P52mX04112024145925383[.]exe

resource
P52mX04112024145925383.exe
unpack001/$PLUGINSDIR/System.dll

P52mX04112024145925383.exe

IMPHASH 56a78d55f3f7af51443e58e0ce2fb5f6
SHA256 0d9e0293185f77ef323b8686cabcd7e7562af2899bf565ccef257d4b259c7b81
MD5 21a40091e05d06c9480da0fb7a8add87
SHA1 186ae82d5cdb969c28e8111af7ea638d98bfdc69
SHA512 e11417ff36d3dfe3c92ba560ca3bd0d75e71b005b38f54ba6e775cfecd9b1f41bbe34544b359967f8a13d96f1b93f6c2d36467ed0cc161fad6d6760c4a886f47
SSDEEP 12288:qic8iBU0BzGGCyDEWqNF2V0/gQashpX7IBy9VoF15NO7nxZ6GLKaDP:qic8GU0AGaO0/gQashpMy9VUgjf6G2a
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

13559

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCreateKeyExW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken SetFileSecurityW RegOpenKeyExW RegEnumValueW

shell32

SHGetSpecialFolderLocation SHFileOperationW SHBrowseForFolderW SHGetPathFromIDListW ShellExecuteExW SHGetFileInfoW

ole32

OleInitialize OleUninitialize CoCreateInstance IIDFromString CoTaskMemFree

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

GetClientRect EndPaint DrawTextW IsWindowEnabled DispatchMessageW wsprintfA CharNextA CharPrevW MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW GetSystemMetrics FillRect AppendMenuW TrackPopupMenu OpenClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW PeekMessageW SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint EmptyClipboard CreatePopupMenu

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateFontIndirectW CreateBrushIndirect DeleteObject SetTextColor SelectObject

kernel32

GetExitCodeProcess WaitForSingleObject GetModuleHandleA GetProcAddress GetSystemDirectoryW lstrcatW Sleep lstrcpyA WriteFile GetTempFileNameW CreateFileW lstrcmpiA RemoveDirectoryW CreateProcessW CreateDirectoryW GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW CopyFileW ExitProcess GetCurrentProcess GetModuleFileNameW GetFileSize GetTickCount MulDiv SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW MoveFileExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW

$PLUGINSDIR/System.dll

IMPHASH 4f33ea844b96a31c8f4690530ba63854
SHA256 a4ec98011ef99e595912718c1a1bf1aa67bfc2192575729d42f559d01f67b95c
MD5 d968cb2b98b83c03a9f02dd9b8df97dc
SHA1 d784c9b7a92dce58a5038beb62a48ff509e166a0
SHA512 2ee41dc68f329a1519a8073ece7d746c9f3bf45d8ef3b915deb376af37e26074134af5f83c8af0fe0ab227f0d1acca9f37e5ca7ae37c46c3bcc0331fe5e2b97e
SSDEEP 192:CVA1YOTDExj7EFrYCT4E8y3hoSdtTgwF43E7QbGPXI9uIc6w79Mw:CrR7SrtTv53tdtTgwF4SQbGPX36wJMw
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

6730

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Gesvejsning.Ude

SHA256 532c213f95e0e4a2847ffc8b5bd15219041667a5c72f1b2fab39e61aca768ec1
MD5 91b7108aa75cae70abbed67e593b5aec
SHA1 1891a966dbaec3b61f3d215ec5af2548db979869
SHA512 ab8f98f3da9029c3cf2e7baa01ac51e8933a0b1b4b7ed1ae5c70ba07b10d274d2cd39741a6dca6e089a3b0a90dc7abddf434613f92d6e0eeb311a218de1be3ac
SSDEEP 6144:TIN3GLsqGOwgx6H+K0wmjYUocAQYXqhgt5RdjlcVgattUTwA:TwqGCx1K0wmjOcAQiptHdjlcU8A
MD5 SHA1 SHA512 SSDEEP

Goldurn/taksts.ops

SHA256 aee50f856a8fd3d0f5a403d14118ccf18cbcf8a457f079ad2d92fde7209b93c9
MD5 6b42ebff820a6ded5480b714440bad4c
SHA1 2f408524df5d97f8d6031a9076404b0b4975f8a0
SHA512 cb31d0bd1732207541fc1bcf372b959134c86bc2b09dca96e01bb26a77bac45f9dcdb5dcd19ad231164b035f2299eeb8088c39892fc0acf6ffefeb2208796e49
SSDEEP 768:q5FQLwdqS+pyFr++8KDLALY1Itj9f7Pn26de1l9JzaQ07RLrInWXsytZmudZl3Dr:qwJK/6j9DUxCFhiul
MD5 SHA1 SHA512 SSDEEP

Terzinen/Marmeladen.Syb

SHA256 a3c3178185a2e08506d614a3c38cafe37345d48a873cc74ce8bdbad3d2bc11c9
MD5 524f9eeb97299d6a46ed175442b5f5b7
SHA1 d22b62db928501d83a8f2ebb89943c68e4dc67d4
SHA512 c8974bf6afa5883a97b2dc133a4ec05ebc305ee5a486c343270709cb9cfdcf3a96eb901f3b44d3bfbfb5b9a36219b52b4983daf083d426a0f0e0c8bdbe7ad71e
SSDEEP 384:WInairuOn70Fvi8/kWy3MSofdCR7xxHWx16Z/r63UNl3PozVPB0OI:FaiyOngi7M9S6x1WrtNh6VP4
MD5 SHA1 SHA512 SSDEEP

Terzinen/Nonelusiveness.til

SHA256 97f2f35bd51daef7cb1bdeac75b4b7aceef5567d54145033277fcdccdc25665f
MD5 7fd58ad1d8df58eadfe11bf7e5208598
SHA1 8cf0172c25ce2c319f0b81a71bc7d1b102bde73d
SHA512 b69e49d7002374d1a61cec728a8e1d1a76c3c53f382380a0dbcc472b76bf47ef34f3c116a586df73fba7f471890f6ac02cbcac8ae16710b3dd75d3e17b16dcad
SSDEEP 1536:kEDGkyNb//WN/ATRK198RTMfClUQCS8gOYGiZawAx7Q:likyVWytI8e5QtuikwAxE
MD5 SHA1 SHA512 SSDEEP

Terzinen/brnefdselsdagenes.agr

SHA256 8595230881f9845e0ff61e8f73e1e0e3eb467fe0dc6b43d7f376cbc547ca5d53
MD5 2ad144ac071bd0eb76081d127662153d
SHA1 810683e8ba7755cd2cefdfadea3b8676e253b10c
SHA512 83fac890fc988cf9a5fb4f499d94c1c31f55fb3883010205ed3929af018ab5c09e49053558f6a0bb04e61ab047f71d121ee6375ccaa0abf7a65317c380c076b9
SSDEEP 768:OhLMBf2BzKTcaSxZfczHYGbAqfKaK4yzmNrwu9uPZHSSiV2oSM+fSWokgXTVecTI:qK9E4NJRh9jcqetmy+JXBuwM/g/qs
MD5 SHA1 SHA512 SSDEEP

Terzinen/dinting.txt

SHA256 6f5babe95ab2c023d567c8e6caf9639cc65841eab7fcaf7ba532405b87b43f28
MD5 e88ef2949a41812525f325512e5ec36d
SHA1 0af7de07ca6a365821a473a1a03f46a49e0a2798
SHA512 5fe8400f88524f001ba20365793a4bdd8fb1264cdfd76123d7aac77219dbee73c081c6b5031b899a51d2e5deae19183e63d6e3d3079a06567bfb5a83145681cd
MD5 SHA1 SHA512

Terzinen/lomedse.jpg

SHA256 85958f77599d172eebef87cdb012b8dae31c60cb5ca28984ee3b3c7ef3473111
MD5 0e5e01c28504c87122f4f856dc616801
SHA1 85f9fb76038a919c0ea972663dcd307097fb4b3e
SHA512 d331a784acaacbfd1460171a780423b74d94cb757250752427aef7d4ce3817b7f303e6780dc68ee6df985ceea9839ed6decd9de30241967d350391e556c9aa46
SSDEEP 192:+knHcUXZLFmwZmut8aaWuTrh28VKMSkgxyhPiCdopTjw24iXmB1VLipJ:VnTLR7OWuTrY8VKLkgUF7opTjwH621Zw
MD5 SHA1 SHA512 SSDEEP

P52mX04112024145925383.exe

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Gesvejsning.Ude

Goldurn/taksts.ops

Terzinen/Marmeladen.Syb

Terzinen/Nonelusiveness.til

Terzinen/brnefdselsdagenes.agr

Terzinen/dinting.txt

Terzinen/lomedse.jpg

Sharing

General

Malware Config

Signatures

File Explorer

P52mX04112024145925383.exe

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Gesvejsning.Ude

Goldurn/taksts.ops

Terzinen/Marmeladen.Syb

Terzinen/Nonelusiveness.til

Terzinen/brnefdselsdagenes.agr

Terzinen/dinting.txt

Terzinen/lomedse.jpg