d4be2f3cfa3365cf4b7d567839a2d31f7d0683bcc39e3abd041f1cfbb6b6bbae[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
d4be2f3cfa3365cf4b7d567839a2d31f7d0683bcc39e3abd041f1cfbb6b6bbae.exe
Size 429KB
Sample240501-ce3hqsfe46
SHA256 d4be2f3cfa3365cf4b7d567839a2d31f7d0683bcc39e3abd041f1cfbb6b6bbae
MD5 566a9fbd642c4a82e90316c224cc095c
SHA1 bd2741e788f69eb3cb56f1cee3fad112838d740e
SHA512 7e27ececc7f952f9231dfff21eda0211edd6a247d1d884c5ffc11af1d708735bc459d11b6ddd03fed7986f1605fd69beb9d3f782b1ab211f2c7f90f02c0928f5
SSDEEP 6144:7pkXGh6tHk47x2IIjpLUJpJ0IgB9AvCF1RIJ+oBlGORmbrKydSBmpJ3PVF97/ENI:2ZHkkx2IIdLdPAvCjRIEZVxdSwb
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
d4be2f3cfa3365cf4b7d567839a2d31f7d0683bcc39e3abd041f1cfbb6b6bbae.exe
unpack001/$PLUGINSDIR/System.dll

File Explorer

d4be2f3cfa3365cf4b7d567839a2d31f7d0683bcc39e3abd041f1cfbb6b6bbae.exe

.exe 429KB
$PLUGINSDIR/System.dll

.dll 11KB
Exemptible/Kommuneplanlov/Scuppler/Tegminal/punktvises.txt

544B
commonly.rei

2KB
isdkke.Shi

380KB

d4be2f3cfa3365cf4b7d567839a2d31f7d0683bcc39e3abd041f1cfbb6b6bbae.exe

IMPHASH e2a592076b17ef8bfb48b7e03965a3fc
SHA256 d4be2f3cfa3365cf4b7d567839a2d31f7d0683bcc39e3abd041f1cfbb6b6bbae
MD5 566a9fbd642c4a82e90316c224cc095c
SHA1 bd2741e788f69eb3cb56f1cee3fad112838d740e
SHA512 7e27ececc7f952f9231dfff21eda0211edd6a247d1d884c5ffc11af1d708735bc459d11b6ddd03fed7986f1605fd69beb9d3f782b1ab211f2c7f90f02c0928f5
SSDEEP 6144:7pkXGh6tHk47x2IIjpLUJpJ0IgB9AvCF1RIJ+oBlGORmbrKydSBmpJ3PVF97/ENI:2ZHkkx2IIdLdPAvCjRIEZVxdSwb
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

12960

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetCurrentDirectoryW GetFileAttributesW GetFullPathNameW Sleep GetTickCount GetFileSize GetModuleFileNameW MoveFileW SetFileAttributesW GetCurrentProcess ExitProcess SetEnvironmentVariableW GetWindowsDirectoryW GetTempPathW GetCommandLineW GetVersion SetErrorMode lstrlenW WaitForSingleObject CopyFileW CompareFileTime GlobalLock CreateThread GetLastError CreateDirectoryW CreateProcessW RemoveDirectoryW lstrcmpiA CreateFileW GetTempFileNameW WriteFile lstrcpyA lstrcpyW MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GlobalFree GlobalAlloc GetShortPathNameW SearchPathW lstrcmpiW SetFileTime CloseHandle ExpandEnvironmentStringsW lstrcmpW GlobalUnlock lstrcpynW GetDiskFreeSpaceW GetExitCodeProcess FindFirstFileW FindNextFileW DeleteFileW SetFilePointer ReadFile FindClose MulDiv MultiByteToWideChar lstrlenA WideCharToMultiByte GetPrivateProfileStringW WritePrivateProfileStringW FreeLibrary LoadLibraryExW GetModuleHandleW

user32

GetSystemMenu SetClassLongW IsWindowEnabled EnableMenuItem SetWindowPos GetSysColor GetWindowLongW SetCursor LoadCursorW CheckDlgButton GetMessagePos LoadBitmapW CallWindowProcW IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard wsprintfW ScreenToClient GetWindowRect GetSystemMetrics SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharPrevW CharNextA wsprintfA DispatchMessageW PeekMessageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow LoadImageW SetTimer SetWindowTextW PostQuitMessage ShowWindow GetDlgItem IsWindow SetWindowLongW FindWindowExW TrackPopupMenu AppendMenuW CreatePopupMenu DrawTextW EndPaint CreateDialogParamW SendMessageTimeoutW SetForegroundWindow

gdi32

SelectObject SetBkMode CreateFontIndirectW SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW ShellExecuteW SHFileOperationW

advapi32

RegDeleteKeyW SetFileSecurityW OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges RegOpenKeyExW RegEnumValueW RegDeleteValueW RegCloseKey RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumKeyW

comctl32

ImageList_AddMasked ord17 ImageList_Destroy ImageList_Create

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 9b93c61c9d63ef8ec80892cc0e4a0877966dca9b0c3eb85555cebd2ddf4d6eed
MD5 fc3772787eb239ef4d0399680dcc4343
SHA1 db2fa99ec967178cd8057a14a428a8439a961a73
SHA512 79e491ca4591a5da70116114b7fbb66ee15a0532386035e980c9dfe7afb59b1f9d9c758891e25bfb45c36b07afd3e171bac37a86c887387ef0e80b1eaf296c89
SSDEEP 192:eS24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35OloSl:S8QIl975eXqlWBrz7YLOlo
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10183

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

d4be2f3cfa3365cf4b7d567839a2d31f7d0683bcc39e3abd041f1cfbb6b6bbae.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Exemptible/Kommuneplanlov/Scuppler/Tegminal/punktvises.txt

commonly.rei

isdkke.Shi