PaymentVolksbankEUR36550Bestellung4500673541[.]com[.]exe

resource
PaymentVolksbankEUR36550Bestellung4500673541.com.exe
unpack001/$PLUGINSDIR/System.dll

PaymentVolksbankEUR36550Bestellung4500673541.com.exe

IMPHASH b34f154ec913d2d2c435cbd644e91687
SHA256 bd4499ee1845b2eeadc364b26f6e5891aaa699945a1125e6fcceedaac87f9090
MD5 97249feaaa2dd67af540e7615533294c
SHA1 dbfde83716b7253d7640d2ae3b45774337ce5931
SHA512 c3dc5f9733e673f23d8d553e613a61fc9854a02f7f87a0305450cf34fb4f1c1be7ea011ac99fb1ee0a37a68a15ae6761948f2af9a5f03067cbf76a34568961a8
SSDEEP 12288:BTuHVrQ4WOKO7gN9GB5VG7K+M6HmPXMi+LO6Y1DLWqTylvQ9IFHepohIxFt7hxXO:twh/7Hy7K+zsXMTwAMWR9hoRR7jKzjrf
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

13136

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetEnvironmentVariableW SetFileAttributesW Sleep GetTickCount GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW SetCurrentDirectoryW GetFileAttributesW GetWindowsDirectoryW GetTempPathW GetCommandLineW GetVersion SetErrorMode lstrlenW lstrcpynW GetDiskFreeSpaceW ExitProcess GetShortPathNameW CreateThread GetLastError CreateDirectoryW CreateProcessW RemoveDirectoryW lstrcmpiA CreateFileW GetTempFileNameW WriteFile lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject lstrcmpiW MoveFileW GetFullPathNameW SetFileTime SearchPathW CompareFileTime lstrcmpW CloseHandle ExpandEnvironmentStringsW GlobalFree GlobalLock GlobalUnlock GlobalAlloc FindFirstFileW FindNextFileW DeleteFileW SetFilePointer ReadFile FindClose lstrlenA MulDiv MultiByteToWideChar WideCharToMultiByte GetPrivateProfileStringW WritePrivateProfileStringW FreeLibrary LoadLibraryExW GetModuleHandleW

user32

GetSystemMenu SetClassLongW EnableMenuItem IsWindowEnabled SetWindowPos GetSysColor GetWindowLongW SetCursor LoadCursorW CheckDlgButton GetMessagePos LoadBitmapW CallWindowProcW IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard ScreenToClient GetWindowRect GetDlgItem GetSystemMetrics SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharPrevW CharNextA wsprintfA DispatchMessageW PeekMessageW ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow GetDC SetTimer SetWindowTextW LoadImageW SetForegroundWindow ShowWindow IsWindow SetWindowLongW FindWindowExW TrackPopupMenu AppendMenuW CreatePopupMenu EndPaint CreateDialogParamW SendMessageTimeoutW wsprintfW PostQuitMessage

gdi32

SelectObject SetBkMode CreateFontIndirectW SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation ShellExecuteExW SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW

advapi32

AdjustTokenPrivileges RegCreateKeyExW RegOpenKeyExW SetFileSecurityW OpenProcessToken LookupPrivilegeValueW RegEnumValueW RegDeleteKeyW RegDeleteValueW RegCloseKey RegSetValueExW RegQueryValueExW RegEnumKeyW

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 c2f405d7402f815d0c3fadd9a50f0bbbb1bab9aa38fe347823478a2587299448
MD5 9625d5b1754bc4ff29281d415d27a0fd
SHA1 80e85afc5cccd4c0a3775edbb90595a1a59f5ce0
SHA512 dce52b640897c2e8dbfd0a1472d5377fa91fb9cf1aeff62604d014bccbe5b56af1378f173132abeb0edd18c225b9f8f5e3d3e72434aed946661e036c779f165b
SSDEEP 192:eX24sihno00Wfl97nH6BenXwWobpWBTtvShJ5omi7dJWjOlqSlS:D8QIl972eXqlWBFSt273YOlqz
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10178

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Hematologist/gutterblood.fri

SHA256 3bbda07c56de4470422589dd83fe0a6577965873efa5c8e5e83fe4f1aa63dcde
MD5 978130b080454ee75826e94eefac0db6
SHA1 eaae2b3999d26409c2940341400bbbab48469e17
SHA512 82495569f36bbdaad1148f0a690d46fa72473525529f0358df93f50be08ac15cfa4fcb80606c42ef8a53c0ccff4b2d0daefa04c58d9c401df53a82911d91f69e
SSDEEP 1536:Ts8u8aVK1ZlzjOxDzNWfy52aTmhK55zGW:K8sK1CnI855zj
MD5 SHA1 SHA512 SSDEEP

Hematologist/inexorable.aut

SHA256 ca79d9c3c8f6bca1c2312b3b03625465720f77fa069df8822c001852d8320174
MD5 f1cf1e2735a25fa7063ad6b83b19fc89
SHA1 fe722248a797fe002769ca18a81576296ab22403
SHA512 c1e23b6f6f1c61434be9b761d2012e3ebdba7f570a81b014762ea132f5de2ab99e0951307536640f546affc69759c0eff0f4d0f58771f18ee2f3e2c984fabd95
SSDEEP 768:bkh4Sjk4H7mPNEmlFSqrgoqOZzoC4SaD7V3dMpWrsmTKup6S0HoEoe+gndJDu4u/:+rmPjodMgqouK0WcnEuKSZoP2XkqBO
MD5 SHA1 SHA512 SSDEEP

Hematologist/milieustyrelses.byg

SHA256 ac86ac0c331bd0885eff6138aa0bfcba447dcc32bf53c764a3b350a24c121c27
MD5 3f90dddd63ae098601831a6e980c14a0
SHA1 4886fab60f9408ea1a4aeb3ecd0ddff3ee5cb6e4
SHA512 54a5a11acf41b7e0f8ad0765637fc9a0f376c61ca3630820f6c80424bc6b849999677eba2046bcc2586a5081ca26e8c01338306e0e3d55cbab9fd8a8830d07fa
SSDEEP 768:XMKYdIEXJwxgkl3KvWaEjMQdp2TWrOr8URnzMazeE3hLOPf9BYgTtTkYCkkpMkNx:FlaopMDh0BmrkYin5Q
MD5 SHA1 SHA512 SSDEEP

Hematologist/traumatically.fra

SHA256 c800df5007c632e89b1f61a7592f36e967bcaa8c37079c9bbdd2edbbc5381a61
MD5 6a1e16cba1445d499afe9eb6d8f6befc
SHA1 189c2e83500790659f5bd0d2d7b21823a6d7d93f
SHA512 81516187aaf31672e2b10183e73a3229fbd638b574e42c9b3acc2388b4cfba1f1c7184f9fe69521fa606306004697506a2783e1c98d3b458a18c4eec8a0694b2
SSDEEP 768:6F9p3t3IrbTwRROFJIPoWbqZKVaCGQUOVKxKEhhKjarIY5LJyyL0bbQUMEQOUI5x:uq2MfCdaCMrG7kLgaRkjpZOzNBK
MD5 SHA1 SHA512 SSDEEP

Hematologist/vennekredse.som

SHA256 08539c762bba9caed2ad7ea548ed678763ecfc8c4a2162658301ca7d5e17e24f
MD5 3df6ad4fbabfd56702af1cf7eba6b9cb
SHA1 b473dd3797ec446c80ebafc30f749939d1bae334
SHA512 d7fa42cc6c6c8f49e74bd0a42b393bd23434601444c99c7f42f2d9ae59701acfb9fb5f8700638a1c6b931810db93823c7734393221e854881349d93dd44f30e7
SSDEEP 768:7Gx4c5hFkUmQbJLYe2jSB5rZDPdg2xnkwzIGn59Yrg/VhmvCQyjVjCC51kotL6PX:m59NMhxMJVZWiEeZnw/2zso55+EhOt
MD5 SHA1 SHA512 SSDEEP

Navnefringers/Alkoholisters26.txt

SHA256 c863e9d0414c2e8c1cf7014287d672ddcaef38cf1ed91278bb9891820044251a
MD5 a057e0ce882029ea5b564143c84fc55a
SHA1 a86f7916a00cf922e1b01b69212029cf52037407
SHA512 8d606d6ed91e274afae731617751db4c90334d572ad236f6c0490f6df0c1cfdc2f17b8bde97a5dfaff5b5c04ae7eed9a23053a9a5758cdc1e84a2f786946a79b
MD5 SHA1 SHA512

Navnefringers/Mediumises.Res

SHA256 77f4a785d42c38ced298f98be916a76afc4333030c96aecb2ec726636ce0aab4
MD5 076998b5db516e7dd1352083b75c3867
SHA1 6a8ad850eceefc42e9dc5bbaf1b6e3fa8430c125
SHA512 a139d7c3211d5d8b657eb47196f475e54eb9d2186f569c2c072d796fa3dbd05bd90fd0d1989d687c8a070aadbb32089ee660d44184dd434e8fcb172c28249828
SSDEEP 6144:vl2jMI/BQsdWiJ34eRHMC76wUDbfRwKH4wd9vJfDfyzJzZ6LRy1:vAdWgIhbH4wd9vNDuV6LRq
MD5 SHA1 SHA512 SSDEEP

Navnefringers/Phagophobia.Unt

SHA256 9db44f12533260e8d5a445b0023b1a4e529f5047f466909607543171e207bf15
MD5 f13d4eb565aea7914bf5916a70319c9c
SHA1 255e6068fafc917282b962e20d1f606c02108eb6
SHA512 54ac471f48cc398650b43dcb39601c4ad94cdcc60d41f3fb1a31fb71a75a419a18f2c68796cdcded271dc386ea103267d33faddbb4aba9a918b72f68bf50f8e0
SSDEEP 384:goDwlL4a2PP/vhLlmNR0oECxvKyB9ZrpvECS7v7mSIsdyoRiSKH:gGi4JNl09yyvEjGlkIT
MD5 SHA1 SHA512 SSDEEP

PaymentVolksbankEUR36550Bestellung4500673541.com.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Hematologist/gutterblood.fri

Hematologist/inexorable.aut

Hematologist/milieustyrelses.byg

Hematologist/traumatically.fra

Hematologist/vennekredse.som

Navnefringers/Alkoholisters26.txt

Navnefringers/Mediumises.Res

Navnefringers/Phagophobia.Unt

Sharing

General

Malware Config

Signatures

File Explorer

PaymentVolksbankEUR36550Bestellung4500673541.com.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Hematologist/gutterblood.fri

Hematologist/inexorable.aut

Hematologist/milieustyrelses.byg

Hematologist/traumatically.fra

Hematologist/vennekredse.som

Navnefringers/Alkoholisters26.txt

Navnefringers/Mediumises.Res

Navnefringers/Phagophobia.Unt