a49b3780d9a1af972b0e6d252284edff3b00e35713336456579431f1081debe4[.]exe

resource
a49b3780d9a1af972b0e6d252284edff3b00e35713336456579431f1081debe4.exe
unpack001/$PLUGINSDIR/System.dll

a49b3780d9a1af972b0e6d252284edff3b00e35713336456579431f1081debe4.exe

IMPHASH e221f4f7d36469d53810a4b5f9fc8966
SHA256 a49b3780d9a1af972b0e6d252284edff3b00e35713336456579431f1081debe4
MD5 2e620407c0b25239ef46534a34217c27
SHA1 1751f775e9e9279757ec94c9f4cf63b01af42525
SHA512 14a0898606e1b8405edb8b790f65ee207e4fe3e1dfdc4f21c6a5014730e80cdc5bffaf9d5af54fc8070cc59fd4873c16a89736fd8dd7733f900a8c6d14755457
SSDEEP 12288:NtjALF2QGm6An6r2vvCi1JQhmlfwfmgpTxDFlvT:HYUQcAn66C+JQhml4bhx3T
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

13144

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathW SetFileTime CloseHandle GetShortPathNameW MoveFileW SetCurrentDirectoryW GetFileAttributesW GetLastError GetFullPathNameW CreateDirectoryW Sleep GetTickCount CreateFileW GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW ExitProcess SetEnvironmentVariableW GetWindowsDirectoryW SetFileAttributesW ExpandEnvironmentStringsW SetErrorMode LoadLibraryW lstrlenW lstrcpynW GetDiskFreeSpaceW GlobalUnlock GlobalLock CreateThread CreateProcessW RemoveDirectoryW lstrcmpiA GetTempFileNameW lstrcpyA lstrcpyW lstrcatW GetSystemDirectoryW GetVersion GetProcAddress LoadLibraryA GetModuleHandleA GetModuleHandleW lstrcmpiW lstrcmpW WaitForSingleObject GlobalFree GlobalAlloc LoadLibraryExW GetExitCodeProcess FreeLibrary WritePrivateProfileStringW GetCommandLineW GetTempPathW GetPrivateProfileStringW FindFirstFileW FindNextFileW DeleteFileW SetFilePointer ReadFile FindClose MulDiv MultiByteToWideChar WriteFile lstrlenA WideCharToMultiByte

user32

EndDialog ScreenToClient GetWindowRect RegisterClassW EnableMenuItem GetSystemMenu SetClassLongW IsWindowEnabled SetWindowPos GetSysColor GetWindowLongW SetCursor LoadCursorW CheckDlgButton GetMessagePos LoadBitmapW CallWindowProcW IsWindowVisible CloseClipboard SetClipboardData wsprintfW CreateWindowExW SystemParametersInfoW AppendMenuW CreatePopupMenu GetSystemMetrics SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharPrevW CharNextA wsprintfA DispatchMessageW PeekMessageW ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage GetDC SetWindowLongW LoadImageW SendMessageTimeoutW FindWindowExW EmptyClipboard OpenClipboard TrackPopupMenu EndPaint ShowWindow GetDlgItem IsWindow SetForegroundWindow

gdi32

SelectObject SetBkMode CreateFontIndirectW SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW ShellExecuteW SHFileOperationW

advapi32

RegCloseKey RegOpenKeyExW RegDeleteKeyW RegDeleteValueW RegEnumValueW RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumKeyW

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

CoCreateInstance CoTaskMemFree OleInitialize OleUninitialize

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 5a1c20a3e2e2eb182976977669f2c5d9f3104477e98f74d69d2434e79b92fdc3
MD5 7399323923e3946fe9140132ac388132
SHA1 728257d06c452449b1241769b459f091aabcffc5
SHA512 d6f28ba761351f374ae007c780be27758aea7b9f998e2a88a542eede459d18700adffe71abcb52b8a8c00695efb7ccc280175b5eeb57ca9a645542edfabb64f1
SSDEEP 192:eF2HS5ih/7i00dWz9T7PH6lOFcQMI5+Vw+bPFomi7dJWsP:rSUmlw9T7DmnI5+N273FP
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10134

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Discomplexion/Modulsystemernes.Tie

SHA256 915cd18120b0827afa12ca7d9c702a61f88541eed6d896779d62ba581251d573
MD5 a2f5f04e983190c0354c8362548f3af2
SHA1 241d36cb0f4490e394f914cb2876a2eecddd4f9a
SHA512 62a7b90aa0cff62a6ec316d312e39e786baeb008cec661ee4879e181353f82af3f9f6771c6390ce1071be42c38667897aa1e9af5d8b05d06dbbc21337bc449df
SSDEEP 3072:kalBfm7DD6XYVXaeQ9O6hE4omcKJV1ICwQYm64BoHSoQq1CIrJmbLd7:kD7DDAe2O6hE4ou1Ivm640SwEWJ+J7
MD5 SHA1 SHA512 SSDEEP

Discomplexion/Sengeheste.txt

SHA256 71f06ce6041a49f416d50e6bc6ff252d44a4829209b9778352d5f03c8120cea0
MD5 1459e91f25e94a3a75c331fee10ce27b
SHA1 98619c367b9c295221e9d419308a7160f927566b
SHA512 8fc53db6ecc6902d55ea0cafc09201feebf30b95b1613489d81031dbfb27f5d222f4ae29f5868081f9f864db11030b0de5234cb076c672ebf038b6df730da459
MD5 SHA1 SHA512

Discomplexion/Soldede.Phy

SHA256 eff5d379fc2733e5fd0860eb112e465a364bcb19c9f0652e4cfc57dd87f739d0
MD5 0667e0457cc4eb7e2455a757544890f9
SHA1 110f026c12e0c1a53fc59424741580adc6c1cbca
SHA512 a1e570e1b981e2aa8dc66d8909625e614e039e5052ce3f5c086f63f1400c45bd7dda23e316bc1b3341afcd8890e96f1681324c07b451821a8bee1743d7061d5b
SSDEEP 1536:4KsgyDvUmRMEiHVKTdrWTjI4h4UK0I5ZVAmKNXUArf7bGSlFEiKEz+gNufpwX81G:LCyQi1vNbGoj28h02QD4bpPM1ONP7
MD5 SHA1 SHA512 SSDEEP

Discomplexion/hulen.urh

SHA256 1a039c58a7d2ca90affcf28f5adba163ce0e38109a8e258e28d49f5d9a5e157c
MD5 731dfa6df00249cac29566287712db7e
SHA1 d0395a078edede1fff4b5f6921549257f9128864
SHA512 9f0586d745c8df4f12329e34e2bf7fcc78c6725e631c760aa912bd3628955e26d56aa466009c4948cb1253839d09ec7df6725c34a67e3b3b51670cb77ae01499
MD5 SHA1 SHA512

Discomplexion/isvintrene.gaf

SHA256 51a0a1d3b04f367ea6f0294222d49e1d351376577ace15734340092d11391081
MD5 3fb3828f8898d364f7ee5607547e6040
SHA1 9ea56eceb3d57ab5ae8d3434a157baecf424715f
SHA512 725671bf74696e2b502bc19352fff96ba9e7a58064fe83ebd1d4c693dc1b7083098a26c2174fa97aa9d3c832dd119b9c6f05e585e1633fb5c7733d2983842aa0
SSDEEP 384:YtjNZ40VIDz3Wddjx2SLfNmEmvgT4mvw/PuKWxidvyQey:YxbRk3WdFxtQ9vz/PXyly
MD5 SHA1 SHA512 SSDEEP

Discomplexion/rustling.avi

SHA256 5a12e8d8793e33175392d0743bce73e93f877dcb1d9933079a19add4161d6d97
MD5 46e9e6bf651e043a929b22b6e20b22c2
SHA1 c2e94b4ce6f9328a063b9a6e2427adf528735164
SHA512 caced7d9f3c38b93ff91ad7b6cf4ae86fc214b446ca62d8e5ba7678ee54364d7952a50987a03ced17fcc62d4b86cf4f03ddde0423070a4b009461c04f9428c97
SSDEEP 768:u4wnuDGKamnhCdUqMxoGyTM4XPYvMiCbR3dGLq:UmAdeoJ/Y7aRtr
MD5 SHA1 SHA512 SSDEEP

a49b3780d9a1af972b0e6d252284edff3b00e35713336456579431f1081debe4.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Discomplexion/Modulsystemernes.Tie

Discomplexion/Sengeheste.txt

Discomplexion/Soldede.Phy

Discomplexion/hulen.urh

Discomplexion/isvintrene.gaf

Discomplexion/rustling.avi

Sharing

General

Malware Config

Signatures

File Explorer

a49b3780d9a1af972b0e6d252284edff3b00e35713336456579431f1081debe4.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Discomplexion/Modulsystemernes.Tie

Discomplexion/Sengeheste.txt

Discomplexion/Soldede.Phy

Discomplexion/hulen.urh

Discomplexion/isvintrene.gaf

Discomplexion/rustling.avi