70d11fed787746ce829546de720d9dd9814f9f1978312123c6923c3ea9e846a7[.]exe

resource
70d11fed787746ce829546de720d9dd9814f9f1978312123c6923c3ea9e846a7.exe
unpack001/$PLUGINSDIR/System.dll

70d11fed787746ce829546de720d9dd9814f9f1978312123c6923c3ea9e846a7.exe

IMPHASH f4639a0b3116c2cfc71144b88a929cfd
SHA256 70d11fed787746ce829546de720d9dd9814f9f1978312123c6923c3ea9e846a7
MD5 0576453b8d1d6effc52190d850a2533e
SHA1 382d78d066815cd3be34434e367b489418d96a65
SHA512 4caeb446142e9f42d46a437ec90525b4033856762d0371984f75ea2073d2e2183aadbb3d34bfc872bf12e42846cfc9f0512dc6a3761490d85ba6af5b9ddb2a93
SSDEEP 12288:eGLutCCjJrz9C2r4jhkPJEaFpoc84YZLbDSj:eGLAC8z95mhYJECoc1YZLbD8
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

13583

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegOpenKeyExW RegCreateKeyExW

shell32

SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW ShellExecuteExW

ole32

CoCreateInstance OleUninitialize OleInitialize IIDFromString CoTaskMemFree

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create

user32

MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW CreatePopupMenu AppendMenuW TrackPopupMenu OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW IsWindowEnabled SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CharPrevW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint CharNextA wsprintfA DispatchMessageW CreateWindowExW PeekMessageW GetSystemMetrics

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor

kernel32

lstrcmpiA CreateFileW GetTempFileNameW RemoveDirectoryW CreateProcessW CreateDirectoryW GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW WriteFile CopyFileW ExitProcess GetCurrentProcess GetModuleFileNameW GetFileSize GetTickCount Sleep SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW MulDiv lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject SetEnvironmentVariableW

$PLUGINSDIR/System.dll

IMPHASH 509a34b3a68a773e0afb4259e68f9f82
SHA256 9111099efe9d5c9b391dc132b2faf0a3851a760d4106d5368e30ac744eb42706
MD5 4add245d4ba34b04f213409bfe504c07
SHA1 ef756d6581d70e87d58cc4982e3f4d18e0ea5b09
SHA512 1bd260cabe5ea3cefbbc675162f30092ab157893510f45a1b571489e03ebb2903c55f64f89812754d3fe03c8f10012b8078d1261a7e73ac1f87c82f714bce03d
SSDEEP 192:VjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZv0QPi:B/Qlt7wiij/lMRv/9V4bvr
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kursusindholdene/Almagtsflelse.Non

SHA256 3ca981ab41ebe30633862b943a42695f5c0344846a7f2abfd5e347011ec8c526
MD5 f4a4ea312b8e54e8abbf04d385030626
SHA1 af6b3ccb12755b44b78091e5f30b80e12dd96fba
SHA512 86ad6cb11c5385c571281e3985fa7f09f4937633bbbce6e5c9212e0650daa2b36370c58a845a7dffe83684c79e375c4860545abfffdc6ad59bba21474cbc8d30
SSDEEP 6144:WggzHhuFo+A41v1QVVYEDDOaI1UAyT8lOcSDy3v2iDayPb+muwIubgUfd9VA:/B/1Q/3Ot1UAtlZSDsvPj+muFukU196
MD5 SHA1 SHA512 SSDEEP

kursusindholdene/Autodynes.taa

SHA256 58a189d482b4ff5182e2a5ff35c2a845cfaf66052b265c11ffe2e863664d9afb
MD5 f36f539856470335e0bedfc4f883925d
SHA1 4c84c86ce35380fa2d566246ea357cef3ab03b1a
SHA512 4145d0d8c87b22da4107324160f34ab558c03879dba883503325f7d64b9d9b9da4557da577582c7ad10c33dcae3cdc28ed04788ec875bea5e6c9247d55f47c31
SSDEEP 192:6MqZzplar+4Hxk5NGlaBOujQtuBZvsm9IQu:L7k5xOoQtunvsN
MD5 SHA1 SHA512 SSDEEP

kursusindholdene/Ifecks.tra

SHA256 3ba0377cecbc95f7751fdcd577b31a773f9b9457d8307f46707cd775d9db8be3
MD5 63c04ea66711af075bd96f3b9f20547d
SHA1 f4cd3ae5ca3c5bccc1c71ee1f434e3f8a507a5c7
SHA512 5e5c3b1cab2dea76f802fddeda911fc42c74413e3db6668f4bbcae17bb67d64de5e95395dd8fd65cc2176f2f72aa23862b30f1f258ad6ab440605fe8a485bcea
SSDEEP 96:AuH43pg3AayV1gYWhhtlaDch0QmW6LjNWkyd4CE4Bg:13AaybglhtYpVLjNYdpg
MD5 SHA1 SHA512 SSDEEP

kursusindholdene/Tetraonine159.bil

SHA256 fa5d7c810131e65586f9310d11554080fc810fe0d08af352d38de104ec0e5a3d
MD5 b7a18fdb58685d5742ad3f4ea3a8aff4
SHA1 cb476ea44dca42b59427a5ed4e91baabe541daff
SHA512 43caee7189aa75eb437e20e72017af6ac5fb7e35202b85d7296ca4d72de2348a575c8fd47fe2bc686ab6022012cbe363821d28ab2673c7de033346090676009e
SSDEEP 192:Aru9NCzCxKn/NTZFrdBAd9/xBF4ajY8nlm1gqXW:Ar6NCeQ/NVFrk08lCnW
MD5 SHA1 SHA512 SSDEEP

kursusindholdene/Uniola/eftersynkronisering.fat

SHA256 917c71f8ddc82e4195259d44eb69b5b5212d449af4ac32845f9ade8119386844
MD5 ec397b8acf200bce13e9184d6c69b8a9
SHA1 e861b53b8d132042f4f26d39a44afa52c0b5c9ef
SHA512 69b1d1ca1a54195462783e2b1ef7d9e2e8bbfe7efd29507114c32dc8055461a3aec55fea205a9a0839306d989dde29ac5dfa395e96fa6c066a5704d87d8574b9
SSDEEP 192:YPdwUyYSrEywHN/wNpMFK3HcZjd0xlUzLFvE3HW0g:YPdwU0wJrc8Zjd0YzLFvEmT
MD5 SHA1 SHA512 SSDEEP

kursusindholdene/Uniola/hvset.spa

SHA256 bac73a4747c7d7c324bd128903b3685bcf29ab1468746812c95ce5245d908058
MD5 69cd5d4db77bd1bde4f896dad4bbf826
SHA1 3bf6062cccdb085deecfc3de80b4970b056f3687
SHA512 5f0e4d6a9011b65c827e67f34e239ccc9575dc5f47d59855ab5121f606b87e4999ec36edd82c4d0ca6081769589f97051e80becb9c32216fe572d53da75fa2f1
SSDEEP 192:al4Bz2znZdkj7NdkVyvvHL9Yqoleymg5kNkVMyGEA:alAz2zu7N28vreq8tkNk2Z
MD5 SHA1 SHA512 SSDEEP

kursusindholdene/Uniola/menage.sus

SHA256 b3871c9d56580b64644e0a465353cd88dfa4ab269c35bd97284f2da8eda822db
MD5 014727a4b1ef65bd80b894d40c0920c9
SHA1 3094421eb35a7f0d8c37f9fb8f16cf1d7a7e756b
SHA512 e2efae00b4b9536c7bbc1a3a38fee4b0e5fc30aea3176533c395f01356e7050d21765c2291575fd93fb2237f1d7ed5454a312a5abc33fc4245a41a529af59eb6
SSDEEP 192:mfXiS0Y4ZA7G48e7SNrVQpiqGrM4CtXelv:mfXi/hO7d8eEVQ23CtXeN
MD5 SHA1 SHA512 SSDEEP

kursusindholdene/Uniola/pyromaniac.sel

SHA256 29f6c2ca5627f32bd0bf9174457e9d34243fb7b636d895d7cf0d38474dd534a1
MD5 91b0191bdc829311bc48f606d8e9d03b
SHA1 6fca9f4211bca4024c3d2de54c5e6dc803e81248
SHA512 fadba3a41ea91e0831be03679c29419f96d6ebe476aacccded93a7305520194b1fc1b80c0211de9926fec8414baa7764a53019aa4b712828a4c350785af0560c
SSDEEP 96:974M+uQTmpaXcByEZB1aCEy6QvoyQRtyLBsGMMdtmvL/Tm9Ka5RCRL+fSk5YWUKu:974gUaxa2ZJMw+m9KaXaL+a6YKHO
MD5 SHA1 SHA512 SSDEEP

kursusindholdene/Uniola/stachyose.kal

SHA256 89a6a02e7dc52f1bfd42613be11abd30744a9b088983f55c3fc7f575658bd200
MD5 8841703f63c046854ebfdad8a870080a
SHA1 6f4239ca5586ff0d14573079ca8c8902e026f3ce
SHA512 4247ab70560bc960033666a962302560027848c310dd27e7cc6f637796d130eb37f0f0c60c09f6dba7f92b60e2a40107391edd92a71e56906747c908bb8c67bb
MD5 SHA1 SHA512

kursusindholdene/Uniola/sweden.unt

SHA256 6fca8403a901305bfedec15ccec1d9d498086fa2a9595891e6ee0499a49029f2
MD5 258d9c488929dc86190568b3b3a3f853
SHA1 64fdfd51f6e2b6e67472e560e243facbd15a2c4a
SHA512 50d1fbea860b0e2b61826d17461e1ae562a1720daa68b9e783c9e564168c9f739e59897033c09ca4e5d7b21e8d335b88de46e345ee24b0f4c31bb5679b93b804
MD5 SHA1 SHA512

kursusindholdene/analyseret.str

SHA256 1a77e8826b92f6e3e836230082821fab2d683fca1a4a98b16c9ccf5297c25b6f
MD5 bb627173f674132f07e6967d5177203b
SHA1 c71118afcb46b1ae3c7cacc1e66550a8d7d5f759
SHA512 34570f5ff833b1b9ae1039ca0ad5b8942dd5ae155003dbaf1219167c5d76d9f70245b5d36adec10040a9b24f52d95e40439db92f01f9bb3517090f930d120b3b
SSDEEP 192:ss5Pr7EKQYysgkCLgql8DzVN981tV2dpK8:s8jlyLCDxN9813J8
MD5 SHA1 SHA512 SSDEEP

kursusindholdene/brugerprogrammer.txt

SHA256 98c6f4d57f72bc54b1ba57be3b3cf014debfb689ee1465575953bd3114aa0b67
MD5 07a04a065fa18e11204da2b0036d49d3
SHA1 eaccfe4b655b910469ffc972d25f38365e8cb3cc
SHA512 e6d9ba892fa67b8a2b6c05cb090860d6613911fadbe01231fa774a4f1217efe7b7504a4a49f2ffe0a183bd3521a9f6eba87077e7c175aba5ca73fa938bfd95ea
MD5 SHA1 SHA512

70d11fed787746ce829546de720d9dd9814f9f1978312123c6923c3ea9e846a7.exe

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

kursusindholdene/Almagtsflelse.Non

kursusindholdene/Autodynes.taa

kursusindholdene/Ifecks.tra

kursusindholdene/Tetraonine159.bil

kursusindholdene/Uniola/eftersynkronisering.fat

kursusindholdene/Uniola/hvset.spa

kursusindholdene/Uniola/menage.sus

kursusindholdene/Uniola/pyromaniac.sel

kursusindholdene/Uniola/stachyose.kal

kursusindholdene/Uniola/sweden.unt

kursusindholdene/analyseret.str

kursusindholdene/brugerprogrammer.txt

Sharing

General

Malware Config

Signatures

File Explorer

70d11fed787746ce829546de720d9dd9814f9f1978312123c6923c3ea9e846a7.exe

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

kursusindholdene/Almagtsflelse.Non

kursusindholdene/Autodynes.taa

kursusindholdene/Ifecks.tra

kursusindholdene/Tetraonine159.bil

kursusindholdene/Uniola/eftersynkronisering.fat

kursusindholdene/Uniola/hvset.spa

kursusindholdene/Uniola/menage.sus

kursusindholdene/Uniola/pyromaniac.sel

kursusindholdene/Uniola/stachyose.kal

kursusindholdene/Uniola/sweden.unt

kursusindholdene/analyseret.str

kursusindholdene/brugerprogrammer.txt