2bda6048a888003443cd18df65f75441974ea3dfa04d524c957b0d7c268654dc[.]exe

resource
unpack001/$PLUGINSDIR/System.dll

2bda6048a888003443cd18df65f75441974ea3dfa04d524c957b0d7c268654dc.exe

IMPHASH b34f154ec913d2d2c435cbd644e91687
SHA256 2bda6048a888003443cd18df65f75441974ea3dfa04d524c957b0d7c268654dc
MD5 01bb109640de25e5052b991261824f1c
SHA1 e539fb8e8a9cb6b5b7c11b8de3a782ede04de2dd
SHA512 e2d6607a0eb500da7f5c8a98028d89d0c1e290642c5033072507b2de0bec711ba7e299cd29ce4965c03ae739c9c86620697ff009deee39528b1cbc5225758563
SSDEEP 12288:uh0vbB0rdv7/vGFJJu1Z7kjNfKWS4k5QVqNE8AknzmmtpTqJYQ:uhMt+v7/vGFJJunWSTj0YZFHQ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

0b:82:18:0f:35:23:c7:70:6a:29:31:c9:37:55:a6:96:d9:49:60:6a:be:47:f1:af:78:16:58:42:5d:57:68:32

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Squushes Commissurotomy\ ,O=almengr,L=Gillespie,ST=Illinois,C=US

Chains

Aug 5, 2024

Minor OS version

0

Major OS version

4

Entry point

13199

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetEnvironmentVariableW SetFileAttributesW Sleep GetTickCount GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW SetCurrentDirectoryW GetFileAttributesW GetWindowsDirectoryW GetTempPathW GetCommandLineW GetVersion SetErrorMode lstrlenW lstrcpynW GetDiskFreeSpaceW ExitProcess GetShortPathNameW CreateThread GetLastError CreateDirectoryW CreateProcessW RemoveDirectoryW lstrcmpiA CreateFileW GetTempFileNameW WriteFile lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject lstrcmpiW MoveFileW GetFullPathNameW SetFileTime SearchPathW CompareFileTime lstrcmpW CloseHandle ExpandEnvironmentStringsW GlobalFree GlobalLock GlobalUnlock GlobalAlloc FindFirstFileW FindNextFileW DeleteFileW SetFilePointer ReadFile FindClose lstrlenA MulDiv MultiByteToWideChar WideCharToMultiByte GetPrivateProfileStringW WritePrivateProfileStringW FreeLibrary LoadLibraryExW GetModuleHandleW

user32

GetSystemMenu SetClassLongW EnableMenuItem IsWindowEnabled SetWindowPos GetSysColor GetWindowLongW SetCursor LoadCursorW CheckDlgButton GetMessagePos LoadBitmapW CallWindowProcW IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard ScreenToClient GetWindowRect GetDlgItem GetSystemMetrics SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharPrevW CharNextA wsprintfA DispatchMessageW PeekMessageW ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow GetDC SetTimer SetWindowTextW LoadImageW SetForegroundWindow ShowWindow IsWindow SetWindowLongW FindWindowExW TrackPopupMenu AppendMenuW CreatePopupMenu EndPaint CreateDialogParamW SendMessageTimeoutW wsprintfW PostQuitMessage

gdi32

SelectObject SetBkMode CreateFontIndirectW SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation ShellExecuteExW SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW

advapi32

AdjustTokenPrivileges RegCreateKeyExW RegOpenKeyExW SetFileSecurityW OpenProcessToken LookupPrivilegeValueW RegEnumValueW RegDeleteKeyW RegDeleteValueW RegCloseKey RegSetValueExW RegQueryValueExW RegEnumKeyW

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
MD5 0d7ad4f45dc6f5aa87f606d0331c6901
SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10643

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Biparental57/Campanologically.Kor

SHA256 4a820b1ec9b00c2d182cfad52fd2468e4236e01d7527029d2a2c18bea7cb9633
MD5 5956f6ce1768a3400eb15b920b039848
SHA1 b1eec8ee95c7689ded37ba7272ed3c63d2527e5a
SHA512 461f0ee276ad63c686d47254d0e6c98895d17f987548eccf3fc2401a57c8759a9952c4986fa9872b9b5254b5cb82fd9820f457441b3dccc98ec08fa6e9f4659e
SSDEEP 6144:I4g1quDNV9GErkwowXQ6l1g9qGL14cccDDv5d6SLls2wwqXE:QRNSBwoQQMgAXccyvtW2zUE
MD5 SHA1 SHA512 SSDEEP

Biparental57/Rullestolene190.txt

SHA256 a79f632fa32b8205ed95d6e5fb9c8389185f0f50086f3685451f7ad3724c6ff8
MD5 4534323b0f94dff6a10c0fa61d2c5a19
SHA1 e0ede17531b63678ff3cdde2dbbe86b2d9295a6d
SHA512 543e84bf10a17a3a4d4044933512a07e69b1eebb41e85c4426e82d3bb5596d12ed9ff05a3956adf2473ab3be985e0ac0af9be5a9b6d0fa0a14341323a3e16005
MD5 SHA1 SHA512

Heltidsansttes190/Selvportrttets.Vam

SHA256 3f7c1517edbf9c5c4dbf11fe3fc8907d6754ac3cce1a594701c76347c80dd557
MD5 a4a19f7485cad94fa61657d97fcc4b52
SHA1 afdff89ce2e1cb8afb3d2f36dd0885b72d481352
SHA512 5768ffadab47bb27308a11595c7216f7210fd4fc518f8ccb579df4fc593c5e79071887d8982b63d2afd97c7b9114dbe5f71dd14c7bfd96d3081f43950bdc0595
SSDEEP 3072:yTBmkJGT7epCa2kgn3Lz09xF/cn8CC9drGlCCu0nJz:4sT7yCa43n0TF/XyD
MD5 SHA1 SHA512 SSDEEP

Heltidsansttes190/hresvages.cal

SHA256 2e9a5662acf97b5c56e09437bf01884ed4ffecd8320123dd70c9d3382cbd7a6f
MD5 65616bae3c81d761ad1bea3ec0cbd5bb
SHA1 01c167a8a0a567b051df8453d6c5b493da732ff6
SHA512 265b5807b77a7084cf18985efb6ad92c4bdfa858bd6e69dcb1bad055893bf08d511f40d65277f343e534c7d3565db24884f366210c5bda779f2de417af5eb26b
SSDEEP 768:i19t/DjpLbgprBM3Yx8kdFIOQy09vkOQ0/tsTgUOpeB3OKXpJCs:GEODnrw
MD5 SHA1 SHA512 SSDEEP

Heltidsansttes190/smagssanserne.sor

SHA256 1e196772b2bf4c9a2d412b7a5cb85d6448ff75a434d035c685cf17bd6f31cce9
MD5 5d3c620f633d403ddd4dca0616e0a7f7
SHA1 64390eda29579fd6642a9ce68cf5fceeed60d491
SHA512 3477705c0dc3c24fa9ad5bfc717a1bd35895222e54542ec4652db66224624f4250c041d47bb2c7df3864091a6dc3946ebd36b9cd4f3520f8b1176a84a48c34e7
SSDEEP 768:osXL2VWJOuhCWVrJvCqS1omAUAEuum0fLVQR8be5SFNUbvXh7EkV/7NP2ocTRu:jeDMw
MD5 SHA1 SHA512 SSDEEP

Heltidsansttes190/trophi.hom

SHA256 ad4c4ad87e015f3760a49e4c6a33e9a7ae728055ebe9b2a4067760a537c11f15
MD5 37a71bb20f670a6842d284654dc45228
SHA1 03e4d60688c49fd319b9a9b3eca2511b229e7663
SHA512 eda15f14bf0d95c0fd0598c7815584697179e0fc70362490ca631094e0726daa16089ffb56394344af9ef934aeb83c2f72890a6cab5f1eb66c701c099c4306f9
SSDEEP 768:DJFF19KmqnFsVCjoJJyByYtUYcf2efq6LwByMIVDTSz0Gb+d9VHz4bROGMummg+A:80LcnKCC
MD5 SHA1 SHA512 SSDEEP

2bda6048a888003443cd18df65f75441974ea3dfa04d524c957b0d7c268654dc.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Biparental57/Campanologically.Kor

Biparental57/Rullestolene190.txt

Heltidsansttes190/Selvportrttets.Vam

Heltidsansttes190/hresvages.cal

Heltidsansttes190/smagssanserne.sor

Heltidsansttes190/trophi.hom

Sharing

General

Malware Config

Signatures

File Explorer

2bda6048a888003443cd18df65f75441974ea3dfa04d524c957b0d7c268654dc.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Biparental57/Campanologically.Kor

Biparental57/Rullestolene190.txt

Heltidsansttes190/Selvportrttets.Vam

Heltidsansttes190/hresvages.cal

Heltidsansttes190/smagssanserne.sor

Heltidsansttes190/trophi.hom