5c165586ed7a8f62f8d8fe850d874ede748092d4dbf54667ce8b02b4081c4cfe[.]exe

resource
5c165586ed7a8f62f8d8fe850d874ede748092d4dbf54667ce8b02b4081c4cfe.exe
unpack001/$PLUGINSDIR/Banner.dll
unpack001/$PLUGINSDIR/LangDLL.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/UserInfo.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/nsExec.dll

5c165586ed7a8f62f8d8fe850d874ede748092d4dbf54667ce8b02b4081c4cfe.exe

IMPHASH f4639a0b3116c2cfc71144b88a929cfd
SHA256 5c165586ed7a8f62f8d8fe850d874ede748092d4dbf54667ce8b02b4081c4cfe
MD5 f48ad078b3b7bec3ef37e33619dbe943
SHA1 3f13e731e2819f3032bf6514cd72c0d68eae13bc
SHA512 5f3a180a3dee732a50c3ca48b033f07aacb2d08a30f813a6c7b5d2e8709fe1dc3df847625e3a45064c85b37a28d33485331f08f04bc202620decf51d1ad21cd9
SSDEEP 12288:JGJ5M7AauPSWS4CTrkUcankl/WdQGMi7B1mSwIhCjVnU:JGfyTuPSWS4CToWK/WdQWB1mSlCjVU
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

13615

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegOpenKeyExW RegCreateKeyExW

shell32

SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW ShellExecuteExW

ole32

CoCreateInstance OleUninitialize OleInitialize IIDFromString CoTaskMemFree

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create

user32

MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW CreatePopupMenu AppendMenuW TrackPopupMenu OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW IsWindowEnabled SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CharPrevW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint CharNextA wsprintfA DispatchMessageW CreateWindowExW PeekMessageW GetSystemMetrics

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor

kernel32

lstrcmpiA CreateFileW GetTempFileNameW RemoveDirectoryW CreateProcessW CreateDirectoryW GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW WriteFile CopyFileW ExitProcess GetCurrentProcess GetModuleFileNameW GetFileSize GetTickCount Sleep SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW MulDiv lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject SetEnvironmentVariableW

$PLUGINSDIR/Banner.dll

IMPHASH beba03bbad1f8d79d5b3c1359e913e0d
SHA256 497b1582c3b690850b72a8d82b151f782d96c4619c9f82558c68d45a43f56807
MD5 520bf4f2fc0661e17f4ff2c14a91e897
SHA1 d804f0ff5b5f0e8d7dc4be7bf199afc9c030e2fc
SHA512 923501f5caabff837a1baec55b0ca11ede21b6287daf4683d0f4ab69124a1407621dad286f453192c14e36f316d1b2d729a12bb3e6e1f4f89c69deb21871d499
MD5 SHA1 SHA512

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4760

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/LangDLL.dll

IMPHASH fe3375e7e4529b73ba45ab2246b9269b
SHA256 131aa0df90c08dce2eecee46cce8759e9afff04bf15b7b0002c2a53ae5e92c36
MD5 549ee11198143574f4d9953198a09fe8
SHA1 2e89ba5f30e1c1c4ce517f28ec1505294bb6c4c1
SHA512 0fb4cea4fd320381fe50c52d1c198261f0347d6dcee857917169fcc3e2083ed4933beff708e81d816787195cca050f3f5f9c5ac9cc7f781831b028ef5714bec8
SSDEEP 48:S46+/sTKYKxbWsptIp5tCZ0iVEAWyMEv9v/ft2O2B8mWofjLl:z+uPbO5tCZBVEAWyMEFv2Cm9L
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5439

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 509a34b3a68a773e0afb4259e68f9f82
SHA256 23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6
MD5 192639861e3dc2dc5c08bb8f8c7260d5
SHA1 58d30e460609e22fa0098bc27d928b689ef9af78
SHA512 6e573d8b2ef6ed719e271fd0b2fd9cd451f61fc9a9459330108d6d7a65a0f64016303318cad787aa1d5334ba670d8f1c7c13074e1be550b4a316963ecc465cdc
SSDEEP 192:ljHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZqE0QPi:R/Qlt7wiij/lMRv/9V4bfr
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/UserInfo.dll

IMPHASH 68e847ed6763e00454edac87b3abd95a
SHA256 a921cc9cc4af332be96186d60d2539cb413dfa44cfd73e85687f9338505ff85e
MD5 f8b6dd1f9620be4ef2ad1e81fb6b79fa
SHA1 f06c8c8650335bace41c8dbe73307cbe4e61b3b1
SHA512 f15811088ecde4cd0c038db2c278b7214e41728e382b25c65c2eb491bc0379c075841398e8c99e8cceba8be7e8342bc69d35836ebe9b12ebebff48d01d5fa61a
MD5 SHA1 SHA512

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4734

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsDialogs.dll

IMPHASH 3b477381217c97b22146297f93df2a92
SHA256 89a82c4849c21dfe765052681e1fad02d2d7b13c8b5075880c52423dca72a912
MD5 b7d61f3f56abf7b7ff0d4e7da3ad783d
SHA1 15ab5219c0e77fd9652bc62ff390b8e6846c8e3e
SHA512 6467c0de680fadb8078bdaa0d560d2b228f5a22d4d8358a1c7d564c6ebceface5d377b870eaf8985fbee727001da569867554154d568e3b37f674096bbafafb8
SSDEEP 96:ooEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YMNqkzfFc:ooEvCu5e81785qHFcU0PuAw0uyyIFc
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

7527

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsExec.dll

IMPHASH 68b7023f8923dd087549802f8fa631c3
SHA256 2cd3a2d4053954db1196e2526545c36dfc138c6de9b81f6264632f3132843c77
MD5 11092c1d3fbb449a60695c44f9f3d183
SHA1 b89d614755f2e943df4d510d87a7fc1a3bcf5a33
SHA512 c182e0a1f0044b67b4b9fb66cef9c4955629f6811d98bbffa99225b03c43c33b1e85cacabb39f2c45ead81cd85e98b201d5f9da4ee0038423b1ad947270c134a
SSDEEP 96:JgzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuHIDQ:JDQHDb2vSuOc41ZfUNQZGdHA
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4231

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Kustodens.Emp

SHA256 15e724a4a4ec10a915470fb5aa7af5a4281b324754a6a9fa10e902702907d025
MD5 f2d067fd06fc55360cc793582dfe9279
SHA1 d5823007a34a2e8e6f75620639b781c91f1c90ad
SHA512 c4c1c1f417ef2999c44d87db3f68523fac37de969900e8467e1a341eb823b306fe7cf4d763b25d5c0b1d9c295fc04f652e41a1dc24a14645bac6699da33991ef
SSDEEP 1536:tgMU/b+/0baTOfV/y6FXqBbUP5HgflgB9iHLnfTXFaUyhGcvk:06KFzWHFyRM
MD5 SHA1 SHA512 SSDEEP

Roundness.ind

SHA256 5a2a01a88ec9ff56b80d957e4c5891a020435407f81dada05de58165c0c86f2d
MD5 84182132beac6b4cdd42ae3c3504778f
SHA1 9844b9b4abeac7b410809a582fe2e41bd38876a3
SHA512 054c17e8ac2eded927f24e77a81fba74498c9f3abd07f5e42d6f9e20a58d47d9c30ff1060cc8626de93fdd5bba2a0503ff61ec7f4f70858871c15e63ddc48a7f
SSDEEP 1536:kVTcKVFuJi5LXKLywcEhXygCilGHIQXMUmMAI:ywKLNLaLywRXygCilGzmMAI
MD5 SHA1 SHA512 SSDEEP

bucrane.erh

SHA256 c6ad2dcc3b851e06a60fa705cbaa83aadbec68b10e24ca667088e8153973a7b2
MD5 aa2cd52abea96b7e317691add713125d
SHA1 b34046de9d9a275896762fd53a2dff2d382eae56
SHA512 ad454262c5804887a9596d5cffcc64d86eb1ed92813a5a37f57d9fcca21d9c2ef465e51f05879f65baba7752252b9fec6352cfb5f678b21d3412b6906eb07c26
SSDEEP 768:597pZQKUv2av3tuZ8qbY2vFhkyd8MBkwaKKKbwspvRxtm8dBct2pEW5x1dGkrKLB:Ve2aPPET8MOwaKGeR//1T9dO
MD5 SHA1 SHA512 SSDEEP

freemanship.txt

SHA256 37b39724fd3b7fe48e1d65da1a69bf4dbf809f34c67bac7c4da13f93da9be856
MD5 ef6fdede5ea8dbef391fec35be82a5fc
SHA1 6c88262f78e8b11651eeb6534f09c65cd0a8f8bb
SHA512 5fb53adeadb7c464a13eeece64add35f972425d55447ffb84a277689ba3f4d5861a43b2883cb0744f98f164f2802c567f9969f777b98ce4609d28a64ed1101fd
MD5 SHA1 SHA512

kildent.Ocu

SHA256 72391e2aec492dc97a5e0a43c85bd608cb3417fec44f92027428d3e9924d1a0b
MD5 73d7b249c1d5b8fb5a12c82c02f0bb36
SHA1 e59ad89e8464c5d32c6ae3c48fa5ddf95c0260bb
SHA512 3af747c48d5c52a860333ba37e8d14211cee9f76f8c4684cdc15834bb4b8022c47ed88b6240b26991bf181f1d15ccf35c82ffae6b31ad56b758509a9b0640c75
SSDEEP 6144:wKkwUHbKTUXiPkuyQ2kmqD4wScCEw1Lxso3+yNkAz5P:zUoU5Dk3D4wSn9dxsskAzx
MD5 SHA1 SHA512 SSDEEP

pressurization.pra

SHA256 a6eb01651c833919fc27f9b7dd2b5c6d9f9dd8766bc7848679b5e664ecc6c8a7
MD5 084cdf1fe8920eacbc8dc0e839d9e5a7
SHA1 5bb2e4e15941ac2ab4287a58f671b82da5c9a384
SHA512 f856c41f540b7bd8233179cc752e63e4c88c1bbc38739b4faf3da09675b13fbc0219458afe95d4c1dd481b35bb69dc9b66c2269c64b106de3659a51ce9ae1b42
SSDEEP 768:3wSokH49c7ZKiDm+1Qer3C4XkGB3luG3fCHoEHKM/yP35tuIJ95oV31XfCp43UtM:55+1GbuKvP32IqV1fmPU0VicgRx
MD5 SHA1 SHA512 SSDEEP

restriktivitets.bnk

SHA256 576d2cd521891cf9c598b3ca0dadb89bd36cde96b3f86f1cd27bf4ffcce863cb
MD5 9ad6681dd2b309e6ace142096f9e2870
SHA1 5e02434342a98589a29b7e389e88dd4c60f09a8a
SHA512 28cfece5e00aab59758864503f4a9058eef2fdfc8b73204abf1e3b41011fbe5d9eac3595e2efa0e3b740b82f285b7ec8e42ea5dd42c39e5eff39735a9c051cbb
SSDEEP 768:GGj5fMy6uanycN+gN/qEN+bHeC6roJdAGpeBgXU9ZWNAnu/Fkutb:L3l0fDkwaPA
MD5 SHA1 SHA512 SSDEEP

tresindstyvendedeles.ord

SHA256 e88bb71c91c537060f76cd2ef8633b767bfd720efd7af6f8300ba6883249eacb
MD5 d2d56c0a1bc3f0ae364c30a638393597
SHA1 b564662188d504d42b22e18a487bf35503b87af5
SHA512 2756334999cfee833dac050193745c85d50a3884fcb18220243c1a71086b51e6ff6eb165189be7748aabb6098f9bd693eb25e539d2ade56486fa95cb297fd023
SSDEEP 1536:Jm/FJf9qdyY/zMFRdfxHg2jUsscLrP6d2i2SJ:Itlw7zMFHx/jUqOd2SJ
MD5 SHA1 SHA512 SSDEEP

Sharing

General

Malware Config

Signatures

File Explorer