Paidcopy2405[.]exe

resource
unpack001/$PLUGINSDIR/System.dll

Paidcopy2405.exe

IMPHASH b34f154ec913d2d2c435cbd644e91687
SHA256 6e849f1461600cf9c9d15613932c2ea2878cf71d3718d12d1c049c37c57d5d72
MD5 0bee9c66a24645fe6468160cd38d3193
SHA1 75d66ad59ae896649cb6967ae0dc6a1384504b12
SHA512 3b3476074cf2038dfa6a072de3bc2cc0e069d2f9288a16b49bc249668d5c0427bbe30d4c0b50b6b2565ada24a1a63d9ac0ce14d6ae03aa8d19cf7bca1581e2d3
SSDEEP 6144:X6bAcJKdUzKcKcgJcgYubVuXLlN5LUumyb4jHqNqoaZOE94ydnNh:IudUzhdcbb6lLUK4jUqbZ1
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

25:7f:10:85:57:70:2f:59:bd:86:d2:16:94:2d:da:4f:97:52:ff:c4:b8:62:57:61:2c:e8:19:23:30:d6:30:9c

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=jonbytnings,OU=Macks Sgenglerne Palaeanthropic\ ,O=jonbytnings,L=Greensboro,ST=North Carolina,C=US,1.2.840.113549.1.9.1=#0c16466163656d616b657240467267656861766e2e477261

Chains

May 15, 2024

Minor OS version

0

Major OS version

4

Entry point

13136

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetEnvironmentVariableW SetFileAttributesW Sleep GetTickCount GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW SetCurrentDirectoryW GetFileAttributesW GetWindowsDirectoryW GetTempPathW GetCommandLineW GetVersion SetErrorMode lstrlenW lstrcpynW GetDiskFreeSpaceW ExitProcess GetShortPathNameW CreateThread GetLastError CreateDirectoryW CreateProcessW RemoveDirectoryW lstrcmpiA CreateFileW GetTempFileNameW WriteFile lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject lstrcmpiW MoveFileW GetFullPathNameW SetFileTime SearchPathW CompareFileTime lstrcmpW CloseHandle ExpandEnvironmentStringsW GlobalFree GlobalLock GlobalUnlock GlobalAlloc FindFirstFileW FindNextFileW DeleteFileW SetFilePointer ReadFile FindClose lstrlenA MulDiv MultiByteToWideChar WideCharToMultiByte GetPrivateProfileStringW WritePrivateProfileStringW FreeLibrary LoadLibraryExW GetModuleHandleW

user32

GetSystemMenu SetClassLongW EnableMenuItem IsWindowEnabled SetWindowPos GetSysColor GetWindowLongW SetCursor LoadCursorW CheckDlgButton GetMessagePos LoadBitmapW CallWindowProcW IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard ScreenToClient GetWindowRect GetDlgItem GetSystemMetrics SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharPrevW CharNextA wsprintfA DispatchMessageW PeekMessageW ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow GetDC SetTimer SetWindowTextW LoadImageW SetForegroundWindow ShowWindow IsWindow SetWindowLongW FindWindowExW TrackPopupMenu AppendMenuW CreatePopupMenu EndPaint CreateDialogParamW SendMessageTimeoutW wsprintfW PostQuitMessage

gdi32

SelectObject SetBkMode CreateFontIndirectW SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation ShellExecuteExW SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW

advapi32

AdjustTokenPrivileges RegCreateKeyExW RegOpenKeyExW SetFileSecurityW OpenProcessToken LookupPrivilegeValueW RegEnumValueW RegDeleteKeyW RegDeleteValueW RegCloseKey RegSetValueExW RegQueryValueExW RegEnumKeyW

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 c2f405d7402f815d0c3fadd9a50f0bbbb1bab9aa38fe347823478a2587299448
MD5 9625d5b1754bc4ff29281d415d27a0fd
SHA1 80e85afc5cccd4c0a3775edbb90595a1a59f5ce0
SHA512 dce52b640897c2e8dbfd0a1472d5377fa91fb9cf1aeff62604d014bccbe5b56af1378f173132abeb0edd18c225b9f8f5e3d3e72434aed946661e036c779f165b
SSDEEP 192:eX24sihno00Wfl97nH6BenXwWobpWBTtvShJ5omi7dJWjOlqSlS:D8QIl972eXqlWBFSt273YOlqz
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10178

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Doblon.ane

SHA256 b4e199438180bb710e526705d7ea80acc2a2dfce55e21299ec6d2dd0c0a5a4e2
MD5 5349f10256a0e2044835fc1f11e29ab9
SHA1 2214395d9733f20af5b0a779c6b78382fe75c652
SHA512 1876833f04aaf1dc345e156791d299b870d55c099fff7033d3d99c93100285c6f55b195b35aeec9e0564b60f60d972527de17d0c85dd6c0fd8d4487ae2f327f6
SSDEEP 96:tjerRbBCjRjaQl+tuzN7vG4TrBMsRq/HrmBC8Xnp3UJpT:tACVWQl+tz+lC/F83pWpT
MD5 SHA1 SHA512 SSDEEP

Fortolkedes.Ans

SHA256 aa338a62d0cda47392bb8705f97a85428be1e21df59b6511554f2abde478331b
MD5 4e7bb6be70f3fe878f0555aef92c3d44
SHA1 d08cdbccbc5aee0762a8cb5d738a6bc65f67d41b
SHA512 8ef87b075cbbe3fdbec050f5e3de505e6cfbe0049075dfe0dcd8e28747108c527a2f667dabd2f6cd8fda79d62c5c8bfb1fccaec5320af9d90e4814112951b071
SSDEEP 96:u7jKYBhz6SdfB3zRUB8XfG1O6M2GKvKprYkd7Lg:u7OYBhzlBtbh2KpkkG
MD5 SHA1 SHA512 SSDEEP

Patriotics.ufo

SHA256 d177d4c4a5cf726f0a1e7d4fbdb2fc6f6210de1d55f2c385ac619af76ff32cb1
MD5 b06b158fbe3a4223edd853501cfbbcb8
SHA1 4ad991993a2494ed30f72b6f44a31942ba3abfec
SHA512 4b085abbdc641933571410106182ab2d0c7b028060ffa2fce4fafccf5684ce1a965909361c429e3c7e5cad6ce6605c4fd1434fff42d9cac6e7a44872c0ee0375
MD5 SHA1 SHA512

hofmann.Ark

SHA256 f679f1210329cff1704567768951099019d4788f6e7e5542f30512c4269b28e0
MD5 e269ef78498f0d98782621c46281db52
SHA1 c11f380c421e08b95951114b0ab4481854b22355
SHA512 9193445b0ba5ebbbb89e697587e060f50ae7da0addbd71b9fa890df81fc35ec849a5a874bd5a2fd4c4f1567abb85db722bf0e81af47eb42076f1252a518cab36
SSDEEP 6144:Br8NZXbjCNgWa8+UGc1s4YHD2zVLQrwtjpPOZ/Y6fmiiVgrVuW:BoNtjAgcaMz6rwtjFOmg1ygrv
MD5 SHA1 SHA512 SSDEEP

rhipidion.txt

SHA256 d697345755210ef89ff792e854802f14db255757a640051a931e207c8d3fe9a2
MD5 a870fda762497d24c604bf321e5d0b59
SHA1 22022111eac018f21f4f156c34a43ca98c159fc9
SHA512 4e4b6b18f2eeb35e5b5e003fa7f79cdca7676875ee5d887b793bcbd342bcec6474a69a78b4bb3a1a7cca3b7cf489f102f799d7cf2ff1f1a9c35a7b19ec5045cf
MD5 SHA1 SHA512

tremellaceae.ten

SHA256 2c4d54cd5bdcb84fb495783a7ec4a61d12aaba4e11af6ae2f9c4248dfa975711
MD5 57d61cecf2ed9d81208aec46644455a6
SHA1 0b1f6d52e5140ad9e6b59031b8e75fd74507aa3e
SHA512 d32febe646f129ac65922cdf4e13fdb9c79c5223007b7826eb41aeea4254382e539614361ff0f065e60e1fa8b34ec88c584b91ead7fb5aecec896272014a6f74
MD5 SHA1 SHA512

Paidcopy2405.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Doblon.ane

Fortolkedes.Ans

Patriotics.ufo

hofmann.Ark

rhipidion.txt

tremellaceae.ten

Sharing

General

Malware Config

Signatures

File Explorer

Paidcopy2405.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Doblon.ane

Fortolkedes.Ans

Patriotics.ufo

hofmann.Ark

rhipidion.txt

tremellaceae.ten