rFa24c148[.]exe | Triage™

resource
rFa24c148.exe
unpack001/$PLUGINSDIR/System.dll

rFa24c148.exe

IMPHASH 7ed0d71376e55d58ab36dc7d3ffda898
SHA256 0b7ba80811d300aefe42de77b7b8fb2d5b6f9a8d4f2cf3d1213b6fead5efb59b
MD5 7644ebbf786053ffaf95dbe86b7de5d4
SHA1 5d563fb10f6d71049ae5f69fb6ccb9f2217ddf32
SHA512 d2da4f4ce1d26aca8e497e0d889d34ce9a4ec06b50245eb29a1feb7c7c20fce281e0dbefa37d234230163ebeaa602f1a49edee312024628387d2759896434a3c
SSDEEP 24576:ynE9Wlvj9UENDYuRe5In2hINGct2YBD9w254CQ+K1Q:yEiJUTOn2hINGctTDOBC7
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

12799

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathW SetFileTime CloseHandle GetShortPathNameW MoveFileW SetCurrentDirectoryW GetFileAttributesW GetLastError GetFullPathNameW CreateDirectoryW Sleep GetTickCount GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW ExitProcess SetEnvironmentVariableW GetWindowsDirectoryW GetTempPathW SetFileAttributesW ExpandEnvironmentStringsW LoadLibraryW lstrlenW lstrcpynW GetDiskFreeSpaceW GlobalUnlock GlobalLock CreateThread CreateProcessW RemoveDirectoryW lstrcmpiA CreateFileW GetTempFileNameW lstrcpyA lstrcpyW lstrcatW GetSystemDirectoryW GetVersion GetProcAddress LoadLibraryA GetModuleHandleA GetModuleHandleW lstrcmpiW lstrcmpW WaitForSingleObject GlobalFree GlobalAlloc LoadLibraryExW GetExitCodeProcess FreeLibrary WritePrivateProfileStringW SetErrorMode GetCommandLineW GetPrivateProfileStringW FindFirstFileW FindNextFileW DeleteFileW SetFilePointer ReadFile FindClose MulDiv MultiByteToWideChar WriteFile lstrlenA WideCharToMultiByte

user32

EndDialog ScreenToClient GetWindowRect RegisterClassW EnableMenuItem GetSystemMenu SetClassLongW IsWindowEnabled SetWindowPos GetSysColor GetWindowLongW SetCursor LoadCursorW CheckDlgButton GetMessagePos LoadBitmapW CallWindowProcW IsWindowVisible CloseClipboard SetClipboardData wsprintfW CreateWindowExW SystemParametersInfoW AppendMenuW CreatePopupMenu GetSystemMetrics SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharPrevW CharNextA wsprintfA DispatchMessageW PeekMessageW ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage GetDC SetWindowLongW LoadImageW SendMessageTimeoutW FindWindowExW EmptyClipboard OpenClipboard TrackPopupMenu EndPaint ShowWindow GetDlgItem IsWindow SetForegroundWindow

gdi32

SelectObject SetBkMode CreateFontIndirectW SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW ShellExecuteW SHFileOperationW

advapi32

RegCloseKey RegOpenKeyExW RegDeleteKeyW RegDeleteValueW RegEnumValueW RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumKeyW

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

CoCreateInstance CoTaskMemFree OleInitialize OleUninitialize

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 7fe77ca13121a113c59630a3dba0c8aaa6372e8082393274da8f8608c4ce4528
MD5 fc90dfb694d0e17b013d6f818bce41b0
SHA1 3243969886d640af3bfa442728b9f0dff9d5f5b0
SHA512 324f13aa7a33c6408e2a57c3484d1691ecee7c3c1366de2bb8978c8dc66b18425d8cab5a32d1702c13c43703e36148a022263de7166afdce141da2b01169f1c6
SSDEEP 192:e/b2HS5ih/7i00eWz9T7PH6yeFcQMI5+Vw+EXWZ77dslFZk:ewSUmWw9T7MmnI5+/F7Kdk
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10125

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Pjaskeriers.fra

SHA256 70bff890e295019b22ad529d689d87197cbf4e147f428875d363a2baa57d5466
MD5 1d30995077f12de7ad1a3bd9ac80363b
SHA1 57645c3f0f256022c6c84aec38066aecf41d6cd5
SHA512 9e20f9fecdf95f061aeb57f874604dc43e52f75bb579f715d2817747e4e1c9af38258f95f6dc6987ab9e6be90e1cbd7fcd80509f8bcdf92005c2a9a1bcd141f2
SSDEEP 768:iEhlBRm38m+Q9aP+nwlYRjI+e1HkKqNAoPG9HLB+dJr/0LeyCWkqPH6xZhUcxgXR:iUkLarxzoO6TM6ezDFDfoi
MD5 SHA1 SHA512 SSDEEP

akvarierne.lbe

SHA256 df3fcf30b3e33e29f3b92285000c8fcf6487db6786427ee1950c55b8bf6328c1
MD5 1e595cb18950e440ff9cea8e0a018ef9
SHA1 9d85d8e450ea472c9345fa9af7327dfd3822900b
SHA512 41d8d2f3a0d56cb47db8c46b7f685971caba069044257b7317f196bc1387142ae24cc03bc1647b36aa0f410ec1b63e6ba5cc408d914b8dd1fef89d33a78b9841
SSDEEP 768:b/fuZKLkY1DA6PEAD/xK5aMfuDI3WwcBV9tkA6vkn1KlvlTL+p22DM54IGNZX4+7:rEAUsCn4jI9gMGhUyNHjonsBhYIB
MD5 SHA1 SHA512 SSDEEP

cornetcies.txt

SHA256 949aeba08c7c808751f6076067ddda2dc269cf1cf2176b54243eb2def6fb2210
MD5 d4c819a65ba47f7736fd974ca29492f1
SHA1 275d7758404d63d4b60053891fdca09b1386adf2
SHA512 7b236a8d956d4677a1f06f63d31fcb7b9a4df9945c3c0812fa583825e612f01d9122cc815c007d6b8e47cf9fe3aac7be845d74976a0e864a71e36310100d70f0
MD5 SHA1 SHA512

dmt.roi

SHA256 62e9fc9f4c5e800031cb09956b0aac1075034983f21b3cd6409a788f7e9de32a
MD5 a996e580d9b9ce218e7506a87b7d5fc6
SHA1 59a450f75283bf0b6f1b7f72272870ec04f28b1c
SHA512 83cf2fd1bd4b3171764bd45df516160576e5b7aed5b63fe7496e804b81dc64fee01d9a31be9c9a3353c8f06934bb2ab4503fc0a90e4d66f5363149e0d09bb626
SSDEEP 768:scS/h94O9/1/ySR3IrEd3kC+AFOtLIerbRbpUnxLwUdwVSBEGVTrUb6m4Hhl0BZa:x4EFTWkC+AkcMdQVM4HA+5Fel8Tf
MD5 SHA1 SHA512 SSDEEP

hisset.tjr

SHA256 a33165526974d2a7fdb9c13e345221fd628599a7571ccd336cce1ada944248bf
MD5 3ef36f591b9193faa0e716084bea5a1c
SHA1 7e7c3bd5f6b443e2902cae200a9c49fa23cb5819
SHA512 48dd573c8bf2f18af8f845f42ee9a5c358a1dab1c58b645cf818d29a8e6dcc9ed9bce570115c19609eed4118ab02dec9f06fef5d245f81a9c56b52946449f2a4
SSDEEP 768:wbZHQ+9l0m6F4361gpBHoZ/ABUmOynflXU7SQ9XYjfbBnMJG1ATLchBRWEPosS0a:kStSjOWttJ1hWtqWO0BqwuZjoff/
MD5 SHA1 SHA512 SSDEEP

juleriernes.lia

SHA256 c05da494e2f7e065ec53702a5157caaf29f3b7b5f64db002e46314c974dfc3dc
MD5 6b590a9d3d02db762e5ef9a748c85069
SHA1 84e51e691a40276de8b4ce85cb9a3e549de143b6
SHA512 640152fb94bbafc8e0e70d3cb1d8695ca6380429df62362c2a7fd37b756a2ecddd528e61a4e0d01271b7774524d5539bfdd60073c60b5e0d9ce3dfda14084cad
SSDEEP 1536:mlq4o7tMrMLBrXgXEZIjtsKSmO/QnawFM:uoKM9+Rjq3m4UZF
MD5 SHA1 SHA512 SSDEEP

matematikopgavens.sti

SHA256 f4d7ce34045d0af74d7d972f30d745480a2a24d3109aecd02542e8dd9a1b67a0
MD5 71a43b445feb255ccd6ed0735ba8646e
SHA1 802661a11510197eafef582eda537c4f9d7a9087
SHA512 65d0349dec40981594be25521fd9362ddbe00b19b0deaa5cb0b61b69e8bccd6786b6260e316f94ffacde21ece2533392fc8010b6b4906ada241ff52c2b6f250c
SSDEEP 768:f3lph7tmvxpUH9uGV96eQ5s8ZSnGCwUWcZP4leLP98b+5rEWpJVLrVPxAvRGL6os:tM0/WVWP9bFn6odCJS2xUKQs9V
MD5 SHA1 SHA512 SSDEEP

rygmarvsprvens.Beg

SHA256 dec5c6e2d902041242d0281724a5b53ff267ecaddbec4a5c537015701d9781c1
MD5 9f56e8056565573212f10beec501201f
SHA1 129d26e2fdf525443442978d4df71795e1d4852e
SHA512 e0cf0881a09fece3b86224adde5e95624fb8fc73646e220e773657576d332751986163babc6a527cdbbef7e3ef1d74e7b0d73507db9e2e3fa3dc76d169736f0c
SSDEEP 6144:hoK67mDT1gEVZMQK37bbM/nXGsXBzFBxoKp7QGRA+zPRoaAg:e14hgEVm3Pbhs/BNp7QGRpzPRoRg
MD5 SHA1 SHA512 SSDEEP

tipssensationens.hve

SHA256 08bb1a2dabca5b76646effc730010abca15117c0d6d02c46a74627b6d294e53d
MD5 018aa244e5be97b5f10208fe5442d2d1
SHA1 6dba0c6e825a958989336905f42fa55aa6885d36
SHA512 089c87e209fbc3df1aeb8937e3ad901f06e74a05ebfadd5c77930b34e7f0c96695d29cbdbacb758f4d5a5b62f9ef2be373ebb14ceba2006f84ba31a29e2347c5
SSDEEP 1536:v+u4VL9fsUAfe4S19OZQ+h46hM85bJjsIL2aAptl:GjVLuUAml19OHhiB
MD5 SHA1 SHA512 SSDEEP

rFa24c148.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Pjaskeriers.fra

akvarierne.lbe

cornetcies.txt

dmt.roi

hisset.tjr

juleriernes.lia

matematikopgavens.sti

rygmarvsprvens.Beg

tipssensationens.hve

Sharing

General

Malware Config

Signatures

File Explorer

rFa24c148.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Pjaskeriers.fra

akvarierne.lbe

cornetcies.txt

dmt.roi

hisset.tjr

juleriernes.lia

matematikopgavens.sti

rygmarvsprvens.Beg

tipssensationens.hve