b5aefdeb0f451c2edd13b5d42cb64234f5b513997af891ae3f5c187d15701602[.]exe

resource
b5aefdeb0f451c2edd13b5d42cb64234f5b513997af891ae3f5c187d15701602.exe
unpack001/$PLUGINSDIR/nsExec.dll

b5aefdeb0f451c2edd13b5d42cb64234f5b513997af891ae3f5c187d15701602.exe

IMPHASH 61259b55b8912888e90f516ca08dc514
SHA256 b5aefdeb0f451c2edd13b5d42cb64234f5b513997af891ae3f5c187d15701602
MD5 eecdcad7501f2a7308d40820445e2aa9
SHA1 898a2f518726c6866ebd3583b634d8c0043f543d
SHA512 ff0c5db3c2fc1a8db8a536bcedcdb7406841d74400e3246fbbbea2450f5ed336257ec0b01d616105f0650f9e0be9bda93dec037f56b6845044146c8909cc4d05
SSDEEP 12288:7T5tGDZWWO4K0GFYSE+ZAaDNtde8N1LGayE3cqU2ricGtq:7T5QDZWb4K0GFYCZA4tde863Ew2G0
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

13888

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCreateKeyExW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken SetFileSecurityW RegOpenKeyExW RegEnumValueW

shell32

SHGetSpecialFolderLocation SHFileOperationW SHBrowseForFolderW SHGetPathFromIDListW ShellExecuteExW SHGetFileInfoW

ole32

OleInitialize OleUninitialize CoCreateInstance IIDFromString CoTaskMemFree

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

GetClientRect EndPaint DrawTextW IsWindowEnabled DispatchMessageW wsprintfA CharNextA CharPrevW MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW GetSystemMetrics FillRect AppendMenuW TrackPopupMenu OpenClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW PeekMessageW SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint EmptyClipboard CreatePopupMenu

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateFontIndirectW CreateBrushIndirect DeleteObject SetTextColor SelectObject

kernel32

GetExitCodeProcess WaitForSingleObject GetModuleHandleA GetProcAddress GetSystemDirectoryW lstrcatW Sleep lstrcpyA WriteFile GetTempFileNameW lstrcmpiA RemoveDirectoryW CreateProcessW CreateDirectoryW GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW CopyFileW ExitProcess GetCurrentProcess GetModuleFileNameW GetFileSize CreateFileW GetTickCount MulDiv SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW MoveFileExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW

$PLUGINSDIR/nsExec.dll

IMPHASH 9f4228b95ba1827b2dc7f6da088b955c
SHA256 14ebfa0711b48ec748b6e4985db4b99a827996ae44b28122d16f14d0d0f51bb6
MD5 84bcbefa5fe3d82647a15f135f22fb2a
SHA1 7c23a0c1a8b185f5af456dafa63a3c1207d8c1dc
SHA512 c0e4ca46be6892b2cec77992e809897bcb768e3436d9bd81e4f84f4f1da9ef123ae902783147d263ac8019c732f131654694ad4105888c1f310c7bce8844b7dd
SSDEEP 96:0Vl/7KOuFlKHMpXGu8FX6eT3sQk1u2QmIG4fa9IJ4V:0Vl+hSs2u85TTHkZQmgy9I0
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

4370

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Bysbarnet131.uni

SHA256 559a86334fd5fe63723ec688834cbd9bc47513bf4cdb9693337a6b28046f0bdb
MD5 a7756ad5894d07dd8064f6c18be50372
SHA1 e427e3b76de4c38995ef25e97626083d9fbfbe7e
SHA512 310442e9514753fc399ace9d14fe4c1f7d668345ce49e73723d69a2b13da33a3b1d998b82e13de8be329599e0ff978013d6c1e3d794e2b6e365a80dc0b6d088d
MD5 SHA1 SHA512

Donnee.Dat

SHA256 0a34a8d31b119c3d015f57ac218e2bb0c710659b5f99dc9a12fd19d6480dd2f4
MD5 6adc76bec8a3a06e3a9569932e4252bf
SHA1 7b150339fc42e2737561b1a45b8ba9be77669443
SHA512 52b6d53ed579e88c0a848fadbdaa7ff94ed36732dc98088e9e1b4bb6b85f6825181feac57bccc165957a210b4c64fc847bcd0911386babc388e6d44a711f69e4
SSDEEP 1536:CxrW80tpiqbO3GraZnHjBTidChzhMiX3AYYv:C08E1aznHtiYhfABv
MD5 SHA1 SHA512 SSDEEP

Varmeskabet.Api

SHA256 d9879e1a4217a17f14492a6425517968b3983226f47303480005cfbaf819d61f
MD5 5b50ee009a67a026ae91ca38a2d18663
SHA1 3ddf7820e3026ee8c93a469d919fa21f3a8c9e6c
SHA512 aee74a12a5cc3a40fe90e04fccb5b4505216ca18be6db1b1243f92526d6bc41d3e5c607d32ed59cfb1d0e2e54f65dff6bb283a21d658154bcc19b718c6e50d69
SSDEEP 6144:2ZLJ9yb/i3LyAc2yLk2aCW5wprVKv1jWZeB0a:2ZLG/i3LTyonCW5wpIv1jYa
MD5 SHA1 SHA512 SSDEEP

camelliaceae.txt

SHA256 79673a2d310739c9e11a8411f2170fb30774b391038775a3b05ead33fd8f1b8d
MD5 93954951e9bbdd75baf6e3fc38d57fe7
SHA1 0b80d99051d94710a2d34fbb073838b1cd37fb98
SHA512 8d0a9cb8db01fa034200feebb07b39dee82e068c68675fcc1094f2bcdd3fed97d65ce34d2cac332e3bd633d30006a88192a73c2259189c9f8a63ec93ed5ac222
MD5 SHA1 SHA512

jaypie.lys

SHA256 aa686f242c75e9f372508c9c2d3936c7f7aa3205e6db5e3d32e56096c6318b14
MD5 0829cefbfd397564c51a3c4d8aa66a32
SHA1 22d72b3b4268370d35783928b2475ae1a96eb96e
SHA512 d0cfeaccdc12aa3347760d31d8e313b75512deb6efa2178ee1cf5f06406c698e4fe5a1e8de73a2caeef5ecb80211a4873fb150861d5601b1e93409ac2ede7f1c
SSDEEP 192:CbuCJqecLwDiufPL2VpmOPkWiCPNnyWcpb4rvRzIz:XNwjPaPmOPTdNnBr5zW
MD5 SHA1 SHA512 SSDEEP

mgets.sty

SHA256 3ac9fa890558fdc6efc82aa3e5ec8b91bec257d0ca950ad5773c27ea198c35e1
MD5 a93d856f2c5cfda8f2a8a64832a41967
SHA1 d45b1e4110bdde424d54c07fb1d5e02da3510e29
SHA512 20b4ff333e3ee102cee6d88234641a4f0cfb9922487055ba8ffe78cb8c90fd689752b2f38aa6cbbdb7599ab8df5b4adfdd012d44ec6b1ead6395fcdcddaf642a
MD5 SHA1 SHA512

misdid.fre

SHA256 d5c07484db191cf6c08f3e8d8e7c2d6fdca4e242a5739c0e8eb86923c39a66f9
MD5 3bb7bd8567241c2f3ff4c400155be332
SHA1 650ebb130f6a294fd7cefb9630319443c69a927a
SHA512 ae802d8c3ad3cd6ea418245e847cf4a931efa25549310925264b048120dc68dd321f042fdf6cb0fa5dcfecaeffc181aa2af33f1d052f245ec4a5f77e7273ce8c
SSDEEP 96:NFFsJi3rCcECle3ptjVYw4BqDcjFL2Pt4M43zl7ys7RNQv9IRNL:NFFsJKatjV35DcjFpJ7yERNQv9qd
MD5 SHA1 SHA512 SSDEEP

whosumdever.und

SHA256 0c636a9d6bb8bfe61568cc0914a3a3b85555dcdee63d2818bffc8f00ed50d98a
MD5 a5f4eee579f22f45b6493dd2e2d08958
SHA1 85fff8ffb400016a395eecfcdbf5eda2043314f5
SHA512 58a65a16c69440da4863ab748bfe095300269fefb4fbc0db8ff5c6ec9e5f43be6b16ff71929d87630de6e71ea3953bb9a5c5f4cc890abda4f2d4064a5afd8997
SSDEEP 192:CnQ7rrCVIP0VXiPHid+UmVJneDqEc4PTSLg+xM:HAIcRiLBVsNxv+a
MD5 SHA1 SHA512 SSDEEP

b5aefdeb0f451c2edd13b5d42cb64234f5b513997af891ae3f5c187d15701602.exe

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/nsExec.dll

advapi32

user32

kernel32

generic

Bysbarnet131.uni

Donnee.Dat

Varmeskabet.Api

camelliaceae.txt

jaypie.lys

mgets.sty

misdid.fre

whosumdever.und

Sharing

General

Malware Config

Signatures

File Explorer

b5aefdeb0f451c2edd13b5d42cb64234f5b513997af891ae3f5c187d15701602.exe

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/nsExec.dll

advapi32

user32

kernel32

generic

Bysbarnet131.uni

Donnee.Dat

Varmeskabet.Api

camelliaceae.txt

jaypie.lys

mgets.sty

misdid.fre

whosumdever.und