MalwareBazaar[.]1 | Triage™

resource
MalwareBazaar.1

MalwareBazaar.1

IMPHASH b34f154ec913d2d2c435cbd644e91687
SHA256 b45cc41648974fd25b69165096e789b5978dd11691c0c9005c911cd6654eb6b7
MD5 abbb01a94544b9c7b1fd9c57af5ee88e
SHA1 7b7146fa23c173111afe710094ec796a2c8a6787
SHA512 d7058b8be542c7ec0b78648da4cba83cad3f405be7178e3fb786c1aa938f9621caae504ef220e834d68dfe41709493f1df191a20aca9a191ba945c34bf98b324
SSDEEP 6144:1NgoThHBKnEV7abvyvlWevjkwlk7xHTEQiTlT4WyQTesZklzJp4WMCsi6DdTEGat:HVPU0RvjRlkdH6t4WB+zJqWTsiK6FfW2
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

13164

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetEnvironmentVariableW SetFileAttributesW Sleep GetTickCount GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW SetCurrentDirectoryW GetFileAttributesW GetWindowsDirectoryW GetTempPathW GetCommandLineW GetVersion SetErrorMode lstrlenW lstrcpynW GetDiskFreeSpaceW ExitProcess GetShortPathNameW CreateThread GetLastError CreateDirectoryW CreateProcessW RemoveDirectoryW lstrcmpiA CreateFileW GetTempFileNameW WriteFile lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject lstrcmpiW MoveFileW GetFullPathNameW SetFileTime SearchPathW CompareFileTime lstrcmpW CloseHandle ExpandEnvironmentStringsW GlobalFree GlobalLock GlobalUnlock GlobalAlloc FindFirstFileW FindNextFileW DeleteFileW SetFilePointer ReadFile FindClose lstrlenA MulDiv MultiByteToWideChar WideCharToMultiByte GetPrivateProfileStringW WritePrivateProfileStringW FreeLibrary LoadLibraryExW GetModuleHandleW

user32

GetSystemMenu SetClassLongW EnableMenuItem IsWindowEnabled SetWindowPos GetSysColor GetWindowLongW SetCursor LoadCursorW CheckDlgButton GetMessagePos LoadBitmapW CallWindowProcW IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard ScreenToClient GetWindowRect GetDlgItem GetSystemMetrics SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharPrevW CharNextA wsprintfA DispatchMessageW PeekMessageW ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow GetDC SetTimer SetWindowTextW LoadImageW SetForegroundWindow ShowWindow IsWindow SetWindowLongW FindWindowExW TrackPopupMenu AppendMenuW CreatePopupMenu EndPaint CreateDialogParamW SendMessageTimeoutW wsprintfW PostQuitMessage

gdi32

SelectObject SetBkMode CreateFontIndirectW SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation ShellExecuteExW SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW

advapi32

AdjustTokenPrivileges RegCreateKeyExW RegOpenKeyExW SetFileSecurityW OpenProcessToken LookupPrivilegeValueW RegEnumValueW RegDeleteKeyW RegDeleteValueW RegCloseKey RegSetValueExW RegQueryValueExW RegEnumKeyW

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

Inimitability.Alt

SHA256 5c8548baa18ace9acfbbb92fffa9ba0b173495bf42c37ba41c2d0bf1bfe8e912
MD5 027d97fcf5b7457f4791a614e2be63f4
SHA1 8734fb07fa96007f0f1b2c669d82891b680625d4
SHA512 fc6f8d33f47d44b144b5b7542b787de50bdedead068088f6d27cba92be9fbc21b78c1d4dd3a7d66a6c00fabd9618c8c3cca45be393c788a056b81f1c7161f4ef
SSDEEP 6144:FraHia8yRah/ufNUpQCj1b98gG/xjoBL/E6wKAmmBJKckVNKzb1S:o8x/QE1bur/k/fbmTpkLiQ
MD5 SHA1 SHA512 SSDEEP

biogeografien.tim

SHA256 16540e47bef0a3e31d663460a583695e518c2570d4bc2579d8b6a5581c384ab7
MD5 104c01e1ebabbc553264ef1f07c3f94a
SHA1 12fe59a71567aafb9d6bcd4289e2a3b715bca662
SHA512 59fb9fe08ff768fb64d50e6705cb69dce12a6d9dc48e440bac87bf369c1ab0521274a9a777affcc0141310c07ff70c92a85e5cb3210c1996f3136d4ebb853aa5
MD5 SHA1 SHA512

discoast.und

SHA256 ec25ed855101ec13fda9bf0af3f955ae40226d0d109f83cd54431146f2cb923a
MD5 ed33a4c44fa9c5b922f293558a592c32
SHA1 0705702432d82932fe0343485582ba1098c59d19
SHA512 e8261eb9bbef22624090e4673bc642ba3101458c25806117dddcedebd427f8eb7a5713e15646be1aafa8f67c726794fcfb62108ee09b286430c0dc3bb0867c39
MD5 SHA1 SHA512

metaphonize.txt

SHA256 b70bae0187e0b9427a6469a12418a81cfe9ad167b83eed284cc80c72ca525638
MD5 928976dad5d8d2c3ba95c5c6289673a8
SHA1 f6b4fd683ff8a7200df35ec0a850a1fca32069e6
SHA512 2475a43af3651c155cfa6013dcd8df12e208eb6b28b76f9cbc5483b99a17d139fba517d98f7c6d3d62d548a9128752a65cf5fde045a75d64ab053ecf15b12b54
MD5 SHA1 SHA512

religionsfrihedens.dep

SHA256 0bef30e5dbaf3911a5814bd0de50ba9de0462070043bc0663b37183d9353c117
MD5 1b8e67f5637845f81c313ed069765a04
SHA1 7f356dd97ae03c0b4d864964863846b3d190ea14
SHA512 f632b75ce45be9c7be43a8fe514d391b72c955a828c7da72ee6e9b1764f88cc4084a19d53d9aa1773e0564c2099f6a6ec3485a6ffe3b077436b34e03e4c56fb9
MD5 SHA1 SHA512

scriveners.unn

SHA256 54833f0fd07260468044e7bb1cf435b4beae5f9e4f3c51d775f1af23f45a97a6
MD5 750de71ea8facd8f0fc8d57c0f86a967
SHA1 256805fdae24dd369adbe3cf63f272bde8246eb5
SHA512 2106928d0cf2b85d86c8392b96122d6643abdd0d36eb0f7ea847dd648191462e9d2c5e64384ec4be89883804412ee2ea2f9e054fb90bb3e720b81c93ff4816e2
SSDEEP 192:QS04I1W2W+1yaUcHuKoI6C+DolkCnDVMZyVvDdzco36hky1Ck+W:QS04Il0cOKozFmkC5MZyBDD6hkyok+W
MD5 SHA1 SHA512 SSDEEP

smygedes.exa

SHA256 a2f4aefd14acae970afc7c6f0e11c550a5c8f34640e11875dbc0808286b91109
MD5 defaa5ed62729346d26842567e2a763f
SHA1 a189481e3c8cb7a94b07748cb4189c182fafde77
SHA512 4a9d45d0c750c6121293723dcacb3df6ba82e13c8fda7d8bec7846dbacaa57fade25b65b14dd5441fdad65db5cd148f5d859ed265607fbf31cabd1503901f0fe
MD5 SHA1 SHA512

stenotypic.Oce

SHA256 7d6895122db0394522476c9c81b932516c81086fe87437ca5f51eb27b3345766
MD5 de2f885eab3f344688c06e7535016111
SHA1 01979649b0b84f78f543e6bab2cc586e748c41fe
SHA512 57cffe8177cd8ab674ea846c3c5088548de6fd0fe6add20590cfac173fea67be5897d9eacfcfae0afb24878ba53154f4a90bef4c1d803b1da64c095e90092aa1
SSDEEP 1536:98hiQPbzFbkOCAywjWvFzQnADF2idQHZBM0SuxgHKdyyBAp+k:OhiQPbzFbkOpywjWvFUnagidQHZBM4+T
MD5 SHA1 SHA512 SSDEEP

Sharing

General

Malware Config

Signatures

File Explorer