5afa64f08316e42fe5a53efd3a7354f06f8c654bf7d2c2784dbfef6ad117349c[.]exe

resource
5afa64f08316e42fe5a53efd3a7354f06f8c654bf7d2c2784dbfef6ad117349c.exe
unpack001/$PLUGINSDIR/System.dll

5afa64f08316e42fe5a53efd3a7354f06f8c654bf7d2c2784dbfef6ad117349c.exe

IMPHASH d4b94e8ee3f620a89d114b9da4b31873
SHA256 5afa64f08316e42fe5a53efd3a7354f06f8c654bf7d2c2784dbfef6ad117349c
MD5 7d0910b695d11385096aa287aa616fa1
SHA1 bab632ec687ba8b45cc29a29ca675ee5e05a48d2
SHA512 7ad728a01047eeac9060184d43cd9f4e4d286a103a14b5296f3600dc6631a5d959ebbbc5d08988c5c95726dce9920da78a724471b5547a85fcf2b35a9d358129
SSDEEP 12288:/5K2KbDXd0+PJdFuvJujrJH7Qshco9VXHtdIaLDjnm:82Um+jFgk1HcsW0hIaLDjn
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

12960

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetCurrentDirectoryW GetFileAttributesW GetFullPathNameW Sleep GetTickCount GetFileSize GetModuleFileNameW MoveFileW SetFileAttributesW GetCurrentProcess ExitProcess SetEnvironmentVariableW GetWindowsDirectoryW GetTempPathW GetCommandLineW GetVersion SetErrorMode lstrlenW lstrcpynW CopyFileW CompareFileTime GlobalLock CreateThread GetLastError CreateDirectoryW CreateProcessW RemoveDirectoryW lstrcmpiA CreateFileW GetTempFileNameW WriteFile lstrcpyA lstrcpyW MoveFileExW lstrcatW GetSystemDirectoryW LoadLibraryW GetProcAddress GetModuleHandleA ExpandEnvironmentStringsW GetShortPathNameW SearchPathW lstrcmpiW SetFileTime CloseHandle GlobalFree lstrcmpW GlobalAlloc WaitForSingleObject GlobalUnlock GetDiskFreeSpaceW GetExitCodeProcess FindFirstFileW FindNextFileW DeleteFileW SetFilePointer ReadFile FindClose MulDiv MultiByteToWideChar lstrlenA WideCharToMultiByte GetPrivateProfileStringW WritePrivateProfileStringW FreeLibrary LoadLibraryExW GetModuleHandleW

user32

GetSystemMenu SetClassLongW IsWindowEnabled EnableMenuItem SetWindowPos GetSysColor GetWindowLongW SetCursor LoadCursorW CheckDlgButton GetMessagePos LoadBitmapW CallWindowProcW IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard wsprintfW ScreenToClient GetWindowRect GetSystemMetrics SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharPrevW CharNextA wsprintfA DispatchMessageW PeekMessageW ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW GetDC SetWindowTextW PostQuitMessage ShowWindow GetDlgItem IsWindow LoadImageW SetWindowLongW TrackPopupMenu AppendMenuW CreatePopupMenu EndPaint SetTimer FindWindowExW SendMessageTimeoutW SetForegroundWindow

gdi32

SelectObject SetBkMode CreateFontIndirectW SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW ShellExecuteW SHFileOperationW

advapi32

RegDeleteKeyW SetFileSecurityW OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges RegOpenKeyExW RegEnumValueW RegDeleteValueW RegCloseKey RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumKeyW

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 e94a1f7bcd7e0d532b660d0af468eb3321536c3efdca265e61f9ec174b1aef27
MD5 ee260c45e97b62a5e42f17460d406068
SHA1 df35f6300a03c4d3d3bd69752574426296b78695
SHA512 a98f350d17c9057f33e5847462a87d59cbf2aaeda7f6299b0d49bb455e484ce4660c12d2eb8c4a0d21df523e729222bbd6c820bf25b081bc7478152515b414b3
SSDEEP 192:eF24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35Ol9Sl:h8QIl975eXqlWBrz7YLOl9
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10183

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Gaufre/Nonjurist.Sik32

SHA256 94e0514ca5e48022008f7eb527e53a16e4576debd44fc30c037db4f102c2c4f2
MD5 c6a6ffbde86d0abdc5238cff67a15c41
SHA1 d990c30156d5e6940a301c79dc30914b3a1eab57
SHA512 b4ac07e119813b507f8afa8f5772827925998bb188533e97d6a52d31e37b1efb6efe1e46db55307755e245d9719e1dbff403549eb5daaabe9f496a7fa16f2a13
SSDEEP 6144:7HMOkiUMiDohHmlhFCnWnk3MzlBzBxph362:7HI6hGlXRnkktZp
MD5 SHA1 SHA512 SSDEEP

Gaufre/Occidentalske.Pas

SHA256 fb83435c5dcbeddf14f0660d2aff0afb618763a6bf4e7aba9b73df88b598e4d5
MD5 aa898cc8c966335ef529e12dbea51487
SHA1 1222043eac4ab301ad18cf5820628e6e37a7ca82
SHA512 b8fd49188838ef0fdd59c6963d69e23fc40b4b94d1eb9b06276d86806bf2d671ec266966957596f58a859434e4d2387bcea0867e4f5d5826ad3ac6c6d761a4a0
SSDEEP 384:ndXlsM/W86eujhxDooFjnzoT2YpX1emmQWZOW:nN61ljEl6TVH
MD5 SHA1 SHA512 SSDEEP

Gaufre/annektere.boa

SHA256 d5388f93e2e8652096a94d0da440fc30631a454eefe2b94681339f58b1d215bf
MD5 5d882e43f04f9e3ecab75d91513c47c5
SHA1 c53cdfd7b5c28d4b96bbb113b1930859ada7503c
SHA512 30d73608445a0f35183bf3e235978773df6f60d057902e97b4a85cbf20201c9ed31df3205c22e8bceb72b8d2cd8f86a05ac5c7f13b7b4886467fe43816879452
SSDEEP 1536:5NoutEi8nTdgryYti40QzlN7nJRim3FPbjEkK:5vOi8nTij0Qrz3Fkk
MD5 SHA1 SHA512 SSDEEP

Gaufre/buduma.ves

SHA256 a4168d8b8246f976d65448e07f0dc9f99a6a16d8d2586b00555387ad02099dae
MD5 863fa122f521e238cb0fc11152c29a97
SHA1 2a21a721b5b84c173ca00d7e7bfb8b48645de5b6
SHA512 fcb763392af39b463b664d842dd86da8df75d4fcc7ab9ce846357695e26e8bfe12b5f2e038462737d8b3ba848f62996b9342bce79e231766c21cc3cce9d91031
SSDEEP 768:mM2KAo+yjNnNRgJLYCK6FVY60l2W9nu01LDmyNqBEVRhfB8yvEx+PtIr5UXBCtmj:mW+9W11HYURi8LdOge63
MD5 SHA1 SHA512 SSDEEP

Gaufre/isopodan.txt

SHA256 05de4cfdf5c4f833d2d5a2931b9719f22912d50485bdf8af3206b53037a43999
MD5 b6f5df9a099d85e8ef9cb11317ab4467
SHA1 3aa33afe232e6f00608ae69a84e0c308b62e2ea2
SHA512 3164ab5e6d8ce8e97c03424776d1236535d6b7717ab2c6cc25d718ae62fe3bb57a9b998aa3412ada044812ba45a809e9873a069ed61f6689afafc34894ecfb34
MD5 SHA1 SHA512

Gaufre/sludredes.peb

SHA256 3719e64ca180afc5c303e7dafe26a80359fe8bc3e0c472a822ec7d0847d70252
MD5 27d252aac87023b3333b038c8366d683
SHA1 2f443415b95254a1db926304565fc76a59cf848c
SHA512 c523f2a23c27a782a830486352ea0bde565ad802b22ffe67b05e91b1ea7b4ecd1dadfe19635c403d86932ec1102240209ab9c6ebde02f065948d1ac09d9b0c73
SSDEEP 768:qE8odS4zheB8ZZDhlEIxdZCtzYpGByaaQasESD+VqOe9VniXR4zSlMfWblqRfE6n:5t2D72hR5qRfE+W/IIjWgu
MD5 SHA1 SHA512 SSDEEP

5afa64f08316e42fe5a53efd3a7354f06f8c654bf7d2c2784dbfef6ad117349c.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Gaufre/Nonjurist.Sik32

Gaufre/Occidentalske.Pas

Gaufre/annektere.boa

Gaufre/buduma.ves

Gaufre/isopodan.txt

Gaufre/sludredes.peb

Sharing

General

Malware Config

Signatures

File Explorer

5afa64f08316e42fe5a53efd3a7354f06f8c654bf7d2c2784dbfef6ad117349c.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Gaufre/Nonjurist.Sik32

Gaufre/Occidentalske.Pas

Gaufre/annektere.boa

Gaufre/buduma.ves

Gaufre/isopodan.txt

Gaufre/sludredes.peb