5543a995a7f45599c76eba74e6856200fad7a026f74b8c5643c78221e48d3f75[.]exe

resource
5543a995a7f45599c76eba74e6856200fad7a026f74b8c5643c78221e48d3f75.exe
unpack001/$PLUGINSDIR/System.dll

5543a995a7f45599c76eba74e6856200fad7a026f74b8c5643c78221e48d3f75.exe

IMPHASH 9dda1a1d1f8a1d13ae0297b47046b26e
SHA256 5543a995a7f45599c76eba74e6856200fad7a026f74b8c5643c78221e48d3f75
MD5 1d50f0c1ff48a16efb655a30addb121e
SHA1 4b5d1ec5c09e32269c725c2df56d21c6aae6e04c
SHA512 f0981a280969545ef1305ec2c631f3f3aacc235fb88339629f262606420dab5ca95cec0017d68fca1774e2bb4a5f60f788543095099d7336988be0f770b5e6a3
SSDEEP 6144:hHadpdwMakhnB4kzYTOVaGxn9nNJGtb57BSfFLJxRgtCFChBcFOKAcAcZtew2h5:hHadykhiOVDN9NJS7ML6UFC3RKFty
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

13925

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegOpenKeyExW RegCreateKeyExW

shell32

SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW ShellExecuteExW

ole32

CoCreateInstance OleUninitialize OleInitialize IIDFromString CoTaskMemFree

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create

user32

MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW CreatePopupMenu AppendMenuW TrackPopupMenu OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW IsWindowEnabled SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CharPrevW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint CharNextA wsprintfA DispatchMessageW CreateWindowExW PeekMessageW GetSystemMetrics

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor

kernel32

RemoveDirectoryW lstrcmpiA GetTempFileNameW CreateProcessW CreateDirectoryW GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW WriteFile ExitProcess GetCurrentProcess GetModuleFileNameW GetFileSize CreateFileW GetTickCount Sleep SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW MulDiv lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject CopyFileW

$PLUGINSDIR/System.dll

IMPHASH 509a34b3a68a773e0afb4259e68f9f82
SHA256 23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6
MD5 192639861e3dc2dc5c08bb8f8c7260d5
SHA1 58d30e460609e22fa0098bc27d928b689ef9af78
SHA512 6e573d8b2ef6ed719e271fd0b2fd9cd451f61fc9a9459330108d6d7a65a0f64016303318cad787aa1d5334ba670d8f1c7c13074e1be550b4a316963ecc465cdc
SSDEEP 192:ljHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZqE0QPi:R/Qlt7wiij/lMRv/9V4bfr
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Postclassic/user-status-pending-symbolic.svg

SHA256 d322c11ea2cd519f96e9e33df5d3c89c8b65c0a40bf98499a5297d7d9ac4da46
MD5 a3272efcfc5a4795e3a4e849aa9cd943
SHA1 696f7fa433cf53b99749c759ee62d1a290fedae1
SHA512 5e4c8669a86e2a16c7dc6bc91ced150160501d7e833b9b0145fa1cf20797b14d57e5d7634697e9382f783062ab5185fefc53260821c93785a36e7519699a21cf
MD5 SHA1 SHA512

Windsucker.Kar

SHA256 3d55448a74c804099c6d266c35d632a4ddb0046defda85b2f1728252caa5be67
MD5 34fedf38e193800b0a2ae8bc8bdde13e
SHA1 9d3765c1d8e05a88caabfe80975f60d2e19adf72
SHA512 93d9e81a099086b21986715cedd6dc9f8bfb026e7363f647e1a63b61d6a7c12c8cfcce5c4b76ed5bc0a44e1718e142dc8d721224c0b80c53d3538e42e3c0e172
SSDEEP 192:7yRzpe+rcweRw1P/P5eQxud1oq6O26fkozOtaoZRQQbCVs2L:ORzHxswd5eGQ1LbrzEQVrL
MD5 SHA1 SHA512 SSDEEP

Zebuers.Com111

SHA256 15e22168a3b8d8264eee405d8304a0b9029faf04fed21480cd18ae2a7077871b
MD5 48e36a4ae31607bd75f9a3e79de8aef2
SHA1 d1f71f866a7399be7a546852ac1f92d991fda292
SHA512 f5ef5c174c55b204ab62fe29c97d97cd56b2c16ae138499cf391a1df1773d5d775085ebab32f07bd9b83f6284bb2ae7a92828c9d36757d3734a553cd791f1636
SSDEEP 6144:bxS50fRKBJGtaB1+sz1hr7ueNPv0vKNsB3x2YMJXnWii:bxS55d1+sBhnf0/BB2HJX6
MD5 SHA1 SHA512 SSDEEP

emoji-people-symbolic.svg

SHA256 7a60f5ddaf07e6ec7471e783546c16dca674a47c2b752e24d87c88282101a8cc
MD5 56e61752282b143c0fed251d6040f0b8
SHA1 d19fada48db00b561b1910d39507f6bf926e9eed
SHA512 206d06deb603c5249715e69badfebf3f039c43add73563b7faf0177ce116d5bd17f33af7a4b86c4ebd3e94069ac0adde943ef5cd1649255502c81474306d4407
MD5 SHA1 SHA512

starred-symbolic.svg

SHA256 964c7715531794681f759a95239c5e60f107bc310a7f761ef438305486204dad
MD5 504fd457eb76c15c0e9efea54bd56ac1
SHA1 f01d0c799bc64ac859584ff4ae3c6bb9139402a4
SHA512 78857450ca9fa6479b7a6a488c4bdae1064a40875ae0c1cd2a12156afd08a69cff53a1f9a72d341fe93b91cef0369e56419057338c0bde314708c0e589237ad6
MD5 SHA1 SHA512

symbolic.jpg

SHA256 b44a9496bcf6507bf64e2ee77e47a2db4dae0c96cdada0a2b880fedb435b9642
MD5 b6a8e077abb66fa2faad2844c64fcedf
SHA1 79adcf8b1e6aff2cc3721cac40dbf815228d85ae
SHA512 ef9ccf942fa3b3ba0ee5ef0c01960f5d51a83ca266029ffb325f5c66c7d5bc2c3a6273fe4f565847e55231cdf3d4e914612ac5d2381448e78016c30fbce5dbc2
SSDEEP 384:SMCJt4/1p3WLhRMO663VuKdGzXpqaodwRno8dpuk+0KfpZQjQ6Cu5hG:STA3WFRZ66czX0aodwRo8ykyAjQ6CEhG
MD5 SHA1 SHA512 SSDEEP

5543a995a7f45599c76eba74e6856200fad7a026f74b8c5643c78221e48d3f75.exe

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Postclassic/user-status-pending-symbolic.svg

Windsucker.Kar

Zebuers.Com111

emoji-people-symbolic.svg

starred-symbolic.svg

symbolic.jpg

Sharing

General

Malware Config

Signatures

File Explorer

5543a995a7f45599c76eba74e6856200fad7a026f74b8c5643c78221e48d3f75.exe

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Postclassic/user-status-pending-symbolic.svg

Windsucker.Kar

Zebuers.Com111

emoji-people-symbolic.svg

starred-symbolic.svg

symbolic.jpg