c52c6d6ea2de4840848a63dca6946a7242d7a2c5f918afe41f271c6aecf3a0af[.]exe

resource
c52c6d6ea2de4840848a63dca6946a7242d7a2c5f918afe41f271c6aecf3a0af.exe
unpack001/$PLUGINSDIR/System.dll

c52c6d6ea2de4840848a63dca6946a7242d7a2c5f918afe41f271c6aecf3a0af.exe

IMPHASH e2a592076b17ef8bfb48b7e03965a3fc
SHA256 c52c6d6ea2de4840848a63dca6946a7242d7a2c5f918afe41f271c6aecf3a0af
MD5 c268abdde91ae0e28f2272d2606a3d9b
SHA1 30e15b4bc40192f98af5b2cb088b8e2a79af89f2
SHA512 8da341163b4ecddc92cb2570d904c7d73d93fbee1af47d64a528cd0277ef90a1a99fd807be0159aef9224fea87c04951115db9f6d1e8ab07272070934ab53a31
SSDEEP 6144:FspNjlsoBNb6ClODxve4lHxQ10MI6YI1uv7jQqwmLrvQizxGOLbN70MI:FcACYDDQ10M7cTUftMxJtI
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

13108

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetCurrentDirectoryW GetFileAttributesW GetFullPathNameW Sleep GetTickCount GetFileSize GetModuleFileNameW MoveFileW SetFileAttributesW GetCurrentProcess ExitProcess SetEnvironmentVariableW GetWindowsDirectoryW GetTempPathW GetCommandLineW GetVersion SetErrorMode lstrlenW WaitForSingleObject CopyFileW CompareFileTime GlobalLock CreateThread GetLastError CreateDirectoryW CreateProcessW RemoveDirectoryW lstrcmpiA CreateFileW GetTempFileNameW WriteFile lstrcpyA lstrcpyW MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GlobalFree GlobalAlloc GetShortPathNameW SearchPathW lstrcmpiW SetFileTime CloseHandle ExpandEnvironmentStringsW lstrcmpW GlobalUnlock lstrcpynW GetDiskFreeSpaceW GetExitCodeProcess FindFirstFileW FindNextFileW DeleteFileW SetFilePointer ReadFile FindClose MulDiv MultiByteToWideChar lstrlenA WideCharToMultiByte GetPrivateProfileStringW WritePrivateProfileStringW FreeLibrary LoadLibraryExW GetModuleHandleW

user32

GetSystemMenu SetClassLongW IsWindowEnabled EnableMenuItem SetWindowPos GetSysColor GetWindowLongW SetCursor LoadCursorW CheckDlgButton GetMessagePos LoadBitmapW CallWindowProcW IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard wsprintfW ScreenToClient GetWindowRect GetSystemMetrics SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharPrevW CharNextA wsprintfA DispatchMessageW PeekMessageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow LoadImageW SetTimer SetWindowTextW PostQuitMessage ShowWindow GetDlgItem IsWindow SetWindowLongW FindWindowExW TrackPopupMenu AppendMenuW CreatePopupMenu DrawTextW EndPaint CreateDialogParamW SendMessageTimeoutW SetForegroundWindow

gdi32

SelectObject SetBkMode CreateFontIndirectW SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW ShellExecuteW SHFileOperationW

advapi32

RegDeleteKeyW SetFileSecurityW OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges RegOpenKeyExW RegEnumValueW RegDeleteValueW RegCloseKey RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumKeyW

comctl32

ImageList_AddMasked ord17 ImageList_Destroy ImageList_Create

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb
MD5 17ed1c86bd67e78ade4712be48a7d2bd
SHA1 1cc9fe86d6d6030b4dae45ecddce5907991c01a0
SHA512 0cbed521e7d6d1f85977b3f7d3ca7ac34e1b5495b69fd8c7bfa1a846baf53b0ecd06fe1ad02a3599082ffacaf8c71a3bb4e32dec05f8e24859d736b828092cd5
SSDEEP 192:eY24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35Ol+Sl:E8QIl975eXqlWBrz7YLOl+
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10183

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Dispapalize.ker

SHA256 0b1a966454acea8ff8b95a47117be87c69a63ce706130b94db92f396e1cf66fc
MD5 11b7ab9c63072e1ab2bc8a9773ad2c8e
SHA1 e6dfb78c873365db5fc3f99459cea61cf22eb454
SHA512 b5c233ebd43237db92aab0d3f707679fdf2a5888612fde98c499c42105dd8cd2a0f0aa2199e520a17c469afcd998e7d1bf261d05158fb092ae75f89781e98cad
SSDEEP 96:448j+sX3arrbaPgOnEBTFF4mOWeeeT3mhkDFEm+tnhfhf:448jba+g5F6We9IKFYlhhf
MD5 SHA1 SHA512 SSDEEP

Hitchhiking/syrnende.bok

SHA256 9edc6bbdda4a379c3b41df87769ef89e6e4442aca810b52996733f1c61a47dd0
MD5 147dc85c6791f2673270d72e4a687506
SHA1 5d210862b480fb98303ddc7e15bcb65f8be1db26
SHA512 2ba464220ba2ff3306b669d4d8a5bec4f28c4d420e0633c5938ee07100ac4a60d2021ec05d2abafb9aae73c2b5aac89a58eb079ef3e8d730044e71625d49be08
MD5 SHA1 SHA512

Nyskabe/Skyggekabinet.txt

SHA256 dd5330f5b165cb86e3a525b9a4abd44d7daf17694322838a75765f4d339f9c20
MD5 db2140a44f51378ad4a11c82a5a3b8c1
SHA1 0d6eef1bb1ceecdec26110297299b0a1294c1782
SHA512 acedaaedcaf3bce932b15649c970185105edc4becfd02cf0ace5eff2b6da340af4dc7e3bca28fb6bd02c1d4c80f129e9db7d33d28eb0c8cb3e790ec761f4df4a
MD5 SHA1 SHA512

Prostatitic.Aff

SHA256 8850290e3eb08ffba97c20e4b28f020fdcac1948e5e1bf993456570c89e8eb4c
MD5 b2ee5c5af55f92a545b90b7247654cf5
SHA1 9ec63a2e71f4be386e49375e521cde31f97266f1
SHA512 032c1187ec9ad3125c875fc58b5c236feb01847b4287fa24d06895e8ef35fb15e7fc00c3d26943fdc69cafa12c7a344156d1bc1f8c40702d7e20858b4ecf3f6a
SSDEEP 6144:NNJTv1jTNX8FAUiNF8Cjlj9A62voPeQwRmBkyU:hTv1jh8an/hjlZwoPlRkL
MD5 SHA1 SHA512 SSDEEP

Taagebankernes/intrapetiolar.boo

SHA256 b97cff1fe1b1dbae6f985491f35a04756f401f2d7f3932c6d85a3ca347c9d489
MD5 65ede306b44b37b106ed871a3363c362
SHA1 64f0abcf8c91b0a8e2821272052a9aca77164649
SHA512 005dc6d7fbaae36140443d7613817ec96f1412f3e6541775ed31b9c30636094d3a93d714e7be9803cb63097eea25ee95862c34a1ec695f957964bc2e2cf01e8d
MD5 SHA1 SHA512

c52c6d6ea2de4840848a63dca6946a7242d7a2c5f918afe41f271c6aecf3a0af.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Dispapalize.ker

Hitchhiking/syrnende.bok

Nyskabe/Skyggekabinet.txt

Prostatitic.Aff

Taagebankernes/intrapetiolar.boo

Sharing

General

Malware Config

Signatures

File Explorer

c52c6d6ea2de4840848a63dca6946a7242d7a2c5f918afe41f271c6aecf3a0af.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Dispapalize.ker

Hitchhiking/syrnende.bok

Nyskabe/Skyggekabinet.txt

Prostatitic.Aff

Taagebankernes/intrapetiolar.boo