rpedido-002297[.]exe

resource
unpack001/$PLUGINSDIR/System.dll

rpedido-002297.exe

IMPHASH 1f23f452093b5c1ff091a2f9fb4fa3e9
SHA256 643a505fefdbf1f0fa9915550a75b2b739aba1683858f92f332c9585c838690d
MD5 e7b674773e7c72426b2bcc90a9c1e299
SHA1 174323edc68682341dd312095cefaa2c6680de24
SHA512 88775e285072fd73cc42eb162b30f81197830befe7751529b4dc3a4d021571a17b90323805236149683097850916cc534205467ed0f584f67cb79b029f771ddb
SSDEEP 12288:TaIq2S5iC8dHsPeOXHO80cE6PU2dLkbdG0A:WrJ8MLXHO8ZE6PU4IdGb
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

46:39:7a:79:89:fb:b7:24:f6:25:4c:9a:67:c5:66:9e:16:4e:9b:d5:67:82:c4:9c:17:61:c6:b8:34:65:c1:47

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Sulfovaskemiddel Tykhana\ ,L=Courbette,ST=Bourgogne-Franche-Comté,C=FR,1.2.840.113549.1.9.1=#0c1853747265657466756c40426f7274676161656465732e506f

Chains

Sep 30, 2024

PE Signature issue

Digest

7a:52:a4:f5:4d:f0:de:62:44:54:93:12:43:cf:39:f1:11:6d:54:d0

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Sulfovaskemiddel Tykhana\ ,L=Courbette,ST=Bourgogne-Franche-Comté,C=FR,1.2.840.113549.1.9.1=#0c1853747265657466756c40426f7274676161656465732e506f

Chains

Sep 30, 2024

Minor OS version

0

Major OS version

4

Entry point

13449

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

ExitProcess SetFileAttributesW Sleep GetTickCount CreateFileW GetFileSize GetModuleFileNameW GetCurrentProcess SetCurrentDirectoryW GetFileAttributesW SetEnvironmentVariableW GetWindowsDirectoryW GetTempPathW GetCommandLineW GetVersion SetErrorMode lstrlenW lstrcpynW CopyFileW GetShortPathNameW GlobalLock CreateThread GetLastError CreateDirectoryW CreateProcessW RemoveDirectoryW lstrcmpiA GetTempFileNameW WriteFile lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject lstrcmpiW MoveFileW GetFullPathNameW SetFileTime SearchPathW CompareFileTime lstrcmpW CloseHandle ExpandEnvironmentStringsW GlobalFree GlobalUnlock GetDiskFreeSpaceW GlobalAlloc FindFirstFileW FindNextFileW DeleteFileW SetFilePointer ReadFile FindClose lstrlenA MulDiv MultiByteToWideChar WideCharToMultiByte GetPrivateProfileStringW WritePrivateProfileStringW FreeLibrary LoadLibraryExW GetModuleHandleW

user32

GetSystemMenu SetClassLongW EnableMenuItem IsWindowEnabled SetWindowPos GetSysColor GetWindowLongW SetCursor LoadCursorW CheckDlgButton GetMessagePos LoadBitmapW CallWindowProcW IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard ScreenToClient GetWindowRect GetDlgItem GetSystemMetrics SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharPrevW CharNextA wsprintfA DispatchMessageW PeekMessageW ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow GetDC SetTimer SetWindowTextW LoadImageW SetForegroundWindow ShowWindow IsWindow SetWindowLongW FindWindowExW TrackPopupMenu AppendMenuW CreatePopupMenu EndPaint CreateDialogParamW SendMessageTimeoutW wsprintfW PostQuitMessage

gdi32

SelectObject SetBkMode CreateFontIndirectW SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation ShellExecuteExW SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW

advapi32

AdjustTokenPrivileges RegCreateKeyExW RegOpenKeyExW SetFileSecurityW OpenProcessToken LookupPrivilegeValueW RegEnumValueW RegDeleteKeyW RegDeleteValueW RegCloseKey RegSetValueExW RegQueryValueExW RegEnumKeyW

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 f004c568d305cd95edbd704166fcd2849d395b595dff814bcc2012693527ac37
MD5 8b3830b9dbf87f84ddd3b26645fed3a0
SHA1 223bef1f19e644a610a0877d01eadc9e28299509
SHA512 d13cfd98db5ca8dc9c15723eee0e7454975078a776bce26247228be4603a0217e166058ebadc68090afe988862b7514cb8cb84de13b3de35737412a6f0a8ac03
SSDEEP 192:ex24sihno00Wfl97nH6BenXwWobpWBTtvShJ5omi7dJWjOlESlS:h8QIl972eXqlWBFSt273YOlEz
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10178

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Sarcocol/Betalingsunderskud.Smm

SHA256 c80bc0a5cd1c7295e310d27454c2cd1438f062297f12433564837fe39c32f479
MD5 4c93c9da5c351928e690ba82e7ea51ed
SHA1 dbfc7eab1b5446ef9a4c6673ecd6da0aed7df929
SHA512 399434f31ede0992f21de34321bed26d85af9a4f0b065c9922323407ec1f81a2c3e833bff8d2eb35edcdbd9ecfc9c84d7bf5459f0924ad5b3604c99af24e5746
SSDEEP 3072:uR0DAmxNwraiNN+kTsdoA2lk0XVaCsDpl+mKFUk/O+mJkxbFxh7nQwMYMfv1h:pUmxNwfNKqVVaCsVlOW+0sQrz1h
MD5 SHA1 SHA512 SSDEEP

Sarcocol/bushers.txt

SHA256 3bf02f982a76a4c896fda78c1c4b2b730d690dd86475213dc415269d4629407b
MD5 b33890a43fb0f38b6ddf18c5bcefe234
SHA1 80ed178a92c2b5cb530aee4673ffc9011ebf86bb
SHA512 169e2d067337bf05ba08d615ce61b28ca4fd93d204966b3386fb4b373d9bacd689bee3ddc5e04a4f19586e585263f62bc40b0944a10e5867c63c9c7236a5cc48
MD5 SHA1 SHA512

Sarcocol/driegh.Con

SHA256 131426a455a67f672fd3cc645daff157271ea00bd7f9251dc11616e505fb8363
MD5 6d112d7139da3c2b95e45a9885b68a26
SHA1 5174e64719ceaccd6c36a7a69e42e03a3217304e
SHA512 8760b49d141524f78bac8f4346a96e1956b191a4fd5367e66b8368e208c0bf8aeb19491da5253152127c07dbc921089c6558ca01fe477dbad80ea366a7e9c8a7
SSDEEP 1536:jcOEWRDhfuU13yxwqLrAXH0H62PNH+slLE4QBF0GtpzkyzoG0QNRVE3kN0hViJam:HeZwNhQQuzfQ0Abmj1lY0dNLUMDIE/ZY
MD5 SHA1 SHA512 SSDEEP

Sarcocol/meropidae.kej

SHA256 0628fa8f44795d79d5b855e8387985e04d134e8b57fe4d57e663fbaed278df89
MD5 0071dc51c79f0655f0bb77074d56b1d7
SHA1 9617ae1434b07532baaf39d69cf720c05b85e8f9
SHA512 e2149e9f3b18dcb50e49ec51226d7a6bf3969e119b385410e80e431024b25a938c965c743d80c0c1d8a3820d0ddda14464cac75f73ae22f259b447264f8431ba
SSDEEP 768:q5eLWls2nEEvz9mAEPesDf7zRhfRKrtTgtOnumyYJBW+JAILJcqhOzwnasNP2r2J:q86nLDJnJuki2BaFsfRz
MD5 SHA1 SHA512 SSDEEP

Sarcocol/plastron.ori

SHA256 c19f7b3f1a20e1529113ee69aa53db6e124a51f03098e6fb6af0e76037c85b8b
MD5 7ba8e260d6477b4fd16dae2d14ea4482
SHA1 16873cb5bfba899d4ed937603aa9980f119695d6
SHA512 ecaa786515c73b08a44c22fd48b205166611750ec633849823a88bbf95a675ca29fb7f22e652efcfc055fc92f8381fc6276f4b732f91612a2385bf670131fff2
SSDEEP 1536:8IfJmHKeJzuGrd0myk0Ek5rFnJd62xZ9WEmaslkcO:8omHKAJR0T8axr
MD5 SHA1 SHA512 SSDEEP

rpedido-002297.exe

PE Signature issue

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Sarcocol/Betalingsunderskud.Smm

Sarcocol/bushers.txt

Sarcocol/driegh.Con

Sarcocol/meropidae.kej

Sarcocol/plastron.ori

Sharing

General

Malware Config

Signatures

File Explorer

rpedido-002297.exe

PE Signature issue

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Sarcocol/Betalingsunderskud.Smm

Sarcocol/bushers.txt

Sarcocol/driegh.Con

Sarcocol/meropidae.kej

Sarcocol/plastron.ori