1b6304388826ef0f3c826c75afbe4ff571562dae466726e8d25cc93afb22ffa0[.]exe

resource
1b6304388826ef0f3c826c75afbe4ff571562dae466726e8d25cc93afb22ffa0.exe
unpack001/$PLUGINSDIR/System.dll

1b6304388826ef0f3c826c75afbe4ff571562dae466726e8d25cc93afb22ffa0.exe

IMPHASH e2a592076b17ef8bfb48b7e03965a3fc
SHA256 1b6304388826ef0f3c826c75afbe4ff571562dae466726e8d25cc93afb22ffa0
MD5 f41482940a8541117d885d640d8ef709
SHA1 c70609efae644cdaede26edeb34215ba67a3ec94
SHA512 c0e8486c399524d47b41e295fff87108ae95236bebd2c789d6048df3b7b93eaa05705e9a9e33dd4a039ae9313abe1810cdc29dac23cb2f4213e97a56012ead6d
SSDEEP 6144:wUjRwQGJaKitWD645y7qCjEXRF7PdrJNT/CcvuziDu7DkKlke:wqcS4IGCjEX/jNT/Cxwu8qH
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

12906

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetCurrentDirectoryW GetFileAttributesW GetFullPathNameW Sleep GetTickCount GetFileSize GetModuleFileNameW MoveFileW SetFileAttributesW GetCurrentProcess ExitProcess SetEnvironmentVariableW GetWindowsDirectoryW GetTempPathW GetCommandLineW GetVersion SetErrorMode lstrlenW WaitForSingleObject CopyFileW CompareFileTime GlobalLock CreateThread GetLastError CreateDirectoryW CreateProcessW RemoveDirectoryW lstrcmpiA CreateFileW GetTempFileNameW WriteFile lstrcpyA lstrcpyW MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GlobalFree GlobalAlloc GetShortPathNameW SearchPathW lstrcmpiW SetFileTime CloseHandle ExpandEnvironmentStringsW lstrcmpW GlobalUnlock lstrcpynW GetDiskFreeSpaceW GetExitCodeProcess FindFirstFileW FindNextFileW DeleteFileW SetFilePointer ReadFile FindClose MulDiv MultiByteToWideChar lstrlenA WideCharToMultiByte GetPrivateProfileStringW WritePrivateProfileStringW FreeLibrary LoadLibraryExW GetModuleHandleW

user32

GetSystemMenu SetClassLongW IsWindowEnabled EnableMenuItem SetWindowPos GetSysColor GetWindowLongW SetCursor LoadCursorW CheckDlgButton GetMessagePos LoadBitmapW CallWindowProcW IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard wsprintfW ScreenToClient GetWindowRect GetSystemMetrics SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharPrevW CharNextA wsprintfA DispatchMessageW PeekMessageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow LoadImageW SetTimer SetWindowTextW PostQuitMessage ShowWindow GetDlgItem IsWindow SetWindowLongW FindWindowExW TrackPopupMenu AppendMenuW CreatePopupMenu DrawTextW EndPaint CreateDialogParamW SendMessageTimeoutW SetForegroundWindow

gdi32

SelectObject SetBkMode CreateFontIndirectW SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW ShellExecuteW SHFileOperationW

advapi32

RegDeleteKeyW SetFileSecurityW OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges RegOpenKeyExW RegEnumValueW RegDeleteValueW RegCloseKey RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumKeyW

comctl32

ImageList_AddMasked ord17 ImageList_Destroy ImageList_Create

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 982c5fb7ada7d8c9bc3e419d1c35da6f05bc5dd845940c179af3a33d00a36a8b
MD5 0ff2d70cfdc8095ea99ca2dabbec3cd7
SHA1 10c51496d37cecd0e8a503a5a9bb2329d9b38116
SHA512 cb5fc0b3194f469b833c2c9abf493fcec5251e8609881b7f5e095b9bd09ed468168e95dda0ba415a7d8d6b7f0dee735467c0ed8e52b223eb5359986891ba6e2e
SSDEEP 192:eK24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35OlASl:u8QIl975eXqlWBrz7YLOlA
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10183

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Ausubo.Gub

SHA256 44eca4095f6190663407c40f33c423055539b73abf0638be0be13f8f1ead79ff
MD5 07270d1602bead9384643551f5e72885
SHA1 7c7b86f60b4e705ea1860f0b71e61d20af6e62ad
SHA512 05774fd0e4b3d3dc0aaed61df43188d9a9fde43bae6853d3053e8e779d646ef2d2665c429866138e884a3ee81b97ec1117e766b47a704982501b368af86600bb
SSDEEP 3072:xNNZJxU++IHbSAz4dioqWLs5pHXQJcUtMPcrD6UpgFcrxtnkmPMd5QhF:xJjU++IXzzFcqgJxtM0icgFEtk4P
MD5 SHA1 SHA512 SSDEEP

Malinstitution/forureningsbelastningernes.ill

SHA256 a9087a5ff6e230677fb76402198ce6cf469dd20d1972bce3d6b5d91b36aa77c0
MD5 ac25bbeafac360d17c528cecd3986e13
SHA1 9e48c5c7e97986f32f38a67db90b548f458d07d6
SHA512 b2eeefa88635cf67509628d3249ad70bdd9f240c06dc068a941968d88b542e54bee7c05fa5b6b4f9304ad90993a1277668868f5e3a726efbc35215b3f6eceb27
SSDEEP 96:PTIA7s7tkdjxleevoOMrNd+NDKyCO76Q/OjUGf9J12:bIA7gkdjxleevoNX4D976Q/OYeb2
MD5 SHA1 SHA512 SSDEEP

Malinstitution/semi.sla

SHA256 ee2061b9979172f0814b801eba0fa9360ad48a560c94b70dbc3e0a5d4c8dc52e
MD5 abada6d613f5af4c7491660bc3530bd1
SHA1 d3b20cbc1dc4512467233b07a6d9d7b496c480a9
SHA512 bc36b5993b2544253482b5bbd7c5295391a0dc7bc5680086ecd0a369d762d96226845a911eadd68103246ea0ac9e07ee1724a061e9040b5c86a05795137e1af8
SSDEEP 384:mvJGopx8zZtAZ6Gn1Q4a9fJ+odGiZZiO98UssUHUhadhTuNHD1ioAzdv1UNj2En9:tocxsu/4Oj4AlbN8PxODb9/7c
MD5 SHA1 SHA512 SSDEEP

Malinstitution/unponderable.nap

SHA256 c343207356c5c3293bd8aa091e3f8b175216ad6cefd9b22245384401fbd481ab
MD5 6934ea29df9d418374036c83a07adb60
SHA1 31081589bd4e74c1cd8b7f3964e52cecf45928d6
SHA512 4d662066c478b4d23b6758ad5bdd678aa660414118812273832c1be2b6927c335eecd9eacfbe507006addb97c2926911ef12e51f3712a95136b803e944fe7a4b
SSDEEP 768:C0R/HSSTAuTx7D7BMCGBDKuSxmzr9i+fVOIMXfxoJrhwp4h0fWsvrgzToWhb:UF
MD5 SHA1 SHA512 SSDEEP

ceratitoidea.txt

SHA256 71343258f0a719e276785f39d3ffcec1c396c35996a4f29214289950ecd21cde
MD5 f9867a6794cf97f462cb9a827b2be04a
SHA1 7c411fbb32a958b7888ca520220d0dfb12daf24f
SHA512 b17d1e53a1eb2059d9c5d815a5b1f84e22d49b83234c826a0a8ec23e0415900e7703470c4cf7a84359f91198e0ba9d982c9636d020db6eacba1ae5f7ccbeafbd
MD5 SHA1 SHA512

dvrgekongens.hov

SHA256 5239dfdbd4420d6d39ed75b3776e7bb4ba3f82d9c1b6d83d1b377a5f3c837e00
MD5 a10791db85688fa6c3a3128c9adeb057
SHA1 46a48f1f5251f67fd8808e99989e76817d7a6cf8
SHA512 7e81fb1bf6d50926c18304822fcfc60068242018d86282a3f284af1bc8358d1d06f9647f0eb4ed3e923b3ae382d121d056f095b5a7b0fbf0c3c1063bc96e99b4
SSDEEP 48:DCzq2XcXBX7QB8oMw9AM8qtJDYhSU3nv3ARGmgxWaQ95w:DuXcBLc8oM0NtF8SU3YRKG
MD5 SHA1 SHA512 SSDEEP

1b6304388826ef0f3c826c75afbe4ff571562dae466726e8d25cc93afb22ffa0.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Ausubo.Gub

Malinstitution/forureningsbelastningernes.ill

Malinstitution/semi.sla

Malinstitution/unponderable.nap

ceratitoidea.txt

dvrgekongens.hov

Sharing

General

Malware Config

Signatures

File Explorer

1b6304388826ef0f3c826c75afbe4ff571562dae466726e8d25cc93afb22ffa0.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Ausubo.Gub

Malinstitution/forureningsbelastningernes.ill

Malinstitution/semi.sla

Malinstitution/unponderable.nap

ceratitoidea.txt

dvrgekongens.hov