No[.] 1349240400713[.]exe

resource
No. 1349240400713.exe
unpack001/$PLUGINSDIR/System.dll

No. 1349240400713.exe

IMPHASH 6e7f9a29f2c85394521a08b9f31f6275
SHA256 d0549673b20a4041c1d1bfbdd841b0b768fefa6057f6a4203d54d0694f270cff
MD5 0049a8ce1e4c42cea9b5d2516c64612c
SHA1 f0526a23f7f5de1c0b2200e92fba833edcacbe02
SHA512 b0b3af0312dffad1492c768475713f15f21b7832c0a5e4e64107149ef9b4f950ca56092d0013343869a649f3c0d009a6f24ae628bbc178569911b5ea0e506315
SSDEEP 6144:cT4DtLOuR2uyPG+H+tMN+dOugpzlyUflyWCalNEToCp6lAG9urP2DDUK5Lq75k:cT02VG+4iDlyUoaiXp6X9uruAK5Gi
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

13509

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCreateKeyExW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken SetFileSecurityW RegOpenKeyExW RegEnumValueW

shell32

SHGetSpecialFolderLocation SHFileOperationW SHBrowseForFolderW SHGetPathFromIDListW ShellExecuteExW SHGetFileInfoW

ole32

OleInitialize OleUninitialize CoCreateInstance IIDFromString CoTaskMemFree

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

GetClientRect EndPaint DrawTextW IsWindowEnabled DispatchMessageW wsprintfA CharNextA CharPrevW MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW GetSystemMetrics FillRect AppendMenuW TrackPopupMenu OpenClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetWindowLongW GetSysColor SetWindowPos PeekMessageW SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint EmptyClipboard CreatePopupMenu

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateFontIndirectW CreateBrushIndirect DeleteObject SetTextColor SelectObject

kernel32

GetExitCodeProcess WaitForSingleObject GetModuleHandleA GetProcAddress GetSystemDirectoryW lstrcatW Sleep lstrcpyA WriteFile GetTempFileNameW CreateFileW lstrcmpiA RemoveDirectoryW CreateProcessW CreateDirectoryW GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersion GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW ExitProcess CopyFileW GetCurrentProcess GetModuleFileNameW GetFileSize GetTickCount MulDiv SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW MoveFileExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 7a9ddee34562cd3703f1502b5c70e99cd5bba15de2b6845a3555033d7f6cb2a5
MD5 564bb0373067e1785cba7e4c24aab4bf
SHA1 7c9416a01d821b10b2eef97b80899d24014d6fc1
SHA512 22c61a323cb9293d7ec5c7e7e60674d0e2f7b29d55be25eb3c128ea2cd7440a1400cee17c43896b996278007c0d247f331a9b8964e3a40a0eb1404a9596c4472
SSDEEP 192:nenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XBDIwL:n8+Qlt70Fj/lQRY/9VjjfL
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10719

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Intuitionernes.bnd

SHA256 2c18506f37f06dad09462bf79f818fdc4765a96127db132f703e1e02c0d79592
MD5 756b6ef5a3a2f1325c8c405839ae2038
SHA1 1cb4e016e36e79cc086c7e329c1890715eb646fe
SHA512 87300a4d16eab9ad221f24813efdd05381bb157b6eefdd1933ca94cbe1b6629005fcfe730f6bd92f3752d08ba2e1799e9d5d41ca220750707bcaa5fb1f228cb4
SSDEEP 768:C+HPGJfVhPDQHMt0DQ1oeTUifi7iY+kU2CcSlnM62d9u1M2cys0UZgJ2T7KgZfxu:Efr35cs2HMrJnaKxBt+aEROhXv
MD5 SHA1 SHA512 SSDEEP

Undefectiveness.pro

SHA256 8197fc9064bc99075f05c0a176c449eaa87d3a284a2304369085bb332530fa15
MD5 4d31fde37f1657c182ddff79b4e2b5a5
SHA1 ee293492272cee9058214b108dc218f022fee640
SHA512 ca06b5cce74f433d5bd118ee19e9744dbe409548232155825844684bb5292b7c4b5fcfa54fd10aeb91e09f75a253547bd3b0148814df0250b0d43470d28cbffb
SSDEEP 768:+T/eEYQyXFjCARfNh1z15a7qOvlkh351RvrhT9FMhTEM/9jXv8qB9N2sRm1T/6W2:RAoFmSZV0Vj7QUJ
MD5 SHA1 SHA512 SSDEEP

Wartlike228.Bln

SHA256 7280a6acb799ce6619f615fe7b76363e5ff889794589426db97b8a5f50f67e75
MD5 305ea21a8615d27fdc4c025370ba5773
SHA1 9ca2cfef430da6107bddbcb66d4b9f8da8ed93ea
SHA512 a07f9e4b273fbd317be1ec5af7406d40cb9c859c955a4997bde31e96f68fe170dfe834f8f887adaa046338974788c05816361c3b88117721e6b7cb22a0a8b5df
SSDEEP 6144:w7AoUTSDxZMJa/uuCFj6mJ+KgFZUeGztNtXw1aBEuUxoVf7abS86pSH:wUoLdqo/u5UJvHezYaBDUcja+1K
MD5 SHA1 SHA512 SSDEEP

hocuses.cur

SHA256 e58c68fe961c8e03a5f463a13720a4ca168a7ef1ad8ea8182392a9811c277d5e
MD5 50b41e3eef8b5d219355cacc44d31161
SHA1 91add8f503e9efe734623542bc1aeb2091a40a95
SHA512 c0c2ba04adbd5f986f42a29b1b3c9a0b436e12690db64b30850384a21acafb4eaacbd8f060aac46eba315d330bbcd4910c3acbbd3afd586dc2aad0d74dc5ea55
SSDEEP 768:YZwdEH/XamBWv0E5OO5FVi+7ACsFm49yq4s0Xt2xFBM6tooBUi6uko:t+va6bEb/3bYZF6q
MD5 SHA1 SHA512 SSDEEP

zeolitter.txt

SHA256 f8ab0068d1b157ecfb10ccb62da4318ace81daa48b76db17d28315cffea44bf6
MD5 7e339110b2d68ce5ed88614c32b7a56e
SHA1 6d5bf14fc1ef712e8ed8a2823d1d4f584eec1650
SHA512 b878b668ca55ad01b693b6d131c265f893ffb3d38f127693d951f1a9e7e516cbcde05495287e97c1f2176f8f9f802b2d3d9b98e9e3d617053df8d8b22875f622
MD5 SHA1 SHA512

No. 1349240400713.exe

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Intuitionernes.bnd

Undefectiveness.pro

Wartlike228.Bln

hocuses.cur

zeolitter.txt

Sharing

General

Malware Config

Signatures

File Explorer

No. 1349240400713.exe

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Intuitionernes.bnd

Undefectiveness.pro

Wartlike228.Bln

hocuses.cur

zeolitter.txt