942763500f541d8a64ead4fc2cb1bb841e684e6005629dec05731381fdf9270e[.]exe

resource
unpack001/$PLUGINSDIR/System.dll

942763500f541d8a64ead4fc2cb1bb841e684e6005629dec05731381fdf9270e.exe

IMPHASH f4639a0b3116c2cfc71144b88a929cfd
SHA256 942763500f541d8a64ead4fc2cb1bb841e684e6005629dec05731381fdf9270e
MD5 ea5afe187f62aa6a3aab486a19435219
SHA1 a750ca86d8ba026fcc79c69c584d8198c4ea3dac
SHA512 8f13a246a46f379ed1446d8b13ffc5e866e07e0f10f3152a60fda40f3d6b1b78eef73b988b9233f4b96b881d41ed386d8bc6a97b1892dfa1ecda1c6c5b4b2c0a
SSDEEP 24576:dXYEOpv66pjpIH8bzUrq3JMTJjXP6z2r8Yb:xlOUSjpIcBaT5Csb
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

1b:12:ac:98:1f:63:b5:8a:5c:55:b6:f0:7b:cc:28:23:72:5d:d2:69:3f:78:a8:66:9f:09:2d:5f:70:78:0c:67

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Fortrstnings,OU=Fingerfrdigheds distributionernes\ ,O=Fortrstnings,L=Thornyhill,ST=Scotland,C=GB,1.2.840.113549.1.9.1=#0c1d466f726e696b6c696e6765726e65734053796d7068796c6f75732e556e

Chains

Apr 30, 2024

Minor OS version

0

Major OS version

4

Entry point

13564

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegOpenKeyExW RegCreateKeyExW

shell32

SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW ShellExecuteExW

ole32

CoCreateInstance OleUninitialize OleInitialize IIDFromString CoTaskMemFree

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create

user32

MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW CreatePopupMenu AppendMenuW TrackPopupMenu OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW IsWindowEnabled SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CharPrevW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint CharNextA wsprintfA DispatchMessageW CreateWindowExW PeekMessageW GetSystemMetrics

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor

kernel32

lstrcmpiA CreateFileW GetTempFileNameW RemoveDirectoryW CreateProcessW CreateDirectoryW GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW WriteFile CopyFileW ExitProcess GetCurrentProcess GetModuleFileNameW GetFileSize GetTickCount Sleep SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW MulDiv lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject SetEnvironmentVariableW

$PLUGINSDIR/System.dll

IMPHASH 509a34b3a68a773e0afb4259e68f9f82
SHA256 9111099efe9d5c9b391dc132b2faf0a3851a760d4106d5368e30ac744eb42706
MD5 4add245d4ba34b04f213409bfe504c07
SHA1 ef756d6581d70e87d58cc4982e3f4d18e0ea5b09
SHA512 1bd260cabe5ea3cefbbc675162f30092ab157893510f45a1b571489e03ebb2903c55f64f89812754d3fe03c8f10012b8078d1261a7e73ac1f87c82f714bce03d
SSDEEP 192:VjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZv0QPi:B/Qlt7wiij/lMRv/9V4bvr
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Autotetraploidy.fre

SHA256 90100208885819a803a28343bdc1a1d6826e30680cbbc041eea58ce52acf241a
MD5 179c7b47fd0feaa26da21a6b3506230c
SHA1 35c6b7f91ea0d6fc198c466d23a7556f65f4eb05
SHA512 4d9d7dfb2d61916216171fcc253a5835627a3b372539ee012b3c46124b579b679ffebdfb1c478973d4ba1cb34ea21b03adaceb0c9459ad7fbe16bfc4654b7cec
SSDEEP 768:zi3L7UAHyPeO5Al+0Bx1KOSTdqu0hxNy5Z1a+HyvgbwIQwzjn57B3MFGWCDeNCzS:gxiy9mGAskutrlB
MD5 SHA1 SHA512 SSDEEP

Balanceman51.sto

SHA256 eb7c02ce7dea70cb4ef34e2bbeb88d05de599dbd180051a9a529e4fa9ba89263
MD5 86207a04d1e7365726f0e767b6595872
SHA1 8113890aa629548034981fcf392a44e35ab27abb
SHA512 7bc98ba1e30799ff1b9c74a594104ba12b1c81d2fc2f15bed0efa86bb9e6d4ccff41a58e0ff5ce2373ed1d742f330a5f9368d251d53b490aa14b1bc91731b3a3
SSDEEP 384:sJKhWPMc1nY5d6N6NxinAgoxasPufiidZ0+iOz2KX7ZWo4d/AKyRVY22vwzKl0:RggQNRAgoUN5dZ0+iOv7ZWdEV32vwP
MD5 SHA1 SHA512 SSDEEP

Bryggeriet.Try

SHA256 a2126168920ee258a66a1febb62b8fd7cb3ccbcc945f56442acf997921cfb3cd
MD5 3d6eec05543f7f7cb095cfe8ea165fd9
SHA1 8e8c95bd48e2ade9e7863cac6580824c136af5c7
SHA512 e30c81130e51f180c2bc17e3a38a57c440733b07cfb71f6542063de0a82f04c883d985efdd8692758f5c5e3a01a37699415167ca84d5bb01b1fbae87c18adab1
SSDEEP 1536:Sy3K/88L1BnsRmRPhG60FTXZNqkklGWbvLdbq6POCWx+/81Pmp:10TtsK060xGkATLDOCe+/8S
MD5 SHA1 SHA512 SSDEEP

Sandbanker.afs

SHA256 f0e1ef6afa6f567f8189feb4b070918aa62ddadbd4d3d3a98c292e77f4ff00c0
MD5 3df565f1cec96e154dad03e300ed2f4b
SHA1 bb626fc14904eb69da3aa340fe2c38a92bc3fad0
SHA512 07230cd9441c3e152c2c3fe111da81fb29fd149ca2057cd5c759b277f0e3e68df536e37a5fb26b607f0628bdf5460ca1fdb9f65943cee4551d1a801303e35750
SSDEEP 768:tZo8CzmBNX5zWnykb49g3xDxGxcySDeeKg0FreELdUThz6Uom891DTWP/0+fIf9X:ItGYOr/dGK5A
MD5 SHA1 SHA512 SSDEEP

Shuteyes.des

SHA256 28b911410c699cdd67542ef760e19b799fad53581cf9243b2c4704a7ce9f1a35
MD5 41236fd6cd5dec5578f2d8fea868a044
SHA1 505826e872b11b4982f3ec2dd6ef709779bb83c6
SHA512 7a29421f06a187bfcab63a7fb38633a319abfbffc16dde3c5e7413f071fe82d575682c70600cfd4351ba52ee49106d03d48fdebd6e9c38b3590f950a377cdfd1
SSDEEP 768:d8cxIS6WI96gzIUttovSU4EY59kIPf9DPNMWY2X2AHeVzFPo7h3sxUcyJmBrEr/l:uunhTsLeructgkVVE
MD5 SHA1 SHA512 SSDEEP

Withas/Geografiers147.Gri

SHA256 28de34b0aa8805094b6ea4f0c21831a3af18c1ca91ddcf09d7f4a1e590889bb7
MD5 7e5245e523a14c186127accdd7491634
SHA1 74d7fcbb29bdbf1f2809626eb0ba599e6e1a0aef
SHA512 f12d1a983325ab1f641aad6a08fcc1b52a8af39bf1fbe29a52b329d91a654c7fc9aa6dcfd1a3a1a7a7eb54f7148f721212b743093c25cbb6070a1dcc419439fd
SSDEEP 12288:KBaOAWNW8zYGVraZMvFF/Gdrp89jlFIml:wVBYxZY1UrpqQ+
MD5 SHA1 SHA512 SSDEEP

dogmatical.xin

SHA256 b8fa2711853a85bb8e4ea6ca7891a84f3fe2747d0a9fed6b33a3644ab4e0fa3c
MD5 1fcc559c2ac0953df6e41b6938d2d58d
SHA1 ae89cd0cba067c3d814d18f05838e9481e91455a
SHA512 3f9eeb129cb234afdfd890f45f2b0a1f124a8d69ad6d6414f03dd6c077e83703468e887c4a71e4c84e237b6222c788cbcbadc9bd620290b4752f92112aed3e1e
SSDEEP 384:VSCuQLEcfMd6ieO23FI9N4KxaYXkR96isyTjtsYhH63m1cd1:VShpetqaVR7jsa6iY
MD5 SHA1 SHA512 SSDEEP

farmakologiernes.ori

SHA256 1cca30dcb1c0c7d7b258a28558b0cf8fd04eb0807544c5b94a706a36ceda7142
MD5 a95ffd9a27c6befd2860f7fa86b5a04b
SHA1 4a2cecc25ea81b191036d437069835cd8999aca2
SHA512 f1ac09bbe81cbba4e29668e9d5e3536374f4d5a53ec64f13f3267a4054d8684c5ee72a015f2d9393c2c63cd9f511142233f1af7144825ff8c3c2f29f60c3fe0d
SSDEEP 768:VssZgUER0fhZ/wPYXVgv8bar4afLxKhSswDyd5N+yKR6bFSU+dG93T1pLt78hJuF:W6wih2z5eRL
MD5 SHA1 SHA512 SSDEEP

indgydelse.txt

SHA256 826253c328958b3ec421c762786d7da10d4daec8f79972a076d82df6b75f9e73
MD5 7b3ea8e0146d4eaa6fe47eb6d465e4cb
SHA1 c68f888f715eec84cfa51fcb1646de56510c3a05
SHA512 2ae68c4e02fa6aa0316983e43194e6ab2f5f3cf3fce82f986d119e915330dc2c0d854fab832521ec20609007f7a015b6a287e9d60f84b0034a75eec4445ac67a
MD5 SHA1 SHA512

lserbrevets.not

SHA256 c11b31955039c61467d7033a533aa2661c7687b0f6db8ee6da4bc8cd386fef0c
MD5 0607f54c1dfe4481b367dc01c45098fa
SHA1 f5425c2a6e748e34f2b6d177bd8524d7ee9d6555
SHA512 c9be48421f70ac8dbb5718d84b1582ae3b41dd5f98fcadc8792dae831ec993dcce35b9207cc26a6736acc55886fb769821277474a0a2b75ebfdd4986f120b9cc
SSDEEP 768:08iyMDK/erVzdj1ddeeZQFantnCCv28jLyR7tS:vkW0qC
MD5 SHA1 SHA512 SSDEEP

modificeringer.opr

SHA256 050891eb9f94fc5f33e5f66ce17f72ea993d0f4335ac3ce0a45b7042c80bc444
MD5 9433c308490550874db26c6063fbdc21
SHA1 c3dd3d23feff03c755ce670b2633ba9cd27cf5e7
SHA512 244654fd9f60bddc50a64757c6eb62636c1b8487bf6f5e4af4e43cf6856efc42849f1cd36c9df170d1dc6f14b2f355339cab87180347ca1732da6f8961e133e1
SSDEEP 768:JT3+9CkPTRLCpX0FUzzOiY19aWvnTOwB/OkBCmiPp+sWVyV2Hmio9VKKeGP4+MaP:SxUZWpRUUq
MD5 SHA1 SHA512 SSDEEP

prciseringernes.ade

SHA256 22cbad0704be18f1ed77ef22348ec64e2dcebdf43251ebfa62db64e604728141
MD5 e6f9fcb6c1cf00d262b8ff2b00603219
SHA1 d5b914b9b2a17fad645b84c587649078e65990eb
SHA512 15ebb86abbc8d836e2f79611e7135742f8d46a7eed825d0dd167531326bc43bd07090a491cf6886343916f7cfa6305ebdc716a16ac64da2c9620eb3de8a0bf24
SSDEEP 384:SY24CStBTM2AVafxXuDCdDQ8sDFO9GHi3BlXsOirrBG9nkvUCtz8ZYyAUb7+rrjo:aSXTMrkJQNRO+i3BlsMyUcQMSJABaaq
MD5 SHA1 SHA512 SSDEEP

senopias.arc

SHA256 bebe706e909ff2b37a4b5947257b0a99244fdb285db908042b896e7c2d51575a
MD5 3d7b4d716e57003112b87aa7471cd5c0
SHA1 ccd1f3259795181ab6a9738d4159f0b6eed79de7
SHA512 a56a28f0e987d268c3b58bc8c87deeb464d3d28ac90a38f50920c2ca5704d6001973a51cd936f8046fa8bee3f3c4c6404e8753530a1307955b21952a7b1405ec
SSDEEP 768:O+oBYyuYBP7jrHM5uT/e+Udlmx8/oSygUBkfBgNMBEOwqlOKIQ/gAnDmDMUyqn4n:wZNSm1JwXv9
MD5 SHA1 SHA512 SSDEEP

transpiration.bur

SHA256 7b1c65301778ab978c46062a418171485cb5d8b59b9199552a05b660c96fe1e8
MD5 00c229573a43e7bad2b442757b632b3d
SHA1 a06794216aedd24d69f8fb51dfdb438336af256e
SHA512 8a7ff8bc296c963bb9c8b00fc9349c1c850728ab37ee7d2feff9ce522f257ac681b61e02a8d86c46872bd8beaf7e48b5876db17ea657cf0af531b807a6422204
SSDEEP 768:THG+AWfUka+eO48IG4l9s+6MwJeWSs2IfsXrtA:q+MlGUtA
MD5 SHA1 SHA512 SSDEEP

942763500f541d8a64ead4fc2cb1bb841e684e6005629dec05731381fdf9270e.exe

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Autotetraploidy.fre

Balanceman51.sto

Bryggeriet.Try

Sandbanker.afs

Shuteyes.des

Withas/Geografiers147.Gri

dogmatical.xin

farmakologiernes.ori

indgydelse.txt

lserbrevets.not

modificeringer.opr

prciseringernes.ade

senopias.arc

transpiration.bur

Sharing

General

Malware Config

Signatures

File Explorer

942763500f541d8a64ead4fc2cb1bb841e684e6005629dec05731381fdf9270e.exe

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Autotetraploidy.fre

Balanceman51.sto

Bryggeriet.Try

Sandbanker.afs

Shuteyes.des

Withas/Geografiers147.Gri

dogmatical.xin

farmakologiernes.ori

indgydelse.txt

lserbrevets.not

modificeringer.opr

prciseringernes.ade

senopias.arc

transpiration.bur