76e3a05dfd8ecb4804d88e490a63656a0e3dd006dbbb0be38dc2deb35c469f5e[.]exe

resource
76e3a05dfd8ecb4804d88e490a63656a0e3dd006dbbb0be38dc2deb35c469f5e.exe
unpack001/$PLUGINSDIR/System.dll

76e3a05dfd8ecb4804d88e490a63656a0e3dd006dbbb0be38dc2deb35c469f5e.exe

IMPHASH e2a592076b17ef8bfb48b7e03965a3fc
SHA256 76e3a05dfd8ecb4804d88e490a63656a0e3dd006dbbb0be38dc2deb35c469f5e
MD5 35d37f25aadfd7c40c7b42da4af78c79
SHA1 1e0af36e1cf84b1937777fc03b8b539c7e25453d
SHA512 04f21b5de31bbb024c29ddeda7c321d07a461b6e8606ffceea2448561979430117a8aab9bce9e1c839eedf1e0e88adcd76b77393772936033595876ea8564c4f
SSDEEP 12288:gqWnL+DM0z3qFXBgSNLyn9fSAthnDSl/amiiPC:6nLR0z6I9fSAthnDSct
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

12906

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetCurrentDirectoryW GetFileAttributesW GetFullPathNameW Sleep GetTickCount GetFileSize GetModuleFileNameW MoveFileW SetFileAttributesW GetCurrentProcess ExitProcess SetEnvironmentVariableW GetWindowsDirectoryW GetTempPathW GetCommandLineW GetVersion SetErrorMode lstrlenW WaitForSingleObject CopyFileW CompareFileTime GlobalLock CreateThread GetLastError CreateDirectoryW CreateProcessW RemoveDirectoryW lstrcmpiA CreateFileW GetTempFileNameW WriteFile lstrcpyA lstrcpyW MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GlobalFree GlobalAlloc GetShortPathNameW SearchPathW lstrcmpiW SetFileTime CloseHandle ExpandEnvironmentStringsW lstrcmpW GlobalUnlock lstrcpynW GetDiskFreeSpaceW GetExitCodeProcess FindFirstFileW FindNextFileW DeleteFileW SetFilePointer ReadFile FindClose MulDiv MultiByteToWideChar lstrlenA WideCharToMultiByte GetPrivateProfileStringW WritePrivateProfileStringW FreeLibrary LoadLibraryExW GetModuleHandleW

user32

GetSystemMenu SetClassLongW IsWindowEnabled EnableMenuItem SetWindowPos GetSysColor GetWindowLongW SetCursor LoadCursorW CheckDlgButton GetMessagePos LoadBitmapW CallWindowProcW IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard wsprintfW ScreenToClient GetWindowRect GetSystemMetrics SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharPrevW CharNextA wsprintfA DispatchMessageW PeekMessageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow LoadImageW SetTimer SetWindowTextW PostQuitMessage ShowWindow GetDlgItem IsWindow SetWindowLongW FindWindowExW TrackPopupMenu AppendMenuW CreatePopupMenu DrawTextW EndPaint CreateDialogParamW SendMessageTimeoutW SetForegroundWindow

gdi32

SelectObject SetBkMode CreateFontIndirectW SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW ShellExecuteW SHFileOperationW

advapi32

RegDeleteKeyW SetFileSecurityW OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges RegOpenKeyExW RegEnumValueW RegDeleteValueW RegCloseKey RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumKeyW

comctl32

ImageList_AddMasked ord17 ImageList_Destroy ImageList_Create

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 9b93c61c9d63ef8ec80892cc0e4a0877966dca9b0c3eb85555cebd2ddf4d6eed
MD5 fc3772787eb239ef4d0399680dcc4343
SHA1 db2fa99ec967178cd8057a14a428a8439a961a73
SHA512 79e491ca4591a5da70116114b7fbb66ee15a0532386035e980c9dfe7afb59b1f9d9c758891e25bfb45c36b07afd3e171bac37a86c887387ef0e80b1eaf296c89
SSDEEP 192:eS24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35OloSl:S8QIl975eXqlWBrz7YLOlo
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10183

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Gryllus57.Tol

SHA256 da97dfc8a812d42a079f57ab6ed99c013849bee59f28700f1e8a55a98fa4919e
MD5 a3ad3786c3004916f9529bc03ea285c8
SHA1 12687488c35e487708d319b6b8f5b3c204ec0cbb
SHA512 c59a2f04e76bbf32dc12e66fed321a4900df348b47e94f943ace40ad89e91b035a5e1272796ad845e9f2735573648a4b839580062f8ef25a43cdf8046581f463
SSDEEP 1536:Xa12er7BeP2XUsbgZsA4oddOIFE6v27WUtc5Wt9PjVy/3:K9vBeP7sbQ94onBFZv27o5KPm
MD5 SHA1 SHA512 SSDEEP

Indoor58.des

SHA256 95c6332d0aa7343ddeea8e8954b18830406c8dea1007854b71e9ee248be3acd0
MD5 e6528bf070447ec7a4a1f1eceb21ec64
SHA1 4c1186240966b4e704f6e7fe9e2ecbd21c058ef0
SHA512 7d5486036f1e557acc65b184ba638dfbef944726bc5ea7325a2056217dcfe0685147739c3e7a1dc12e43a6b1ad5c12ebef6cebb2c315c91f6dd7a99471f85cdc
SSDEEP 768:3gGUTbjliygXaC4PQg5nue7sx1CZ6tkMBve6fpfWzXW0ixCBPT23b9L2TSPYRWnu:KCKwbpQGblx869jF15O
MD5 SHA1 SHA512 SSDEEP

Skafotter.cou

SHA256 8bfff0c5353284b405ea38a80bdb71b30981b276b0b78c4797a53854ee19c2cb
MD5 1df1a8aa1cc5bbc32802e0f8fa7729f3
SHA1 3a667711bddfbfa6ae7d78183e49954f4eb0f869
SHA512 f239c293905783a7613ed98ffffc09ab4a629abd3b88d87d46fced67c1a8902ba8e27c71cbc2bc69bd57c07f322a665fa0eeca4531097cd71690d48e6a5b6414
SSDEEP 768:yR2xxKXdVYS2ngxErAJiGNNLGeub4E9BBFAH/JL0d9LC4jWyJzGFuPkbZtElathM:i2G8JM0yMAgYasP5
MD5 SHA1 SHA512 SSDEEP

Unclutch.Dis

SHA256 61ae92c0d4b51ce63f81cfa80b3d959228aab5f6809bde6b6758fb5d5e10dad5
MD5 87c03079dd5a15d7551acd7143691601
SHA1 9e0350b6c7e166984f6a4e55287f0598f07563ef
SHA512 8e427d15a4047fecf61c3a5af5cadd055c291a36547822b82b7be869b3d128f80892cbd90d3c3b607694f775b37a459c8d2dcf2528c3b72e751f790579a9157d
SSDEEP 3072:Pf3kn0VrrWrV8VL6SMc5iBjvuezAQTMQxuPfX+LnNFu+copZIPBiv2J:XknSrwWL6uJeBMQxgoNFu2ZIE+J
MD5 SHA1 SHA512 SSDEEP

growed.txt

SHA256 db2651c1f4f8f257c7541a6968cc2402085e18012d934d2051081086ef87e4e2
MD5 c9af41c850c805c581c448026f1a36a5
SHA1 486c3805da87155614a6121cc0403fff4b2b775a
SHA512 e3bc8a3c77a16d5be771ec6c241063d49358b2eb4bdb6ef762928645d977299a5de6767279d72455a431ad69a8c9009f2a82cbadcbd91de7abdc5105d398a33f
MD5 SHA1 SHA512

skelsaarets.ove

SHA256 65d259e27610f4a01fb0dc8b12355d43be35483f27ece90a802afa29c3614ad9
MD5 eeb3a4f21b33af7260052a8436e03780
SHA1 26acdc4b6e1cc2d23723e65cb66b2ce90c97eefb
SHA512 d9fd3cd73b170f2d4fd2b94d98c85854c4b53f316d1556788beb48e56f256d86dcfef97a266e8556766dec4ffae6355107e56139447ff16e7514cf182795213d
SSDEEP 768:xhrQMNV932lB6CxdTvflY+yF0G5CBMlKYE9mOufOADgb0a+yR2vXbK++7Fbcb7wy:ckEjZvjRG3bA9N
MD5 SHA1 SHA512 SSDEEP

76e3a05dfd8ecb4804d88e490a63656a0e3dd006dbbb0be38dc2deb35c469f5e.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Gryllus57.Tol

Indoor58.des

Skafotter.cou

Unclutch.Dis

growed.txt

skelsaarets.ove

Sharing

General

Malware Config

Signatures

File Explorer

76e3a05dfd8ecb4804d88e490a63656a0e3dd006dbbb0be38dc2deb35c469f5e.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Gryllus57.Tol

Indoor58.des

Skafotter.cou

Unclutch.Dis

growed.txt

skelsaarets.ove