Ziraat Bankasi Swift Mesaji[.]exe

resource
unpack001/$PLUGINSDIR/System.dll

Ziraat Bankasi Swift Mesaji.exe

IMPHASH 6e7f9a29f2c85394521a08b9f31f6275
SHA256 c7a6d57fc3d397c2b303477d8e1d4fea64fec51f46b0ddfad97a11527771702c
MD5 57dbc2be60ede5140738c720a629781c
SHA1 b348e314c3f9be312725b23a0fecf491404caf66
SHA512 8932c191f72eb089d346848164c36104e6114e39cdeed19d1e67a7546ce68f01d8fdadec2c6f9ce5a80915e5781631fd37018f9e57c3a1d54d677f2e9c6ae006
SSDEEP 24576:N3mYVFbTdL3LgGStF2C/GVOoD5jQZj7/MJhmO:N3mYV9x3SH2C/EOEm7lO
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

5f:48:33:19:17:bd:ba:7f:ec:95:6a:8f:cb:f5:0e:67:7f:da:f3:9e:65:c1:26:b4:9a:af:a0:62:6f:f0:e5:af

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Desquamated,OU=still Sikkerhedslovgivningers\ ,O=Desquamated,L=Cleverton,ST=England,C=GB,1.2.840.113549.1.9.1=#0c1e4f7064726966747365766e657340556e69666f726d6174696f6e2e556473

Chains

Jul 1, 2024

Minor OS version

0

Major OS version

4

Entry point

13474

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCreateKeyExW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken SetFileSecurityW RegOpenKeyExW RegEnumValueW

shell32

SHGetSpecialFolderLocation SHFileOperationW SHBrowseForFolderW SHGetPathFromIDListW ShellExecuteExW SHGetFileInfoW

ole32

OleInitialize OleUninitialize CoCreateInstance IIDFromString CoTaskMemFree

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

GetClientRect EndPaint DrawTextW IsWindowEnabled DispatchMessageW wsprintfA CharNextA CharPrevW MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW GetSystemMetrics FillRect AppendMenuW TrackPopupMenu OpenClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetWindowLongW GetSysColor SetWindowPos PeekMessageW SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint EmptyClipboard CreatePopupMenu

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateFontIndirectW CreateBrushIndirect DeleteObject SetTextColor SelectObject

kernel32

GetExitCodeProcess WaitForSingleObject GetModuleHandleA GetProcAddress GetSystemDirectoryW lstrcatW Sleep lstrcpyA WriteFile GetTempFileNameW CreateFileW lstrcmpiA RemoveDirectoryW CreateProcessW CreateDirectoryW GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersion GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW ExitProcess CopyFileW GetCurrentProcess GetModuleFileNameW GetFileSize GetTickCount MulDiv SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW MoveFileExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 acf90ab6f4edc687e94aaf604d05e16e6cfb5e35873783b50c66f307a35c6506
MD5 6e55a6e7c3fdbd244042eb15cb1ec739
SHA1 070ea80e2192abc42f358d47b276990b5fa285a9
SHA512 2d504b74da38edc967e3859733a2a9cacd885db82f0ca69bfb66872e882707314c54238344d45945dc98bae85772aceef71a741787922d640627d3c8ae8f1c35
SSDEEP 192:MenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XBaIwL:M8+Qlt70Fj/lQRY/9VjjgL
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10719

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Meningsforskellens/Soullessness16.sek

SHA256 fa74d4423e214d87986645c81ba38e7afa7a498b9684335c122c08a8ecffe451
MD5 243c31660775a2e7584a46ec73864dd3
SHA1 bcf00da974d34335c1b21a6b089c792e160f06db
SHA512 6def3324a27a18b5fda1aff8b7ed80667fb893720b286d962ba00f5de61092bce8ef2ffa66f25f4fe156a57a8f8595b1f81cefab65e69a3d649cdce7b44d20b1
SSDEEP 768:iXdSmnxKfLHMWYroAGg8t3wqvzRPkV5XC3WcLpSzfkW5shsgR4zqgDXQCyYYZT52:HFXQlr5
MD5 SHA1 SHA512 SSDEEP

Meningsforskellens/flunkies.spi

SHA256 c8b1edc97f3fad4396a1f4a29319d432cb0a6a5f8971ad0d6534aa4a5873616b
MD5 5842c30c39947564b58346e6db63cd80
SHA1 638a42bd822d558ca5ff78611482d83ff2d1c432
SHA512 647e8baf90a7ac29ae931a0244f772feeb0a7cc51b308bbe65d5bdde2e0b7367cf1a8296d87ecfdddffc75b9d3baae642f012cbd9a0242e0c99ca17efc500e62
SSDEEP 768:5P7w2MkL8H8furwce7XSEuBF1ZULOgtFENMXyHevMN+gZo1kk+4DcOJlNDglmC2V:p6
MD5 SHA1 SHA512 SSDEEP

Nicaean/Gangbrdderne86.doc

SHA256 6178d1b0de66ef523b5ce188bb92eb9651ff99383a0ed1e1b9b2cd69f651c45e
MD5 f2060b3940c55ff4023d4340598f4aa9
SHA1 a7ee53054c21ab1b6082db2732e1973a98ac5149
SHA512 9b212142cde23a426b51d151547a73b9a5ba04081c354d8f0c5b8cbce9ec359db53aa2a4677a59532b83d06baa65127391b82816ef02a70b8a1f8e4f2aa84462
SSDEEP 384:m6srPhzGmc17ehfBtdbowZFBhBLnHIaQjcNWmBsuJYMxsZlRfaWC6uLg1x0S68Jz:OPhOWhtZIXEvJYjRfa+
MD5 SHA1 SHA512 SSDEEP

Nicaean/Malingering.har

SHA256 d15e9add017a5ac8d2ca9ee4b5580327e698d62cacdbb5d43379529d5f5f6621
MD5 ef0b415570e1345519d0d43499660651
SHA1 af3f24093aef691235b6457f9c84852b834be69c
SHA512 42edcc5b1080fb052b3688fc62a9c9cb7327590713fb76c62c20ea541e101f9ee6253c852d1fedea0241d4ac2bceb47b968b03a37ccc9ab0244b115e846b489d
SSDEEP 384:QTSVYpybyMBELnd0SlFvvHiOW7tt/DKk+iMk:rYpYQxvvMtY1
MD5 SHA1 SHA512 SSDEEP

Unabstemiously.Cep

SHA256 aad2c88175ed36505fd9bfc56c70882e97cee6143558e3b3ca4737e8730c6061
MD5 c2b2fa7fcf71956902d57dd3dd44d189
SHA1 faff70c3daae8e92245cdf87ed340591b5c914df
SHA512 4334174ccb343450f0f098878da76e5a8ed16ac8b963b55214418be1e488a2f7994a0b46b5ce844939d58b7926349b94888ebd9e6ed4cf3a95102b3fcd1f625e
SSDEEP 6144:OgsreB91ECdv9vdzam+HIC4x9gGrNm129uxp5tnQuNTt6S:qrejbvEm+R4xthWp5tQ6TtP
MD5 SHA1 SHA512 SSDEEP

polygonies.afs

SHA256 8775b604ae8ecca973abc369eb9a86cffa93a36bbe0110665922b9fd21e224b0
MD5 68abb7c33e33e67bc33b6e6648fbf8b8
SHA1 b21357c376076ab99ea06354637e64d2595aa1be
SHA512 6fc91e0b7cf721f3a54251048b89310fc3ba5fe2abee215adc6549b7707893576bd75f6164b3682c26074becd783b9926f372d7709abda5cc65aa902be605f90
SSDEEP 768:Jp0xeMYR4x8UHUXxOc+sd0cSXgiOKXSK9/NrHSc73XD0vC4HMYZAz3Im5GPiknLl:/ie6
MD5 SHA1 SHA512 SSDEEP

sanktionere.txt

SHA256 e8ee55695ddff6614c052d4e4173ea38ed3aced3076aee177e943eb03b5d002b
MD5 538cb1013e83a19163858b8ed8e63252
SHA1 11ceaeecc9d72ff089d4aaeed483b3e1c0fc6cd9
SHA512 c41350956472af8916596c07952f91fa9a9f70ed5de651c1e5208e6da4f74626602ade6be917313330cb1bf90f3c386930d0bebd418e83e52e3bc982f39f2777
MD5 SHA1 SHA512