COACH MARCH ORDER +COACH JUNE, JULY, AUGUST ORDER [.]xlsx[.]exe

resource
unpack001/$PLUGINSDIR/System.dll

COACH MARCH ORDER +COACH JUNE, JULY, AUGUST ORDER .xlsx.exe

IMPHASH 6e7f9a29f2c85394521a08b9f31f6275
SHA256 8a3597999df227bed6a515aebd8ecf14468a8e3f23d570af30f42d72b3f6356b
MD5 eef80ad0744688be6c6029e7793dcf91
SHA1 35c0251531d08a060807c429e0833b5d48099a9d
SHA512 ed28dbb5861aa55f64a0ff08851df3419275c780bc215a5821d08a49c5f1ccc16b0d7ba635f9394b467a48caef841101254dc8982bd0b28b0a3bdcc661bc870c
SSDEEP 12288:EMwrhdMp7SyAHZ5lEhugESlldjfmj/IiZY4CqXr6pSD8gZLI:EMwr0p7STUE6+jdm9qb/8gZI
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

f2:fc:d6:15:ce:00:f8:32:8d:87:59:c0:b3:dd:57:cb:46:f7:a8:14:e4:31:97:be:c9:b5:8e:1e:8f:39:70:bd

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Tredjeprmie,OU=Svirreflues Grandioseness\ ,O=Tredjeprmie,L=Mid Mossdale,ST=England,C=GB,1.2.840.113549.1.9.1=#0c1f496e73616c756272696f75736c79404b616c6b756c61746f727336362e416e

Chains

Mar 16, 2024

PE Signature issue

Digest

d5:2d:be:97:e9:26:6e:70:39:d5:fe:b9:a6:55:a7:cb:c3:66:8f:6c

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Tredjeprmie,OU=Svirreflues Grandioseness\ ,O=Tredjeprmie,L=Mid Mossdale,ST=England,C=GB,1.2.840.113549.1.9.1=#0c1f496e73616c756272696f75736c79404b616c6b756c61746f727336362e416e

Chains

Mar 16, 2024

Minor OS version

0

Major OS version

4

Entry point

13455

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCreateKeyExW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken SetFileSecurityW RegOpenKeyExW RegEnumValueW

shell32

SHGetSpecialFolderLocation SHFileOperationW SHBrowseForFolderW SHGetPathFromIDListW ShellExecuteExW SHGetFileInfoW

ole32

OleInitialize OleUninitialize CoCreateInstance IIDFromString CoTaskMemFree

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

GetClientRect EndPaint DrawTextW IsWindowEnabled DispatchMessageW wsprintfA CharNextA CharPrevW MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW GetSystemMetrics FillRect AppendMenuW TrackPopupMenu OpenClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetWindowLongW GetSysColor SetWindowPos PeekMessageW SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint EmptyClipboard CreatePopupMenu

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateFontIndirectW CreateBrushIndirect DeleteObject SetTextColor SelectObject

kernel32

GetExitCodeProcess WaitForSingleObject GetModuleHandleA GetProcAddress GetSystemDirectoryW lstrcatW Sleep lstrcpyA WriteFile GetTempFileNameW CreateFileW lstrcmpiA RemoveDirectoryW CreateProcessW CreateDirectoryW GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersion GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW ExitProcess CopyFileW GetCurrentProcess GetModuleFileNameW GetFileSize GetTickCount MulDiv SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW MoveFileExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 acf90ab6f4edc687e94aaf604d05e16e6cfb5e35873783b50c66f307a35c6506
MD5 6e55a6e7c3fdbd244042eb15cb1ec739
SHA1 070ea80e2192abc42f358d47b276990b5fa285a9
SHA512 2d504b74da38edc967e3859733a2a9cacd885db82f0ca69bfb66872e882707314c54238344d45945dc98bae85772aceef71a741787922d640627d3c8ae8f1c35
SSDEEP 192:MenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XBaIwL:M8+Qlt70Fj/lQRY/9VjjgL
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10719

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Miljinvesterings16.Sta

SHA256 21053960cbcc0793963f164ba3270c6267e90f4eaf65067668eb9ad52bb05b29
MD5 e0e6aca0120705f468654360e3e80c74
SHA1 cc221f092ad6fb01d9ff6faeeff2743062ce8e8d
SHA512 681352f5f036b6aa942b73cba03d686b7c2c70a4d3d3e74a344e66cbbf4f7b830bca161bddfd50ea39acea1c36d26c22b74525a5eedc772b670ac27cbf28f055
SSDEEP 3072:H0jPfqGB488ZbK7J2GhIgbHIyoNRgquI93TAdYuXLG/MX/SEP1tkkwbB/:HiPCur8ZeF2QIEHIyoNRcI9DmXiEP13W
MD5 SHA1 SHA512 SSDEEP

Samfundsnyttes/Rangstiges/Geobotanik.Loc

SHA256 6f12ac629e82fadb236f75beb85c90d3b6892226e9d474dc1ceecfe40c3983b8
MD5 1e788bc0388a8b1ec7e2c4aab341ff82
SHA1 35889afa334a63713f940798295b7d2dd267c3b5
SHA512 ddb31954e01a60c6dc4c135ef3119de5aed1c71c15ce5a8ecca9e124fd61f0164b53dbd1a45d7d0af38913af17c70056676c7ece688c019e5d1a1917aca8f663
SSDEEP 3072:a3WV15HQrtnJsrUxgERXiCmKGk29c8MHBQULKb3rqDFrvOK:ae1QrtnqwzRXiCb1EcTHqP3rqDpv7
MD5 SHA1 SHA512 SSDEEP

Samfundsnyttes/Rangstiges/Signalled.sty

SHA256 898c1244febc5f1588a78b8f21d0da31c2ee50781096514e452957295627f463
MD5 a5db4ebc017edd783439241042486bab
SHA1 f7f02260158d93af64224c4b9001e030b3c8fd9e
SHA512 3e10a512227990cb9db9b0f715ad7469eb47260d6f6955166eb4b22ab8d4568c4c2c90611910448d999451f8953895a595c383a166c82b5da63f07feb01fe655
SSDEEP 768:HSTAbJpDn5A5UeokXCxG4Q23YxUSBXDKhL9Oes6z7TJj+EVWWyBC7VPp0CO4L+ZM:R3tX4
MD5 SHA1 SHA512 SSDEEP

Samfundsnyttes/Rangstiges/phonographical.cac

SHA256 0741b38bf8df37c1c0db3ca1a401cdebada5a95bba17380678f0b8fe6015f02a
MD5 a6b92cb93f3358e3bbc348ec79021e06
SHA1 fa5c6769ceafe407375da64a4dee36044a43d35a
SHA512 096bd484d66c09588a600e9be0752d168fadff5cb854c19d484b75c28f0af9139d9eed82f3288413ce391f93d838dc20d95fa4dc329edfb09a1e28eba0b75d25
SSDEEP 768:LHmEVRcmsKcL+n+POb0QRibjG/PmInXzXrWeDnCvZK6FDwK:5+V
MD5 SHA1 SHA512 SSDEEP

pantisocratist/Obviate/unbedewed/Pus/Naalejet.txt

SHA256 e6031327a76f964762d01a40bbcbc066c8fd60f6a5c0f6aac251c40970b7d873
MD5 b36da9835bc16049d70e8fc16cfed0eb
SHA1 4d90efe57aaf9fe5b22c37dc8ef2414444b84318
SHA512 d83ad22a9ad8cff8ec315a9c62c65b0eda33f221a26179f37652d9379e736be76ae591a554756d51b3ba314dbaf97ca941c834bd3e05191f4a0f8e92b4c0e23b
MD5 SHA1 SHA512

COACH MARCH ORDER +COACH JUNE, JULY, AUGUST ORDER .xlsx.exe

PE Signature issue

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Miljinvesterings16.Sta

Samfundsnyttes/Rangstiges/Geobotanik.Loc

Samfundsnyttes/Rangstiges/Signalled.sty

Samfundsnyttes/Rangstiges/phonographical.cac

pantisocratist/Obviate/unbedewed/Pus/Naalejet.txt

Sharing

General

Malware Config

Signatures

File Explorer

COACH MARCH ORDER +COACH JUNE, JULY, AUGUST ORDER .xlsx.exe

PE Signature issue

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Miljinvesterings16.Sta

Samfundsnyttes/Rangstiges/Geobotanik.Loc

Samfundsnyttes/Rangstiges/Signalled.sty

Samfundsnyttes/Rangstiges/phonographical.cac

pantisocratist/Obviate/unbedewed/Pus/Naalejet.txt