6aa4aecddd8e0ffc3b3cee5987c88d34eb7cb048cb5a42983b2b223875182bd4[.]exe

resource
6aa4aecddd8e0ffc3b3cee5987c88d34eb7cb048cb5a42983b2b223875182bd4.exe
unpack001/$PLUGINSDIR/System.dll

6aa4aecddd8e0ffc3b3cee5987c88d34eb7cb048cb5a42983b2b223875182bd4.exe

IMPHASH d4b94e8ee3f620a89d114b9da4b31873
SHA256 6aa4aecddd8e0ffc3b3cee5987c88d34eb7cb048cb5a42983b2b223875182bd4
MD5 d5124313ebf51a883392d6171e9b7049
SHA1 72c137198f1893be9f5a73a89967889895160117
SHA512 dfda9be5f1641ab3567f483cb80d340fefa30ec893ba9af42d687726f8ef07d2ee7457ae45a10e3f6d087206693e01239f2c3ec3e9aaa23b9dab21f371c453fd
SSDEEP 12288:I5gGipxkBKTBX7yFUJFLoEaOAUGsoj5eTZa86q+gdD3/86DtrmT9cPfRNLiyi7TH:5GiwB4NyF8olhRj5eKq+Y/gcHv+yIdv
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

12960

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetCurrentDirectoryW GetFileAttributesW GetFullPathNameW Sleep GetTickCount GetFileSize GetModuleFileNameW MoveFileW SetFileAttributesW GetCurrentProcess ExitProcess SetEnvironmentVariableW GetWindowsDirectoryW GetTempPathW GetCommandLineW GetVersion SetErrorMode lstrlenW lstrcpynW CopyFileW CompareFileTime GlobalLock CreateThread GetLastError CreateDirectoryW CreateProcessW RemoveDirectoryW lstrcmpiA CreateFileW GetTempFileNameW WriteFile lstrcpyA lstrcpyW MoveFileExW lstrcatW GetSystemDirectoryW LoadLibraryW GetProcAddress GetModuleHandleA ExpandEnvironmentStringsW GetShortPathNameW SearchPathW lstrcmpiW SetFileTime CloseHandle GlobalFree lstrcmpW GlobalAlloc WaitForSingleObject GlobalUnlock GetDiskFreeSpaceW GetExitCodeProcess FindFirstFileW FindNextFileW DeleteFileW SetFilePointer ReadFile FindClose MulDiv MultiByteToWideChar lstrlenA WideCharToMultiByte GetPrivateProfileStringW WritePrivateProfileStringW FreeLibrary LoadLibraryExW GetModuleHandleW

user32

GetSystemMenu SetClassLongW IsWindowEnabled EnableMenuItem SetWindowPos GetSysColor GetWindowLongW SetCursor LoadCursorW CheckDlgButton GetMessagePos LoadBitmapW CallWindowProcW IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard wsprintfW ScreenToClient GetWindowRect GetSystemMetrics SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharPrevW CharNextA wsprintfA DispatchMessageW PeekMessageW ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW GetDC SetWindowTextW PostQuitMessage ShowWindow GetDlgItem IsWindow LoadImageW SetWindowLongW TrackPopupMenu AppendMenuW CreatePopupMenu EndPaint SetTimer FindWindowExW SendMessageTimeoutW SetForegroundWindow

gdi32

SelectObject SetBkMode CreateFontIndirectW SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW ShellExecuteW SHFileOperationW

advapi32

RegDeleteKeyW SetFileSecurityW OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges RegOpenKeyExW RegEnumValueW RegDeleteValueW RegCloseKey RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumKeyW

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 e94a1f7bcd7e0d532b660d0af468eb3321536c3efdca265e61f9ec174b1aef27
MD5 ee260c45e97b62a5e42f17460d406068
SHA1 df35f6300a03c4d3d3bd69752574426296b78695
SHA512 a98f350d17c9057f33e5847462a87d59cbf2aaeda7f6299b0d49bb455e484ce4660c12d2eb8c4a0d21df523e729222bbd6c820bf25b081bc7478152515b414b3
SSDEEP 192:eF24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35Ol9Sl:h8QIl975eXqlWBrz7YLOl9
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10183

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Chesterfieldsofa/sensism.bas

SHA256 cb1178a4a21f8b12fb3544cafe4625b6c098752ba49bae561f247b3094c43fd5
MD5 97644562741015704946729715168bed
SHA1 83cec9fa1e2cbb4bea86ca4ba79ec135e39b7408
SHA512 87e304b1c1d8127d841e77b7ba40d8913202fa0b3b470848ffa155c2aac59bfea137cfd5ca8c87e181eaab82926c810aff624a757b1118c6d817b51b32d2acfa
SSDEEP 3072:sT+qlTYiP7oneFImU16PUqzd2RX7ZocgA:nMGaU16HMUk
MD5 SHA1 SHA512 SSDEEP

Chesterfieldsofa/subskriptionen.gan

SHA256 2251156dc9349bbe87f490ec9ccda16fc3aba701e2c44ff0b60ad6468277b7c0
MD5 1cea1993a071fd7c9ce75713724170ee
SHA1 99611e72a6079e180f9c9e654a68727ea1f6b6fe
SHA512 ec31ded8847c071a93c946578e3f647825d77cc9d04ce33019eb51346e8036efa8d0c71e3273550f85193d2eccd16478fa5042f0238dc07f31405f475e40d59e
SSDEEP 1536:CM6JQ5kteG2RK7oZFOtYlSZfU+aDXt9HkIFCkjc:2v0+YlSZs9x9H3N
MD5 SHA1 SHA512 SSDEEP

Udkragning75.txt

SHA256 ba1c5a68f37f887614a24f049a02d41b39473c4b7f84a0db2bc1f3690235670c
MD5 275cd3c290015c208e1d7e73f9100c3e
SHA1 ab54852cb8c9db983a0cb664c42571877e3685a2
SHA512 df3d87871ea31370ce6674a08f19a1f186c0e9264c84388d954095c7b79c40c7e8d9a23683d25b667dd10f422b0d1de6a788da432db94bacfcbe9ce58bfe9ae4
MD5 SHA1 SHA512

Vkkeur.Int

SHA256 d4788915015b44d15cfba8040a39177c1e252ac9e4f70870bcc780525e0a7b8c
MD5 26a3f3ce782e3bedb90ad4de9645fa65
SHA1 96e2cb7512328de44262533c4048f52b90f9503c
SHA512 cbbb4644797460d84084fadcc6bffba6b069db246115a3feb0c760a36f172b951f224952d010b4ecb4f44c63553001b5370ecb5ebd22685313f92ab11b40ff89
SSDEEP 3072:pE1+FHIubIBkqudUq16wULfy80DImlTvrAO2BIknNFUvXR4Bsy5Y0oBOm1nNZnK7:pSuoubOogLl0DrtDYBnNaeY+iBKblatY
MD5 SHA1 SHA512 SSDEEP

bukkeskindets.hav

SHA256 d4663f81b11d3590d60e051448c6cb26bfb5f4789a6f9730edde35d78f32a689
MD5 a5ffed60cebde1ebca82e76fa7c8c6bd
SHA1 a819e54237e22c02769f183f59e4805d84af8987
SHA512 61e2e98f1a6488c79c8688b1eb43daa6a09c33f6dcc578e4bc79d481367cd2cf67814cbafc3f72258757f15cdf60fa1f8f4e034ed93efc1cddb44d6bd7f15a45
SSDEEP 1536:kuZ95Qjm57LIXGikXThD5gLrQhkrvCOEaKnqrvQy6h6Dsza+nAk:Lujm5/IXEXTiQqrvf92JhDPAk
MD5 SHA1 SHA512 SSDEEP

gtx.jpg

SHA256 c39ad9d27785be80646c5462f559455b07b5a013fcc0707e319395a7b8e021fe
MD5 2f5afd2d81a0e802450f7b5f9e541177
SHA1 503ebec0a321b292afea3e3607887cf1956e1dbd
SHA512 1de3185e99afd684b1434dc38c470940ee1a3940dcb78279c6b71ceecafc6d3f1f714094e699fce65d3175d91a065e8660487b495c937ab9a09fee3e6d1d73cd
SSDEEP 1536:ICtnsmW6u1pB8l4UtPXnRyJlxwKSHUrPMuh787TKAx2wzzcbnO3srBCeIN2hsIzB:dr9u1I3tvn0XxMOkuh787TKAx24d3CB3
MD5 SHA1 SHA512 SSDEEP

6aa4aecddd8e0ffc3b3cee5987c88d34eb7cb048cb5a42983b2b223875182bd4.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Chesterfieldsofa/sensism.bas

Chesterfieldsofa/subskriptionen.gan

Udkragning75.txt

Vkkeur.Int

bukkeskindets.hav

gtx.jpg

Sharing

General

Malware Config

Signatures

File Explorer

6aa4aecddd8e0ffc3b3cee5987c88d34eb7cb048cb5a42983b2b223875182bd4.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Chesterfieldsofa/sensism.bas

Chesterfieldsofa/subskriptionen.gan

Udkragning75.txt

Vkkeur.Int

bukkeskindets.hav

gtx.jpg