dhl_awb_shipping_invoice_21_05_2024_000000000000024[.]exe

resource
unpack001/$PLUGINSDIR/System.dll

dhl_awb_shipping_invoice_21_05_2024_000000000000024.exe

IMPHASH 4ea4df5d94204fc550be1874e1b77ea7
SHA256 a7a04842ca3e817e5ae28cf389f590ba2a4f76c63e25249419bad63277b7312f
MD5 3783014e89435e8f979155435933d4f0
SHA1 c711fb0d97d5d363e241ed5532c6331e0fe8aa57
SHA512 611452baa7692ffd4a5f3fb73d60a0e1b4ecc8a77d1d94021c87e369909c8d9d583c5e2ae575fd7ebb95b5a3e70fb670fa4d97a4594644b74d1bb1adc9c75010
SSDEEP 12288:NgeDYSnG4nSUWbjU0WHUMTJRewXLvWkgTkVj:tDYSnG4n2bjmHUMhvKI
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

d1:00:9e:2e:db:04:88:b4:a7:27:6a:e2:23:69:5d:b7:d6:16:71:ff:3b:73:1c:12:c5:3f:05:29:5d:f9:38:57

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Cerynean,OU=Supernatural Evangeliaries Funktionsmaaden\ ,O=Cerynean,L=Brockel,ST=Niedersachsen,C=DE,1.2.840.113549.1.9.1=#0c17566962726163756c6f696440426e646c6574732e726164

Chains

May 21, 2024

Minor OS version

0

Major OS version

4

Entry point

13238

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetCurrentDirectoryW GetFileAttributesW GetFullPathNameW Sleep GetTickCount CreateFileW GetFileSize MoveFileW SetFileAttributesW GetModuleFileNameW CopyFileW ExitProcess SetEnvironmentVariableW GetWindowsDirectoryW GetTempPathW GetCommandLineW GetVersion SetErrorMode WaitForSingleObject GetCurrentProcess CompareFileTime GlobalUnlock GlobalLock CreateThread GetLastError CreateDirectoryW CreateProcessW RemoveDirectoryW lstrcmpiA GetTempFileNameW WriteFile lstrcpyA lstrcpyW MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GlobalFree GlobalAlloc GetShortPathNameW SearchPathW lstrcmpiW SetFileTime CloseHandle ExpandEnvironmentStringsW lstrcmpW GetDiskFreeSpaceW lstrlenW lstrcpynW GetExitCodeProcess FindFirstFileW FindNextFileW DeleteFileW SetFilePointer ReadFile FindClose MulDiv MultiByteToWideChar lstrlenA WideCharToMultiByte GetPrivateProfileStringW WritePrivateProfileStringW FreeLibrary LoadLibraryExW GetModuleHandleW

user32

GetSystemMenu SetClassLongW IsWindowEnabled EnableMenuItem SetWindowPos GetSysColor GetWindowLongW SetCursor LoadCursorW CheckDlgButton GetMessagePos LoadBitmapW CallWindowProcW IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard wsprintfW ScreenToClient GetWindowRect GetSystemMetrics SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharPrevW CharNextA wsprintfA DispatchMessageW PeekMessageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow LoadImageW SetTimer SetWindowTextW PostQuitMessage ShowWindow GetDlgItem IsWindow SetWindowLongW FindWindowExW TrackPopupMenu AppendMenuW CreatePopupMenu DrawTextW EndPaint CreateDialogParamW SendMessageTimeoutW SetForegroundWindow

gdi32

SelectObject SetBkMode CreateFontIndirectW SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW ShellExecuteW SHFileOperationW

advapi32

RegDeleteKeyW SetFileSecurityW OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges RegOpenKeyExW RegEnumValueW RegDeleteValueW RegCloseKey RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumKeyW

comctl32

ImageList_AddMasked ord17 ImageList_Destroy ImageList_Create

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 9b93c61c9d63ef8ec80892cc0e4a0877966dca9b0c3eb85555cebd2ddf4d6eed
MD5 fc3772787eb239ef4d0399680dcc4343
SHA1 db2fa99ec967178cd8057a14a428a8439a961a73
SHA512 79e491ca4591a5da70116114b7fbb66ee15a0532386035e980c9dfe7afb59b1f9d9c758891e25bfb45c36b07afd3e171bac37a86c887387ef0e80b1eaf296c89
SSDEEP 192:eS24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35OloSl:S8QIl975eXqlWBrz7YLOlo
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10183

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Diakrone/svovldioxidudsendelsernes.txt

SHA256 3c2064f903a7e5a9a231074ef4c9ebf4396cf75e66c09b5294977c0ed6b62929
MD5 19c0ebffbd7b2f7fca7fe2d0218b7229
SHA1 c16743deb31ae0b134937a31a84fc70e2df0fced
SHA512 83ca6dc56de2f1a84d26dbe61fe2a3efb4f1f95a902aefe440183c3033f42f9d6e29378cc35e1c64888cfe89fa5a977dc4ccbe7c85bcb1bbd4843766d0e4b7ce
MD5 SHA1 SHA512

Kbet.Ens

SHA256 39d592adfc241f601c169927c3a30ce0ce4a6820e7124494624001b8fdf766cd
MD5 c4ceafd4d2cbf864579eb4061e0481a3
SHA1 06ddea8607e900d440970c183ec467a0af095e41
SHA512 dc36b4e9a99ad4ac298a83c82584814d91771994b92516ce5ab5fd5edc0e401258e89742ea90405002e953f463bce03921c1d361e8f8a77474a66ab79260ad4c
SSDEEP 3072:nJYzOniD2IaRfPFxbwgPX4pGCwsPR7rrop4ZIyl6KzAh8:JYzLD2IaRfdmggGCPxYcjzAh8
MD5 SHA1 SHA512 SSDEEP

Rnenser.Try

SHA256 747965ec303627bf5dc46fd2709e25be5e1d448051aeeb885178281fe3744509
MD5 1bf5e84ceddcbe7e4171e85c11784027
SHA1 488a988de155d2d4126af673ae4f070e2a1ed770
SHA512 c4035137c54e5fb3330e79a1ae64220ee319a6d264df7e960e42c4a3c96d37a04e4f77aab1d3fa15cfa2d5b73fb5367f94997c21eb419af35c5e495caa4f8d86
SSDEEP 384:8M8SaqCPbxEdLk+kF9vcud9E93C2HAAoS3//M+P:8JrDqLkDl9+C2poS3Mu
MD5 SHA1 SHA512 SSDEEP

agterhalerens.sam

SHA256 c317137b065e439bf16de2815c48e55c0059ae2807913525a4e75a7385add917
MD5 92f1ba216ecc861b69af70fa2f7ad0b0
SHA1 65017a853788e324fe340eb963b26b516bb469e6
SHA512 0f853a2333c8ae3b3c5b250bbd5ef5e93621d1b68f58df7416fdbd1c23b5e36b145215c423bcf0b2fb5d780e717591ab63a1564b65a602dcdac34f506620be8a
SSDEEP 768:JotBUFX6TZnG9FDu1GqSVilhWASUEK3EwabG1wZjMFMWpHD7+T+YA:f
MD5 SHA1 SHA512 SSDEEP

consumedly.cor

SHA256 dc014f94b248a2b89912f9d79cce970f0c92eaeb4443893fd0b0c5fd597f4221
MD5 d0c21040c4001f382775e593d905e9fd
SHA1 bc757c34bb3e556a65b9b8eba7beec207f4c1e1e
SHA512 42b157cd4a7b40efc279a4f1fa99cfa7a0ecd8a686e45d1968ae29acb8dae02fba4af1993369b9f87fc6c5da2337a33f762cb43084dcfd1595b63033a3620534
SSDEEP 768:x205HCdJ7rONcc1xsYD/WIIcnUikZG0FUe2fv:
MD5 SHA1 SHA512 SSDEEP

storvildtjagter.div

SHA256 bf29886c051c4c65a9ce5a49cd301f6061065bfea6c32617f3e3de3b913d0ee3
MD5 75f34b8cb553239f14699306ade616d3
SHA1 a789fa6105cc96792d9634ecb5c9db5bd9094a16
SHA512 1f990bccb3fc74af7da22309ba867637e2c989d91e863bf86f9c6597c91320433a6561357b72c8d8c9dd18274a28738e416a255f1319759ee829a4e1d9f3585b
SSDEEP 768:nuV8X0nJ2rASGRbrdFzGXRiGX0VbgFhB67+Xf:b
MD5 SHA1 SHA512 SSDEEP

dhl_awb_shipping_invoice_21_05_2024_000000000000024.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Diakrone/svovldioxidudsendelsernes.txt

Kbet.Ens

Rnenser.Try

agterhalerens.sam

consumedly.cor

storvildtjagter.div

Sharing

General

Malware Config

Signatures

File Explorer

dhl_awb_shipping_invoice_21_05_2024_000000000000024.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Diakrone/svovldioxidudsendelsernes.txt

Kbet.Ens

Rnenser.Try

agterhalerens.sam

consumedly.cor

storvildtjagter.div