16c111672e8f0becdc8ae2e860594f90N[.]exe

resource
unpack001/$PLUGINSDIR/System.dll

16c111672e8f0becdc8ae2e860594f90N.exe

IMPHASH 17b7d61bda0f7478e36d9ce3d4170680
SHA256 82121bc438a17d43f7c48b6b1744d74fdc5a4a5f59fb3aea87674e306c62278c
MD5 16c111672e8f0becdc8ae2e860594f90
SHA1 f27e4b0f3a5ed6b2f45fbb549d7669b8460ad302
SHA512 8dc9092ab67489f14b51dbc539e67e532477c6e82c05e20884905eb7276120874d34725f0f576c35d9c82619d2b04932ca5f1ef63c788a333cf0df06fbbbbc77
SSDEEP 12288:Kiu5LgA08Jh7fpCwTnQ9kA6+A83Gv2dwdWKX:e5L48JtgOQ9Bh3I2+gKX
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

30:0a:04:c2:dd:71:1e:1b:ba:68:c4:ec:71:ef:4f:2f:4c:92:2b:44:76:7a:25:70:f8:20:36:ae:99:fa:b6:40

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Transitivt Synchroscope Olympicness\ ,O=Forudberegnes,L=Laroque-de-Fa,ST=Occitanie,C=FR

Chains

Aug 22, 2024

Minor OS version

0

Major OS version

4

Entry point

13084

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathW SetFileTime CloseHandle GetShortPathNameW MoveFileW SetCurrentDirectoryW GetFileAttributesW GetLastError GetFullPathNameW CreateDirectoryW Sleep GetTickCount CreateFileW GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW ExitProcess SetEnvironmentVariableW GetWindowsDirectoryW SetFileAttributesW ExpandEnvironmentStringsW SetErrorMode LoadLibraryW lstrlenW lstrcpynW GetDiskFreeSpaceW GlobalUnlock GlobalLock CreateThread CreateProcessW RemoveDirectoryW lstrcmpiA GetTempFileNameW lstrcpyA lstrcpyW lstrcatW GetSystemDirectoryW GetVersion GetProcAddress LoadLibraryA GetModuleHandleA GetModuleHandleW lstrcmpiW lstrcmpW WaitForSingleObject GlobalFree GlobalAlloc LoadLibraryExW GetExitCodeProcess FreeLibrary WritePrivateProfileStringW GetCommandLineW GetTempPathW GetPrivateProfileStringW FindFirstFileW FindNextFileW DeleteFileW SetFilePointer MultiByteToWideChar FindClose MulDiv ReadFile WriteFile lstrlenA WideCharToMultiByte

user32

EndDialog ScreenToClient GetWindowRect RegisterClassW EnableMenuItem GetSystemMenu SetClassLongW IsWindowEnabled SetWindowPos GetSysColor GetWindowLongW SetCursor LoadCursorW CheckDlgButton GetMessagePos LoadBitmapW CallWindowProcW IsWindowVisible CloseClipboard SetClipboardData wsprintfW CreateWindowExW SystemParametersInfoW AppendMenuW CreatePopupMenu GetSystemMetrics SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharPrevW CharNextA wsprintfA DispatchMessageW PeekMessageW ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage GetDC SetWindowLongW LoadImageW SendMessageTimeoutW FindWindowExW EmptyClipboard OpenClipboard TrackPopupMenu EndPaint ShowWindow GetDlgItem IsWindow SetForegroundWindow

gdi32

SelectObject SetBkMode CreateFontIndirectW SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW ShellExecuteW SHFileOperationW

advapi32

RegCloseKey RegOpenKeyExW RegDeleteKeyW RegDeleteValueW RegEnumValueW RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumKeyW

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

CoCreateInstance CoTaskMemFree OleInitialize OleUninitialize

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 852047023ba0cae91c7a43365878613cfb4e64e36ff98c460e113d5088d68ef5
MD5 be2621a78a13a56cf09e00dd98488360
SHA1 75f0539dc6af200a07cdb056cddddec595c6cfd2
SHA512 b80cf1f678e6885276b9a1bfd9227374b2eb9e38bb20446d52ebe2c3dba89764aa50cb4d49df51a974478f3364b5dbcbc5b4a16dc8f1123b40c89c01725be3d1
SSDEEP 192:eB2HS+ihg200uWz947Wzvxu6v0MI7JOde+Ij5Z77dslFsE+:3S62Gw947ExuGDI7J8EF7KIE
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10041

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Rebar.snr

SHA256 ef79ab7633450ca34413a0e3e457a5dd66a1443a4dee95dd5908255c28db975d
MD5 8f888b97286c81c4873617b07ee78022
SHA1 b588da74274dfa7a63c76f679eea55fd623f4971
SHA512 b927b85ade5001803be44437767aca2621878b314793311da3adf93a5ba7e9bc22c3ad5dcb3e25bcfefedf1e1cea664992079fe6c29611ed48873c09008adda2
SSDEEP 3072:weZG+teqDiV95D1X0O6JgsfFqHRhPdHK7ZhyAY/VgeiBcN+UNKhcWh:2JD1XkFqHRhP87ZEAGsKLWvh
MD5 SHA1 SHA512 SSDEEP

Shoulderette.Pre226

SHA256 c458440064bc007f1b6a1f1a77d82d29379adaa7dd825401e07f816591023160
MD5 ebf0ef9e2af63e5610cd51d69bb3454a
SHA1 8c90fa62339c3ecce57e44c6026cba232a71c87d
SHA512 8763d519c2eeb1b87e24a22b737030f487d13c24bb573f5987927049985b2ae01981c8e96ce5883b124a8e4847b50379cfcae07b428af0379d89a6160934a1e5
SSDEEP 384:5/66I/aMorhDc/yw+p6lHGKaGWSJCheg3glzh288Cldt8hx:5S6ICLDktlmAng3W2qdyx
MD5 SHA1 SHA512 SSDEEP

anvendelsessteds.jer

SHA256 0053e209cd776bac7d6044ec7c31c98aa3b2e11781e05f9cc969f1467c748203
MD5 1c8d9a0509870eed740ea421f205e6d5
SHA1 351aa95ddc46bdb484f5b4df328de036404f67d6
SHA512 c4fed5299171b56c63b07c823af2e7ca0ac1e2ab7b200f39fbbce56a15360dfa1e269d952ee39742710a455b926cd99f4a7dc0ba6f142c56d52e2b6f1cd0b40f
SSDEEP 768:31meq1wz0OOldD/3Dp/pWhfldoPxJ4pHbD3rkX3mtDY/OPxBSPt/DVbyfhgQAqRb:31jMYpYsx2bkbDE06CLbymzS6
MD5 SHA1 SHA512 SSDEEP

fodsporet.txt

SHA256 348f73d878e5e513828f54f588b7eb31f3f45cfcfcb683708fbc499706a8e79d
MD5 156d3e157dbdf1074d2b0125e3167bbe
SHA1 31e903c303e1c903940b5b54a980b55f2a3236bc
SHA512 f58e9a710e614bd3c6ff34df0101d63ff96d0010f4347f584e5b3dfaa7ab1ee4b5252f48721eece614af59ee7ce101f2be0f6632f3e4a61e3079659f84bd8367
MD5 SHA1 SHA512

methylphenidate.sta

SHA256 82e60c9f43a4a7f5d9882db77e026b16b344d9e54a2d6d637efa3cc061ee7922
MD5 111d385a0ea18429bf24e6a2dff3b66c
SHA1 f3337713f47cc0cfcda4ac01c5c92b66f3f0e1d6
SHA512 0c5065affb4246f3374e76082300b35c18e8c4e2441fc7d580a0195a48470d513edc18442c8bf6a9f65eaa9c06429778a60108d31a394a6c5117008890ff1c4c
SSDEEP 768:ZC/gQyn3GMClUoNrZaKOQjXFIaMvsJPl15xlwTBoZi52CL9MbzljGZRSLMepuizl:ZJaUaDoHxX40AN
MD5 SHA1 SHA512 SSDEEP

refrustrating.ult

SHA256 a15198026ae7b84f2825e279a2721cbddafd799794733b0a004fa5fd39707878
MD5 dad31e1b64d71f12869931dff4748c74
SHA1 df3bfc71988c7f21438eebf7417c79f029554de2
SHA512 cac8b3290d37dc9a75ebd3eb5f53d4bd65de63616b5229e965132927ba83014203270e5b4e5e1d5a54c926b3e70e081f312dfebe09c98cd821fb0b396b54c93a
SSDEEP 768:kmB8fbBjdVDRJ2M+oBudGGmgi/vJtQiuHTAOqYu07d+jyAREhpZVONckfQ6aDiWN:RdSO3IwmGhTYX9SIuLz2h
MD5 SHA1 SHA512 SSDEEP

16c111672e8f0becdc8ae2e860594f90N.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Rebar.snr

Shoulderette.Pre226

anvendelsessteds.jer

fodsporet.txt

methylphenidate.sta

refrustrating.ult

Sharing

General

Malware Config

Signatures

File Explorer

16c111672e8f0becdc8ae2e860594f90N.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Rebar.snr

Shoulderette.Pre226

anvendelsessteds.jer

fodsporet.txt

methylphenidate.sta

refrustrating.ult