e99dfc08c5ef50c923aa461264723b3c1041f1cfe76373ed42466e9d23f37f3f[.]exe

resource
unpack001/$PLUGINSDIR/System.dll

e99dfc08c5ef50c923aa461264723b3c1041f1cfe76373ed42466e9d23f37f3f.exe

IMPHASH 17b7d61bda0f7478e36d9ce3d4170680
SHA256 e99dfc08c5ef50c923aa461264723b3c1041f1cfe76373ed42466e9d23f37f3f
MD5 a0e1030b0002d26a5aa7770b076a86ef
SHA1 2b1d46e58eacf14f3f63fc64e1a9d950b47e5d45
SHA512 f6e9e51d11a8fb46b271f6daab54ef60ce9e99b6c2af8e53131d6da029e0c02b8b330d15177a3bdc9c729a98ec144b6d56b02cca3acf205814b7f14eacea9072
SSDEEP 12288:Riu5LgA08Jh7fpCwTnwGHHD/ZGAx+iZH2VlnUE1DmbG:T5L48JtgOwGHj/wFNVd1CG
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

e9:84:c2:e4:1b:ca:58:f5:d8:94:8f:4d:8f:c0:24:2e:b0:41:62:0d:8d:93:50:80:88:e5:ad:68:b3:3c:d9:38

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Planchment Beneficeredes\ ,O=Tympanize,L=San Antonio,ST=Texas,C=US

Chains

Aug 22, 2024

Minor OS version

0

Major OS version

4

Entry point

13084

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathW SetFileTime CloseHandle GetShortPathNameW MoveFileW SetCurrentDirectoryW GetFileAttributesW GetLastError GetFullPathNameW CreateDirectoryW Sleep GetTickCount CreateFileW GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW ExitProcess SetEnvironmentVariableW GetWindowsDirectoryW SetFileAttributesW ExpandEnvironmentStringsW SetErrorMode LoadLibraryW lstrlenW lstrcpynW GetDiskFreeSpaceW GlobalUnlock GlobalLock CreateThread CreateProcessW RemoveDirectoryW lstrcmpiA GetTempFileNameW lstrcpyA lstrcpyW lstrcatW GetSystemDirectoryW GetVersion GetProcAddress LoadLibraryA GetModuleHandleA GetModuleHandleW lstrcmpiW lstrcmpW WaitForSingleObject GlobalFree GlobalAlloc LoadLibraryExW GetExitCodeProcess FreeLibrary WritePrivateProfileStringW GetCommandLineW GetTempPathW GetPrivateProfileStringW FindFirstFileW FindNextFileW DeleteFileW SetFilePointer MultiByteToWideChar FindClose MulDiv ReadFile WriteFile lstrlenA WideCharToMultiByte

user32

EndDialog ScreenToClient GetWindowRect RegisterClassW EnableMenuItem GetSystemMenu SetClassLongW IsWindowEnabled SetWindowPos GetSysColor GetWindowLongW SetCursor LoadCursorW CheckDlgButton GetMessagePos LoadBitmapW CallWindowProcW IsWindowVisible CloseClipboard SetClipboardData wsprintfW CreateWindowExW SystemParametersInfoW AppendMenuW CreatePopupMenu GetSystemMetrics SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharPrevW CharNextA wsprintfA DispatchMessageW PeekMessageW ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage GetDC SetWindowLongW LoadImageW SendMessageTimeoutW FindWindowExW EmptyClipboard OpenClipboard TrackPopupMenu EndPaint ShowWindow GetDlgItem IsWindow SetForegroundWindow

gdi32

SelectObject SetBkMode CreateFontIndirectW SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW ShellExecuteW SHFileOperationW

advapi32

RegCloseKey RegOpenKeyExW RegDeleteKeyW RegDeleteValueW RegEnumValueW RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumKeyW

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

CoCreateInstance CoTaskMemFree OleInitialize OleUninitialize

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 852047023ba0cae91c7a43365878613cfb4e64e36ff98c460e113d5088d68ef5
MD5 be2621a78a13a56cf09e00dd98488360
SHA1 75f0539dc6af200a07cdb056cddddec595c6cfd2
SHA512 b80cf1f678e6885276b9a1bfd9227374b2eb9e38bb20446d52ebe2c3dba89764aa50cb4d49df51a974478f3364b5dbcbc5b4a16dc8f1123b40c89c01725be3d1
SSDEEP 192:eB2HS+ihg200uWz947Wzvxu6v0MI7JOde+Ij5Z77dslFsE+:3S62Gw947ExuGDI7J8EF7KIE
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10041

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Collophane/Meadowbur.Sta

SHA256 a6b7f47c75c930b493d06d5efef4d68b5cf44b4629518797d093c2569d3ad589
MD5 086b3e8189119c561939622407eb04d0
SHA1 8c97d9f5639e2fadd15436569ac2359cce1004ab
SHA512 98960b2c65ca2b0dc0fe8c6f8b3ed53d9168046ccc44020962905def0545d7e773712443adbadabd666cb5909cf50fd5d7a66f6bf54694dd828c7f30427b298d
SSDEEP 3072:+2JhcsfAGd89DMPaP2vVvf9xLVDJXr2aAxLDTunajL67s0xosi:Vwk89DcauvtlxhDJXryHTuaj+Lxosi
MD5 SHA1 SHA512 SSDEEP

Collophane/anvendelsessteds.jer

SHA256 0053e209cd776bac7d6044ec7c31c98aa3b2e11781e05f9cc969f1467c748203
MD5 1c8d9a0509870eed740ea421f205e6d5
SHA1 351aa95ddc46bdb484f5b4df328de036404f67d6
SHA512 c4fed5299171b56c63b07c823af2e7ca0ac1e2ab7b200f39fbbce56a15360dfa1e269d952ee39742710a455b926cd99f4a7dc0ba6f142c56d52e2b6f1cd0b40f
SSDEEP 768:31meq1wz0OOldD/3Dp/pWhfldoPxJ4pHbD3rkX3mtDY/OPxBSPt/DVbyfhgQAqRb:31jMYpYsx2bkbDE06CLbymzS6
MD5 SHA1 SHA512 SSDEEP

Collophane/fodsporet.txt

SHA256 348f73d878e5e513828f54f588b7eb31f3f45cfcfcb683708fbc499706a8e79d
MD5 156d3e157dbdf1074d2b0125e3167bbe
SHA1 31e903c303e1c903940b5b54a980b55f2a3236bc
SHA512 f58e9a710e614bd3c6ff34df0101d63ff96d0010f4347f584e5b3dfaa7ab1ee4b5252f48721eece614af59ee7ce101f2be0f6632f3e4a61e3079659f84bd8367
MD5 SHA1 SHA512

Collophane/methylphenidate.sta

SHA256 82e60c9f43a4a7f5d9882db77e026b16b344d9e54a2d6d637efa3cc061ee7922
MD5 111d385a0ea18429bf24e6a2dff3b66c
SHA1 f3337713f47cc0cfcda4ac01c5c92b66f3f0e1d6
SHA512 0c5065affb4246f3374e76082300b35c18e8c4e2441fc7d580a0195a48470d513edc18442c8bf6a9f65eaa9c06429778a60108d31a394a6c5117008890ff1c4c
SSDEEP 768:ZC/gQyn3GMClUoNrZaKOQjXFIaMvsJPl15xlwTBoZi52CL9MbzljGZRSLMepuizl:ZJaUaDoHxX40AN
MD5 SHA1 SHA512 SSDEEP

Collophane/propellant.Dog

SHA256 cb9eae5f7ab6787abf1086b4b9c21cb0a803e0911aa73c2825ad7f9bba463023
MD5 a074a56ac4bf04b684abb9bc3a885b33
SHA1 2497e49e14421629fcce76151a9582db132b7ad4
SHA512 1c63760dc919fb0597a590034ee89fdac340b0fd329eabd040dcebfde36e404994991e9f134c2339d15c5f21f8f47768c1a54b42790dc179063392b8fa53ab74
SSDEEP 384:KhGTzXCLSU3lUVvzOeWDodHGJc7Sln235MxAnA:SWzXXOeP1GUW23y2A
MD5 SHA1 SHA512 SSDEEP

Collophane/refrustrating.ult

SHA256 a15198026ae7b84f2825e279a2721cbddafd799794733b0a004fa5fd39707878
MD5 dad31e1b64d71f12869931dff4748c74
SHA1 df3bfc71988c7f21438eebf7417c79f029554de2
SHA512 cac8b3290d37dc9a75ebd3eb5f53d4bd65de63616b5229e965132927ba83014203270e5b4e5e1d5a54c926b3e70e081f312dfebe09c98cd821fb0b396b54c93a
SSDEEP 768:kmB8fbBjdVDRJ2M+oBudGGmgi/vJtQiuHTAOqYu07d+jyAREhpZVONckfQ6aDiWN:RdSO3IwmGhTYX9SIuLz2h
MD5 SHA1 SHA512 SSDEEP

e99dfc08c5ef50c923aa461264723b3c1041f1cfe76373ed42466e9d23f37f3f.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Collophane/Meadowbur.Sta

Collophane/anvendelsessteds.jer

Collophane/fodsporet.txt

Collophane/methylphenidate.sta

Collophane/propellant.Dog

Collophane/refrustrating.ult

Sharing

General

Malware Config

Signatures

File Explorer

e99dfc08c5ef50c923aa461264723b3c1041f1cfe76373ed42466e9d23f37f3f.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Collophane/Meadowbur.Sta

Collophane/anvendelsessteds.jer

Collophane/fodsporet.txt

Collophane/methylphenidate.sta

Collophane/propellant.Dog

Collophane/refrustrating.ult