Quotation[.]exe | Triage™

resource
unpack001/$PLUGINSDIR/System.dll

Quotation.exe

IMPHASH 3f91aceea750f765ef2ba5d9988e6a00
SHA256 2013e4b243a72b09add6488f84ad97b47ce0587cdecc1114f4380c82650e069c
MD5 5607e8b6d0197e51ec19233e72bc2036
SHA1 91cf6d8f6eeb59e44741d16c4a1ba38cffe59435
SHA512 bd1334cf2a73bfaf4b4235baaa0b4f0ef86e352e90323f60912a1e749f31e2ce82cb29acd45e8b3df74bd0f172239f7cf31fd3f7303eb299d9d7e21ea4e4dd92
SSDEEP 24576:64nhDoAFKQnWqZRi73deBNF12ZNXLGQ7WczkxFnfbP98:6+hkhQnxZRiBe5iNXKQKczga
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

6e:57:0c:8f:35:6a:d7:03:91:3c:b9:9a:25:a5:30:6c:50:80:2e:8b:44:3f:7e:17:a3:bf:9d:10:ae:58:c9:15

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Frostklart,O=Frostklart,L=Ancey,C=FR

Chains

Oct 29, 2024

PE Signature issue

Digest

42:d1:50:20:b6:fc:97:b6:ef:da:5f:b3:5a:e4:e2:3f:43:1f:fb:ec

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Frostklart,O=Frostklart,L=Ancey,C=FR

Chains

Oct 29, 2024

Minor OS version

1

Major OS version

5

Entry point

14042

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCloseKey RegDeleteKeyW RegDeleteValueW RegEnumKeyW RegEnumValueW RegQueryValueExW RegSetValueExW OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueW SetFileSecurityW RegCreateKeyExW RegOpenKeyExW

shell32

ShellExecuteExW SHFileOperationW SHBrowseForFolderW SHGetPathFromIDListW SHGetFileInfoW SHGetSpecialFolderLocation

ole32

OleInitialize OleUninitialize CoTaskMemFree IIDFromString CoCreateInstance

comctl32

ord17 ImageList_Destroy ImageList_AddMasked ImageList_Create

user32

DispatchMessageW wsprintfA SystemParametersInfoW SetClassLongW GetWindowLongW GetSysColor ScreenToClient SetCursor GetWindowRect TrackPopupMenu AppendMenuW EnableMenuItem CreatePopupMenu GetSystemMenu GetSystemMetrics IsWindowEnabled EmptyClipboard SetClipboardData CloseClipboard OpenClipboard CheckDlgButton EndDialog DialogBoxParamW IsWindowVisible SetWindowPos CreateWindowExW GetClassInfoW PeekMessageW CallWindowProcW GetMessagePos CharNextW ExitWindowsEx SetWindowTextW SetTimer CreateDialogParamW DestroyWindow LoadImageW FindWindowExW SetWindowLongW InvalidateRect ReleaseDC GetDC SetForegroundWindow EnableWindow GetDlgItem ShowWindow IsWindow PostQuitMessage SendMessageTimeoutW SendMessageW wsprintfW FillRect GetClientRect EndPaint BeginPaint DrawTextW DefWindowProcW SetDlgItemTextW GetDlgItemTextW CharNextA MessageBoxIndirectW RegisterClassW CharPrevW LoadCursorW

gdi32

SetBkMode CreateBrushIndirect GetDeviceCaps SelectObject DeleteObject SetBkColor SetTextColor CreateFontIndirectW

kernel32

WriteFile GetLastError WaitForSingleObject GetExitCodeProcess GetTempFileNameW CreateFileW CreateDirectoryW WideCharToMultiByte lstrlenW lstrcpynW GlobalLock GlobalUnlock CreateThread GetDiskFreeSpaceW CopyFileW GetVersionExW GetWindowsDirectoryW ExitProcess GetCurrentProcess CreateProcessW GetTempPathW SetEnvironmentVariableW GetCommandLineW GetModuleFileNameW GetTickCount GetFileSize MultiByteToWideChar MoveFileW WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA lstrcmpiW lstrcmpW MulDiv GlobalFree GlobalAlloc LoadLibraryExW GetModuleHandleW FreeLibrary Sleep CloseHandle SetFileTime SetFilePointer SetFileAttributesW ReadFile GetShortPathNameW GetFullPathNameW GetFileAttributesW FindNextFileW FindFirstFileW FindClose DeleteFileW CompareFileTime SearchPathW SetCurrentDirectoryW ExpandEnvironmentStringsW RemoveDirectoryW GetSystemDirectoryW MoveFileExW GetModuleHandleA GetProcAddress lstrcmpiA lstrcpyA lstrcatW SetErrorMode

$PLUGINSDIR/System.dll

IMPHASH 4f33ea844b96a31c8f4690530ba63854
SHA256 f917aef484d1fbb4d723b2e2d3045cb6f5f664e61fbb3d5c577bd1c215de55d9
MD5 d6f54d2cefdf58836805796f55bfc846
SHA1 b980addc1a755b968dd5799179d3b4f1c2de9d2d
SHA512 ce67da936a93d46ef7e81abc8276787c82fd844c03630ba18afc3528c7e420c3228bfe82aeda083bb719f2d1314afae913362abd1e220cb364606519690d45db
SSDEEP 192:acA1YOTDExj7EFrYCT4E8y3hoSdtTgwF43E7QbGPXI9uIc6w79Mw:RR7SrtTv53tdtTgwF4SQbGPX36wJMw
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

6730

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$_41_/Emmens.udk

SHA256 1b6dc1ead079db05b998725b154e803e6e1504e7e5b49c5611d55e018cd45e6d
MD5 1d099f6122f4b7c8a78925726b59e5c3
SHA1 eea154e31ff04cd1a2ced0193f7633ed219cfa47
SHA512 f31f0a285c5a6eb2236ccd49a8bf939e46624f270e0270fc4c5640b37684bc1c7780c5350f778da8e9d0b8cd25320c1909a9cd937f15bb3a7cddbceee94c47fb
SSDEEP 1536:+yiLw81PnsncGiIsTVODPOqNbsVEVWZkZA4:G/Pne9iIyVODPsVpZkZA4
MD5 SHA1 SHA512 SSDEEP

$_41_/Parfumere224.wam

SHA256 51312e2ddefccabc4c8c96a229637b5f247fb1000fecedbf6fd6ead54843870b
MD5 7c3e64a3e8123691a49fe787a50fc916
SHA1 abd13a7497b522741f727e0172a8bc839db18c93
SHA512 87d464c7a1eff82650fab62f0e8f0444a6a9504dd53151f607705d1f3a9fedc00b76a201902dde27d79474dc763e42e6815baba6a763f7e23b11d5ef4375015f
SSDEEP 6144:+Ojg9/+8Uw+Txop1slWP/FAYiCHdj+1m9MLvZsq2IOz:16WzTxopkKAHC9j+Q9kuz
MD5 SHA1 SHA512 SSDEEP

unnaturalism/Erythroclastic.Lid

SHA256 9f9ad7ddda58aac8054d9a28ece3956741834e725611c130db15139c4dffd1fa
MD5 7fc876f12112a1459c701ae1812ac3a4
SHA1 bf3acab93654d132bb2d62c844d888231ab17df4
SHA512 e210b9ddc6c8699ea5cfa4e3b13348f17693bed48b1244327775c335ab325a604dd78db7b358051c84b562463f39a66fb1cc654ff3e0c8e0a8161c8d5665dffb
SSDEEP 1536:Gxab7YwMXTp0UgPWnDziLbHyFC/cx6pTeH6gObSzRy20KDfC3wInFTlLBmsYY6aH:xUw8iUgPsHoDu6pTek20EUnVlLksHt
MD5 SHA1 SHA512 SSDEEP

unnaturalism/Proprietrer.bet

SHA256 645c325f62af720972466322b09a7e396e46d8e640b138d582374b68d763a3a7
MD5 0b62328c4966f6b879b3c13b7fbd9c0d
SHA1 6dd81f12e739e81e06778067513ed1178a06afc9
SHA512 2f738a2950352f124f7b969d38b52bd2e4453ff42bc8deb7566620e6cdea30368a6dc16230ba49050f8c0327175cab71dc4a1709541f08a3ffdcf55faf5b75b8
SSDEEP 768:l1SkOmjqFRV/HZzy6+19kZBH4YVHCdJS7G5iOUEEaXXLlgHHl7MRY9hN+418WPK5:KOqvBJzC5vBhp8KT9AGCbQTZkkR
MD5 SHA1 SHA512 SSDEEP

unnaturalism/Trikstanks.pra

SHA256 a55dac07fb586d4b64f0ddf812087a2eeec6f5286d9bc73ad648ed3220abdd3a
MD5 49be0e06f2e4f0ccffb46426ee262642
SHA1 ff9c56c31a824e4ca087705c23d01d288fe34239
SHA512 27e9d035708943dd257186457c15488c9405747fc77f7c76760c96ee011c239f9fa53b5da17958038fb2ba1c4e27e643e7924a37e6164e250b9f45a109d92e53
SSDEEP 768:AgVdAd1etxyZmQhZgJwrQTTwKuiTGrJqCoIEsPkZnFFSKsOI4v/3n35lB3LiADa4:5TxLsV5IjQ3xx12
MD5 SHA1 SHA512 SSDEEP

unnaturalism/boyaus.rom

SHA256 a56351ed69a301f5d9d89b6530280b7a85f998a806e1648911c37b6983ba9426
MD5 f130ec3095dbecedc791d8c58a59040c
SHA1 dad2300b487f31f199520e1b41ab02b7d677b352
SHA512 8599200f472f2d59390e8f2c497331640b12ab9faf71817160c6d450edf8a99f78cef28cc3b57581d6aecfc1ec90a49947a6685c606321b6ee300d483c838360
SSDEEP 768:jby0EUrStmwpKcx/orVcYZ+M3ok1I7vZFCDrlv2UV5t3votN6cGia46OGj3OkYSk:FaZaukRTadSdbrJ5N275Ea3nRYS3r
MD5 SHA1 SHA512 SSDEEP

unnaturalism/gear.dra

SHA256 fad1b5e641dc44b5a51048470d4e0fb47664cf2b994cea24304495d99323b9de
MD5 53ff1a157920ae92c9bf891d453d6b65
SHA1 b7bf3b7b16048f38132d8acca841130d73db44c3
SHA512 e739381c24627f89255db55b2da39a09f055a322c577c3604ba048fb2c817ae7f63b12131f8461491f6140953fb33dd94eb66d8cb3b13b36717143342ce270af
SSDEEP 768:NFXORpsqJLOaVDzzoIgUPRGRoYNxHVxyczaUz4pP9Nom56I4tY6UBh1Yc88LaAQo:TUAoYxPzqoIzdwWR1+/24cwZXeCPiIBo
MD5 SHA1 SHA512 SSDEEP

unnaturalism/jagtfalk.ill

SHA256 accd4911d88e808aed4a2aa27394628c62574810b0b47977b7103a246fdf2a10
MD5 169115c751dda5e021e8c86e8454b26d
SHA1 5a8254634c0c726bb18e42e626eaeb581d532dcd
SHA512 2b643014e8623cadba7ce78b91d3c751d60fcbf3fa69fa26f29a14e55679fc6a5c2074834b2496773a1756e3172ec7c898e2df29cb4a0513dbf8bc0dcdda7e04
SSDEEP 1536:XkYzjcLYszRzU5n1C900tMkYQx+gnpovYHO:XkYz4DzQB5sYYH
MD5 SHA1 SHA512 SSDEEP

unnaturalism/regill.ful

SHA256 4bc57a47b82b63ec20b393f65f3585eb81fe3f7748229cd19dec8fe8a41d67c3
MD5 b4fb425baf217f31e91aab39abf66dcd
SHA1 03de3bd0f923ab14213b6c4461c5ca73a0a6371c
SHA512 e72395fd6098130efd543c5941781a1aa80fce17c7701cb40fa8874271e0d43e0f7f082ebf5d458181287de41cf4b34f88dcaabe84d8ad51003ef5da1495d871
SSDEEP 1536:HMtjgMjMD1whyMu1IXCVAcFNpruXO+nBJH:stjgmYi03XDL+nBJ
MD5 SHA1 SHA512 SSDEEP

unnaturalism/sortlistningens.txt

SHA256 2ea079dede1b356842c5f5e0751b5e2b6565fded65dafb59a73d170c002abb27
MD5 46003c65aa12a0ebe55662f0141186dc
SHA1 739652c3375018daffb986302a7d3e8d32770b41
SHA512 59d394789f9eece97873d56aea64f353d3e13e007e4acbd396ac76cb68e91494eb65888049ef05cbe9b20597adadcc960d067f90aad3ea5aa46ac3a82f5b82fd
MD5 SHA1 SHA512

Quotation.exe

PE Signature issue

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$_41_/Emmens.udk

$_41_/Parfumere224.wam

unnaturalism/Erythroclastic.Lid

unnaturalism/Proprietrer.bet

unnaturalism/Trikstanks.pra

unnaturalism/boyaus.rom

unnaturalism/gear.dra

unnaturalism/jagtfalk.ill

unnaturalism/regill.ful

unnaturalism/sortlistningens.txt

Sharing

General

Malware Config

Signatures

File Explorer

Quotation.exe

PE Signature issue

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$_41_/Emmens.udk

$_41_/Parfumere224.wam

unnaturalism/Erythroclastic.Lid

unnaturalism/Proprietrer.bet

unnaturalism/Trikstanks.pra

unnaturalism/boyaus.rom

unnaturalism/gear.dra

unnaturalism/jagtfalk.ill

unnaturalism/regill.ful

unnaturalism/sortlistningens.txt