pagamento240529[.]bat[.]exe

resource
pagamento240529.bat.exe
unpack001/$PLUGINSDIR/System.dll

pagamento240529.bat.exe

IMPHASH d4b94e8ee3f620a89d114b9da4b31873
SHA256 6762d4556e49a9fe0272ca23cb07595e6e7ca6b78d74cd6a8076678031f530f2
MD5 e03150e70ad6d79cf0cdf217429cda61
SHA1 d771aed76e171d6dd3c7f5e2f280fbbde3bb5091
SHA512 f3d105765a186c5c6ab320d8f374a58b71d22fa071d6e0d3caaea0a6162352ac4e93d14707843e710edbe2963e8e63d4fc0bb80bc6e72ab9f013d74286ce4fb0
SSDEEP 12288:0vdsolqcQb7KqhkJ9kmmpkA1W2lhXR7IXjk:RiQh5o0hB7Ak
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

12925

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetCurrentDirectoryW GetFileAttributesW GetFullPathNameW Sleep GetTickCount GetFileSize GetModuleFileNameW MoveFileW SetFileAttributesW GetCurrentProcess ExitProcess SetEnvironmentVariableW GetWindowsDirectoryW GetTempPathW GetCommandLineW GetVersion SetErrorMode lstrlenW lstrcpynW CopyFileW CompareFileTime GlobalLock CreateThread GetLastError CreateDirectoryW CreateProcessW RemoveDirectoryW lstrcmpiA CreateFileW GetTempFileNameW WriteFile lstrcpyA lstrcpyW MoveFileExW lstrcatW GetSystemDirectoryW LoadLibraryW GetProcAddress GetModuleHandleA ExpandEnvironmentStringsW GetShortPathNameW SearchPathW lstrcmpiW SetFileTime CloseHandle GlobalFree lstrcmpW GlobalAlloc WaitForSingleObject GlobalUnlock GetDiskFreeSpaceW GetExitCodeProcess FindFirstFileW FindNextFileW DeleteFileW SetFilePointer ReadFile FindClose MulDiv MultiByteToWideChar lstrlenA WideCharToMultiByte GetPrivateProfileStringW WritePrivateProfileStringW FreeLibrary LoadLibraryExW GetModuleHandleW

user32

GetSystemMenu SetClassLongW IsWindowEnabled EnableMenuItem SetWindowPos GetSysColor GetWindowLongW SetCursor LoadCursorW CheckDlgButton GetMessagePos LoadBitmapW CallWindowProcW IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard wsprintfW ScreenToClient GetWindowRect GetSystemMetrics SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharPrevW CharNextA wsprintfA DispatchMessageW PeekMessageW ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW GetDC SetWindowTextW PostQuitMessage ShowWindow GetDlgItem IsWindow LoadImageW SetWindowLongW TrackPopupMenu AppendMenuW CreatePopupMenu EndPaint SetTimer FindWindowExW SendMessageTimeoutW SetForegroundWindow

gdi32

SelectObject SetBkMode CreateFontIndirectW SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW ShellExecuteW SHFileOperationW

advapi32

RegDeleteKeyW SetFileSecurityW OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges RegOpenKeyExW RegEnumValueW RegDeleteValueW RegCloseKey RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumKeyW

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 e94a1f7bcd7e0d532b660d0af468eb3321536c3efdca265e61f9ec174b1aef27
MD5 ee260c45e97b62a5e42f17460d406068
SHA1 df35f6300a03c4d3d3bd69752574426296b78695
SHA512 a98f350d17c9057f33e5847462a87d59cbf2aaeda7f6299b0d49bb455e484ce4660c12d2eb8c4a0d21df523e729222bbd6c820bf25b081bc7478152515b414b3
SSDEEP 192:eF24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35Ol9Sl:h8QIl975eXqlWBrz7YLOl9
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10183

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Bayerns.ero

SHA256 31e23629015e3832c3c622224fe04fc2eb586eb21b06cae3dbeb6479158e56a1
MD5 94b1a46ebd8a3e6668c71f632b5f4ba5
SHA1 c906941f578ccc89463693e2071889d1938b2105
SHA512 b584c4d174d781e7e5d2b90b23cebaafcc2aba7186f6c3b1f4f8f144233a8ac7dcc3177513d7ef0648d9151a34c0a93892424386ffdf02d8fe0667c1dfb6cd31
SSDEEP 96:1yCKwZUAdCpkRQ2y8Xm/qRUVLuyvDpza4A+UzhlvrPDutcV8vfD64Uz1yt:k7wZUAMTB8laq2FG4OPsVvbVUByt
MD5 SHA1 SHA512 SSDEEP

Coony.Gra

SHA256 cf625a743d1560d257777fd1b1a049571cdce1cbf4a537228201a02f5ab0d6a5
MD5 df23ecb339e7707dbf3541e6b6f0b54e
SHA1 ea14cf06ac0624ecaea854e267a2a50819edbe68
SHA512 c24d0953fc2ed322981b2a803ed800db18b24f1fcee6b85eebc86fcefe2c735a1d955491bebcd193d80c8853f1f908e34760d612650c934ac0cafe1b3d042f3a
SSDEEP 192:G9j/OoWzYPBOZdINxuliEctAn9+PYG3cL2Fq5ebkLQmdK/:Gx/iLE6AESr3cLCqBLndK/
MD5 SHA1 SHA512 SSDEEP

Lovgivningsomraadets/rederivation.fld

SHA256 5e509941db3f648666a7aecf10831338c4484cb1e63ed52380690fb6cf375455
MD5 a1c05d7c184c6d7b33da049171ca776b
SHA1 17a0bb73cf113a2f3b0743cd2dc008c46514e95f
SHA512 d13ec68e89ccd760013c76d47a124d23cf64280cd95d4e914815e43414c0bf0553a80502feaf8f940fb6343924fbf042d26edcad71c0a062130b82912817f63b
SSDEEP 192:ApqTfrSCex/dp9j49jkFgu2H5a0XZYM5VxeXT/uz27HR6Z:ApKjSCiHG6z2ZJ3D0T/uzcHcZ
MD5 SHA1 SHA512 SSDEEP

Lovgivningsomraadets/retsstaters.ser

SHA256 84187989af132563f774001b3cbee8f8dde22c8fdea5d9f4c07684b92fee0ab8
MD5 667fcc10f76491018a2b0b13812b3324
SHA1 c4b941500009fce2a09e2d011e29bb9ad2aaefe2
SHA512 e29520b8239b7852b210c2f1db17d5996d647fb067463faa72981296c7676454479c5fa62902fb2bc6c3325a69cfa4a151fc29cfd7e6f31468fde016c78e7ac7
SSDEEP 384:dKtu7hUTB0+RUy+krOS9zRYfnWnJIQQqxxbVZfW769e:diuiTFRD+KN9zcnwRQqvn+2I
MD5 SHA1 SHA512 SSDEEP

Lovgivningsomraadets/sammenstyrtninger.tra

SHA256 d494531b61b9c628047f630af1826a24e74ec8be3af45dd3f894e0b264601f29
MD5 70d2724e52d584829af1fcace807cd7d
SHA1 79d76fb17e0045a1940dd38e29aa2d0ab751ffde
SHA512 f24c1add4f424cabc0a08a3c41f5af1b585ecd7d529339071d8d4f434590a205aaff96bd844b6e11e4f536a6b8bc6830f6641891559fe68f04651437ea403f20
SSDEEP 192:zGmvHlZJpyPi6ApOlI1OjBUZLvQN0fQ59cl+b6VMlsvEa7QG8pk2EBj:zzvmPkodVSfsa+eVMlhaUGjpJ
MD5 SHA1 SHA512 SSDEEP

Lovgivningsomraadets/subpastorship.boc

SHA256 fbc2ac78ea0e19259b281470a2f4f49cffd2149240e0040ad10917e8320b0a8b
MD5 0146293bd53354a5576b546922b2996e
SHA1 9c7af6ebb6ab2d380cfc03f2b0e226665f0766ab
SHA512 ef34d608e5472ffb4364a9cb84cf19217d6f65adcc4fa9924d436d9824c3d94b699fe40e18fa33e86d597ceb547598877c481d80d1d86033d92ed7fb3f8ed70c
SSDEEP 192:7aPGORKVeKO3P5X1ovLFROt7bZ9/TlrdYlKNV5I:7aP4w3P11ovGNZ9/TfpI
MD5 SHA1 SHA512 SSDEEP

Lovgivningsomraadets/templates.ske

SHA256 d4285856e875c986b83475dbd57168f1dba1dce4f2ef65b052a9a3f95c44b19f
MD5 1a5c112310775f20782c50d7c9973f5d
SHA1 61a06b684498c0adf12faf6d233a3197253ae5bb
SHA512 060d945571ff216759b5d362c750c6944dd2e6a52115e8e25aae86a0631a6840406f2c0ba419996d0e518eb33ee4bb96477c05cf9f26fd971db8dbe4045d0c37
SSDEEP 96:HiH3u8kuoUCP1OAh65nZQLQaP0Rm4agTuGUc5ZmqmFCTNMk0edK6rpCq4:H183o4P1ZQLr0YqTuGUW/OCyk0eo6174
MD5 SHA1 SHA512 SSDEEP

Lovgivningsomraadets/torkel.ove

SHA256 f993969c2754dd755a3251afbf3c17d47d0855a5018980b2c5bfc305a5746d77
MD5 195c8a1dbd3d5268a610b62f0136cf6e
SHA1 a425ac196ca4274855cca16d97a7c5e886f08801
SHA512 a4ed0988d0b6cef91cf7fac5c2b67cd4c5010ab2ce718688d2bdef8809e4fc4db67a2e3a9a52d47ab187ee521f90deada82e1ce54816df032e59ea56fc7203ab
MD5 SHA1 SHA512

Nodding/klageskrivelsernes.ben

SHA256 9bbdde59e4939889a891e504459a8d29b0214d9a1892e355ac00bce14f61b413
MD5 33dfb9d1a19e074be324b386e25e80af
SHA1 5d08363ccba5204519ee1a108c16eb25273a0a6c
SHA512 61de3b1b97e4f8c5e65a27746b090488b7b074f1070f00b81a1ddd9d385d9200312b9265328977111f8c0588fad4992490bc0a538216059b4ed8fbc979e2037c
SSDEEP 384:RxDvQ39syxY6YaFUGAjCUP9swYw56CbgG5UaqCg:RxE37xY6YaFw2iswYOV5Tg
MD5 SHA1 SHA512 SSDEEP

Nodding/pavies.mag

SHA256 38cb4d807f8fada271111792f7876e5d3a70dde48339dd3eab2af0f6c099de70
MD5 047419207a62dec41f8e45b33dbcee4a
SHA1 d0df940a29e55f81611be4a3bf8d0c7b98979996
SHA512 68edc90865e14ecf710458df3b67eda197542aef6c4bc81dac7555cfdaf0df42bf838980789151baff938d1c65bab78ef115231b4bea2faf11289654c8001b90
MD5 SHA1 SHA512

Reimposure.Caj

SHA256 afc1611a3e77c9d436f495fd81198d82ecee548a213480cfebe2536d47cc1d3b
MD5 9055ec4896cc794c2e6580c0b7f61446
SHA1 6ca27d08fd696d3344ea39eba45c310e075536a1
SHA512 0fdd3df9de4b140126b51c641e233dc2986a7932db455022f04c651fa0b09c574525078cbf024247f092c585bbf4839990e9e55966ba4c6f1773b7fa8cf98358
SSDEEP 6144:MFNfLhvRSuLbyIebV7UFQVPjEbksMad4V7lrnDNIpDEr2I7Q:MTbp3yIAV702IbkGutRrs
MD5 SHA1 SHA512 SSDEEP

Stopfodre.tam

SHA256 fabb9686c8ad6df8981c65d5eed636a0717a33d9291433211ea30d558edc5c1d
MD5 60cb95dd31878b91b5d2c3ec152eaa35
SHA1 5fe0aa79a271f7b2e7321051467d13a4dda0a74e
SHA512 747b9c412b0b66b18d2da223917b79805d968da0f3c09ef59e4ef7c53e5452752dc11c407376ae23f73a52e62b00dfc0ede2b063b2f579eb7db11f124d411bba
SSDEEP 384:oCPusbpPtkxbuXh0T/2HU9UwNXZ7j+2S5IVoE:omxPtyux0jadwPkIVZ
MD5 SHA1 SHA512 SSDEEP

beredelsens.tin

SHA256 fff40e3bc20b68d7699167bcf6842710a0d615e1f4ebd6958ad0ab2d30099407
MD5 3612e073562d5de5a09b6c1223265b0a
SHA1 5707f6f0de357c758222a76210fe1173ad63cd9d
SHA512 bc8f0bea824ac1041942ce388b34b4223c33f5e7fd5ebeecdeb68a85a7c798470d62d38991a2e983265b753d203e4b0ace8ed20d995e230aa675e54d8147e130
SSDEEP 192:QKwjqdycQ51jDnW++EGZ90viNDJBizm5D+6hU/rfdV5SwrYJS4IfY:QKvdyckW++59V/icODpSaiS/Y
MD5 SHA1 SHA512 SSDEEP

bountiful.are

SHA256 b48a403ab972daacb26013595a07d3f2911a920efe43e2e91ca41aef84acb1bd
MD5 0c9fbed9e565a162b6d5605ccde1c536
SHA1 a9167410f572feb89c0fdb6e8523963b09b16c62
SHA512 f622bd0a379c8d4e3c50be56f4e024468de5d8fac5ab8e077a9a2886bbe954df048b14b2107b53f9ed54b2e2911b883ba9ed901db557528fdf7d1bee134ad2f1
SSDEEP 96:3wsc0O9ZGrAC0Y6E3WM4xHdTErWtwv5x3o:pcTn6klHM4ZZuI
MD5 SHA1 SHA512 SSDEEP

bradypepsy.txt

SHA256 ee7876bd7ffc8a98689d45c8c4ada11ce20e6a37bfe4f0e8682cda7d3d1d24e9
MD5 473011ba8701d8b5329a17e192a29c12
SHA1 761580aed31d73db4bea1283bcaa2c9ba0760a7b
SHA512 0386349be8f1f275608b87f95369072f99bc463f05920dbc09df2b4844474f34b4c7e2a89c85eb8a123edc3b0c28fc3194cd83295d9302d967edb4935f219de7
MD5 SHA1 SHA512

demurity.bio

SHA256 0ced45a71b2dd9d475d9b4ca7d3e75886dfabf758276a8db74018573c3497485
MD5 4809c1c0800303e2fe525d3834db28e3
SHA1 f6f0557b515d5daed1d6f93af8caba4b6114dfd8
SHA512 c1d780eb0db7acc40162a80fdef12d34ebbb5ebc7ef11a9b01123d346ba23f0aedc063548d39d589f6b86da67f87068c9c36ceefae12a46d5e66f834797fa86f
SSDEEP 96:Tb2jjGlYnjST8H9FziaCVrr/M+h7B5G3VLKMZp4DNKqg9/wW23VTb7yV:Tb2fj88djK/DdvG1KspU3E/wz3VTb7yV
MD5 SHA1 SHA512 SSDEEP

emancipering.nir

SHA256 be3ff57797434ce660edd20df910266e28e6d982d05a8e448b5d029ce8abcbf5
MD5 d47096d546ff36092c1ca06fe548f439
SHA1 d2d50c1c3f1ee7a721410d4f8b506876e4a06ade
SHA512 c9dc22c56b6c2b052f21c3cf4ddee18e7e8f939b5f8e924060a30a479538113165380717d213a19e971993b8161b25e25e7ca977c140b7711ba51f6a9ecaa377
SSDEEP 96:aji+KOsO59Ca28enFUSTvYx/LpkY0F53K2e2X3qcaaVeRh0ZJ17jk:4jdSaimVkYc56HKaeevG1c
MD5 SHA1 SHA512 SSDEEP

fejespaanerne.sdv

SHA256 fc94138c7e9f46507ea2b208446af8111f41f3a34c35b57e702bc65d97a38160
MD5 6bdb394716c0238fa52de99c91df8b23
SHA1 228e1ef8070fc0abf27f402af6130bf0c6891771
SHA512 14d7b45c570edaecf6ac39300e39608b9b3f671f0ce6ea22244c23c7ee53450c47c2637391b91e66acfa9c77a0d8fff34a8b6e1425067bce8ed88881d4be08db
SSDEEP 96:FHsa97LQBlFVpR6z3d3tb/FqtHhf1OB+kSUDd/I3oP8hxPx:l12FVizvcbfY0Up/I3oP8hz
MD5 SHA1 SHA512 SSDEEP

pagamento240529.bat.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Bayerns.ero

Coony.Gra

Lovgivningsomraadets/rederivation.fld

Lovgivningsomraadets/retsstaters.ser

Lovgivningsomraadets/sammenstyrtninger.tra

Lovgivningsomraadets/subpastorship.boc

Lovgivningsomraadets/templates.ske

Lovgivningsomraadets/torkel.ove

Nodding/klageskrivelsernes.ben

Nodding/pavies.mag

Reimposure.Caj

Stopfodre.tam

beredelsens.tin

bountiful.are

bradypepsy.txt

demurity.bio

emancipering.nir

fejespaanerne.sdv

Sharing

General

Malware Config

Signatures

File Explorer

pagamento240529.bat.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Bayerns.ero

Coony.Gra

Lovgivningsomraadets/rederivation.fld

Lovgivningsomraadets/retsstaters.ser

Lovgivningsomraadets/sammenstyrtninger.tra

Lovgivningsomraadets/subpastorship.boc

Lovgivningsomraadets/templates.ske

Lovgivningsomraadets/torkel.ove

Nodding/klageskrivelsernes.ben

Nodding/pavies.mag

Reimposure.Caj

Stopfodre.tam

beredelsens.tin

bountiful.are

bradypepsy.txt

demurity.bio

emancipering.nir

fejespaanerne.sdv