79c5102316d9d99b55f51c53550a99b9ccef58f7386d79601a314029625c87aa[.]exe

resource
unpack001/$PLUGINSDIR/LangDLL.dll
unpack001/$PLUGINSDIR/System.dll

79c5102316d9d99b55f51c53550a99b9ccef58f7386d79601a314029625c87aa.exe

IMPHASH 6e7f9a29f2c85394521a08b9f31f6275
SHA256 79c5102316d9d99b55f51c53550a99b9ccef58f7386d79601a314029625c87aa
MD5 3470b26b4f683b2c79794d5a71b5d681
SHA1 cb17633bfb7e935c0ff9b9aded16ec64cd45880b
SHA512 2c7cae1b505c98c07873f592087bbc864600a80be8f33069417e67d35ed5f221fcee96eea3b230c4c3b8a3096c8c99f11187977be31af537490b5757d4eb55c4
SSDEEP 6144:0Mm4CCe7fZXJPg3h/tZfbbFNKU7IUqIO/P8XbCo/32TIKaWEPgHT02ED1sgMo:0Mwd2Vpb5pyEXbb/m5t0WI
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

1e:15:a8:29:5e:38:cb:16:c8:4c:4d:f0:ae:e3:04:eb:4e:58:be:4a:01:37:d0:d1:c9:c2:86:dc:0d:39:54:fb

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Trvejrsdagene Praezygapophysis\ ,O=Vangee,L=Belfast City Airport,ST=Northern Ireland,C=GB

Chains

Aug 5, 2024

Minor OS version

0

Major OS version

4

Entry point

13455

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCreateKeyExW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken SetFileSecurityW RegOpenKeyExW RegEnumValueW

shell32

SHGetSpecialFolderLocation SHFileOperationW SHBrowseForFolderW SHGetPathFromIDListW ShellExecuteExW SHGetFileInfoW

ole32

OleInitialize OleUninitialize CoCreateInstance IIDFromString CoTaskMemFree

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

GetClientRect EndPaint DrawTextW IsWindowEnabled DispatchMessageW wsprintfA CharNextA CharPrevW MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW GetSystemMetrics FillRect AppendMenuW TrackPopupMenu OpenClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetWindowLongW GetSysColor SetWindowPos PeekMessageW SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint EmptyClipboard CreatePopupMenu

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateFontIndirectW CreateBrushIndirect DeleteObject SetTextColor SelectObject

kernel32

GetExitCodeProcess WaitForSingleObject GetModuleHandleA GetProcAddress GetSystemDirectoryW lstrcatW Sleep lstrcpyA WriteFile GetTempFileNameW CreateFileW lstrcmpiA RemoveDirectoryW CreateProcessW CreateDirectoryW GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersion GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW ExitProcess CopyFileW GetCurrentProcess GetModuleFileNameW GetFileSize GetTickCount MulDiv SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW MoveFileExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW

$PLUGINSDIR/LangDLL.dll

IMPHASH 3e8d18bb71c7ebbda2ddc2a4bb03547b
SHA256 4883cd4231744be2dca4433ef62824b7957a3c16be54f8526270402d9413ebe6
MD5 08de81a4584f5201086f57a7a93ed83b
SHA1 266a6ecc8fb7dca115e6915cd75e2595816841a8
SHA512 b72e7cea5ce1f4dc64e65a1f683a3ef9e3fa2dc45cf421f569eb461f1fdcc0caf4ff62a872e62b400579f567c6ff9fc3c2e6e020cdca89d96015502c803a09b9
SSDEEP 48:S46+/1TKYKxbWsptIpBtWZ0iV8jAWiAJCvxft2O2B8mLofjLl:zHuPbOBtWZBV8jAWiAJCdv2CmeL
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5439

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 acf90ab6f4edc687e94aaf604d05e16e6cfb5e35873783b50c66f307a35c6506
MD5 6e55a6e7c3fdbd244042eb15cb1ec739
SHA1 070ea80e2192abc42f358d47b276990b5fa285a9
SHA512 2d504b74da38edc967e3859733a2a9cacd885db82f0ca69bfb66872e882707314c54238344d45945dc98bae85772aceef71a741787922d640627d3c8ae8f1c35
SSDEEP 192:MenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XBaIwL:M8+Qlt70Fj/lQRY/9VjjgL
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10719

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Caphtorim114.blo

SHA256 9e8ae27b22ac14cdbe3e3a3a7b601350611452d03db59b2316867aa6f1970cd0
MD5 7e052f2e6225c0a9cc4d1dab1c2da1e6
SHA1 8d0b2c5639b510c9893ae59a9f1088161b388825
SHA512 25aefa204c645d15feffb75c9bcbcc2038b26baad7f0341e4657e83fb183cdba18fc934b1db6660a4ae20525d51fd2b2a5467acd680b0d5b4ec458258815678f
SSDEEP 1536:BOxyLdCHJqAUJzM92M+kUmp3TmJ0jhX6cee/fpYsPVLMLrWeT4tUUi:M1eWgGDbi
MD5 SHA1 SHA512 SSDEEP

Opspring.dia

SHA256 bd2421d6c1b53d016f7c61004bfa7640a36a25686d29d87372d736e241ad5314
MD5 82a269f5bae8475eacd0e5cf4c7fa6db
SHA1 e50aa449bfeab5c72eb98bf0f98d16c7b5846e23
SHA512 896244a0c5819e2d4979529797fab0b801fe4ca13dbf7039531ed157b8c4f55c512447878c5cc764fc78c1d01300894c038996d31ce66099deb930cfaa730a8b
SSDEEP 192:MVenofP5CL1Vkht0EjXViZ/jjRI6CUwHC6dqSAzZ+PHPwEc2VO:9s5CLwIaXkZLjMrC2EZ+PvwX
MD5 SHA1 SHA512 SSDEEP

Overfamiliarly.lit

SHA256 4336f9f5f28e007e6a48a5b2078d04fcbfabddf8fa91c7a1a1496965459600f2
MD5 19ad849311a96a6e4cf732f801e4e82f
SHA1 097a4d680e6ec048650497bf0a5de57045435ac2
SHA512 4b454937708f04506e2444434b005badd21cc7d901d72cd3ddfbb97e74c617d1a6558613c2ba6921c3c3c8818f920d6d635f82ca4a7037b37d87192fd45ee0b3
MD5 SHA1 SHA512

Ungdomspension.Yve

SHA256 fc925f33031fcae41f755fb657807f97b3c411118bfb027a3a25ed37f4a6f9c9
MD5 ebe4e8b8a0b08e470772802ba624bff4
SHA1 eef57b6ad1fac6973a163743405431f5197a2326
SHA512 08d449249e5c543f28e7a11a0a287247034902d7a206ea8e8b0b230649b5aa20fca579d44be21f1414245a86d7655896e446bb589ece0fd49247fa54dbfe91c1
SSDEEP 6144:qBE2z7ZAnEl56N6u7n+taNGQGV0IIgHDNlI4l7UIUWCEGzjA:qBE2fWODan+8NGQKIU9l7UaSzjA
MD5 SHA1 SHA512 SSDEEP

cuddled.txt

SHA256 17931d5fa3f3e93fe13344de61e8239d41a1b7b603493f07aa5a04d131557592
MD5 3483fab1a78f10e7784ca3ca3150b2ca
SHA1 fe5e671a0a0d3b278bef62e29d3bc95a6b842b82
SHA512 ec6d70b3f03dfd8ae89112e66a07847597d7d1d3b6a508fb396ddf0b7e69ff6109ea1929dd904d5fe6b7dc41fe79d599e05e3869483838416f95a0adb663d670
MD5 SHA1 SHA512

nsec.tar

SHA256 8f73ab5e525b86591b138f15fd4315876f07f0222683711d84a56966c5901a9f
MD5 39dcabfd6c10c19cc2d532b2c03e57ea
SHA1 1b2813c18ff9f2f6344704133e579a70d623f0e2
SHA512 2c63bdde2fcc891fdb41fc45d46dad3083828512704533e427ffc1d1c8a04140be96bfbfa6d4277b9ee2ad73983350452526583c38d0a2efe1631413f8e1eb26
SSDEEP 96:YPAr4BCbpOje1kysgOM27luhZl9ubZmlRe9zKOfTKeDxy8nO433trIO8syU+B8:Y4rSje1FI85uU78hTTDUB433tkGCu
MD5 SHA1 SHA512 SSDEEP

piggy.riv

SHA256 706a3591732ab4fc5a227386e6c3b32592f9a5467327c876d45a3070035c844b
MD5 0843d03d3c1cc92613470216de0ef1a1
SHA1 ac8e656c3a2044b4fc51b38ba985e57eabf0b995
SHA512 afdf0c65fd83f494a9d2a7094614d66608d7eef0e5427c74d2c2e787f3338c0c530a57055b5e3db5ac90c0c6cbc4f683d3c590e5477260bd7f9edb141a41b7cc
SSDEEP 192:A9k5U5K4UkC9ZN17ktv4u2vwusr8JwlHRPguH48XsSNdJOAosgASLfljirw:AsMtlCHTwCu29K8uJRhH488oJ4MSzc0
MD5 SHA1 SHA512 SSDEEP

produktionskden.slu

SHA256 d757263bdbcdb4ae46691df9bcb12e168f745a5716a9feea75c20e359e2ad2af
MD5 2bb28d61ddf2533ccbb803ddbe326bdc
SHA1 8b7c2571f544ec2aed6ac232d561fee3016d99c8
SHA512 66ddbf35ba173a8dcc8204426e66200436347890d2154a8bc604cdbe2da59577dcc35156d1a4ce46cf1e775d0e9aa6e875c28841b4f7adc78a77c7501e285cc8
SSDEEP 192:cvQVyl9vo9vkEB/g8s5GI4SGvPEu/mVI1PVpb80:c4V4xbEdR8T4SaFuVI7
MD5 SHA1 SHA512 SSDEEP