03fa96650130466d43c4b486c615294a

resource
03fa96650130466d43c4b486c615294a
unpack001/$TEMP/Compound

IMPHASH 56a78d55f3f7af51443e58e0ce2fb5f6
SHA256 15bf2e47fd14a3a676452ca26d5c2551a67140ed8e8d3f1ebce9e5fcb7aa3fb4
MD5 03fa96650130466d43c4b486c615294a
SHA1 88650e99ae745097810f096035a3272455e0b708
SHA512 c0583e46f845e6a53a559ca4658d7203a921ff9fabb8a5cee20551e80f056d2def72c112921968435a3e30bb0dcd08bb824159f1bca1bcfa137bf3ee3263115f
SSDEEP 49152:gwsPtT+HW9zDL6axnzPmZ/lqTpv9Dasv3xzHM3kCJwf:gwMtSAXL68nzgITZBfxxCW
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

13559

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCreateKeyExW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken SetFileSecurityW RegOpenKeyExW RegEnumValueW

shell32

SHGetSpecialFolderLocation SHFileOperationW SHBrowseForFolderW SHGetPathFromIDListW ShellExecuteExW SHGetFileInfoW

ole32

OleInitialize OleUninitialize CoCreateInstance IIDFromString CoTaskMemFree

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

GetClientRect EndPaint DrawTextW IsWindowEnabled DispatchMessageW wsprintfA CharNextA CharPrevW MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW GetSystemMetrics FillRect AppendMenuW TrackPopupMenu OpenClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW PeekMessageW SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint EmptyClipboard CreatePopupMenu

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateFontIndirectW CreateBrushIndirect DeleteObject SetTextColor SelectObject

kernel32

GetExitCodeProcess WaitForSingleObject GetModuleHandleA GetProcAddress GetSystemDirectoryW lstrcatW Sleep lstrcpyA WriteFile GetTempFileNameW CreateFileW lstrcmpiA RemoveDirectoryW CreateProcessW CreateDirectoryW GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW CopyFileW ExitProcess GetCurrentProcess GetModuleFileNameW GetFileSize GetTickCount MulDiv SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW MoveFileExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW

$TEMP/Alot

SHA256 7ac226e081d090f2e3cb99104b4226fcd5e77cb83f7edb23081c1a2bd376533c
MD5 0c257b9edbcc7f41af6e1027bc0713ee
SHA1 2149a7bb22476f85610c842c34628b2f22d8a549
SHA512 f98b584e5112a81336ad4d7f2a1a4066028fc0c9d7a0b5b148172bd4c9a0485983ea868522a61999415837fdbd73401cb703138729e03831dc39bbe6c1f3f25b
SSDEEP 768:bDP8WBosd0bHazf0Tye4Ur2+9ByVatPVEV3GPkj9d:sWyu0uZo2+9BgWOEMd
MD5 SHA1 SHA512 SSDEEP

$TEMP/Bathrooms

SHA256 f231fe2acf36b89ade78b80eb336650de0e4a7e9bfee25e70bce55a93c77e02a
MD5 a0d9b89b48e8fc49b82d019ee8500484
SHA1 5ca4d2e68d734e2314bc226f0bd6b5c04e0bdac3
SHA512 1ac26f3815f4477a1ba6e73fe90587952fda18dd4da2ccd201bb5a36eebbe76270ace8b5f8764e279568ed394e5bdcf9ee10a429ad6c76f9b462c37043034fe5
SSDEEP 192:TNpj6Hq+sRaY/G3R6RycS39f4Qb7dqHm0nL:TN43WG39fndk
MD5 SHA1 SHA512 SSDEEP

$TEMP/Compound

SHA256 640dd32f2764bdb5c0578093a02e828ff53e18d397512a1992bba583d1d2e648
MD5 da2be5607513a22a9d61d9538f5f0636
SHA1 e77975bb6f507b4089409a06ab2226a6d54bfefd
SHA512 1f432b70928e2b41fe74427e086bca411c88710adba700c32bc6089d02684edd04859503269b95bfa64be7439ebbfd41d928d9a464717517db18e68bc3eb63f4
SSDEEP 3072:vsVEU0SgcAApfFSvfWLhOa2rdf1wFX8ZpU80KS/n0zmo:mHggFOrrdNWsZK8X0n0So
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

2

Major OS version

5

Entry point

154084

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

$TEMP/Disco

SHA256 dc30e0b588b256bd593502a28b6ce43f0da029b38fd70408b19b415d219066df
MD5 8de31c24cb7fe99ff6348875de7cd146
SHA1 8e2afafc129d1ddfc6de010029bb867f1708c6f6
SHA512 6a20368a0cbc03e25fb699815f584727c050f4b583ff8ee467e4a03ce4123c29d2f90dc8a4745831f5bc860b7deaa68a2bc19364c46bfe136956d265539ac133
SSDEEP 24576:7x6oM8NnQfaD1CDpsC7UXNEfW7EtlLZDxY3hnvo35ugdO0pfvequnACdJ77Uar8i:7x6oM8NGWyZ0
MD5 SHA1 SHA512 SSDEEP

$TEMP/Emotions

SHA256 7e9d688abe2dd7d1ac4796a62d9e816d8c3efe719f2de72ce6c49221e027d2a7
MD5 8a83e45fdfd2f28ef8210428fecdef9c
SHA1 db669761c961b72e7771cd8317c582ef8e48ddd1
SHA512 74dff439e42139117e9d384cb6323039683aaf5c18ed71285eec65d215eb4bf4a4c3e284231f1e7da6af9147606e9ccf13f081fb84f7f311f4e444878a7ab1e2
SSDEEP 6144:AN1FQLaiOOWP/jXrwUqAM/8chPwPf73umIrxJQugUvCXC:OQ+iOr/Drw+cZwX73umI9JJES
MD5 SHA1 SHA512 SSDEEP

$TEMP/Injection

SHA256 647a49b0eab7039c74d69e4142ed1be7f01afe9cbd6483d01039cf5b289973da
MD5 4d21c2eec34495a74f67de9c7944bff3
SHA1 f9241a3fc121e397e23d6f3d07a3ee24b14137c2
SHA512 8091201ebe4c08b105e558d2085aed1e90366ce289effa3e2d2a6b51d9364f1f68e3c1d8e54502931800a34d469152bb615e688d7563ac8b299de02c7161110c
SSDEEP 6144:0uBiw3zowPuUGHc3AM7G/XruYZgwB4IQDp:Ew3zluXUATrxy
MD5 SHA1 SHA512 SSDEEP

$TEMP/Participants

SHA256 33f67ac58e056d541e9ffc261620bb6069bc3bdc0690cf6b1b4402cf64476da4
MD5 53c678fa488852a4533e20624a3f4ac2
SHA1 22af659f0f7b6f09e3780ecafa87dff857c29707
SHA512 79f7f93f9bc6b731bed2a69868cf2451b4c255fda7500914e8a0580b0fa6a8d468b2a2ec27c01f9b007e0addf9b5bc1abd569edeea16496464461cb09cb71fd7
SSDEEP 1536:ZleFmHz1vNq82r/c1qqxa4HoWJ4p9dlWsWldbuiaAwuJPj:YtqxDoY4B+VaAtJPj
MD5 SHA1 SHA512 SSDEEP

$TEMP/Richmond

SHA256 5f9ba61683e3b51ca21cb15674306b7c58b62ee68210d96ecf8fb00b1d396a2f
MD5 bc70f3222d729f92658b32a28c6d7375
SHA1 8591ee5231e1efcf3eadc507909ec98b2cf29614
SHA512 10e7738f01e40321e305f89115df545c29a60bad47b91fca651cec8d1dcacb4551c72f838ac0a10f7d5739090d042ac429c85ebced5056809d0251d8c909f3c6
SSDEEP 3072:l61e9Bd0YddxrTgarmeI93RdeniKqk/IgM:l61eLgarRI93qi4M
MD5 SHA1 SHA512 SSDEEP

$TEMP/Worm

SHA256 0795d6a6fdc1bac55de379cd7f33e4440dc3645e748f91d2b3b4dddf38a8635a
MD5 1624046c22d7d232e3ad77d456743551
SHA1 6ac978fe79d62baec9626ae3d18e2263ea91ede7
SHA512 da89fc52fab7905d82fd1d9abb92ba53ec5f93f1ed296acab297aeeb8ce0b708052f8b519300926323001274d769b859778fbb7e736375f6e7c196f6287dcdc3
SSDEEP 3072:esG5+N7+msUMKCrMuoS7FIMQIPcNwTFVAu/:eB5+N7jHMKVu7FlNcwTFWu
MD5 SHA1 SHA512 SSDEEP

Sharing

General

Malware Config

Signatures

File Explorer