IMG_00991ORDER_FILES[.]exe

resource
IMG_00991ORDER_FILES.exe
unpack001/$PLUGINSDIR/Banner.dll
unpack001/$PLUGINSDIR/LangDLL.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/UserInfo.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/nsExec.dll

IMG_00991ORDER_FILES.exe

IMPHASH f4639a0b3116c2cfc71144b88a929cfd
SHA256 0645a7ba3f25c2f398a13f9d0d6701e9d3602044f3045f1ca1d598e08e4cde82
MD5 3e9713868f8c85ac3aea7fa6c1ae4387
SHA1 8c2862d76937d712b4d8cb7c891d23eda0af7abf
SHA512 b575adb99ed53bfc389b64f1a2dbb81a7ac2f1f391c2be514fb5a56d0aee5d249beca1b5b933bc95b6e32329a40625c846d1145348fab1d33c09dfeee7b7ea1b
SSDEEP 12288:JGPWHXq5rMTaQgsv89N42v3JanklTQGMi7B1mSwIhCjVn:JGu65Kdv89e2voKTQWB1mSlCjV
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

13615

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegOpenKeyExW RegCreateKeyExW

shell32

SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW ShellExecuteExW

ole32

CoCreateInstance OleUninitialize OleInitialize IIDFromString CoTaskMemFree

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create

user32

MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW CreatePopupMenu AppendMenuW TrackPopupMenu OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW IsWindowEnabled SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CharPrevW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint CharNextA wsprintfA DispatchMessageW CreateWindowExW PeekMessageW GetSystemMetrics

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor

kernel32

lstrcmpiA CreateFileW GetTempFileNameW RemoveDirectoryW CreateProcessW CreateDirectoryW GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW WriteFile CopyFileW ExitProcess GetCurrentProcess GetModuleFileNameW GetFileSize GetTickCount Sleep SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW MulDiv lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject SetEnvironmentVariableW

$PLUGINSDIR/Banner.dll

IMPHASH beba03bbad1f8d79d5b3c1359e913e0d
SHA256 497b1582c3b690850b72a8d82b151f782d96c4619c9f82558c68d45a43f56807
MD5 520bf4f2fc0661e17f4ff2c14a91e897
SHA1 d804f0ff5b5f0e8d7dc4be7bf199afc9c030e2fc
SHA512 923501f5caabff837a1baec55b0ca11ede21b6287daf4683d0f4ab69124a1407621dad286f453192c14e36f316d1b2d729a12bb3e6e1f4f89c69deb21871d499
MD5 SHA1 SHA512

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4760

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/LangDLL.dll

IMPHASH fe3375e7e4529b73ba45ab2246b9269b
SHA256 131aa0df90c08dce2eecee46cce8759e9afff04bf15b7b0002c2a53ae5e92c36
MD5 549ee11198143574f4d9953198a09fe8
SHA1 2e89ba5f30e1c1c4ce517f28ec1505294bb6c4c1
SHA512 0fb4cea4fd320381fe50c52d1c198261f0347d6dcee857917169fcc3e2083ed4933beff708e81d816787195cca050f3f5f9c5ac9cc7f781831b028ef5714bec8
SSDEEP 48:S46+/sTKYKxbWsptIp5tCZ0iVEAWyMEv9v/ft2O2B8mWofjLl:z+uPbO5tCZBVEAWyMEFv2Cm9L
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5439

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 509a34b3a68a773e0afb4259e68f9f82
SHA256 23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6
MD5 192639861e3dc2dc5c08bb8f8c7260d5
SHA1 58d30e460609e22fa0098bc27d928b689ef9af78
SHA512 6e573d8b2ef6ed719e271fd0b2fd9cd451f61fc9a9459330108d6d7a65a0f64016303318cad787aa1d5334ba670d8f1c7c13074e1be550b4a316963ecc465cdc
SSDEEP 192:ljHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZqE0QPi:R/Qlt7wiij/lMRv/9V4bfr
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/UserInfo.dll

IMPHASH 68e847ed6763e00454edac87b3abd95a
SHA256 a921cc9cc4af332be96186d60d2539cb413dfa44cfd73e85687f9338505ff85e
MD5 f8b6dd1f9620be4ef2ad1e81fb6b79fa
SHA1 f06c8c8650335bace41c8dbe73307cbe4e61b3b1
SHA512 f15811088ecde4cd0c038db2c278b7214e41728e382b25c65c2eb491bc0379c075841398e8c99e8cceba8be7e8342bc69d35836ebe9b12ebebff48d01d5fa61a
MD5 SHA1 SHA512

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4734

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsDialogs.dll

IMPHASH 3b477381217c97b22146297f93df2a92
SHA256 89a82c4849c21dfe765052681e1fad02d2d7b13c8b5075880c52423dca72a912
MD5 b7d61f3f56abf7b7ff0d4e7da3ad783d
SHA1 15ab5219c0e77fd9652bc62ff390b8e6846c8e3e
SHA512 6467c0de680fadb8078bdaa0d560d2b228f5a22d4d8358a1c7d564c6ebceface5d377b870eaf8985fbee727001da569867554154d568e3b37f674096bbafafb8
SSDEEP 96:ooEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YMNqkzfFc:ooEvCu5e81785qHFcU0PuAw0uyyIFc
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

7527

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsExec.dll

IMPHASH 68b7023f8923dd087549802f8fa631c3
SHA256 2cd3a2d4053954db1196e2526545c36dfc138c6de9b81f6264632f3132843c77
MD5 11092c1d3fbb449a60695c44f9f3d183
SHA1 b89d614755f2e943df4d510d87a7fc1a3bcf5a33
SHA512 c182e0a1f0044b67b4b9fb66cef9c4955629f6811d98bbffa99225b03c43c33b1e85cacabb39f2c45ead81cd85e98b201d5f9da4ee0038423b1ad947270c134a
SSDEEP 96:JgzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuHIDQ:JDQHDb2vSuOc41ZfUNQZGdHA
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4231

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Bjergernes24.His

SHA256 e04789e803329f151d3b930408a73f16516a1418b48000bb9dc15510209699fa
MD5 4c4105145931134682106af3985e057d
SHA1 fc445a1aa699284d067943557c1070e4b432d1a3
SHA512 b6807de5bd752fdc42a07e36f4450fea64522bca4c05df5f15c248d12462e37af65bc77e2ea6dd5b4a7d92473e4631b979a88763a72d8251be78ea14dbaae2d2
SSDEEP 6144:wHWKnqmE6qH1tl8qLrLx9TCHp4LShyP7HOv5:wHxqVtqqLrLTTCkNLO5
MD5 SHA1 SHA512 SSDEEP

Klavier/Novellefilm.Tol

SHA256 4bf6580a097827e57868fd84eeffc981f75f79a51a5f41b6a5c65eb0e11fa500
MD5 119afd84089f0098b2f3019c6863b051
SHA1 53502865db91a252965155244b1ba97e72f50124
SHA512 60f14fc0d534a8ec7c44d5af2839407e74bdc5179eae07591f90f3f7a741138c86b4d1f27221de9330c1596b6980c21ca3879bb5fdc245e0ba4bb011b67f4c41
SSDEEP 1536:dG3p+nVEJF6Wth12aV3pHLE3cTSzFlo6BhKfdo2aNy/:la/r/
MD5 SHA1 SHA512 SSDEEP

Klavier/Roundness.ind

SHA256 5a2a01a88ec9ff56b80d957e4c5891a020435407f81dada05de58165c0c86f2d
MD5 84182132beac6b4cdd42ae3c3504778f
SHA1 9844b9b4abeac7b410809a582fe2e41bd38876a3
SHA512 054c17e8ac2eded927f24e77a81fba74498c9f3abd07f5e42d6f9e20a58d47d9c30ff1060cc8626de93fdd5bba2a0503ff61ec7f4f70858871c15e63ddc48a7f
SSDEEP 1536:kVTcKVFuJi5LXKLywcEhXygCilGHIQXMUmMAI:ywKLNLaLywRXygCilGzmMAI
MD5 SHA1 SHA512 SSDEEP

Klavier/bucrane.erh

SHA256 c6ad2dcc3b851e06a60fa705cbaa83aadbec68b10e24ca667088e8153973a7b2
MD5 aa2cd52abea96b7e317691add713125d
SHA1 b34046de9d9a275896762fd53a2dff2d382eae56
SHA512 ad454262c5804887a9596d5cffcc64d86eb1ed92813a5a37f57d9fcca21d9c2ef465e51f05879f65baba7752252b9fec6352cfb5f678b21d3412b6906eb07c26
SSDEEP 768:597pZQKUv2av3tuZ8qbY2vFhkyd8MBkwaKKKbwspvRxtm8dBct2pEW5x1dGkrKLB:Ve2aPPET8MOwaKGeR//1T9dO
MD5 SHA1 SHA512 SSDEEP

Klavier/freemanship.txt

SHA256 37b39724fd3b7fe48e1d65da1a69bf4dbf809f34c67bac7c4da13f93da9be856
MD5 ef6fdede5ea8dbef391fec35be82a5fc
SHA1 6c88262f78e8b11651eeb6534f09c65cd0a8f8bb
SHA512 5fb53adeadb7c464a13eeece64add35f972425d55447ffb84a277689ba3f4d5861a43b2883cb0744f98f164f2802c567f9969f777b98ce4609d28a64ed1101fd
MD5 SHA1 SHA512

Klavier/pressurization.pra

SHA256 a6eb01651c833919fc27f9b7dd2b5c6d9f9dd8766bc7848679b5e664ecc6c8a7
MD5 084cdf1fe8920eacbc8dc0e839d9e5a7
SHA1 5bb2e4e15941ac2ab4287a58f671b82da5c9a384
SHA512 f856c41f540b7bd8233179cc752e63e4c88c1bbc38739b4faf3da09675b13fbc0219458afe95d4c1dd481b35bb69dc9b66c2269c64b106de3659a51ce9ae1b42
SSDEEP 768:3wSokH49c7ZKiDm+1Qer3C4XkGB3luG3fCHoEHKM/yP35tuIJ95oV31XfCp43UtM:55+1GbuKvP32IqV1fmPU0VicgRx
MD5 SHA1 SHA512 SSDEEP

vride/restriktivitets.bnk

SHA256 576d2cd521891cf9c598b3ca0dadb89bd36cde96b3f86f1cd27bf4ffcce863cb
MD5 9ad6681dd2b309e6ace142096f9e2870
SHA1 5e02434342a98589a29b7e389e88dd4c60f09a8a
SHA512 28cfece5e00aab59758864503f4a9058eef2fdfc8b73204abf1e3b41011fbe5d9eac3595e2efa0e3b740b82f285b7ec8e42ea5dd42c39e5eff39735a9c051cbb
SSDEEP 768:GGj5fMy6uanycN+gN/qEN+bHeC6roJdAGpeBgXU9ZWNAnu/Fkutb:L3l0fDkwaPA
MD5 SHA1 SHA512 SSDEEP

vride/tresindstyvendedeles.ord

SHA256 e88bb71c91c537060f76cd2ef8633b767bfd720efd7af6f8300ba6883249eacb
MD5 d2d56c0a1bc3f0ae364c30a638393597
SHA1 b564662188d504d42b22e18a487bf35503b87af5
SHA512 2756334999cfee833dac050193745c85d50a3884fcb18220243c1a71086b51e6ff6eb165189be7748aabb6098f9bd693eb25e539d2ade56486fa95cb297fd023
SSDEEP 1536:Jm/FJf9qdyY/zMFRdfxHg2jUsscLrP6d2i2SJ:Itlw7zMFHx/jUqOd2SJ
MD5 SHA1 SHA512 SSDEEP

Sharing

General

Malware Config

Signatures

File Explorer