E-dekont[.]exe | Triage™

resource
unpack001/$PLUGINSDIR/System.dll

E-dekont.exe

IMPHASH 56a78d55f3f7af51443e58e0ce2fb5f6
SHA256 314e3abec0012d3f585ac340586017c4ef2dd4f860ecb75d07c0e5649775a814
MD5 598012c3a6e72731d52ed98e0d7aa4cf
SHA1 1f6bc82eb8f3013f46f17990fa48e4995efe8049
SHA512 1d9e77bb8e2e24c71166b5df51aa26baee235cc6387e803303379ca660829cc538757e6fd7f8d9650d13242431d7bbbfbaa1ae615e54ce4ea826893b065150b6
SSDEEP 6144:qi9+8TGGtwWIW8C5khpM1uhdYOZCtuQCDCu+gxjGm2QpMJU+18kNtjy82fxJh:qiR6qChjdAlWCuHxjB2Qp+Zw8oP
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

96:44:e8:80:6d:41:a2:9b:9a:ec:e1:2b:77:2c:06:a3:77:34:03:c0:cd:3a:23:a1:12:84:a3:43:5b:35:a7:d7

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=encell,OU=Decentraliserede Aandsarbejdet Kendingsmrkets\ ,O=encell,L=Bowdoinham,ST=Maine,C=US,1.2.840.113549.1.9.1=#0c19536e6564726976656e7340556e67736b7565723134322e5562

Chains

Jun 10, 2024

Minor OS version

0

Major OS version

4

Entry point

13559

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCreateKeyExW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken SetFileSecurityW RegOpenKeyExW RegEnumValueW

shell32

SHGetSpecialFolderLocation SHFileOperationW SHBrowseForFolderW SHGetPathFromIDListW ShellExecuteExW SHGetFileInfoW

ole32

OleInitialize OleUninitialize CoCreateInstance IIDFromString CoTaskMemFree

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

GetClientRect EndPaint DrawTextW IsWindowEnabled DispatchMessageW wsprintfA CharNextA CharPrevW MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW GetSystemMetrics FillRect AppendMenuW TrackPopupMenu OpenClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW PeekMessageW SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint EmptyClipboard CreatePopupMenu

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateFontIndirectW CreateBrushIndirect DeleteObject SetTextColor SelectObject

kernel32

GetExitCodeProcess WaitForSingleObject GetModuleHandleA GetProcAddress GetSystemDirectoryW lstrcatW Sleep lstrcpyA WriteFile GetTempFileNameW CreateFileW lstrcmpiA RemoveDirectoryW CreateProcessW CreateDirectoryW GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW CopyFileW ExitProcess GetCurrentProcess GetModuleFileNameW GetFileSize GetTickCount MulDiv SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW MoveFileExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW

$PLUGINSDIR/System.dll

IMPHASH 4f33ea844b96a31c8f4690530ba63854
SHA256 a4ec98011ef99e595912718c1a1bf1aa67bfc2192575729d42f559d01f67b95c
MD5 d968cb2b98b83c03a9f02dd9b8df97dc
SHA1 d784c9b7a92dce58a5038beb62a48ff509e166a0
SHA512 2ee41dc68f329a1519a8073ece7d746c9f3bf45d8ef3b915deb376af37e26074134af5f83c8af0fe0ab227f0d1acca9f37e5ca7ae37c46c3bcc0331fe5e2b97e
SSDEEP 192:CVA1YOTDExj7EFrYCT4E8y3hoSdtTgwF43E7QbGPXI9uIc6w79Mw:CrR7SrtTv53tdtTgwF4SQbGPX36wJMw
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

6730

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Birdhouses.diu

SHA256 aa02ae43d507764a6a68559b71b2ad6795a675c574eedb220b09b697f9698a5d
MD5 702958970ce0ca09ab6235714f33a157
SHA1 7abd9d9d45e13c43e6cccf25aad97b9c15e89e18
SHA512 aac1c35972073fb5a427a1b76e74cb06b272055076f6f3848d14d639af191a291fbef4b500e65be4d35d8afbc28e6baa906b13b41d646af1c5596756889f4fba
SSDEEP 96:/WsgnX/INxqWJ6rJfFFeSpYnHv6VArCMoAxsuZVS1:/6/ISWJOJfTWvOMo8suK
MD5 SHA1 SHA512 SSDEEP

Dirigomotor.sei

SHA256 557bafe4267d402105e9f3405bad7053f4648b2583abc69fb8e2ae9b784630b9
MD5 1854f92f3a17f58e45a4f1798d716125
SHA1 40eb2d93d7137a989ed73531580601cdf1c4cd17
SHA512 16010062ee7c65c85790f2a19098abc3b470448e01812bf4f4645a3a7aebeb0e61d6c116b6e00afa459c00e969b80d71f3ac5d084929684fd13db6ac8d3a8d95
SSDEEP 6144:G9Sp/be7BUdb6DxoGr7i7Y5WfO9IcpnH97oSf7apoXA7j9d6iA1bO:G9IbjsWa37DYoXAn9d631i
MD5 SHA1 SHA512 SSDEEP

Faresignalernes/Costotransversal.reg

SHA256 95594c175b5fb5b36a684e2aba62e8e9e81db932e996176bb8481d1d8570dd49
MD5 cccfe426fea95715fd67776a1887242c
SHA1 0cf9880dd4f40e430b16b76a4be620c5a13c0eee
SHA512 6d69a0461985060b233551cf5ff31c81df5fe080d50cc3caba058edfc956ae32622144cbc08af39e2eb74b18c73777f817df543ca73f7209b963693e025cc9db
MD5 SHA1 SHA512

Faresignalernes/Envelope.non

SHA256 af919b4b5abe18a0556bd7fc36c787ad264dc1aa954ba3fba6c580d2d97d4806
MD5 21ee7d2e67a7f7dca05b00b84e1ec4b0
SHA1 1701f771705db7cafb3907c7c535f816109330fe
SHA512 1b1b6127a4f85856b29c49ddb8c54fa696d1f0bfd697516a6ded54027a1a8fdc2d7feb9a0bcc83c91b3b02f842ad0a8db34f58cb566a28b98a8cde683b5ac3fe
SSDEEP 96:oOrzWf59Ju+dqEgV1t/hPi8/Xw+Q6JO50psh27U1u/VbIC:oOa59bqE6pq8/3JeSY24KBIC
MD5 SHA1 SHA512 SSDEEP

Faresignalernes/Foreningsfriheden/coelomata.heg

SHA256 67ad3118b2ec02504237964adcfac6dc86201c83e876023aec0d8b8697c09440
MD5 ce8621b6363ac12fc331259b14eed1d0
SHA1 ad335b3e3f63dc341bb5c2bf03aa447772dc55f5
SHA512 88774f419c5b4cfaabd238adbb2125d88aa99cef9b9dfba9e3d4055ffba5d592920f6ba4874857483dedecd1df1fcdf62113628768b0c1de2dd80d323d168faf
MD5 SHA1 SHA512

Faresignalernes/Foreningsfriheden/dewani.paa

SHA256 c3e4af57708a49f765b351aa2ed0af5054fdb9037947b199086b1d7c9e33fa0e
MD5 e3c46d220146f94ab546780fc0c89824
SHA1 4e166e3ead6342bf08eb14846628a63e8c185db0
SHA512 945dcfd7126ae3c8b64deb71d7b7d16ec3a06420a825857ebad8f18b5a8fd6419d49a515a0b14d4d6b4ffcaefc093b6d9479b1cc425cf8195737c75e3b1e5e1a
MD5 SHA1 SHA512

Faresignalernes/Foreningsfriheden/disturbative.txt

SHA256 2bca05c6b3a7df81866211bdba33a28e3d1631b85a6f399b3aedb349d8b99f56
MD5 a59800cf3d3106e181a466f3d0b8489e
SHA1 d5917e10807d52d4844967f7289a6068a64c59a2
SHA512 34ce09ea6546dc75e57d2019659b5d37a9690220181c2b57c546b1c77c60037afba79771289e83e3888cb8411665c355dd7f132cc7881ac26cfb40de76734757
MD5 SHA1 SHA512

Faresignalernes/Foreningsfriheden/fejlmeldingen.que

SHA256 2d4c51eb43f7095fa509b0df45cda88df8db0192202e398481b64fd373b89de5
MD5 f1bdb65a73bff24b3ab6f4f9b8bd045e
SHA1 96fda846e722e9483d595cca722de5286b3f2bae
SHA512 7005476580d38453df87393d8878d83cedd6b6e81384c64e9d842f1184c973419025aea6d1ded1058242ce517b0a9fd4c2dab79308296c7decce39553fd4cb05
MD5 SHA1 SHA512

Faresignalernes/Foreningsfriheden/harbors.hea

SHA256 fd4b385bbf845cb69bcbc5249038e4a931b263afe19fad1b89d1f35e005c79b4
MD5 5832af13a97c9ad99994dd3cd543e990
SHA1 8942f9c86e71f53d5df5ac7f92b6889a94f86933
SHA512 bd449e26b10e221f5b20ed2176c48e8a536f3f589287fa15707659bb1c3e9915615e3653f3a0b707923e2b4ca6cbbdbfb0ea04b1ff387275d4f9742a518d3142
MD5 SHA1 SHA512

Faresignalernes/Foreningsfriheden/indspilledes.til

SHA256 ab359374cc832d0b5dd5d326be171d3e8887863c714b551cf067de310f42817b
MD5 030b555d6f9673fdef7d1115fde0641c
SHA1 b0a053dfd487adf9af5932247c7ad28f93ed0bce
SHA512 30f844bf508834f1d460bcbbc4035a6bfa1a160f6a0de16ca6eaee42118ab3d1b3cbcb5344dc77122fcf99236808d428f1830515449e6147691829b912abcb62
MD5 SHA1 SHA512

Faresignalernes/Foreningsfriheden/langrede.tot

SHA256 25b420d65a0b36f120e405cd2cf58a8e876db9bec50cc0ee052c462048ffc1be
MD5 2b1cfb2ed159a0c4cfa703f5f375476d
SHA1 fa6ddcef42d58f15c29dc49d1038600b0f72f45e
SHA512 d7e3fe33be5c119d4ad9a4ea06c1cd92680be0e001ad8a8fb4d58696349e365541f08cb6abe561c95fb1a01d6e3ef6cc915af67fe4b2ca66d84dfb7978d73f46
SSDEEP 96:XquG9/7UQDuPLq6uJJ7IzpU2sh7TZZCpTb7TA8GYJiqvBIuv:XrwaRujIzqthfzCpT3TjGYVJR
MD5 SHA1 SHA512 SSDEEP

Faresignalernes/Foreningsfriheden/loxodon.dec

SHA256 88a09f4b448f4553e1fa443b2944f085e3c24fbef6822e195f906aa760500b36
MD5 5585bb1c4bc72ba72f4e1cd42b1839d5
SHA1 f952adca1280d67d00464592fc912de489f98cf2
SHA512 eb5fcf7dc89e376be67a659d87ad74dfa1c3a102223f4d00869559b3d2fcc7353ab40c15fff80da49c5cff18f61d5e69d4033638538453c07c74f1b7752fc0b1
SSDEEP 96:9ftVy1pwQhGVeb7+38QDxrN/MQXZboKL3iBUY+DRXtTvLnuyGkPp:9fiNIU+MQVkyyBB+DFtTzn6kPp
MD5 SHA1 SHA512 SSDEEP

Faresignalernes/Foreningsfriheden/naturgivne.ant

SHA256 02fe4718691adcaafdee2e08783fb00159c8476b76692ede2db07b309d415f2a
MD5 02d1fb690d5378310ba0c325d5cff1d4
SHA1 f6b17889f44f2083fba916c4a596cf30c825330b
SHA512 a21868eef45aae2cd7c8e2377a6502e682be021b91c3c2d322501b548c27c83cce2e89d2f1d1861ad0b7ae7278ae10ae14a3af156ed63961a6222aa538605ddc
SSDEEP 48:XfnRBS4iLO+dPJAqS3zeROoh8NUZA/XUQWqnypWUpRKHWG+GoKIhOi7wYctDR8VP:XfTS4iaCP6odeFXnyPXGEVhR6PkIbD2
MD5 SHA1 SHA512 SSDEEP

Faresignalernes/Foreningsfriheden/overclement.hom

SHA256 58f4e6edcca0cbffe7c7459d57fbb3ff202dce72f0e8818d4f0d21600f098b89
MD5 e2f808fe15230b54175c56420805863f
SHA1 6b0a992123286772fbde647a8aa2327697d7f4a9
SHA512 26f6c16350a88bbb85ad39320df2611938ff7945b40117df36704c38a4e62f073101e3b117c6103e5462ad532a04a8467a7fefb3f20fbfb5bb93f7588e9f26c8
MD5 SHA1 SHA512

Faresignalernes/Foreningsfriheden/valgbrevet.rem

SHA256 5f6d0ebda655235cb8aa605f5e88fe4aa0a6f88dcd7533d5d70d65b7455c6ac4
MD5 c796a59dbb2c299be29a4854fce422cc
SHA1 2a7d08e268d23153a91db477aa32c6413eb737a5
SHA512 c32c3ee6b645f17f181bdd843a8208c62a4b4ab7d2f14117c69f5a7292122aedfe545c1b3a5fa4c52322b11875aa7ccff1e241ed39b5a7f64e620dd22f8149c5
MD5 SHA1 SHA512

Faresignalernes/Lichenic79.sta

SHA256 b77f107c6cb9dd36285847d19abcfe4ebaf4c4127ff676acfe77ba2ebef73503
MD5 652376906fadded91c8120d29d27d3b7
SHA1 7b7596afbeefa3492fa720608077c29e4314d782
SHA512 d733230e34c0178d7643edea3849105a6edeb4e96a644195d5d46ca74523e01c4355f1165b94088a2db4de1e057ad0c13588df24b963401bc94b80395977bdb7
SSDEEP 96:6yXxSVF/RdWV+B31h9UsX0zxM5vKVaSXaqDEvwXn:JxSvRdWV+51h9Ue0z+pK8SXaqDEvEn
MD5 SHA1 SHA512 SSDEEP

Faresignalernes/Skrkkeligeres.man

SHA256 eca63f67f0c856e223781dda0e08e633fc4a74efaa7a60b83154169f51a90182
MD5 91c5f443b410cd92561c14573415eac4
SHA1 8c92e6e4dad496389ec204be1ebf455f1881206c
SHA512 64f85136a8bf06de578bec551427bb90042ccf104de594ec3f5a0899ee952fdf5bbc7b3b4bc8b64d44bb7476419c734fe49f41cb48ec98306e87c95f30ff7963
SSDEEP 96:6oAOrxGOe5xKCQTlEgWOg09Ld8avZLW017y9sV/BYFmd9T2569gw:fAUx9ejK5TlEXOLddZC017y6JY+QE9F
MD5 SHA1 SHA512 SSDEEP

E-dekont.exe

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Birdhouses.diu

Dirigomotor.sei

Faresignalernes/Costotransversal.reg

Faresignalernes/Envelope.non

Faresignalernes/Foreningsfriheden/coelomata.heg

Faresignalernes/Foreningsfriheden/dewani.paa

Faresignalernes/Foreningsfriheden/disturbative.txt

Faresignalernes/Foreningsfriheden/fejlmeldingen.que

Faresignalernes/Foreningsfriheden/harbors.hea

Faresignalernes/Foreningsfriheden/indspilledes.til

Faresignalernes/Foreningsfriheden/langrede.tot

Faresignalernes/Foreningsfriheden/loxodon.dec

Faresignalernes/Foreningsfriheden/naturgivne.ant

Faresignalernes/Foreningsfriheden/overclement.hom

Faresignalernes/Foreningsfriheden/valgbrevet.rem

Faresignalernes/Lichenic79.sta

Faresignalernes/Skrkkeligeres.man

Sharing

General

Malware Config

Signatures

File Explorer

E-dekont.exe

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Birdhouses.diu

Dirigomotor.sei

Faresignalernes/Costotransversal.reg

Faresignalernes/Envelope.non

Faresignalernes/Foreningsfriheden/coelomata.heg

Faresignalernes/Foreningsfriheden/dewani.paa

Faresignalernes/Foreningsfriheden/disturbative.txt

Faresignalernes/Foreningsfriheden/fejlmeldingen.que

Faresignalernes/Foreningsfriheden/harbors.hea

Faresignalernes/Foreningsfriheden/indspilledes.til

Faresignalernes/Foreningsfriheden/langrede.tot

Faresignalernes/Foreningsfriheden/loxodon.dec

Faresignalernes/Foreningsfriheden/naturgivne.ant

Faresignalernes/Foreningsfriheden/overclement.hom

Faresignalernes/Foreningsfriheden/valgbrevet.rem

Faresignalernes/Lichenic79.sta

Faresignalernes/Skrkkeligeres.man