345ed67cf43e000ffa57dfc07fc6606f757cf88a6d3b9d8778444d7eef1dd793[.]exe

resource
unpack001/$PLUGINSDIR/System.dll

345ed67cf43e000ffa57dfc07fc6606f757cf88a6d3b9d8778444d7eef1dd793.exe

IMPHASH 4ea4df5d94204fc550be1874e1b77ea7
SHA256 345ed67cf43e000ffa57dfc07fc6606f757cf88a6d3b9d8778444d7eef1dd793
MD5 789ee5c5300dc862faaf96475720f9bc
SHA1 0ef8137d58a07747fc9d4e5708241ff298734646
SHA512 1f9ccdffa0ef09d89d0f024a5c698c0a4c6e3666353db38f5d3b48f49ca00544b038ca6db6069e3eee93f1c66d11467bde3ecf53148f2add1c7206e701ba2b23
SSDEEP 12288:vgEdJmlO0y9cb0crEM9wH056oDWLJuNdRey:bdJmlO995cAKwA6bLJuNKy
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

84:0c:a8:96:da:e9:4a:68:fa:3b:e1:50:48:54:dd:bf:df:9f:03:6b:e6:b1:be:fb:b5:ed:0f:36:5c:f3:b0:1e

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Aborterendes,OU=Dermapostasis Telegraphers\ ,O=Aborterendes,L=Valréas,ST=Provence-Alpes-Côte d'Azur,C=FR,1.2.840.113549.1.9.1=#0c1e53747564656e74657273405069657465747368656e73796e656e652e4361

Chains

May 2, 2024

PE Signature issue

Digest

db:8b:12:f5:82:7e:1d:04:4a:0e:82:f4:1f:34:83:f6:c1:af:a2:a1

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Aborterendes,OU=Dermapostasis Telegraphers\ ,O=Aborterendes,L=Valréas,ST=Provence-Alpes-Côte d'Azur,C=FR,1.2.840.113549.1.9.1=#0c1e53747564656e74657273405069657465747368656e73796e656e652e4361

Chains

May 3, 2024

Subject

CN=Aborterendes,OU=Dermapostasis Telegraphers\ ,O=Aborterendes,L=Valréas,ST=Provence-Alpes-Côte d'Azur,C=FR,1.2.840.113549.1.9.1=#0c1e53747564656e74657273405069657465747368656e73796e656e652e4361

Serial Number

33:54:cb:2b:ae:92:47:45:85:f2:24:87:a8:b9:b7:93:a1:a1:6d:b3

Issuer

CN=Aborterendes,OU=Dermapostasis Telegraphers\ ,O=Aborterendes,L=Valréas,ST=Provence-Alpes-Côte d'Azur,C=FR,1.2.840.113549.1.9.1=#0c1e53747564656e74657273405069657465747368656e73796e656e652e4361

Timespan

May 12, 2023 - May 11, 2026

Subject

CN=Aborterendes,OU=Dermapostasis Telegraphers\ ,O=Aborterendes,L=Valréas,ST=Provence-Alpes-Côte d'Azur,C=FR,1.2.840.113549.1.9.1=#0c1e53747564656e74657273405069657465747368656e73796e656e652e4361

Serial Number

33:54:cb:2b:ae:92:47:45:85:f2:24:87:a8:b9:b7:93:a1:a1:6d:b3

Issuer

CN=Aborterendes,OU=Dermapostasis Telegraphers\ ,O=Aborterendes,L=Valréas,ST=Provence-Alpes-Côte d'Azur,C=FR,1.2.840.113549.1.9.1=#0c1e53747564656e74657273405069657465747368656e73796e656e652e4361

Timespan

May 12, 2023 - May 11, 2026

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 23, 2017 - Mar 22, 2029

Minor OS version

0

Major OS version

4

Entry point

13238

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetCurrentDirectoryW GetFileAttributesW GetFullPathNameW Sleep GetTickCount CreateFileW GetFileSize MoveFileW SetFileAttributesW GetModuleFileNameW CopyFileW ExitProcess SetEnvironmentVariableW GetWindowsDirectoryW GetTempPathW GetCommandLineW GetVersion SetErrorMode WaitForSingleObject GetCurrentProcess CompareFileTime GlobalUnlock GlobalLock CreateThread GetLastError CreateDirectoryW CreateProcessW RemoveDirectoryW lstrcmpiA GetTempFileNameW WriteFile lstrcpyA lstrcpyW MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GlobalFree GlobalAlloc GetShortPathNameW SearchPathW lstrcmpiW SetFileTime CloseHandle ExpandEnvironmentStringsW lstrcmpW GetDiskFreeSpaceW lstrlenW lstrcpynW GetExitCodeProcess FindFirstFileW FindNextFileW DeleteFileW SetFilePointer ReadFile FindClose MulDiv MultiByteToWideChar lstrlenA WideCharToMultiByte GetPrivateProfileStringW WritePrivateProfileStringW FreeLibrary LoadLibraryExW GetModuleHandleW

user32

GetSystemMenu SetClassLongW IsWindowEnabled EnableMenuItem SetWindowPos GetSysColor GetWindowLongW SetCursor LoadCursorW CheckDlgButton GetMessagePos LoadBitmapW CallWindowProcW IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard wsprintfW ScreenToClient GetWindowRect GetSystemMetrics SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharPrevW CharNextA wsprintfA DispatchMessageW PeekMessageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow LoadImageW SetTimer SetWindowTextW PostQuitMessage ShowWindow GetDlgItem IsWindow SetWindowLongW FindWindowExW TrackPopupMenu AppendMenuW CreatePopupMenu DrawTextW EndPaint CreateDialogParamW SendMessageTimeoutW SetForegroundWindow

gdi32

SelectObject SetBkMode CreateFontIndirectW SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW ShellExecuteW SHFileOperationW

advapi32

RegDeleteKeyW SetFileSecurityW OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges RegOpenKeyExW RegEnumValueW RegDeleteValueW RegCloseKey RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumKeyW

comctl32

ImageList_AddMasked ord17 ImageList_Destroy ImageList_Create

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 9b93c61c9d63ef8ec80892cc0e4a0877966dca9b0c3eb85555cebd2ddf4d6eed
MD5 fc3772787eb239ef4d0399680dcc4343
SHA1 db2fa99ec967178cd8057a14a428a8439a961a73
SHA512 79e491ca4591a5da70116114b7fbb66ee15a0532386035e980c9dfe7afb59b1f9d9c758891e25bfb45c36b07afd3e171bac37a86c887387ef0e80b1eaf296c89
SSDEEP 192:eS24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35OloSl:S8QIl975eXqlWBrz7YLOlo
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10183

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Linieredes.Tpp

SHA256 3a96e39dc9a0d59f558bede8c9f1d57551ab9902ea8edaa43b682ddf8d8a85b0
MD5 c66ad8fe59f27fd739c59b30f26ef1a2
SHA1 41527f655df4951107b12f29a2333701bd14f7d8
SHA512 aef16dd9db0b0cc6c20d8dda962615b30e39fb4ff55b84019665cd174d6272f63c0adc0fe48a5b46d0f792fe8dee1b9862ba65da9fec5cc4dc0c016558630102
SSDEEP 6144:qODx3agNDwQ090omwjpmxT8iTa7nAh5cL04BySYRMGx//kB:LDx3o71mCLLeO065GM
MD5 SHA1 SHA512 SSDEEP

Metepimeron/Wrenlike/Pippier/echeneis.ver

SHA256 d551460bfe6f675e72b51f9b75cf2b6f464370ca3ef95f08f97582a30c157cca
MD5 54cd663724acfe5547d2a09d2d216502
SHA1 039b4d8d04ce14696dbab075425b8bc5bf387f43
SHA512 997f1e677440c523394b72eee2e4456a1a82d867b434fe45d6e2c36d4607ed9b3e6f1db3c4c6e46f2408a5bcddedec1818f64571de8b8dcd56a358acacbb6607
SSDEEP 96:YGSXMOfcTWl2n5lb8gVsMZTisIrVPPBdV:YGSXMOfcTWs5lb8gVsMcsIrVHBdV
MD5 SHA1 SHA512 SSDEEP

Seychelliskes/Rekurregr/Ultrauncommon/Pschent/landgrevskabet.afl

SHA256 dbeb677b4a46c7fabdb9f63f3bcb287c66730ab832fae6b653edf61b3fea0add
MD5 12f76e82dce91459c7b810bb597635b0
SHA1 12ae593d6e8c0f2b9ebbb66509047571d0826444
SHA512 dea83df51d397faad119b25d5dbc135a1c18b662c8d63c544c86443a9d27d1731328eedc037f73140a80a0ae8a9b792c5aceb9d988aed6271155faa29d6f41d8
SSDEEP 48:3O9CNivRD191rH6pI3JI2PSiEzHGFJrRheiubPk7qYQiZ1BkTxSSysNsJCUv7flZ:+9BpFFZ1PStjqRluTBvK/uyTJCqNwEd
MD5 SHA1 SHA512 SSDEEP

Seychelliskes/Rekurregr/Ultrauncommon/Pschent/spildevandsledningen.hur

SHA256 a959c155dd886c91f15fb50245965ea7869fc63ff3a8dac89d30b7d83d6d3e0f
MD5 6d474b2a2a52442ba06641b32ba9426a
SHA1 1c35d73a6882adac2d97de79a1e0c3fefe02e3b9
SHA512 8a84d602c8fd88f862e808ca597fb3313a9d1c3f20963048703699cf38ca9d573459a3610b42d544b952ec7dae864c4aac8f048fb0a5029bc6ca360564eafdb6
SSDEEP 48:dFa8OdJATAcKZ2JWbL6chUmv4p5m4BNYGmHNQiu:8AoYYbOchUmwjSGmS
MD5 SHA1 SHA512 SSDEEP

Seychelliskes/Rekurregr/Ultrauncommon/Pschent/spp.fav

SHA256 404d41e5442d03925f740f9beb168551c38f612977fe3ddc9dd64f0585ba60b6
MD5 bb1f6067b4e96ce0cc0ee0d2fed548e3
SHA1 3cdbe6747ecca5772b47b81d40f5e9d7e08739dd
SHA512 1b57aa5e2016fc172e65c74ecf48e65157d0c6b67a8f8b72460888f16e2521fdfe209da4efb2e4f68dd43afba2a224ce98149c096f8701be233bc2120efaa12d
SSDEEP 48:9DPUbZj8geR5P1YcSiOVv/fbQ0aC3kuN7AcD99HxjQMXOh+vQ+ofjk55u4dZYVMq:RMVjteRohzaK7A+6+Y+KjkurP2W8N
MD5 SHA1 SHA512 SSDEEP

Yves231.txt

SHA256 e53489d36794f21533560a90aa88e01e2c8bcb266313e660f540013870e2e33a
MD5 d9513425bd0fa572c6870b8ae7ec6749
SHA1 9362f26597c73f909dd32cc0328450ba8a92137a
SHA512 4fdc68103628e5f8e17ab1fd64e7ea16f9f4fa538007e4e8b818d0dfa8ffc0c163a5613b630b50775f9c07e53d41bb1c9bad36146d0d12b5c6d6f25f3570c8b0
MD5 SHA1 SHA512

345ed67cf43e000ffa57dfc07fc6606f757cf88a6d3b9d8778444d7eef1dd793.exe

PE Signature issue

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Linieredes.Tpp

Metepimeron/Wrenlike/Pippier/echeneis.ver

Seychelliskes/Rekurregr/Ultrauncommon/Pschent/landgrevskabet.afl

Seychelliskes/Rekurregr/Ultrauncommon/Pschent/spildevandsledningen.hur

Seychelliskes/Rekurregr/Ultrauncommon/Pschent/spp.fav

Yves231.txt

Sharing

General

Malware Config

Signatures

File Explorer

345ed67cf43e000ffa57dfc07fc6606f757cf88a6d3b9d8778444d7eef1dd793.exe

PE Signature issue

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Linieredes.Tpp

Metepimeron/Wrenlike/Pippier/echeneis.ver

Seychelliskes/Rekurregr/Ultrauncommon/Pschent/landgrevskabet.afl

Seychelliskes/Rekurregr/Ultrauncommon/Pschent/spildevandsledningen.hur

Seychelliskes/Rekurregr/Ultrauncommon/Pschent/spp.fav

Yves231.txt