e3fe07f87b41a5b796c4bf9d657c482367668ea4de33fa86bf6bc75b9904357f[.]exe

resource
e3fe07f87b41a5b796c4bf9d657c482367668ea4de33fa86bf6bc75b9904357f.exe
unpack001/$PLUGINSDIR/System.dll

e3fe07f87b41a5b796c4bf9d657c482367668ea4de33fa86bf6bc75b9904357f.exe

IMPHASH e221f4f7d36469d53810a4b5f9fc8966
SHA256 e3fe07f87b41a5b796c4bf9d657c482367668ea4de33fa86bf6bc75b9904357f
MD5 3ac10da2561b50bc38b8c8e328850965
SHA1 4fcd399954d96ff5ed99e1e142049441ff40e5e9
SHA512 32652516c763628831e9fde805054cd706d1a32f67569f6187ea5198f580c7aecfa3d5fecb1f808e5e060837aba9bbf1cd182285e2161d8945a727cc1f54ca1b
SSDEEP 24576:RYPWVKIQMfAmKIPHi70rXV0TP0TDAS3y7zIeYOCW/yVXiCIVl1:REW0IQYfw0dnguxW+Xi9Vn
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

13146

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathW SetFileTime CloseHandle GetShortPathNameW MoveFileW SetCurrentDirectoryW GetFileAttributesW GetLastError GetFullPathNameW CreateDirectoryW Sleep GetTickCount CreateFileW GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW ExitProcess SetEnvironmentVariableW GetWindowsDirectoryW SetFileAttributesW ExpandEnvironmentStringsW SetErrorMode LoadLibraryW lstrlenW lstrcpynW GetDiskFreeSpaceW GlobalUnlock GlobalLock CreateThread CreateProcessW RemoveDirectoryW lstrcmpiA GetTempFileNameW lstrcpyA lstrcpyW lstrcatW GetSystemDirectoryW GetVersion GetProcAddress LoadLibraryA GetModuleHandleA GetModuleHandleW lstrcmpiW lstrcmpW WaitForSingleObject GlobalFree GlobalAlloc LoadLibraryExW GetExitCodeProcess FreeLibrary WritePrivateProfileStringW GetCommandLineW GetTempPathW GetPrivateProfileStringW FindFirstFileW FindNextFileW DeleteFileW SetFilePointer ReadFile FindClose MulDiv MultiByteToWideChar WriteFile lstrlenA WideCharToMultiByte

user32

EndDialog ScreenToClient GetWindowRect RegisterClassW EnableMenuItem GetSystemMenu SetClassLongW IsWindowEnabled SetWindowPos GetSysColor GetWindowLongW SetCursor LoadCursorW CheckDlgButton GetMessagePos LoadBitmapW CallWindowProcW IsWindowVisible CloseClipboard SetClipboardData wsprintfW CreateWindowExW SystemParametersInfoW AppendMenuW CreatePopupMenu GetSystemMetrics SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharPrevW CharNextA wsprintfA DispatchMessageW PeekMessageW ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage GetDC SetWindowLongW LoadImageW SendMessageTimeoutW FindWindowExW EmptyClipboard OpenClipboard TrackPopupMenu EndPaint ShowWindow GetDlgItem IsWindow SetForegroundWindow

gdi32

SelectObject SetBkMode CreateFontIndirectW SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW ShellExecuteW SHFileOperationW

advapi32

RegCloseKey RegOpenKeyExW RegDeleteKeyW RegDeleteValueW RegEnumValueW RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumKeyW

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

CoCreateInstance CoTaskMemFree OleInitialize OleUninitialize

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 7fe77ca13121a113c59630a3dba0c8aaa6372e8082393274da8f8608c4ce4528
MD5 fc90dfb694d0e17b013d6f818bce41b0
SHA1 3243969886d640af3bfa442728b9f0dff9d5f5b0
SHA512 324f13aa7a33c6408e2a57c3484d1691ecee7c3c1366de2bb8978c8dc66b18425d8cab5a32d1702c13c43703e36148a022263de7166afdce141da2b01169f1c6
SSDEEP 192:e/b2HS5ih/7i00eWz9T7PH6yeFcQMI5+Vw+EXWZ77dslFZk:ewSUmWw9T7MmnI5+/F7Kdk
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10125

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Betel.txt

SHA256 295fee47bd34f5c874a31222608953e2523afe887a8ea937e975c63927440902
MD5 d1b1f95843ab6dc5f671262bc7138236
SHA1 e70493c512c601890606c6cab2a3e001cc31f428
SHA512 622df8c19e8bb92422d798c348efca21c9b288f5467f7543b6a3d2706e2b0682278b99484eff32ce6117d2bd3faad791c9d93823cd93b33f5de51cafa8f1e487
MD5 SHA1 SHA512

Generalisationens.str

SHA256 5c0173b09ab37b1276451638323387550f143b642e71e612668e21862b7e0849
MD5 5cffd1025d89fe751164791e74154308
SHA1 825cb43619299fe3982f9335284a1f526378ea3a
SHA512 f6842375421c07e659c0aa2803c508be8d4f0ed0ba91ef2b4f2f53b56b71f18bf919d6490d1b87b604e97c54a0e97f87cd765c2b1a06859d251447094156d646
SSDEEP 6144:xBaOT8x+Ycq0gYlH1OjSj71M5sb6M6oG1BobxZ5sWqcB/Wcf2Y4:OOAxP0gYlHk4B8BfobXr/MY4
MD5 SHA1 SHA512 SSDEEP

Tredefowel.Aca

SHA256 1d06510b1db60480d732578de4cc461b958bf9b6d83782068bf7f43df2c981b1
MD5 7e663f8a8d976a72b3ba883f397dd885
SHA1 c9888232a796b522f94b11e23de03d7e370ef259
SHA512 8aafd8d5c633eca8ec9a636e0dd4d28c07ff6e64c9b99a54c6ffcb55417a7bc29f2d10a391f37f05c9ce7468549d1f965682c045b641e66a7abcd90a013be75c
SSDEEP 3072:pCMir0BuqwrY+6La46rLZ0mxyFrXq/2MSAHuukzW49YVBwCfgcs:pCMwrYZLanmmxOrq/2YAW4Kw5
MD5 SHA1 SHA512 SSDEEP

noncertainty.afg

SHA256 c4cd1d9e85cb15855624e1f92df0280d12cfa85a5ccaf9e9ca3935eefd1b5c76
MD5 0b6ad830e7e92868042b8166c328143e
SHA1 48437e6b59ef234918b362e990e8de7c97bb84c9
SHA512 7b023c1743d091b0575097242c691939f182fa66d6adc831110fb5ac0eb6e4dd74014053c80d41935ab5fdbd28b98a5e4707a7294c452a6ee843f7716c28bb64
SSDEEP 6144:MWjJCjm8ffen/ouo1Jv+PT5SpAXMFciu94U/Np9qaWnkwGsEc3AFc/R:MWjym8blYBAcQU/Qr9b7J
MD5 SHA1 SHA512 SSDEEP

praktikleder.Ent

SHA256 cd4bb9a25995b8eda8d673ed00c31eeae9bc7baa6019b2280d71aacbbd817e85
MD5 bcb099df0cbe2c9ad41d4947b6a83ea1
SHA1 567a87cd8a9aceaa106f0b01f03fe4c0b04d16e1
SHA512 42dbfe9d2f7289eeba75ff9bc43179bc5d7f7d908d3657606c5e4173aba29af8987a2336fb49ecbcf9f299bc4da28e52082ad85f60f554869186487d0c99400e
SSDEEP 6144:IeomVABoZFABjNA3hUaxFxuM7trAsn80zDacZNdOx7/K/oS46U1Xk9yz:xqWiuUaxaKtrK0zWcZexb+sJ
MD5 SHA1 SHA512 SSDEEP

sprug.tro

SHA256 8e5eb01a110ba039f469d0cab8ac35949d09c4ebeaa9bb42639aabc87afcdba6
MD5 64f80a0bb0dddaf565a17ea51d6d26d3
SHA1 d07ced0e5a1678555a42ca2bd7722b727296fa0a
SHA512 3b469b4918ce45b1342745f7c302efbf05c52adc3978a7f243b88dc9ef3d78f6a4bf2871c9a1eec5e91182844fa00e7ed8b7bbf18e79e9ec1844e30c3d8f2c31
SSDEEP 1536:Zt7prg1lBDivrAMpS4lD7gNxEvhhmFh6Q0ENUdKiUywYdT:L7kl9ivrAHVjEnyhFzQwYx
MD5 SHA1 SHA512 SSDEEP

e3fe07f87b41a5b796c4bf9d657c482367668ea4de33fa86bf6bc75b9904357f.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Betel.txt

Generalisationens.str

Tredefowel.Aca

noncertainty.afg

praktikleder.Ent

sprug.tro

Sharing

General

Malware Config

Signatures

File Explorer

e3fe07f87b41a5b796c4bf9d657c482367668ea4de33fa86bf6bc75b9904357f.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Betel.txt

Generalisationens.str

Tredefowel.Aca

noncertainty.afg

praktikleder.Ent

sprug.tro