file[.]exe | Triage™

resource
unpack001/$PLUGINSDIR/nsExec.dll

file.exe

IMPHASH f4639a0b3116c2cfc71144b88a929cfd
SHA256 9845acc424512cc5b0c67de96ce917624b5e80ee95ea4ea6a7cbc37b7c03ef63
MD5 7fbb332b55f872e61c8307e0b5242287
SHA1 b499466240ef01da4a2cf380d709752b2e44232a
SHA512 e813f006263b87a5078bca9c58b94567ac8df627b27d44411774b797bdd7095f9bebaff8a1d2f0329b8fc63016199ef7e04ec17d68ce28b250cd3da37c2e8d04
SSDEEP 12288:TfLdembnSidi8rrdTT4aQUh9IHUM1mPCeBxHnymwsXFDsiJjWlWVB0mPHp:TfLNnSsi8dTTCjmqePSrsXF4i7XPPJ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

54:59:b9:39:11:e3:4a:7b:56:be:0e:ee:c8:a0:ea:11:9d:39:87:f7:72:85:dc:1b:39:b3:ee:60:df:91:98:d6

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Dumdristig Cathetometer\ ,O=Nonculpably,L=Medaryville,ST=Indiana,C=US

Chains

Sep 23, 2024

Minor OS version

0

Major OS version

4

Entry point

13618

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegOpenKeyExW RegCreateKeyExW

shell32

SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW ShellExecuteExW

ole32

CoCreateInstance OleUninitialize OleInitialize IIDFromString CoTaskMemFree

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create

user32

MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW CreatePopupMenu AppendMenuW TrackPopupMenu OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW IsWindowEnabled SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CharPrevW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint CharNextA wsprintfA DispatchMessageW CreateWindowExW PeekMessageW GetSystemMetrics

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor

kernel32

lstrcmpiA CreateFileW GetTempFileNameW RemoveDirectoryW CreateProcessW CreateDirectoryW GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW WriteFile CopyFileW ExitProcess GetCurrentProcess GetModuleFileNameW GetFileSize GetTickCount Sleep SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW MulDiv lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject SetEnvironmentVariableW

$PLUGINSDIR/nsExec.dll

IMPHASH 68b7023f8923dd087549802f8fa631c3
SHA256 01e72332362345c415a7edcb366d6a1b52be9ac6e946fb9da49785c140ba1a4b
MD5 b4579bc396ace8cafd9e825ff63fe244
SHA1 32a87ed28a510e3b3c06a451d1f3d0ba9faf8d9c
SHA512 3a76e0e259a0ca12275fed922ce6e01bdfd9e33ba85973e80101b8025ef9243f5e32461a113bbcc6aa75e40894bb5d3a42d6b21045517b6b3cf12d76b4cfa36a
SSDEEP 96:JwzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuH0DQ:JTQHDb2vSuOc41ZfUNQZGdHM
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4231

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PROGRAMFILES/skydeselskabs/Camomiles.Bev

SHA256 b8408fc8df3cd3c0938d8314568b278d72cb102b8d128a11608cab75a2046b21
MD5 99eba9ecc95f62898e4df3aa12cb4624
SHA1 c21a35b90111b01c32c9e963b20aaa01b35658a6
SHA512 42b40c55dc01197d21b6dbb5c4d0ca77be2ca890a70fab1e0022defbde7204a8b19387915fe144b540333bdb72fde557e8f1673131830faf455aa0fb25e6a347
SSDEEP 1536:13twgdZfLUclpxZnFhI/8Qb+X/JDOsq3eJwdCzDzZier9:13qUFUclCzb+xDO/arr9
MD5 SHA1 SHA512 SSDEEP

$PROGRAMFILES/skydeselskabs/Tvangsforflytnings.Fus

SHA256 dbd8e48ed8e7ec0fbead479f69b3a733c33d2f814ef70161f7d65331cc069c02
MD5 b7996fe76d831f7949992da7e460b2f6
SHA1 ac086ba78fb87fd615a5c4b760ebb90057ebb46e
SHA512 4721f5d304b7077c29fb87923b8278e326e1eebb24446ba450445006c7976d75bd529a119af3e72da009ff4cc1907690417823ea95430962f35fffe598dd2f77
SSDEEP 6144:/UUvKKVQiIl/mdVzp9A2e3dLVKPbsKZpRqHrb5OmuwYjofT:MUvKKyAFOh3DwYKQuSfT
MD5 SHA1 SHA512 SSDEEP

Tjenestepligterne/rettersted.bef

SHA256 414bb9bb930f1269088cf9bf027667e6b9a4130e6e719e7c178406a8c8c3183e
MD5 78c7002a6c29415cea767894f99bdf01
SHA1 37b39af4e61d2a97d1b1aea54d1c3c3d8c3ad6d8
SHA512 a39b5656af287783ab4c5e211c148d2d233ab635e8d8c4870693d31267904e9c94a3bcc07b20f92c55f68bc7e6e2b5f1d22c6ed3f9b3a729cabd14b2e7b58d58
SSDEEP 1536:AfCPIKQLWsgBwj5eZNb+h+QkSGkJPsGyksKU:ATKZNbTQkSGky0sKU
MD5 SHA1 SHA512 SSDEEP

Tjenestepligterne/xenosaurid.txt

SHA256 50d950ee2f6cd5d31aaa35b913dc46c8eee3120b7444ef5ebb302b88851f3328
MD5 261f38f05e7de27da302c07b62e1f94d
SHA1 8d495d43fc7a2b40c52b8d31678f24b519257610
SHA512 62106a1d3608a63c12d6e9a7a00fd775ecd38193b779d4c13e18850230f1c7a1f0bd5df0602af5553f24bb0bad6703bb9dc00c09c14e91dd098ce4ec95050e47
MD5 SHA1 SHA512

afplingen.che

SHA256 7579e3606c789ed66e555d541f14bda6ecaea4b2eb7b7bc3a25e7c804b3ab48f
MD5 9f9ec5cb34b99692a4eac963634a7d82
SHA1 5c1c97f3b00365f6cdb43112d31d7dd3aa050870
SHA512 a574404306396b333f64fc16256c093ca1f2b6cf87e5675ed678f00de3b899ffe4a95cba4d1113b9c86b8c46549d06d7ab97930955f921cd73ae37d4067b1eb0
SSDEEP 768:7x19EzEPqdI04IDk5wH/o606sFjlhpHi98oiQErpn6jGW3LSSW1Vn+7xd4R89Z9u:13ujvdGpic/cN2q8+js/5/H
MD5 SHA1 SHA512 SSDEEP

forlggere.bov

SHA256 ce57c2dedaa3a0fd5f5c267f3336f5acb6109d00d31a98d4638d26a77939cefc
MD5 30c2c02fb78efaa65c6a38457a7dc4f6
SHA1 40aef6b9982695f88f0515104bfeeacfaf22feda
SHA512 8ac0b2e7831c801d7c4043195befc309f2c79be719ff0171d0a4e580671ebadd2f737c307a4aae2e548705cd11b24fe64f07c6e842d7dd5d3ccd88ea677bc7fa
SSDEEP 768:qlmssNPVJP2ri6hEVTp7WLL1GEOCTOemgej7kcwntQz2Y1drtNhgCV+AhB/7/dR+:5tvPloD3bnq3TzwesbDEfLeaz6oSzjU8
MD5 SHA1 SHA512 SSDEEP

file.exe

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/nsExec.dll

advapi32

user32

kernel32

generic

$PROGRAMFILES/skydeselskabs/Camomiles.Bev

$PROGRAMFILES/skydeselskabs/Tvangsforflytnings.Fus

Tjenestepligterne/rettersted.bef

Tjenestepligterne/xenosaurid.txt

afplingen.che

forlggere.bov

Sharing

General

Malware Config

Signatures

File Explorer

file.exe

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/nsExec.dll

advapi32

user32

kernel32

generic

$PROGRAMFILES/skydeselskabs/Camomiles.Bev

$PROGRAMFILES/skydeselskabs/Tvangsforflytnings.Fus

Tjenestepligterne/rettersted.bef

Tjenestepligterne/xenosaurid.txt

afplingen.che

forlggere.bov