whatsappjpg[.]exe | Triage™

resource
whatsappjpg.exe
unpack001/$PLUGINSDIR/System.dll

whatsappjpg.exe

IMPHASH e221f4f7d36469d53810a4b5f9fc8966
SHA256 fb89c14504a9c08ddc006305975b11a20f0595e1f2ad7bd9475ba5c245eda0f6
MD5 8a3f9583866e402739f7da1541d6038d
SHA1 928530c1cee879a0c6c284f71a56039004ca4fa9
SHA512 43040b663ba09c3c9b284c045c4a16250b95117b0e45c17a2d164d2f66089b875850f81adfd122e7e7d73a42d18d6ea482e9e6473a04dea39b85f2230bf3de74
SSDEEP 12288:8tvD9kg2V9Lki65FEyz2szE/oDnv7nUhyl6sgoLpp2NjamHD3v1:1XlP60yz2sMenbUhyo80j1D1
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

13144

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathW SetFileTime CloseHandle GetShortPathNameW MoveFileW SetCurrentDirectoryW GetFileAttributesW GetLastError GetFullPathNameW CreateDirectoryW Sleep GetTickCount CreateFileW GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW ExitProcess SetEnvironmentVariableW GetWindowsDirectoryW SetFileAttributesW ExpandEnvironmentStringsW SetErrorMode LoadLibraryW lstrlenW lstrcpynW GetDiskFreeSpaceW GlobalUnlock GlobalLock CreateThread CreateProcessW RemoveDirectoryW lstrcmpiA GetTempFileNameW lstrcpyA lstrcpyW lstrcatW GetSystemDirectoryW GetVersion GetProcAddress LoadLibraryA GetModuleHandleA GetModuleHandleW lstrcmpiW lstrcmpW WaitForSingleObject GlobalFree GlobalAlloc LoadLibraryExW GetExitCodeProcess FreeLibrary WritePrivateProfileStringW GetCommandLineW GetTempPathW GetPrivateProfileStringW FindFirstFileW FindNextFileW DeleteFileW SetFilePointer ReadFile FindClose MulDiv MultiByteToWideChar WriteFile lstrlenA WideCharToMultiByte

user32

EndDialog ScreenToClient GetWindowRect RegisterClassW EnableMenuItem GetSystemMenu SetClassLongW IsWindowEnabled SetWindowPos GetSysColor GetWindowLongW SetCursor LoadCursorW CheckDlgButton GetMessagePos LoadBitmapW CallWindowProcW IsWindowVisible CloseClipboard SetClipboardData wsprintfW CreateWindowExW SystemParametersInfoW AppendMenuW CreatePopupMenu GetSystemMetrics SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharPrevW CharNextA wsprintfA DispatchMessageW PeekMessageW ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage GetDC SetWindowLongW LoadImageW SendMessageTimeoutW FindWindowExW EmptyClipboard OpenClipboard TrackPopupMenu EndPaint ShowWindow GetDlgItem IsWindow SetForegroundWindow

gdi32

SelectObject SetBkMode CreateFontIndirectW SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW ShellExecuteW SHFileOperationW

advapi32

RegCloseKey RegOpenKeyExW RegDeleteKeyW RegDeleteValueW RegEnumValueW RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumKeyW

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

CoCreateInstance CoTaskMemFree OleInitialize OleUninitialize

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 5a1c20a3e2e2eb182976977669f2c5d9f3104477e98f74d69d2434e79b92fdc3
MD5 7399323923e3946fe9140132ac388132
SHA1 728257d06c452449b1241769b459f091aabcffc5
SHA512 d6f28ba761351f374ae007c780be27758aea7b9f998e2a88a542eede459d18700adffe71abcb52b8a8c00695efb7ccc280175b5eeb57ca9a645542edfabb64f1
SSDEEP 192:eF2HS5ih/7i00dWz9T7PH6lOFcQMI5+Vw+bPFomi7dJWsP:rSUmlw9T7DmnI5+N273FP
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10134

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

660.jpg

SHA256 68b60014573ef5042b6ab616b17be733af6e803ea7096036bc3a075790656233
MD5 976f85df642fe509973bcc05e4a32c2b
SHA1 7a36a94c45039a31fd7a0baffcc3aca8e3ac656a
SHA512 7ea1663835c92e178f3dfba67bca0de52cd5690ed775a67a1a5163e0c4ecf309aa05742b6978206811a2bc95222a823afe982c1a70d24facf62a493d4078cdf7
SSDEEP 768:FU6UE3Rk9Eo7uT/59xGBxipyyZ4D9iBao1htGs5AQ:y6UZE3D5v34D9wL1XGnQ
MD5 SHA1 SHA512 SSDEEP

Editere.ter

SHA256 80653e80939085343c215d19eb9035353beb0068ab6efa11b1baa4e7d10e1b27
MD5 a1dc683d395b4aad6aadb883922026d6
SHA1 72846e629938f0c24deb9c8aead39a51190e1ff4
SHA512 a430db1c99acf3a3ffb73754c18a5ff39b0741b9dcbfa6e5a5cd176df5e90b058c2958336ca98d6194751c087fcb9ba21651eae594270255bfd5645dc3006144
SSDEEP 3072:zZVDR8is0ltz1OWUk+tdYUTn16yd8aXlVDDcwTsKR9A:zZj0COWT+tb6yHXTTsKR9A
MD5 SHA1 SHA512 SSDEEP

Wodewose235.enc

SHA256 34b4dfd59ae76d70c89c05e2b7d42c5177c14912e5602f3488f14cb2bec3ae15
MD5 091bc262a5d568d2dd2ce1c16934963b
SHA1 58f0086f8c18c516bbbfc86bd9f1b6098e043019
SHA512 019acbfcfcaf1645a2e365aac15a15b60efc1f144cb7c9a703413baad79b800037589c80326be41b487af8b22f532526301f561eda67b0f4b7d007a9a4451ef6
SSDEEP 384:Hn4soqyBjp3VRJ8c1VeHzeF8mjExy8jaw5zjnyh+:Ys3aPJzeTeMxy8j15J
MD5 SHA1 SHA512 SSDEEP

dharma.txt

SHA256 c7fb70336975f025e346e7b884a1641bdf4a9510315d059f1509a51249eddd07
MD5 71229ab517ca5dac3316733fe5538924
SHA1 0db282ed1142aa8d850e0bec60d502df3a8d786b
SHA512 77c36aff187ec195eaf128b4696f54e18b297a9797922eca97e3147ee9f49a0ba15ecb81be7ed65c6d199d83ea8bc7823d30aacba5b35351312ebab25c658ddc
MD5 SHA1 SHA512

howadji.Pte

SHA256 c4c720ad722f8673fa92eab77db0c8c4ca4198c52501313ade276b2bfd0313a3
MD5 c81e0d0656440b130efc97216a87c8b0
SHA1 4c87598ba8e2ee3e8c99392f8b9128fdc892072c
SHA512 3ce91fd990f2cab286d0ef100fd4c3948dbdca0cacbf0ea196742358baf1dbc3c851c81a66fd493c031a8b2e7f918820ad4a5b13085568be41a8608995a5bda8
SSDEEP 12288:68ktj4DXTNkTEFPtLnnwH3hB0v3oXBjDdHW:OtkDJk4FFLnwXhBy3oXBV2
MD5 SHA1 SHA512 SSDEEP

shears.sip

SHA256 d1465221589c115afa440e20e7e63e6e7d70b8dae1ca87710a8ffd6d7d8eadc5
MD5 b6f7202b553b5dc0a1b7d7b141fe8a64
SHA1 68b48ed6e05998b9f6e590510f74ad5677620ee7
SHA512 4d7b9795444537247ff1851b0c557a1235e90dddb49abcdc64dbc9612bb2347d675734faa6121d0875ef099b0c453a278c977463ce1d4453142cb19127244506
SSDEEP 192:ys2EB7EvpKyCMZFGrgNerrpDYvMo4E1+iI2tjx:ysfdCyGerrpUvxZ+7+t
MD5 SHA1 SHA512 SSDEEP

whatsappjpg.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

660.jpg

Editere.ter

Wodewose235.enc

dharma.txt

howadji.Pte

shears.sip

Sharing

General

Malware Config

Signatures

File Explorer

whatsappjpg.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

660.jpg

Editere.ter

Wodewose235.enc

dharma.txt

howadji.Pte

shears.sip