Wuerth_factura_4052073226[.][.]exe

resource
Wuerth_factura_4052073226..exe
unpack001/$PLUGINSDIR/System.dll

Wuerth_factura_4052073226..exe

IMPHASH e2a592076b17ef8bfb48b7e03965a3fc
SHA256 4447fbf1066bc4f640abff84fcac04d0c86664f9823410348a36c280ac80e26d
MD5 787041cd8d6cd5e63534d1b060889a76
SHA1 82da83771130fbe29d2443635757c3cf5c3949c6
SHA512 76c61133334a5c0658a166bf2cbe4d737eb24bd17089622e5ee083b730a7f06d40d4346957890268a94cc7daf7eafe3da3918e4adadf710faca9a7ead36f4330
SSDEEP 24576:4l4OsRyZEyJ2zgsJVXRMpYHpiLNutFYTYdk6Tc3:m4O/qyEcwKpDE+YdVTc3
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

12925

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetCurrentDirectoryW GetFileAttributesW GetFullPathNameW Sleep GetTickCount GetFileSize GetModuleFileNameW MoveFileW SetFileAttributesW GetCurrentProcess ExitProcess SetEnvironmentVariableW GetWindowsDirectoryW GetTempPathW GetCommandLineW GetVersion SetErrorMode lstrlenW WaitForSingleObject CopyFileW CompareFileTime GlobalLock CreateThread GetLastError CreateDirectoryW CreateProcessW RemoveDirectoryW lstrcmpiA CreateFileW GetTempFileNameW WriteFile lstrcpyA lstrcpyW MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GlobalFree GlobalAlloc GetShortPathNameW SearchPathW lstrcmpiW SetFileTime CloseHandle ExpandEnvironmentStringsW lstrcmpW GlobalUnlock lstrcpynW GetDiskFreeSpaceW GetExitCodeProcess FindFirstFileW FindNextFileW DeleteFileW SetFilePointer ReadFile FindClose MulDiv MultiByteToWideChar lstrlenA WideCharToMultiByte GetPrivateProfileStringW WritePrivateProfileStringW FreeLibrary LoadLibraryExW GetModuleHandleW

user32

GetSystemMenu SetClassLongW IsWindowEnabled EnableMenuItem SetWindowPos GetSysColor GetWindowLongW SetCursor LoadCursorW CheckDlgButton GetMessagePos LoadBitmapW CallWindowProcW IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard wsprintfW ScreenToClient GetWindowRect GetSystemMetrics SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharPrevW CharNextA wsprintfA DispatchMessageW PeekMessageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow LoadImageW SetTimer SetWindowTextW PostQuitMessage ShowWindow GetDlgItem IsWindow SetWindowLongW FindWindowExW TrackPopupMenu AppendMenuW CreatePopupMenu DrawTextW EndPaint CreateDialogParamW SendMessageTimeoutW SetForegroundWindow

gdi32

SelectObject SetBkMode CreateFontIndirectW SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW ShellExecuteW SHFileOperationW

advapi32

RegDeleteKeyW SetFileSecurityW OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges RegOpenKeyExW RegEnumValueW RegDeleteValueW RegCloseKey RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumKeyW

comctl32

ImageList_AddMasked ord17 ImageList_Destroy ImageList_Create

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 9b93c61c9d63ef8ec80892cc0e4a0877966dca9b0c3eb85555cebd2ddf4d6eed
MD5 fc3772787eb239ef4d0399680dcc4343
SHA1 db2fa99ec967178cd8057a14a428a8439a961a73
SHA512 79e491ca4591a5da70116114b7fbb66ee15a0532386035e980c9dfe7afb59b1f9d9c758891e25bfb45c36b07afd3e171bac37a86c887387ef0e80b1eaf296c89
SSDEEP 192:eS24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35OloSl:S8QIl975eXqlWBrz7YLOlo
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10183

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Imminute.dro

SHA256 792f317bc4af8fb6d76c7bc475fd8e1929f9d8b165593773581be266a51944db
MD5 7b16e53394f4f4ffd0e7c35379a2293e
SHA1 29fe76b48f47ee6530307be96e90948adf7cf76e
SHA512 72529e6cf043721b7c91e85a1d74b8ae833f90b4ccfdb781b87d6208c2de315633f94693a601aefe130182d4a3964961d4c0597eb575a04c7d293e1cf3c87285
SSDEEP 3072:CTGpbg/BmM1QgPeK2wpHAwq1BRL8vFOSmdsWtW39LzvSA2Lp/WwcjunAjXod:CTCgEM1YwZAwqT18vseVh2LZXcjuATod
MD5 SHA1 SHA512 SSDEEP

Kbenhavnerbegivenhed/theravada.txt

SHA256 a67abb08865a81c6df7f7f8368c51c3e67d1c2bc5c9de1bc547681e3baa4b417
MD5 d66db73c5f70ecf9e205628181597125
SHA1 113334f1957b7257e1e13f193cf6b8cbbd86528e
SHA512 0e1df58d9137ce5d3bafaa3c45a2674ec475878155cc1e434c50652597efe01e6814f8cf9fa3688b36c538b4b447050dba06276c977aebb8c4ffd92b232b91ca
MD5 SHA1 SHA512

Orfgild.Sub

SHA256 bc409e1ede84e5868c06a2b73e3ece79fbf72e61e004cd84a598d20d0a6de432
MD5 9d64d16ee047bfac69f3b2face04a73b
SHA1 273a1c62b1a1c0ac3e91f28d7be0d1c43378b132
SHA512 0994eadbe24eac5660d478d50445de0a5867c98962c16e7b248da41a63f79ed0c7f36fb5358668ad0f37b90b499890deaf7ca3e339edd057ca5c6e4c996e7ead
SSDEEP 6144:PCknF5TU1Y+SBnlxsM4/SkyD3HJTan9xBTcrfE8:VFpUG+SBnlAqka8U/
MD5 SHA1 SHA512 SSDEEP

antagonister.kid

SHA256 670b812eaae8e8b967956ce5ade35427586b14360387b38431cdcc34127af394
MD5 58126ceccd4050bce5859f67637de1ee
SHA1 a130a906a246f985ea0be292121d15c4648cdcfd
SHA512 4ad589d8804db4d645aa9b3c010f357b76964ed5f76bcee3029e9be09be6da2c73a07b5f87b26a1d7061d02f0af0593cdcaab3129bf9b336e8db38df55bb2e96
SSDEEP 6144:eFJ4awIARNAzNCi1dhbiuMhsnxpWl6nhf31Sx4Kq:24Cs8NJpWl6FR
MD5 SHA1 SHA512 SSDEEP

magtpolitiske.ret

SHA256 e20ffb018b127d728280c6ca25c03a6899283a1fe0851756bb5f41b65c63753f
MD5 cd2df99412676a25675042d7dcb85703
SHA1 d46f497c4784b4f7cb53221943ade9eba9517191
SHA512 3d0139c9440cd8384c512eb7c0f59f22b002a6ab73b600e8738a17faef173d9aa23fe47e5c017299974e7739081686636bd307747a601cb1341a73ef7afb43f8
SSDEEP 12288:NrD+aAiLaNSLFBa9eBrl9CLb++kCxHw7u:NmadZBcCliDxb
MD5 SHA1 SHA512 SSDEEP

Wuerth_factura_4052073226..exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Imminute.dro

Kbenhavnerbegivenhed/theravada.txt

Orfgild.Sub

antagonister.kid

magtpolitiske.ret

Sharing

General

Malware Config

Signatures

File Explorer

Wuerth_factura_4052073226..exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Imminute.dro

Kbenhavnerbegivenhed/theravada.txt

Orfgild.Sub

antagonister.kid

magtpolitiske.ret