DHL TAX INVOICES - MARCH 2024[.]exe

resource
DHL TAX INVOICES - MARCH 2024.exe
unpack001/$PLUGINSDIR/nsExec.dll

DHL TAX INVOICES - MARCH 2024.exe

IMPHASH 4ea4df5d94204fc550be1874e1b77ea7
SHA256 d53afbfc333acb95639354fe5eb9cddce8fc0f59190d23dbfa60fec9944a5e27
MD5 9751f18fb374bf112f867381a68bb3a9
SHA1 b6690412b3ce7e65d76437b4d6704a3646e62938
SHA512 b42a8071e8234c62fbd8028e9f364a39b0daeb7a62b7ccbc94f3588cdda7be93953834c737ab01b3feebcc51665a0a528ede9f2042af369ad3a1ecee69bd8b6f
SSDEEP 12288:agyMCmL5EW2zV3mDinwWxjQKQpUGk06VqbwQX3isAr:YViiwwEKQpUs6swI32
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

13238

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetCurrentDirectoryW GetFileAttributesW GetFullPathNameW Sleep GetTickCount CreateFileW GetFileSize MoveFileW SetFileAttributesW GetModuleFileNameW CopyFileW ExitProcess SetEnvironmentVariableW GetWindowsDirectoryW GetTempPathW GetCommandLineW GetVersion SetErrorMode WaitForSingleObject GetCurrentProcess CompareFileTime GlobalUnlock GlobalLock CreateThread GetLastError CreateDirectoryW CreateProcessW RemoveDirectoryW lstrcmpiA GetTempFileNameW WriteFile lstrcpyA lstrcpyW MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GlobalFree GlobalAlloc GetShortPathNameW SearchPathW lstrcmpiW SetFileTime CloseHandle ExpandEnvironmentStringsW lstrcmpW GetDiskFreeSpaceW lstrlenW lstrcpynW GetExitCodeProcess FindFirstFileW FindNextFileW DeleteFileW SetFilePointer ReadFile FindClose MulDiv MultiByteToWideChar lstrlenA WideCharToMultiByte GetPrivateProfileStringW WritePrivateProfileStringW FreeLibrary LoadLibraryExW GetModuleHandleW

user32

GetSystemMenu SetClassLongW IsWindowEnabled EnableMenuItem SetWindowPos GetSysColor GetWindowLongW SetCursor LoadCursorW CheckDlgButton GetMessagePos LoadBitmapW CallWindowProcW IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard wsprintfW ScreenToClient GetWindowRect GetSystemMetrics SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharPrevW CharNextA wsprintfA DispatchMessageW PeekMessageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow LoadImageW SetTimer SetWindowTextW PostQuitMessage ShowWindow GetDlgItem IsWindow SetWindowLongW FindWindowExW TrackPopupMenu AppendMenuW CreatePopupMenu DrawTextW EndPaint CreateDialogParamW SendMessageTimeoutW SetForegroundWindow

gdi32

SelectObject SetBkMode CreateFontIndirectW SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW ShellExecuteW SHFileOperationW

advapi32

RegDeleteKeyW SetFileSecurityW OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges RegOpenKeyExW RegEnumValueW RegDeleteValueW RegCloseKey RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumKeyW

comctl32

ImageList_AddMasked ord17 ImageList_Destroy ImageList_Create

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/nsExec.dll

IMPHASH 0b75f1007d3cc8e457970ae3e3fd53c3
SHA256 ee052fd5141bf769b841846170aabf0d7c2bb922c74c623c3f109344534f7a70
MD5 01e76fe9d2033606a48d4816bd9c2d9d
SHA1 e46d8a9ed4d5da220c81baf5f1fdb94708e9aba2
SHA512 62ef7095d1bf53354c20329c2ce8546c277aa0e791839c8a24108a01f9483a953979259e0ad04dbcab966444ee7cdd340f8c9557bc8f98e9400794f2751dc7e0
SSDEEP 96:J7fhfKaGgchPzxK6bq+pKX6D8ZLidGgmkN738:HbGgGPzxeX6D8ZyGgmkN
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4231

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Borgerrettigheders/Kompletterings/Hackling/Swordman/Sydside.Ski

SHA256 7603126a3e7f1258479357e5df46bcdf769004b536f678f4bff0bd72fe1ab816
MD5 213296c17d11adf994b3d8eea2f44497
SHA1 48cb90d8d8063ef5ca129084ced6f9279cdf31b0
SHA512 77c4a3cc051ed8eeaaea917e077170e413c1bd80ed119acdd40b699025bd72c26907ce108f4cbe1396f38737fab73fa92ac55153dde4323661c78dda62151bd4
SSDEEP 6144:QiYECBdMEjlgweL1zv/JCXutRa4b8xm1TeTjy0Vjh26Gi7MhQFmLzHDMfLxq:7YEsuweLDCe3BY0UGgh2ji7MaAzHcNq
MD5 SHA1 SHA512 SSDEEP

Fljlens.bro

SHA256 a18183d891ae2282d9051d4d462dda1b346085ae0e7af525f5c31b4f20b803d2
MD5 45de86e7ec59c5e4e5fb2ed53061188d
SHA1 e2fd2269f4645eece08831dd5cacc4635d500e06
SHA512 2f8a2402c46b277a6b8741093b845dc3e3e6b3526910d6c10e3a86d1a0eee8a157ca0156989a1a99b7006cf7ba24d11ffad43fe9cc0b8b257c5513f6bf390bb8
SSDEEP 768:WKRtrtXot873KIx+BWGvZsb7SKsoisH3kQJ3FbQPKbffiJy/pk5XC2F1TmdxCN1h:Wov60Q2ip
MD5 SHA1 SHA512 SSDEEP

Handelshindringens.Dec

SHA256 a87dc179ea36df155f5d8b7a8a5963ef1de61fa7032db510a8a1f64033182ff2
MD5 26ac3d358904de47313a08e6e95b9ef8
SHA1 d8cb62fa3f065244d37862489962401a3c829a9a
SHA512 efc8932a6e6cb055fd76603cade1ce298c2d19f250d9e3234255f55b2ec28b6c34345f35a017816b35400a4258eb0cca8fdf885a1c8b5f0c08f50731d17bae71
SSDEEP 1536:8cdYRGdh2mJBi9i2cMJC/uvyxOd8maeZ1q6KwDN2C:Bbh7J+5CHxOdbn1qr2Nh
MD5 SHA1 SHA512 SSDEEP

erhvervshmmets.ten

SHA256 b20e10ff5d29a94d05c4c0d0120a7a3489182ec8e76d98baf34a946e9f1a0583
MD5 359ec97a933b88a53af37470c2a65967
SHA1 047daaffaa0024f646a7d3e0b2e475413c43c7e6
SHA512 76a4f29170b6249f47245d0dce1b4595db98d564583fbd286c693cebb31206a7460f4a3c4bef3338e6ba2da7062536f43da141b744503228b8e8d90b7da43532
SSDEEP 768:Cg6nSaeWp7roSf5WH9ybdJP/tn7PA43zK+1BoED5f74ZkD/MK1Z7M2E039ZCS2tD:85Fqk
MD5 SHA1 SHA512 SSDEEP

saarbarestes.txt

SHA256 535e3c82563232c3cab08fd3ac94b7ff3f5c40edf4fc345222b2516d3c3e9c6c
MD5 4b698da0f4172beafb7948d5a9bb6e32
SHA1 1f340da3ffa3d44921db00b64e1131c3e9c7e55c
SHA512 5c109bfda596e6ecf211c077e9a75a70c5559df9c30cc4a01f0828326227103f1f960f201e1615102765270c4937f79942381e8b0889d71c885253803edaed07
MD5 SHA1 SHA512

startsymbolers.pro

SHA256 6aaac21670c9d5fafc0487b0f83f2e7104ef5d1f8989707d0227175389e4eba8
MD5 bf4c39957b38842b30c3ad3b3e6c7b12
SHA1 da2223f3437ac09ede73bc0f04d4ccd20e53cca2
SHA512 003af17de7af3c3d1fabf67d3684d7b3b219125e5b0cfafd6c3f5898797d646f58700c6dce09d07b1f6c9cf2bda0e4bea027a0f610559bab81a7e4a4d9c8fbf5
SSDEEP 768:O8HlxWnNCSVvAb60ku7WszE7e3P6z80nOEPFGQCr//vhS3KN5MFzk:XWoF
MD5 SHA1 SHA512 SSDEEP

DHL TAX INVOICES - MARCH 2024.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/nsExec.dll

kernel32

user32

advapi32

generic

Borgerrettigheders/Kompletterings/Hackling/Swordman/Sydside.Ski

Fljlens.bro

Handelshindringens.Dec

erhvervshmmets.ten

saarbarestes.txt

startsymbolers.pro

Sharing

General

Malware Config

Signatures

File Explorer

DHL TAX INVOICES - MARCH 2024.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/nsExec.dll

kernel32

user32

advapi32

generic

Borgerrettigheders/Kompletterings/Hackling/Swordman/Sydside.Ski

Fljlens.bro

Handelshindringens.Dec

erhvervshmmets.ten

saarbarestes.txt

startsymbolers.pro