalLock CreateThread GetLastError CreateDirectoryW CreateProcessW RemoveDirectoryW lstrcmpiA GetTempFileNameW WriteFile lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject lstrcmpiW MoveFileW GetFullPathNameW SetFileTime SearchPathW CompareFileTime lstrcmpW CloseHandle ExpandEnvironmentStringsW GlobalFree GlobalUnlock GetDiskFreeSpaceW GlobalAlloc FindFirstFileW FindNextFileW DeleteFileW SetFilePointer ReadFile FindClose lstrlenA MulDiv MultiByteToWideChar WideCharToMultiByte GetPrivateProfileStringW WritePrivateProfileStringW FreeLibrary LoadLibraryExW GetModuleHandleW

user32

GetSystemMenu SetClassLongW EnableMenuItem IsWindowEnabled SetWindowPos GetSysColor GetWindowLongW SetCursor LoadCursorW CheckDlgButton GetMessagePos LoadBitmapW CallWindowProcW IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard ScreenToClient GetWindowRect GetDlgItem GetSystemMetrics SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharPrevW CharNextA wsprintfA DispatchMessageW PeekMessageW ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow GetDC SetTimer SetWindowTextW LoadImageW SetForegroundWindow ShowWindow IsWindow SetWindowLongW FindWindowExW TrackPopupMenu AppendMenuW CreatePopupMenu EndPaint CreateDialogParamW SendMessageTimeoutW wsprintfW PostQuitMessage

gdi32

SelectObject SetBkMode CreateFontIndirectW SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation ShellExecuteExW SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW

advapi32

AdjustTokenPrivileges RegCreateKeyExW RegOpenKeyExW SetFileSecurityW OpenProcessToken LookupPrivilegeValueW RegEnumValueW RegDeleteKeyW RegDeleteValueW RegCloseKey RegSetValueExW RegQueryValueExW RegEnumKeyW

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
MD5 0d7ad4f45dc6f5aa87f606d0331c6901
SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10643

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Jumbucks/Bundes/Zion/spgelset.emi

SHA256 2a17a75570c89409aa5774d710e6fdc10e35e49e879b58615bffa27294bcea68
MD5 ee479c560910335aa25e1784af29ec45
SHA1 647a089058e89e9bbd4eb5167fd56986dee3f7cf
SHA512 fd7b39d9c62dda0f3353b768d1b48b6ca11001646656d95a82f4aa2d9a14a4927d3f75b1b84850d6342faa22b73b8362d4419e33528b52c656071168b7582701
SSDEEP 768:4auU4DI5veD9KURU3EI8XQ5+YXkcbCCu9FqPimuGIM9In84kYa42EbflVPFA/RfQ:Fbs
MD5 SHA1 SHA512 SSDEEP

Metarsenite/Amphioxuses/Voven237/whippletree.alb

SHA256 23f15dc0d145bf33f8197d5b973b318376c36b48c0d391b3760587aa429d4947
MD5 f11cf6233ec5acb7d093d0a9de2364fd
SHA1 3c3e90f775dde25c71e79ff74389a82980d8b385
SHA512 ccd3bb73cfe8523ff2df36dfaa1a807512895e6f6bbf440424c1a578732fcd8f9f18d99121810ef6f7dde9f9b9891997a9fd5480f8105c0b189efe8bd37302f9
SSDEEP 768:k3AJVg9whqACjXTxSuTumEFSd3aTJql++5VjUDSKc:0PUDe
MD5 SHA1 SHA512 SSDEEP

Nonpersons/Gokartbanerne/Ansgendes.txt

SHA256 c4e7ee4e49b8c4e24991021cd8eeaae1f86a376f82b1d8325f6257f89be2881e
MD5 a3c13ec32d3775f4eb6b659955d7f0a8
SHA1 8341dfff10c7ac404b9c9e1b52cf5dd126e08f4f
SHA512 097dc78f6c339faeb4bd5cc581ad2f82259605063597f0d14023569954a7fe09b22dea454f4cb9204c9fc54963c789288a90bccbf611995ff63269a496c962ca
MD5 SHA1 SHA512

Nonpersons/Gokartbanerne/Fremskridtsmndene.Thr

SHA256 c65cf08a2641a73c43faad5932b814f367754a4de228c49a28d8b4299d85e03a
MD5 d45e95e2518f44610dd3f8decb331c21
SHA1 aaf7aa8a0d393f29bf476e95039b91ebc8e556c0
SHA512 ada5bf65caf19fb5d8e0a09d966e6afa10cae1b503d301e76dd07b6b822aead3ddcb289934ec5136d578a413ab8f9812a9391e8882cc2bd03b228bee680bb2a5
SSDEEP 6144:WR9l4wGRmh4Tiotx4f0U37BCz2rTc+jV0N:WRMwGQh4Tlx4DLBrsO0N
MD5 SHA1 SHA512 SSDEEP

Nonpersons/Gokartbanerne/Grovvareforeningen.poi

SHA256 9fa0016b5cdb669bb03420322093d0bddf6cbc00eb02254943ecd0ceada1c807
MD5 d460a477e557d1ef6b395022bcf8e3ef
SHA1 a37da2e98dca6372c47a3b48ce2b60d90150fd13
SHA512 f90258640819ac7ddea659f55bb09db07bffc377d331e9bcdb9e14a74a4f9423ab99805a935ad9d5bb5a8ff115f0408e8042eb98d2ae51bfa356e914137d7cbc
SSDEEP 768:dunCKrr/MRXEyf4gemMDdnUEWHPG71U+:FrS
MD5 SHA1 SHA512 SSDEEP

Nonpersons/Gokartbanerne/Tilringe.Ara

SHA256 f503407c62c0ff16bf7bd76d5fce3538d3c8565e188ad0551f0e7d58f77d3861
MD5 9f769546bb10fd2fe19ab914de241708
SHA1 33bab37cc08ba6af84c57a3d22986bf8a0b181c1
SHA512 db3250e9c42182cce4e3efa3b59a0de33fe9d7459cc4dcba731aa4a62cd4a4761b4f3efdb74908645b2b8f7df6069476742ce0f037e9886e54b4f2698d33c464
SSDEEP 384:ZjQRYNIDKVIHEPsRDRyirg3uodcLhqn5MvTt7Y60qCkKW:1Zq+VxUNvE3VcA5MBR0qVKW
MD5 SHA1 SHA512 SSDEEP

Nonpersons/Gokartbanerne/angergivne.kar

SHA256 14b025c5369ba06d77ea0a37d07cb8c1aa168459031a76bba91e21e714304103
MD5 47b2cfe31b79825275788cf5106de72e
SHA1 92eb3ee55845c5fa47a45078dfb03e599981bd4a
SHA512 ffee0de70b5757985a3768724f8b832b0a92d5a704acc960bbe9ce81361b2bc136b3642356f1dbb9c9f6a6f0bb12b20abfca612c95d3220606b2f185b035f19c
SSDEEP 768:2IAAG49vImgg4IfukmV4j7lOaX6z42iHi1KAZs9uqijJw2O4clAjEBATqZHW/lkf:28F06a
MD5 SHA1 SHA512 SSDEEP

Opskringsvejledningers/balancevelse.owe

SHA256 ba45110f75faad03f6dce77956839bd5fe8294ae33b2963a33cde0ad9da8e573
MD5 a2b2bf2db4f34e91535234e1febc76a0
SHA1 e442ad1c907f9003697cd5e890183c55e08ef23c
SHA512 bf88797f2da96e07b23d2ae7c9d6fb8e41aadcfff9165a6a496e29643cf9a34093594916cd832d20d70d9fcc8c5fc602a129bdf9bfde79cc39d1084f18732ae6
SSDEEP 768:W0nZaP+2YdA+XY1d7thGxpubd5Ikepq4lKPAoJAesPXz6x+3wZxJJRPEaaZLFvux:TD
MD5 SHA1 SHA512 SSDEEP

Opskringsvejledningers/kancellistilen.car

SHA256 629143916fcc6063905e2ad88401b94ed3bbda21945cdb9a7743cd1c07c31d01
MD5 287f28e114d1f2cab60f01edd6a8c952
SHA1 ee9061d58d1cf35f1ecf76fc27de0ad4b114ad71
SHA512 29a60d12fe3846e6d3391b8e3f816a9b6d4b57602cc0c0572dd9418d5aeb72861b0d53d0a7263c884f120aaf7861ddcbf6c9b87e8c2c39b8e0142241ce915c2d
SSDEEP 768:bbUmhU9vMLs56Aw3GywRgMrKdQ/lFZJrZM71Y5+pfgv8ZrAryhQOhJiE:KGJAW7
MD5 SHA1 SHA512 SSDEEP

Opskringsvejledningers/kapitalforsikringer.ula

SHA256 b117adb069b3845cfffb800f5e4392fbaaabe69b995c442430f9ea13c4b9bf65
MD5 77e99cef398468cea37ea0fb89df0a4f
SHA1 3bcaf370b16b4f89ae39cc0836183e69cfabf796
SHA512 f2484d123ae619617cfb64303f4c8acca7a201fa6ace3248b8ec46f9f3da53dac4c5f02b296c76cd9a835e53b57268c1ad7d2f3174e5c3d5d62eebbecdce4a1c
SSDEEP 768://CVjnSy3FwspN74JAuSpYSqVYHOPoP53wOyi7wCyMXW9RTCTabjWeRsX5X7UPTU:npfYu
MD5 SHA1 SHA512 SSDEEP

Opskringsvejledningers/skalar.the

SHA256 4f68fc35fc1ae79c3b2f5654980a53d8c8f4026c5dd8f392b57f380c2597df1a
MD5 468742c8ee1655492b3943d08b062b4a
SHA1 e39d27eb0fe28daf44c1582518651bc5a68921d0
SHA512 b1434d1f41760decc5e5e281f006fee8769ec1db19dde71e04ceac13ece565c9a3a2d27e9b3075509d8de331334be1d07f9a37df4fca59f5ac087d826b4fbed7
SSDEEP 768:2c5AXbcE4OzmTAOa81WMXIbM1589LTIrSKJ74JN+1vCvV:XTD
MD5 SHA1 SHA512 SSDEEP

factura-022853.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Jumbucks/Bundes/Zion/spgelset.emi

Metarsenite/Amphioxuses/Voven237/whippletree.alb

Nonpersons/Gokartbanerne/Ansgendes.txt

Nonpersons/Gokartbanerne/Fremskridtsmndene.Thr

Nonpersons/Gokartbanerne/Grovvareforeningen.poi

Nonpersons/Gokartbanerne/Tilringe.Ara

Nonpersons/Gokartbanerne/angergivne.kar

Opskringsvejledningers/balancevelse.owe

Opskringsvejledningers/kancellistilen.car

Opskringsvejledningers/kapitalforsikringer.ula

Opskringsvejledningers/skalar.the

Sharing

General

Malware Config

Signatures

File Explorer

factura-022853.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Jumbucks/Bundes/Zion/spgelset.emi

Metarsenite/Amphioxuses/Voven237/whippletree.alb

Nonpersons/Gokartbanerne/Ansgendes.txt

Nonpersons/Gokartbanerne/Fremskridtsmndene.Thr

Nonpersons/Gokartbanerne/Grovvareforeningen.poi

Nonpersons/Gokartbanerne/Tilringe.Ara

Nonpersons/Gokartbanerne/angergivne.kar

Opskringsvejledningers/balancevelse.owe

Opskringsvejledningers/kancellistilen.car

Opskringsvejledningers/kapitalforsikringer.ula

Opskringsvejledningers/skalar.the