d322df678d8d8b40b30c463a51395a961b0a703a01523d6def82a4679b5729a6[.]exe

resource
d322df678d8d8b40b30c463a51395a961b0a703a01523d6def82a4679b5729a6.exe
unpack001/$PLUGINSDIR/System.dll

d322df678d8d8b40b30c463a51395a961b0a703a01523d6def82a4679b5729a6.exe

IMPHASH 84062c623770f0d888e4ca58451aa7ad
SHA256 d322df678d8d8b40b30c463a51395a961b0a703a01523d6def82a4679b5729a6
MD5 2a19eac38990809a62213e2b89be0f60
SHA1 99d231bc3c54c0d29469c97c4987329fd523fe20
SHA512 c5691f86d12f6263405d44288f0ca918dccb8ecd131010053cb12b4989587257935fd0f219ae06f36f79a30fba123596569cdcd0c65a342db2d68583f6a56d11
SSDEEP 24576:ZFZsHTO9u9XKhrmooaiw6J/xJ3hLGdftX8P2J8:Z3n9i6BiwW5J3lStMPm8
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

14340

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCloseKey RegDeleteKeyW RegDeleteValueW RegEnumKeyW RegEnumValueW RegQueryValueExW RegSetValueExW OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueW SetFileSecurityW RegCreateKeyExW RegOpenKeyExW

shell32

SHFileOperationW SHBrowseForFolderW SHGetPathFromIDListW SHGetFileInfoW ShellExecuteExW

ole32

OleInitialize OleUninitialize CoTaskMemFree IIDFromString CoCreateInstance

comctl32

ord17 ImageList_Destroy ImageList_AddMasked ImageList_Create

user32

PeekMessageW DispatchMessageW wsprintfA SystemParametersInfoW SetClassLongW GetWindowLongW GetSysColor ScreenToClient SetCursor GetWindowRect TrackPopupMenu AppendMenuW EnableMenuItem CreatePopupMenu GetSystemMenu GetSystemMetrics IsWindowEnabled EmptyClipboard SetClipboardData CloseClipboard OpenClipboard CheckDlgButton EndDialog DialogBoxParamW IsWindowVisible SetWindowPos CreateWindowExW GetClassInfoW SetDlgItemTextW CallWindowProcW GetMessagePos CharNextW ExitWindowsEx SetWindowTextW SetTimer CreateDialogParamW DestroyWindow LoadImageW FindWindowExW SetWindowLongW InvalidateRect ReleaseDC GetDC SetForegroundWindow EnableWindow GetDlgItem ShowWindow IsWindow PostQuitMessage SendMessageTimeoutW SendMessageW wsprintfW FillRect GetClientRect EndPaint BeginPaint DrawTextW DefWindowProcW GetDlgItemTextW CharNextA CharPrevW RegisterClassW MessageBoxIndirectW LoadCursorW

gdi32

SetBkMode CreateBrushIndirect GetDeviceCaps SelectObject DeleteObject SetBkColor SetTextColor CreateFontIndirectW

kernel32

GetLastError WaitForSingleObject GetExitCodeProcess RemoveDirectoryW GetTempFileNameW CreateDirectoryW WideCharToMultiByte lstrlenW lstrcpynW GlobalLock GlobalUnlock CreateThread GetDiskFreeSpaceW CopyFileW GetVersionExW GetWindowsDirectoryW ExitProcess GetCurrentProcess SetErrorMode CreateProcessW SetEnvironmentVariableW GetCommandLineW GetModuleFileNameW GetTickCount GetFileSize CreateFileW MultiByteToWideChar MoveFileW WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA lstrcmpiW lstrcmpW MulDiv GlobalFree GlobalAlloc LoadLibraryExW GetModuleHandleW FreeLibrary Sleep CloseHandle SetFileTime SetFilePointer SetFileAttributesW ReadFile GetShortPathNameW GetFullPathNameW GetFileAttributesW FindNextFileW FindFirstFileW FindClose DeleteFileW CompareFileTime SearchPathW SetCurrentDirectoryW ExpandEnvironmentStringsW WriteFile MoveFileExW GetSystemDirectoryW GetModuleHandleA GetProcAddress lstrcmpiA lstrcpyA lstrcatW GetTempPathW

$PLUGINSDIR/System.dll

IMPHASH 4f33ea844b96a31c8f4690530ba63854
SHA256 a4ec98011ef99e595912718c1a1bf1aa67bfc2192575729d42f559d01f67b95c
MD5 d968cb2b98b83c03a9f02dd9b8df97dc
SHA1 d784c9b7a92dce58a5038beb62a48ff509e166a0
SHA512 2ee41dc68f329a1519a8073ece7d746c9f3bf45d8ef3b915deb376af37e26074134af5f83c8af0fe0ab227f0d1acca9f37e5ca7ae37c46c3bcc0331fe5e2b97e
SSDEEP 192:CVA1YOTDExj7EFrYCT4E8y3hoSdtTgwF43E7QbGPXI9uIc6w79Mw:CrR7SrtTv53tdtTgwF4SQbGPX36wJMw
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

6730

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Disintrench223.Lrl

SHA256 546ee04ebf7f2c7b904ddfeb054d8ec27963af1cbb9cd28503b58ed55206408f
MD5 a71e9d6209889f11905fa3c40b25b42e
SHA1 91f72eaa951aa2624be666b602f638b57a7b33d4
SHA512 3a7eeae9b391bbc7f4a4b8b89c46120f5a8fd07a7c58a86a01d0675f0df9e3ac485896b3232846ffddb509f1cf1be04485ec6d01c53f98b1852bc4bb7cb7fb3f
SSDEEP 6144:0wrXUVnR5dk609ys1b9uKjiYREmJc3SAJDmsfPLpnMADa:R+R5dzWt1biogJD9P9PDa
MD5 SHA1 SHA512 SSDEEP

Opsamlingsbeholdere119.bes

SHA256 2587546927274a33be48c542ad1b98e07df0c2a8503afbc1f260ebec1cb13ede
MD5 a6b0286190ff25673a5bbcca3e635e17
SHA1 b50d863e08054654434eeead618ae36d66f5ad59
SHA512 1f9c0f6cd3be6f79168bbd9b07931181cae135d144da4e569191e42bf66c5af0be49c894e1608a4c45c3be38dfd47eb912cba4dadb660a688474b1a3f2acc72e
SSDEEP 768:r1/VRVN7GaY97mbexftA4Z+RRCLDHuPxfARLhzR+9wBhtOxALX5Wa/5X6dJddvt2:LMxA4/Lf6dHgeGxN37ruZwuLi+OLj
MD5 SHA1 SHA512 SSDEEP

Viagram.Chi

SHA256 a310fd8300fbd0c22c5d74651fd028ded78518553f90e4ad69731a5cdf51aec8
MD5 22303fbb1d25c1b276ae5f8e751ff4b2
SHA1 abfa7710a6f1956c7fb30db43ccad36a7e6d8235
SHA512 12043f6859aada73c9468a3287437881a765dc6790e7fa496a2fe51679ec636b051c2f366797bfd5c1d06d87686e03f81fda1f5772b4cfcc240b864f48c41ef7
SSDEEP 1536:vdv//aYeUak0vzEsZibc/ZZ+LLRf2B5s+/yb1fEyHLkyC/DON2DnxX0m:Jhak0rYbgZZQf2g+/k8EYyC/K4DKm
MD5 SHA1 SHA512 SSDEEP

ammunitionsfabrikken.txt

SHA256 e619e25d31210ded72b4dbae631948d4335aeae318148e864421457ef0f4ace9
MD5 87f4b14cca6f39d1c934f93b13234749
SHA1 9fcdd0ead74ee185f49409e0ffe86b1925cc6f77
SHA512 13db40313fef1fdeb1d517e0664b7766328dd7dc7244741ff6b6eae62c6d0ba5ee458e058375c466c9cb6062e0d7dcc3ec3f57310604a7372f79839acafe9471
MD5 SHA1 SHA512

teleph.all

SHA256 480d36cf0de68beae5f1ed80a81aee327bba323c7b01a478e5d41bf429041f02
MD5 6957ac2ffff57f658f70a8608c653d42
SHA1 a6764fe4f4fcdd48c73cb23ccca9ce19e2845935
SHA512 0b2575bdbb7de38a6d5c2d1d5c8641ec7a65f9f05e2da8cfad8f09ce47c31eeea70c891a8a42a4842f27215deddb69357de9293d57c5ecfb19cc6007b1042505
SSDEEP 768:kFtpdTjsz/zhmhiCGrJI7rqVQuEB7QCGqvL2f0SQ1E2IC67MpqrchPadg+nlwAGP:mPGDDdQxvn1Xmrizhj8H3hE3MA
MD5 SHA1 SHA512 SSDEEP

d322df678d8d8b40b30c463a51395a961b0a703a01523d6def82a4679b5729a6.exe

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Disintrench223.Lrl

Opsamlingsbeholdere119.bes

Viagram.Chi

ammunitionsfabrikken.txt

teleph.all

Sharing

General

Malware Config

Signatures

File Explorer

d322df678d8d8b40b30c463a51395a961b0a703a01523d6def82a4679b5729a6.exe

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Disintrench223.Lrl

Opsamlingsbeholdere119.bes

Viagram.Chi

ammunitionsfabrikken.txt

teleph.all