e4ed3892cc2c77e7de57a5fc47040118740b1a672747f72193ed065570a55b38[.]exe

resource
e4ed3892cc2c77e7de57a5fc47040118740b1a672747f72193ed065570a55b38.exe
unpack001/$PLUGINSDIR/System.dll

e4ed3892cc2c77e7de57a5fc47040118740b1a672747f72193ed065570a55b38.exe

IMPHASH b34f154ec913d2d2c435cbd644e91687
SHA256 e4ed3892cc2c77e7de57a5fc47040118740b1a672747f72193ed065570a55b38
MD5 50ad24c74502951d0bec1507ca050c46
SHA1 392235b1cf28c1e5e5c4ce98922b472d80fb8d0c
SHA512 e06ac807482380f9b1986f1b064ee215716095aac4350d9427baeeda5a6bfc4a302b048788a3d187e9131620f032e0a6476cbff5f6db9eb2420a56ecbaade5d8
SSDEEP 24576:twh/C6tZbwDaudTLF9AMWR9hoRR7jKzjrh:twE6tZ6dT/A5ORlKzj1
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

13136

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetEnvironmentVariableW SetFileAttributesW Sleep GetTickCount GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW SetCurrentDirectoryW GetFileAttributesW GetWindowsDirectoryW GetTempPathW GetCommandLineW GetVersion SetErrorMode lstrlenW lstrcpynW GetDiskFreeSpaceW ExitProcess GetShortPathNameW CreateThread GetLastError CreateDirectoryW CreateProcessW RemoveDirectoryW lstrcmpiA CreateFileW GetTempFileNameW WriteFile lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject lstrcmpiW MoveFileW GetFullPathNameW SetFileTime SearchPathW CompareFileTime lstrcmpW CloseHandle ExpandEnvironmentStringsW GlobalFree GlobalLock GlobalUnlock GlobalAlloc FindFirstFileW FindNextFileW DeleteFileW SetFilePointer ReadFile FindClose lstrlenA MulDiv MultiByteToWideChar WideCharToMultiByte GetPrivateProfileStringW WritePrivateProfileStringW FreeLibrary LoadLibraryExW GetModuleHandleW

user32

GetSystemMenu SetClassLongW EnableMenuItem IsWindowEnabled SetWindowPos GetSysColor GetWindowLongW SetCursor LoadCursorW CheckDlgButton GetMessagePos LoadBitmapW CallWindowProcW IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard ScreenToClient GetWindowRect GetDlgItem GetSystemMetrics SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharPrevW CharNextA wsprintfA DispatchMessageW PeekMessageW ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow GetDC SetTimer SetWindowTextW LoadImageW SetForegroundWindow ShowWindow IsWindow SetWindowLongW FindWindowExW TrackPopupMenu AppendMenuW CreatePopupMenu EndPaint CreateDialogParamW SendMessageTimeoutW wsprintfW PostQuitMessage

gdi32

SelectObject SetBkMode CreateFontIndirectW SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation ShellExecuteExW SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW

advapi32

AdjustTokenPrivileges RegCreateKeyExW RegOpenKeyExW SetFileSecurityW OpenProcessToken LookupPrivilegeValueW RegEnumValueW RegDeleteKeyW RegDeleteValueW RegCloseKey RegSetValueExW RegQueryValueExW RegEnumKeyW

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 c2f405d7402f815d0c3fadd9a50f0bbbb1bab9aa38fe347823478a2587299448
MD5 9625d5b1754bc4ff29281d415d27a0fd
SHA1 80e85afc5cccd4c0a3775edbb90595a1a59f5ce0
SHA512 dce52b640897c2e8dbfd0a1472d5377fa91fb9cf1aeff62604d014bccbe5b56af1378f173132abeb0edd18c225b9f8f5e3d3e72434aed946661e036c779f165b
SSDEEP 192:eX24sihno00Wfl97nH6BenXwWobpWBTtvShJ5omi7dJWjOlqSlS:D8QIl972eXqlWBFSt273YOlqz
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10178

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Absented127/traumatically.fra

SHA256 c800df5007c632e89b1f61a7592f36e967bcaa8c37079c9bbdd2edbbc5381a61
MD5 6a1e16cba1445d499afe9eb6d8f6befc
SHA1 189c2e83500790659f5bd0d2d7b21823a6d7d93f
SHA512 81516187aaf31672e2b10183e73a3229fbd638b574e42c9b3acc2388b4cfba1f1c7184f9fe69521fa606306004697506a2783e1c98d3b458a18c4eec8a0694b2
SSDEEP 768:6F9p3t3IrbTwRROFJIPoWbqZKVaCGQUOVKxKEhhKjarIY5LJyyL0bbQUMEQOUI5x:uq2MfCdaCMrG7kLgaRkjpZOzNBK
MD5 SHA1 SHA512 SSDEEP

Alkoholisters26.txt

SHA256 c863e9d0414c2e8c1cf7014287d672ddcaef38cf1ed91278bb9891820044251a
MD5 a057e0ce882029ea5b564143c84fc55a
SHA1 a86f7916a00cf922e1b01b69212029cf52037407
SHA512 8d606d6ed91e274afae731617751db4c90334d572ad236f6c0490f6df0c1cfdc2f17b8bde97a5dfaff5b5c04ae7eed9a23053a9a5758cdc1e84a2f786946a79b
MD5 SHA1 SHA512

Bangladeshers.Fag

SHA256 3cae47c75bbf9311c3966163f767afd5ce2b73d88cadc5b482487b4df1074afa
MD5 c7bf2d747d1defecbbf177e8ca8e0a60
SHA1 a2a56f36391500c40f35b2c806e6dbccf9034306
SHA512 fd07de0a858663bc1a83473aa7d7fd575f95eb8d4b9390b7270c4d2f3b42bb1788f8f46eaabd2441ea16c62330fcdabd1aa3b582f94ead33b5861ede0f69f580
SSDEEP 6144:8Xg71tfBj9TJpD37tDWCNSO8l6r9s+n5wQo36CYZn1eqi:8yBRVzXNSOmosAwZ3UZ1eqi
MD5 SHA1 SHA512 SSDEEP

Predive.Arb

SHA256 cde7cf0875155bb564a50f409d0be820fa9cce7c83282a7bae4a66fa9414b63e
MD5 172aa18e4c5835ed9b5c81d0e4a1bccf
SHA1 1be5b60f8dc4f7d0a20e9923e76e0f3fe050b4a4
SHA512 f9a6e0920622ae8cd164125abd17ec4245561f5ee0599aeb3922007eaca2cb2ab82ef971b7540cbad28c7089d7e2c33130ee0a4163ba3af90b83e0cf49d925e9
SSDEEP 192:BKg1zAFz9m8cE1cfe6o9aRAeo/tGTscitMzDmo6FlkBTFlvnb9uWIK5HStmkd3e:EFzg8cE1AeFAAJusBgWlA5tnbQWIwy0
MD5 SHA1 SHA512 SSDEEP

gutterblood.fri

SHA256 3bbda07c56de4470422589dd83fe0a6577965873efa5c8e5e83fe4f1aa63dcde
MD5 978130b080454ee75826e94eefac0db6
SHA1 eaae2b3999d26409c2940341400bbbab48469e17
SHA512 82495569f36bbdaad1148f0a690d46fa72473525529f0358df93f50be08ac15cfa4fcb80606c42ef8a53c0ccff4b2d0daefa04c58d9c401df53a82911d91f69e
SSDEEP 1536:Ts8u8aVK1ZlzjOxDzNWfy52aTmhK55zGW:K8sK1CnI855zj
MD5 SHA1 SHA512 SSDEEP

inexorable.aut

SHA256 ca79d9c3c8f6bca1c2312b3b03625465720f77fa069df8822c001852d8320174
MD5 f1cf1e2735a25fa7063ad6b83b19fc89
SHA1 fe722248a797fe002769ca18a81576296ab22403
SHA512 c1e23b6f6f1c61434be9b761d2012e3ebdba7f570a81b014762ea132f5de2ab99e0951307536640f546affc69759c0eff0f4d0f58771f18ee2f3e2c984fabd95
SSDEEP 768:bkh4Sjk4H7mPNEmlFSqrgoqOZzoC4SaD7V3dMpWrsmTKup6S0HoEoe+gndJDu4u/:+rmPjodMgqouK0WcnEuKSZoP2XkqBO
MD5 SHA1 SHA512 SSDEEP

milieustyrelses.byg

SHA256 ac86ac0c331bd0885eff6138aa0bfcba447dcc32bf53c764a3b350a24c121c27
MD5 3f90dddd63ae098601831a6e980c14a0
SHA1 4886fab60f9408ea1a4aeb3ecd0ddff3ee5cb6e4
SHA512 54a5a11acf41b7e0f8ad0765637fc9a0f376c61ca3630820f6c80424bc6b849999677eba2046bcc2586a5081ca26e8c01338306e0e3d55cbab9fd8a8830d07fa
SSDEEP 768:XMKYdIEXJwxgkl3KvWaEjMQdp2TWrOr8URnzMazeE3hLOPf9BYgTtTkYCkkpMkNx:FlaopMDh0BmrkYin5Q
MD5 SHA1 SHA512 SSDEEP

vennekredse.som

SHA256 08539c762bba9caed2ad7ea548ed678763ecfc8c4a2162658301ca7d5e17e24f
MD5 3df6ad4fbabfd56702af1cf7eba6b9cb
SHA1 b473dd3797ec446c80ebafc30f749939d1bae334
SHA512 d7fa42cc6c6c8f49e74bd0a42b393bd23434601444c99c7f42f2d9ae59701acfb9fb5f8700638a1c6b931810db93823c7734393221e854881349d93dd44f30e7
SSDEEP 768:7Gx4c5hFkUmQbJLYe2jSB5rZDPdg2xnkwzIGn59Yrg/VhmvCQyjVjCC51kotL6PX:m59NMhxMJVZWiEeZnw/2zso55+EhOt
MD5 SHA1 SHA512 SSDEEP

e4ed3892cc2c77e7de57a5fc47040118740b1a672747f72193ed065570a55b38.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Absented127/traumatically.fra

Alkoholisters26.txt

Bangladeshers.Fag

Predive.Arb

gutterblood.fri

inexorable.aut

milieustyrelses.byg

vennekredse.som

Sharing

General

Malware Config

Signatures

File Explorer

e4ed3892cc2c77e7de57a5fc47040118740b1a672747f72193ed065570a55b38.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Absented127/traumatically.fra

Alkoholisters26.txt

Bangladeshers.Fag

Predive.Arb

gutterblood.fri

inexorable.aut

milieustyrelses.byg

vennekredse.som