ad1f6b68331f1d4b983df1eddfea197f4a091e648528dc28c6016524b51d58b0[.]exe

resource
unpack001/$PLUGINSDIR/System.dll

ad1f6b68331f1d4b983df1eddfea197f4a091e648528dc28c6016524b51d58b0.exe

IMPHASH 3f91aceea750f765ef2ba5d9988e6a00
SHA256 ad1f6b68331f1d4b983df1eddfea197f4a091e648528dc28c6016524b51d58b0
MD5 038aab3a1450ed01e0635bdb5b09c39c
SHA1 bf02949f07662158215776acbaac683b6959320e
SHA512 471c0ab744b228dd5b46c53d3dde2127834ff066bc3dde1f969c287fb22bc490f5bdc2fee13141fc91d931e9a02d2583b3c280deec85bdbdd9b1cb26f1eece82
SSDEEP 24576:h4nhDoAFmXsrvR1kSMEkaHnjZVhbBNF1lmZNXLGQ7WczkxFnfbP9u:h+hkbXsjQSME/1Vhb5kNXKQKczgI
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

59:b6:19:02:05:e9:24:5e:3c:9c:85:f8:43:1a:8a:85:2c:ca:90:b0:7a:e2:ac:48:b1:92:7f:02:6f:28:d0:02

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=aalandske,O=aalandske,L=Inworth,C=GB

Chains

Oct 29, 2024

PE Signature issue

Digest

91:d9:82:0a:bb:e7:db:92:2c:f5:2e:96:0b:6d:83:75:48:4f:47:2f

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=aalandske,O=aalandske,L=Inworth,C=GB

Chains

Oct 29, 2024

Minor OS version

1

Major OS version

5

Entry point

14042

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCloseKey RegDeleteKeyW RegDeleteValueW RegEnumKeyW RegEnumValueW RegQueryValueExW RegSetValueExW OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueW SetFileSecurityW RegCreateKeyExW RegOpenKeyExW

shell32

ShellExecuteExW SHFileOperationW SHBrowseForFolderW SHGetPathFromIDListW SHGetFileInfoW SHGetSpecialFolderLocation

ole32

OleInitialize OleUninitialize CoTaskMemFree IIDFromString CoCreateInstance

comctl32

ord17 ImageList_Destroy ImageList_AddMasked ImageList_Create

user32

DispatchMessageW wsprintfA SystemParametersInfoW SetClassLongW GetWindowLongW GetSysColor ScreenToClient SetCursor GetWindowRect TrackPopupMenu AppendMenuW EnableMenuItem CreatePopupMenu GetSystemMenu GetSystemMetrics IsWindowEnabled EmptyClipboard SetClipboardData CloseClipboard OpenClipboard CheckDlgButton EndDialog DialogBoxParamW IsWindowVisible SetWindowPos CreateWindowExW GetClassInfoW PeekMessageW CallWindowProcW GetMessagePos CharNextW ExitWindowsEx SetWindowTextW SetTimer CreateDialogParamW DestroyWindow LoadImageW FindWindowExW SetWindowLongW InvalidateRect ReleaseDC GetDC SetForegroundWindow EnableWindow GetDlgItem ShowWindow IsWindow PostQuitMessage SendMessageTimeoutW SendMessageW wsprintfW FillRect GetClientRect EndPaint BeginPaint DrawTextW DefWindowProcW SetDlgItemTextW GetDlgItemTextW CharNextA MessageBoxIndirectW RegisterClassW CharPrevW LoadCursorW

gdi32

SetBkMode CreateBrushIndirect GetDeviceCaps SelectObject DeleteObject SetBkColor SetTextColor CreateFontIndirectW

kernel32

WriteFile GetLastError WaitForSingleObject GetExitCodeProcess GetTempFileNameW CreateFileW CreateDirectoryW WideCharToMultiByte lstrlenW lstrcpynW GlobalLock GlobalUnlock CreateThread GetDiskFreeSpaceW CopyFileW GetVersionExW GetWindowsDirectoryW ExitProcess GetCurrentProcess CreateProcessW GetTempPathW SetEnvironmentVariableW GetCommandLineW GetModuleFileNameW GetTickCount GetFileSize MultiByteToWideChar MoveFileW WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA lstrcmpiW lstrcmpW MulDiv GlobalFree GlobalAlloc LoadLibraryExW GetModuleHandleW FreeLibrary Sleep CloseHandle SetFileTime SetFilePointer SetFileAttributesW ReadFile GetShortPathNameW GetFullPathNameW GetFileAttributesW FindNextFileW FindFirstFileW FindClose DeleteFileW CompareFileTime SearchPathW SetCurrentDirectoryW ExpandEnvironmentStringsW RemoveDirectoryW GetSystemDirectoryW MoveFileExW GetModuleHandleA GetProcAddress lstrcmpiA lstrcpyA lstrcatW SetErrorMode

$PLUGINSDIR/System.dll

IMPHASH 4f33ea844b96a31c8f4690530ba63854
SHA256 f917aef484d1fbb4d723b2e2d3045cb6f5f664e61fbb3d5c577bd1c215de55d9
MD5 d6f54d2cefdf58836805796f55bfc846
SHA1 b980addc1a755b968dd5799179d3b4f1c2de9d2d
SHA512 ce67da936a93d46ef7e81abc8276787c82fd844c03630ba18afc3528c7e420c3228bfe82aeda083bb719f2d1314afae913362abd1e220cb364606519690d45db
SSDEEP 192:acA1YOTDExj7EFrYCT4E8y3hoSdtTgwF43E7QbGPXI9uIc6w79Mw:RR7SrtTv53tdtTgwF4SQbGPX36wJMw
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

6730

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$_41_/Alternationernes.Gru

SHA256 a16cd0c6db99d578e840dd902d917ec4441b8352ddbb1c824e01332ddd57f135
MD5 b0ba5389a2888bc642886d17adac9b3b
SHA1 c8a4d319438043b8f5867fa57d0cc099b9967497
SHA512 f51014f7e425795dffcdc9e6946f7946e1a597ab1920ce1c47b22099a824b1e6316aefda5e1095ed201ee50ecbb9db8328474ab21738e7504420c79095a1c177
SSDEEP 6144:bATgf7o7Q7SuLBXUE9cZzpLgGzUc0ZR1egZBt4K1Ui9YgT/RiGOYDE:WkEU7H1c7VUj1egZjpT/IP
MD5 SHA1 SHA512 SSDEEP

$_41_/Emmens.udk

SHA256 1b6dc1ead079db05b998725b154e803e6e1504e7e5b49c5611d55e018cd45e6d
MD5 1d099f6122f4b7c8a78925726b59e5c3
SHA1 eea154e31ff04cd1a2ced0193f7633ed219cfa47
SHA512 f31f0a285c5a6eb2236ccd49a8bf939e46624f270e0270fc4c5640b37684bc1c7780c5350f778da8e9d0b8cd25320c1909a9cd937f15bb3a7cddbceee94c47fb
SSDEEP 1536:+yiLw81PnsncGiIsTVODPOqNbsVEVWZkZA4:G/Pne9iIyVODPsVpZkZA4
MD5 SHA1 SHA512 SSDEEP

$_41_/Proprietrer.bet

SHA256 645c325f62af720972466322b09a7e396e46d8e640b138d582374b68d763a3a7
MD5 0b62328c4966f6b879b3c13b7fbd9c0d
SHA1 6dd81f12e739e81e06778067513ed1178a06afc9
SHA512 2f738a2950352f124f7b969d38b52bd2e4453ff42bc8deb7566620e6cdea30368a6dc16230ba49050f8c0327175cab71dc4a1709541f08a3ffdcf55faf5b75b8
SSDEEP 768:l1SkOmjqFRV/HZzy6+19kZBH4YVHCdJS7G5iOUEEaXXLlgHHl7MRY9hN+418WPK5:KOqvBJzC5vBhp8KT9AGCbQTZkkR
MD5 SHA1 SHA512 SSDEEP

$_41_/Slitteskruerne.Out

SHA256 9e64b777501320db723915be5defd808f1ca0ed40e9b811f14f835e911fb8247
MD5 63de7a8209e8617973894a2616c7d1b4
SHA1 f60353431c2f272c973a4d9fe831c9ed9783a5c5
SHA512 1d7915392878b167543266fcde0524e01f05f0d4da4491e8fc9450bd0330c63b23e6c7d4af29f4547ec1697dfb333df9d25bc2db6b24feb4b6b20d4b5acd6b99
SSDEEP 3072:FoWR1x2aW/RJB6TOtq7hXs3JU8PL9FCVkv:2E32aWvB6KQK3dPpR
MD5 SHA1 SHA512 SSDEEP

$_41_/Trikstanks.pra

SHA256 a55dac07fb586d4b64f0ddf812087a2eeec6f5286d9bc73ad648ed3220abdd3a
MD5 49be0e06f2e4f0ccffb46426ee262642
SHA1 ff9c56c31a824e4ca087705c23d01d288fe34239
SHA512 27e9d035708943dd257186457c15488c9405747fc77f7c76760c96ee011c239f9fa53b5da17958038fb2ba1c4e27e643e7924a37e6164e250b9f45a109d92e53
SSDEEP 768:AgVdAd1etxyZmQhZgJwrQTTwKuiTGrJqCoIEsPkZnFFSKsOI4v/3n35lB3LiADa4:5TxLsV5IjQ3xx12
MD5 SHA1 SHA512 SSDEEP

$_41_/boyaus.rom

SHA256 a56351ed69a301f5d9d89b6530280b7a85f998a806e1648911c37b6983ba9426
MD5 f130ec3095dbecedc791d8c58a59040c
SHA1 dad2300b487f31f199520e1b41ab02b7d677b352
SHA512 8599200f472f2d59390e8f2c497331640b12ab9faf71817160c6d450edf8a99f78cef28cc3b57581d6aecfc1ec90a49947a6685c606321b6ee300d483c838360
SSDEEP 768:jby0EUrStmwpKcx/orVcYZ+M3ok1I7vZFCDrlv2UV5t3votN6cGia46OGj3OkYSk:FaZaukRTadSdbrJ5N275Ea3nRYS3r
MD5 SHA1 SHA512 SSDEEP

$_41_/gear.dra

SHA256 fad1b5e641dc44b5a51048470d4e0fb47664cf2b994cea24304495d99323b9de
MD5 53ff1a157920ae92c9bf891d453d6b65
SHA1 b7bf3b7b16048f38132d8acca841130d73db44c3
SHA512 e739381c24627f89255db55b2da39a09f055a322c577c3604ba048fb2c817ae7f63b12131f8461491f6140953fb33dd94eb66d8cb3b13b36717143342ce270af
SSDEEP 768:NFXORpsqJLOaVDzzoIgUPRGRoYNxHVxyczaUz4pP9Nom56I4tY6UBh1Yc88LaAQo:TUAoYxPzqoIzdwWR1+/24cwZXeCPiIBo
MD5 SHA1 SHA512 SSDEEP

$_41_/jagtfalk.ill

SHA256 accd4911d88e808aed4a2aa27394628c62574810b0b47977b7103a246fdf2a10
MD5 169115c751dda5e021e8c86e8454b26d
SHA1 5a8254634c0c726bb18e42e626eaeb581d532dcd
SHA512 2b643014e8623cadba7ce78b91d3c751d60fcbf3fa69fa26f29a14e55679fc6a5c2074834b2496773a1756e3172ec7c898e2df29cb4a0513dbf8bc0dcdda7e04
SSDEEP 1536:XkYzjcLYszRzU5n1C900tMkYQx+gnpovYHO:XkYz4DzQB5sYYH
MD5 SHA1 SHA512 SSDEEP

$_41_/regill.ful

SHA256 4bc57a47b82b63ec20b393f65f3585eb81fe3f7748229cd19dec8fe8a41d67c3
MD5 b4fb425baf217f31e91aab39abf66dcd
SHA1 03de3bd0f923ab14213b6c4461c5ca73a0a6371c
SHA512 e72395fd6098130efd543c5941781a1aa80fce17c7701cb40fa8874271e0d43e0f7f082ebf5d458181287de41cf4b34f88dcaabe84d8ad51003ef5da1495d871
SSDEEP 1536:HMtjgMjMD1whyMu1IXCVAcFNpruXO+nBJH:stjgmYi03XDL+nBJ
MD5 SHA1 SHA512 SSDEEP

$_41_/sortlistningens.txt

SHA256 2ea079dede1b356842c5f5e0751b5e2b6565fded65dafb59a73d170c002abb27
MD5 46003c65aa12a0ebe55662f0141186dc
SHA1 739652c3375018daffb986302a7d3e8d32770b41
SHA512 59d394789f9eece97873d56aea64f353d3e13e007e4acbd396ac76cb68e91494eb65888049ef05cbe9b20597adadcc960d067f90aad3ea5aa46ac3a82f5b82fd
MD5 SHA1 SHA512

ad1f6b68331f1d4b983df1eddfea197f4a091e648528dc28c6016524b51d58b0.exe

PE Signature issue

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$_41_/Alternationernes.Gru

$_41_/Emmens.udk

$_41_/Proprietrer.bet

$_41_/Slitteskruerne.Out

$_41_/Trikstanks.pra

$_41_/boyaus.rom

$_41_/gear.dra

$_41_/jagtfalk.ill

$_41_/regill.ful

$_41_/sortlistningens.txt

Sharing

General

Malware Config

Signatures

File Explorer

ad1f6b68331f1d4b983df1eddfea197f4a091e648528dc28c6016524b51d58b0.exe

PE Signature issue

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$_41_/Alternationernes.Gru

$_41_/Emmens.udk

$_41_/Proprietrer.bet

$_41_/Slitteskruerne.Out

$_41_/Trikstanks.pra

$_41_/boyaus.rom

$_41_/gear.dra

$_41_/jagtfalk.ill

$_41_/regill.ful

$_41_/sortlistningens.txt