rPurchaseOrderPO05232024[.]exe

resource
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsExec.dll

rPurchaseOrderPO05232024.exe

IMPHASH e2a592076b17ef8bfb48b7e03965a3fc
SHA256 dd39d251c8d31fdcd410940c7e3a6b1ec76c62b341c60810215da5434d2cb52a
MD5 818e095a728bb7fde8d34c3276c01e15
SHA1 5bc32d174f3dc493312b330d01ceb55e58127f4c
SHA512 3f65fe9b8b0755ae9faad6cd7028fae580e09401de2eb988814292458c256c21ea01ba1e481ecd28c7c8615b0457405b32744be7190bdae58846c300c9ef3672
SSDEEP 12288:bvp1DrAkngRmfxs7u//fARGujCxyIG1TxHhsS14P6bu4:TnDrA/mfWu/gnjNdNhd14CV
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

7a:08:c5:ef:5a:b6:aa:b8:86:bd:a3:ae:7d:78:15:ab:c8:e4:3b:f7:4c:87:7c:b8:37:0f:62:3a:0a:bb:95:db

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Nonrectangular,OU=kaw Oprulnings\ ,O=Nonrectangular,L=Honolulu,ST=Hawaii,C=US,1.2.840.113549.1.9.1=#0c11456d62657a7a6c654041636964732e536d

Chains

May 16, 2024

PE Signature issue

Digest

aa:fa:ba:aa:2a:28:ca:8c:e2:51:ca:7f:fb:b1:52:1f:1d:3f:a1:97

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Nonrectangular,OU=kaw Oprulnings\ ,O=Nonrectangular,L=Honolulu,ST=Hawaii,C=US,1.2.840.113549.1.9.1=#0c11456d62657a7a6c654041636964732e536d

Chains

May 16, 2024

Minor OS version

0

Major OS version

4

Entry point

12960

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetCurrentDirectoryW GetFileAttributesW GetFullPathNameW Sleep GetTickCount GetFileSize GetModuleFileNameW MoveFileW SetFileAttributesW GetCurrentProcess ExitProcess SetEnvironmentVariableW GetWindowsDirectoryW GetTempPathW GetCommandLineW GetVersion SetErrorMode lstrlenW WaitForSingleObject CopyFileW CompareFileTime GlobalLock CreateThread GetLastError CreateDirectoryW CreateProcessW RemoveDirectoryW lstrcmpiA CreateFileW GetTempFileNameW WriteFile lstrcpyA lstrcpyW MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GlobalFree GlobalAlloc GetShortPathNameW SearchPathW lstrcmpiW SetFileTime CloseHandle ExpandEnvironmentStringsW lstrcmpW GlobalUnlock lstrcpynW GetDiskFreeSpaceW GetExitCodeProcess FindFirstFileW FindNextFileW DeleteFileW SetFilePointer ReadFile FindClose MulDiv MultiByteToWideChar lstrlenA WideCharToMultiByte GetPrivateProfileStringW WritePrivateProfileStringW FreeLibrary LoadLibraryExW GetModuleHandleW

user32

GetSystemMenu SetClassLongW IsWindowEnabled EnableMenuItem SetWindowPos GetSysColor GetWindowLongW SetCursor LoadCursorW CheckDlgButton GetMessagePos LoadBitmapW CallWindowProcW IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard wsprintfW ScreenToClient GetWindowRect GetSystemMetrics SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharPrevW CharNextA wsprintfA DispatchMessageW PeekMessageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow LoadImageW SetTimer SetWindowTextW PostQuitMessage ShowWindow GetDlgItem IsWindow SetWindowLongW FindWindowExW TrackPopupMenu AppendMenuW CreatePopupMenu DrawTextW EndPaint CreateDialogParamW SendMessageTimeoutW SetForegroundWindow

gdi32

SelectObject SetBkMode CreateFontIndirectW SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW ShellExecuteW SHFileOperationW

advapi32

RegDeleteKeyW SetFileSecurityW OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges RegOpenKeyExW RegEnumValueW RegDeleteValueW RegCloseKey RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumKeyW

comctl32

ImageList_AddMasked ord17 ImageList_Destroy ImageList_Create

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 982c5fb7ada7d8c9bc3e419d1c35da6f05bc5dd845940c179af3a33d00a36a8b
MD5 0ff2d70cfdc8095ea99ca2dabbec3cd7
SHA1 10c51496d37cecd0e8a503a5a9bb2329d9b38116
SHA512 cb5fc0b3194f469b833c2c9abf493fcec5251e8609881b7f5e095b9bd09ed468168e95dda0ba415a7d8d6b7f0dee735467c0ed8e52b223eb5359986891ba6e2e
SSDEEP 192:eK24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35OlASl:u8QIl975eXqlWBrz7YLOlA
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10183

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsExec.dll

IMPHASH 0b75f1007d3cc8e457970ae3e3fd53c3
SHA256 ee052fd5141bf769b841846170aabf0d7c2bb922c74c623c3f109344534f7a70
MD5 01e76fe9d2033606a48d4816bd9c2d9d
SHA1 e46d8a9ed4d5da220c81baf5f1fdb94708e9aba2
SHA512 62ef7095d1bf53354c20329c2ce8546c277aa0e791839c8a24108a01f9483a953979259e0ad04dbcab966444ee7cdd340f8c9557bc8f98e9400794f2751dc7e0
SSDEEP 96:J7fhfKaGgchPzxK6bq+pKX6D8ZLidGgmkN738:HbGgGPzxeX6D8ZyGgmkN
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4231

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Bfferne/Thesmothetae.Rig112

SHA256 8947f76f00e5db4d7321abecdaeafc55c74395a3bc08cb35e4df83bc059ec953
MD5 614673d411c58aa981c207a004046213
SHA1 5b1010f2a12f593dbd04bfdc68921a8c570e98ea
SHA512 3d72278e2e62079074e676832b17ded012d4e9f668bad2f60d33fdc0397b4fdbded6e0e08a7ecee00c38850e3ce040c65c128758eb6742856217a2be75108f25
SSDEEP 1536:TLw8QJAcnzvzreqYnZPKTUEcYTtVp37jPR:3NUtVr
MD5 SHA1 SHA512 SSDEEP

Bfferne/redischarged.txt

SHA256 f505a76ee510656617589119be40fd9233af4fe1b593f82d285a6a34c8a7b21f
MD5 54eff8a07ff643e09b36ec2459f15cbb
SHA1 6186156e525f9bec16b71d7944b0718702ef226a
SHA512 c2ece824a3442732a8c13f9b2629ed07d630ec2633611d9029eb1b3a5570e9a90dd19f834c88775ef4e73dccf0b034e71f45ea6ee90845a38fafab2e4ee8dc99
MD5 SHA1 SHA512

Bfferne/trimklapper.mis

SHA256 d802c2bbdda9ebad65a946ede1964bcc6e516825bb306ae2ec3910a846f23fc0
MD5 fa97d041f05f0bac7ab4b52d9b9b4a6c
SHA1 9b0c51f695c046d689eabcf346a2a77a24a43d07
SHA512 147ab6160954d3effb57d2fa57064c8ae526924c1057699572a2f0f8997044456ee50a6d714e9c1fb01591eee37a01252e296874ff66b8a93f1dc0d318d032c6
SSDEEP 768:LBNjNEXQEI9tobFsxGREVx8zi9e9TawOJF:l
MD5 SHA1 SHA512 SSDEEP

Lignone55.gra

SHA256 f2131f0fe2a13f926670cfbca00a163629df3fc516ecf4ba31d0a7cbccaf0815
MD5 6d55a4161e1afe85331f3df53b0411a6
SHA1 5ffb406e8e1b68b234c2e4889e7b5777ae274594
SHA512 f4ce7b7869089f1103246d004e5665af97ce279b6fe1fb69d98b97c98a007a31207a04a13224b68a0ea5c96d5e1d680438b19ca80fab1177960eda71b5bdbe40
SSDEEP 384:r+5+iiV0lvQuK5JcFgRh4e0ONWrjnv2gVzCgOgiAb4imxZS:XiVKLKChPQvtnWS
MD5 SHA1 SHA512 SSDEEP

Sindbilledes.Sli53

SHA256 800d55f4201a0ccf594196155fac26c72558e4418948e07c02e05e74da83fd14
MD5 30b271a4a902d3c947d555a5f9db7d0a
SHA1 c3ce06fad05c5ed4fecc874a00c4eee1d0b1829f
SHA512 90213eade230f9b0295873b5f8a555f791c543b9b9e980c8d320ff0e051b6d8a945ae9e78fbd071548c34775cb0f3920d7023bfdbf1182ad50af0eb6527f51db
SSDEEP 3072:vssChmlrYDRXREdkKy4iRIf4b7XfL+/XVAt7iKg/BtvMCso8q+0SNX:vohcyhvKy4AIfQ7XjxAV6Cso8qMNX
MD5 SHA1 SHA512 SSDEEP