DHL Package[.]exe | Triage™

resource
unpack001/$PLUGINSDIR/BgImage.dll
unpack001/$PLUGINSDIR/nsDialogs.dll

DHL Package.exe

IMPHASH 7ed0d71376e55d58ab36dc7d3ffda898
SHA256 c9a985aea86448e6770b76c334fbd6a83658df00688bd4e754bde0ec0a12504f
MD5 35ad880f5b37f694d5d9fc7d750cad14
SHA1 262f9712da9fb80700481b28b539f52f3ce9fa98
SHA512 491cfb154b71f7b3b25306e0abf8ccff3532149ece79b4be827e5b5c5ad8913ed9bdca09edb6976755ff6c3e1bf1024e7ce5e89061326443fba32759a7ee5a60
SSDEEP 12288:JY4e1029uZQEzSp4b5N1kC2Dg0A9INKLdzReocbosx:FereQEG4b5N1kC4gpINqdc0c
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

66:f2:80:7c:33:d8:61:32:52:e3:81:32:5d:59:4d:5f:24:d2:48:0d:47:a0:ff:e7:a9:1b:9b:2e:5e:83:89:c6

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Dolk,OU=Louey Domspraksissene Wannabe\ ,O=Dolk,L=Hoffman,ST=Minnesota,C=US,1.2.840.113549.1.9.1=#0c2953696b6b6572686564736166646b6e696e6765724054656b73746b6f6d6d656e74617265722e47656e

Chains

Jun 7, 2024

Minor OS version

0

Major OS version

4

Entry point

12818

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathW SetFileTime CloseHandle GetShortPathNameW MoveFileW SetCurrentDirectoryW GetFileAttributesW GetLastError GetFullPathNameW CreateDirectoryW Sleep GetTickCount GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW ExitProcess SetEnvironmentVariableW GetWindowsDirectoryW GetTempPathW SetFileAttributesW ExpandEnvironmentStringsW LoadLibraryW lstrlenW lstrcpynW GetDiskFreeSpaceW GlobalUnlock GlobalLock CreateThread CreateProcessW RemoveDirectoryW lstrcmpiA CreateFileW GetTempFileNameW lstrcpyA lstrcpyW lstrcatW GetSystemDirectoryW GetVersion GetProcAddress LoadLibraryA GetModuleHandleA GetModuleHandleW lstrcmpiW lstrcmpW WaitForSingleObject GlobalFree GlobalAlloc LoadLibraryExW GetExitCodeProcess FreeLibrary WritePrivateProfileStringW SetErrorMode GetCommandLineW GetPrivateProfileStringW FindFirstFileW FindNextFileW DeleteFileW SetFilePointer ReadFile FindClose MulDiv MultiByteToWideChar WriteFile lstrlenA WideCharToMultiByte

user32

EndDialog ScreenToClient GetWindowRect RegisterClassW EnableMenuItem GetSystemMenu SetClassLongW IsWindowEnabled SetWindowPos GetSysColor GetWindowLongW SetCursor LoadCursorW CheckDlgButton GetMessagePos LoadBitmapW CallWindowProcW IsWindowVisible CloseClipboard SetClipboardData wsprintfW CreateWindowExW SystemParametersInfoW AppendMenuW CreatePopupMenu GetSystemMetrics SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharPrevW CharNextA wsprintfA DispatchMessageW PeekMessageW ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage GetDC SetWindowLongW LoadImageW SendMessageTimeoutW FindWindowExW EmptyClipboard OpenClipboard TrackPopupMenu EndPaint ShowWindow GetDlgItem IsWindow SetForegroundWindow

gdi32

SelectObject SetBkMode CreateFontIndirectW SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW ShellExecuteW SHFileOperationW

advapi32

RegCloseKey RegOpenKeyExW RegDeleteKeyW RegDeleteValueW RegEnumValueW RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumKeyW

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

CoCreateInstance CoTaskMemFree OleInitialize OleUninitialize

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

$PLUGINSDIR/BgImage.dll

IMPHASH 32b0f5880a0efd258c6be2f7a14f4a9f
SHA256 a45f294137e2b0f6092eee8fdd2e19334f34ff3640d865a810b70f2104e92c21
MD5 ee255bdf426349e1caa8f1b71de9fd22
SHA1 d589773826620046df1d77dd148f819a88dd35ec
SHA512 71eeb41b5816b7d0f9517264aaf026da878561b6a222064c8100e47c383de9ac369800b734468322f3a6fc3eedb1a23d3c5ca6874bd7bf84af08f395248872cc
SSDEEP 96:8ePik1LFJaO1/radJEaYtv1Zs4lkL8y3A2EN8Cmy3uTc4j7J3kWyy/:tPdTJa2roqJyA2EN8diuTJje
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

7202

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsDialogs.dll

IMPHASH ec5fddc407d2b4e0a16fc4d786afc555
SHA256 be60a00f32924ccbe03f9914e33b8e1ad8c8a1ca442263a69896efba74925b36
MD5 dbdbf4017ff91c9de328697b5fd2e10a
SHA1 b597a5e9a8a0b252770933feed51169b5060a09f
SHA512 3befc15aab0a5dbe7fde96155b0499d385f2799b1a2d47ce04f37b5804006b1c6c4fff93d3cedb56a2a8172b23752b6f9dc6168cfce3596b91def3247836cf10
SSDEEP 96:33YnIxFkDUGZpKSmktse3GpmD8pevbE9cxSgB5PKtAtYE9v5E9KntrmfVEB3YdkS:33YIvGZDdtP8pevbg0PuAYK56NyoIFI
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

7424

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Beskeders/Neverne/harddiskenes.unc

SHA256 5026ca81ddd09f1fc6ee23de5d49b6532daec337638a2b2951e89da05cd3dc50
MD5 4d9028d268808d78832e4f550105fcf5
SHA1 74401268b48d94685f1d01b8e66cd18f6f5da832
SHA512 7baf24d3bab3b9e8a579fe1f80719703135802e495f24a7daa3e55a3f56652c2f60e5924b5eb7f5240286f81307a445ece922a1b2b5c7c689480d36aed91cb9e
MD5 SHA1 SHA512

Beskeders/Neverne/kaardernes.bun

SHA256 8657a575be836dc4993b4179f747f031eabeab20ab8901d38256dcee60648bb7
MD5 afebc0b01ae3921607a3b2d3a6648464
SHA1 4b9bb9003090a05c6097129cebe5537f4c238435
SHA512 b9204000ec8d20752f62b61ff9ba16a9a6df38ac06ce8063856dbfa2ea782a6e9e7448295e63649e3d5c22f70eb6f8685592b63f1dc65048c9f2f3c835966cdd
MD5 SHA1 SHA512

Beskeders/Neverne/multiphasic.pol

SHA256 0659920404c1f3accbe61b7ac34b0dcdc4dcfda94c5d1038c8807c7ef10e35d1
MD5 99ecb35c320eecaba4c34885532dc983
SHA1 1e4d761f718299571e848460a5cdd8b682b22965
SHA512 cdc559eb8eb29cfd105834b144f0bdd4f734cdcce5c894a9857424361b15f68f70a9cbc9d894ab4c21c06355ad388474e4a27fe55e5dfdbcfdb91ca55dae4f3b
MD5 SHA1 SHA512

Beskeders/airtightness.led

SHA256 565eea03984f8b87a515889c9ef462058fbd541fbdff685ee9d9a940b9203587
MD5 ca40f2466434089041b55920394d2fc4
SHA1 69afccea7fa564fc526cead00a1dcf9d9fd1db61
SHA512 4c732042be100e15b0d07412c36c6733bf87ddddeea83aa6b871222368ba5b0801d3c4a46dc5478505348dec4f01a77002f756cfa38b32527a8491e6e09f771d
MD5 SHA1 SHA512

Beskeders/diphyllous.txt

SHA256 eb81ba0e80ff7bfc2ab9bfebecbbb9be22c3f1c32f90f25b784b5c6ce8798d35
MD5 60b85da9eb5eac417cddbc536f7f1775
SHA1 dd999b3e817d4fd6177f2d880b58976a582dd640
SHA512 4f8262dea75098b5ffe3374dc9f8f7094bf9b1153f5fdacc358543e418592d38118d8c6a3eb6e838d1df52f83355ca948e9e55d8a944d59ac5f010342f311083
MD5 SHA1 SHA512

Beskeders/gitterpunkter.mas

SHA256 92e42fe08eb7d7743ca549055458d65d3a74a1c63ba10b5bd32d1312dc85c055
MD5 f5c9712d768f16dd3484b4e8aa193a84
SHA1 8516963c5a2f517b471a323fca7ca8622037f138
SHA512 ab32acc0026e12d0a4042895c95738ce51d5e015ecf9c71df5e5903fd667bd3b0ec8a55b8b2f2161aecc5f3819527aa859bb6fcd388a3e052a8102afc84acd4d
MD5 SHA1 SHA512

Beskeders/grassmen.maa

SHA256 e4e7a0fd594088a1ddefa32a6d42c4a7cda0b36216421ad07b185f44ec651992
MD5 67aa7a10ddb594bb6bfb024f9dad107b
SHA1 3d84a65ba46eb2332ac7224afe4d1faa7a9a6c4c
SHA512 3e1cf141273085a5fcd575deeb785b60c41b977bfda8f8288dfa52da17c28e18d3109c86aeec092a4b14d3b2961f41b03cb9d3ef38b68af3d53594da46b15ae7
MD5 SHA1 SHA512

Cfh.cil

SHA256 ea6ae371659002025cf976468034fd21c23f66d91461391b2cd43b9a8bdb6cb0
MD5 1c16e637171f7414ad2eb442471433b2
SHA1 0e61e19e6872696b89324364365c1fe549855411
SHA512 20ae444965d972cf6f12d1af17ddc94391078cc52b7094b084895c431a77d1d75fa99852231bbab6d1c73a59780963439fe5390041e466a67479909094b63c3d
MD5 SHA1 SHA512

Hovedpersonernes.Til

SHA256 64b44c5656ec52010fa89f61e6989ff0da8a1086234d521a3efaf29b0d2d2dba
MD5 70d08f321239063f95d063cf97d92b54
SHA1 c1cbde3a80a68f45f176b908bc038fe6bb9f976b
SHA512 66485b9ad7b1e002ec3c96bf43ca577939598ae1d1c20e803800a2d798d4e8a41dc137329d142e5fd44f485c43a2d3d506037e1c10342d83464f328e150ee8c4
SSDEEP 1536:NaQ45yyIGTqbE+5pcXjE670aXgnAsSwPELUz:05bfObE+p8EGgJ8LE
MD5 SHA1 SHA512 SSDEEP

Samlsninger.Und

SHA256 6b4976f6b5434ccd43e67ff8cb4d8e1dcf6e83023019a11dbd924e07a8d78ee5
MD5 f073bd2d22d562066ab8462d2db25d78
SHA1 c1dff7239cbc46d602413477006586f9fd8a0337
SHA512 74bf272942d4608d3839695d2ab9d60f3cee752e08010e8ba7fd4943b21b809fb709770eb79a8fe12ed0bd9019db5ad6f18877635122c78f267e635ec5964fc9
SSDEEP 6144:4qTcVokus2wjxV4W5YBy14RYEkp1pwaQ5M2eLczqAervdMGd:4icVo8fjxV15T4RYEkVwpM2eLUfeSGd
MD5 SHA1 SHA512 SSDEEP

Symphonization/Forbindingers187.ind

SHA256 83ac8fe458f875d4463931f5218749e5801ddf7ddf3802e5830397ba00d3ef21
MD5 8e3884cdb3ca76f3251c4c41fb30e312
SHA1 e8ef71e5914d8a135373313684f958f395edde97
SHA512 c72728ddd3097a4a65c4bd749760802247f8491c5c788b43f80a7037411e128eea0f07a470ad2598cfe058c8da4980e2490af0c0573fa47e6ad83ff4d4dc3a17
MD5 SHA1 SHA512

Symphonization/Misrepresenter202.std

SHA256 35497bc5c2d920b8218514c99cac0aa4114902aa6b1aedc61bc1471af6d73053
MD5 1d6e4603cb5147f71191df104d60c690
SHA1 ddf4626a0aaf8f0b9b3b59e0a3881b4c038b95a2
SHA512 5e6020fe52de906c622d6777e0f0a9d35d47afd483e0cc4dd4e7bd195495729848378d438843ba2f13f9b3287170750cb223345746868e08d64bd9bf881888ee
MD5 SHA1 SHA512

ochrejelly.per

SHA256 d30bc80ccc04dd48ee492b351e3982449af7796a426258ac4e818204732006f1
MD5 71976a28d85f716e338d7b56d68cd4e0
SHA1 bf80a19bd9011ec6a4372db3b65d4120ecb2ae49
SHA512 87f0656b9061f48f1c16ca39a95feb5c73d1b437489b6f1e63dee775779c898a58496c930d72888aeaf4fabe4c57fb8b0826f7be50c251145d3ccb318a74d1af
MD5 SHA1 SHA512

serpenticide.per

SHA256 f9d6fda9ca03fecacae8285d16ee8ccc2d2c92dfdd72d0b0b987dae7886374bf
MD5 332a4713583767b93fbd77ed08540db7
SHA1 5fc66a02c859594c96bf12180d67e2898feda3ee
SHA512 c4bade0341e15382b6324676623e724c79e7c87f4038653929e0f21caec3e52b00b76e6ae0ccca7d2a1cbd4404a579986026490122bd99b3cf4ca5cb20536e4d
MD5 SHA1 SHA512

sultet.and

SHA256 334def0e2fca8fba537716e1aa2556d987dab915be5d0f4ece6c3e1ebf8e5115
MD5 fd4b6ac7d763ed5d216f52c033230d8b
SHA1 8111fede52f9448ff6b8cb97fad50b7b4f457a37
SHA512 eeaa7f7471f78aa0ef7162c3e90b1f92e160053fe37f80587bef1d684151afe43f0571a55d8d6890696e3397a0f3b30a9590910fd4b862abb138a8d1e8c91b71
SSDEEP 96:8ioppvqKKfyyCJOVIxMqdUOqJ4ljh6APF6f3L1:8iopcKsVIeqiOquljhBF03B
MD5 SHA1 SHA512 SSDEEP

tory.dis

SHA256 ab30b6d7f0eaaaee27cef4b2be4fb7dff3dbcc43fcae3989075bfd7ef285bbde
MD5 1493ac0622ae6f1b9ad0294101f87398
SHA1 8bfb78952215f4b94e99a7af0938c3e91b0198be
SHA512 d1a488b692d423290a74d435284f9895522fc16571c2f34a9ee2733026f16f5342fe25f596bd77a632b1f58b97d5d49cc26be26085b0fd1fcd93aa7d1435e78e
SSDEEP 96:u7qaVW2HG32gR5VLpe2RiB/lhGYOLAIxP7KlKFErQBtx5C:napGf5W//nTBeKul5c
MD5 SHA1 SHA512 SSDEEP

udkobles.bog

SHA256 4f2e0dca9882a0eeecf6baace3e5f597c96d55611260d9ee1aa2c109bacd1da9
MD5 f7b0c69b54c0689f47c64a29b0eadb39
SHA1 27c5220f281ef7e5a0032b08402bf69ef9f603bb
SHA512 8803344596f900f06f5766e7867203e4824c03003cdc95bac5f91d5e0d047c31fb271861db8b00f2c0130fd4023b4fb3bab5ce14a57808e3545c7d6092af180a
MD5 SHA1 SHA512

unomnisciently.mer

SHA256 c8a5b9edf558659c60d08a04e222989f5d3272cf2b637da9ceaaff8777e7ce28
MD5 90d4e41561c0a80f4df7c29ccb5f0460
SHA1 b219fc5678fe23183cc378d687b3e239675770a6
SHA512 282246180b49ab94b5f96c3df6567f742ab1f61d51e0bc16423bbf69b6f9c65ebab7e18cea3f5ef35c1808ff5048e2771e8079410d9e26b3434a80ad066b9b93
MD5 SHA1 SHA512

Sharing

General

Malware Config

Signatures

File Explorer

DHL Package.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/BgImage.dll

kernel32

user32

gdi32

winmm

generic

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

Beskeders/Neverne/harddiskenes.unc

Beskeders/Neverne/kaardernes.bun

Beskeders/Neverne/multiphasic.pol

Beskeders/airtightness.led

Beskeders/diphyllous.txt

Beskeders/gitterpunkter.mas

Beskeders/grassmen.maa

Cfh.cil

Hovedpersonernes.Til

Samlsninger.Und

Symphonization/Forbindingers187.ind

Symphonization/Misrepresenter202.std

ochrejelly.per

serpenticide.per

sultet.and

tory.dis

udkobles.bog

unomnisciently.mer