1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1[.]exe

resource
1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe
unpack001/$PLUGINSDIR/System.dll

1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe

IMPHASH e2a592076b17ef8bfb48b7e03965a3fc
SHA256 1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1
MD5 3392cd428f177152dcf9ac6256365b1a
SHA1 3e454db1c2d909510594a48efbe0380c3194aa2f
SHA512 53265bead60447f7dd26db363dfe3a698d83c51019c4fa1d51907d5166cd53e11dae4da51ee3ebe162f0313ac6b2971a0a3904a4738fde116d835eab4c4d53bb
SSDEEP 24576:Z6k1f9gIpCzUjadgzQdbzyoxSyz74WCePDMoqno2NND74lams:ZJFmSCzyApoy/p3PDP6Ela3
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

12906

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetCurrentDirectoryW GetFileAttributesW GetFullPathNameW Sleep GetTickCount GetFileSize GetModuleFileNameW MoveFileW SetFileAttributesW GetCurrentProcess ExitProcess SetEnvironmentVariableW GetWindowsDirectoryW GetTempPathW GetCommandLineW GetVersion SetErrorMode lstrlenW WaitForSingleObject CopyFileW CompareFileTime GlobalLock CreateThread GetLastError CreateDirectoryW CreateProcessW RemoveDirectoryW lstrcmpiA CreateFileW GetTempFileNameW WriteFile lstrcpyA lstrcpyW MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GlobalFree GlobalAlloc GetShortPathNameW SearchPathW lstrcmpiW SetFileTime CloseHandle ExpandEnvironmentStringsW lstrcmpW GlobalUnlock lstrcpynW GetDiskFreeSpaceW GetExitCodeProcess FindFirstFileW FindNextFileW DeleteFileW SetFilePointer ReadFile FindClose MulDiv MultiByteToWideChar lstrlenA WideCharToMultiByte GetPrivateProfileStringW WritePrivateProfileStringW FreeLibrary LoadLibraryExW GetModuleHandleW

user32

GetSystemMenu SetClassLongW IsWindowEnabled EnableMenuItem SetWindowPos GetSysColor GetWindowLongW SetCursor LoadCursorW CheckDlgButton GetMessagePos LoadBitmapW CallWindowProcW IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard wsprintfW ScreenToClient GetWindowRect GetSystemMetrics SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharPrevW CharNextA wsprintfA DispatchMessageW PeekMessageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow LoadImageW SetTimer SetWindowTextW PostQuitMessage ShowWindow GetDlgItem IsWindow SetWindowLongW FindWindowExW TrackPopupMenu AppendMenuW CreatePopupMenu DrawTextW EndPaint CreateDialogParamW SendMessageTimeoutW SetForegroundWindow

gdi32

SelectObject SetBkMode CreateFontIndirectW SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW ShellExecuteW SHFileOperationW

advapi32

RegDeleteKeyW SetFileSecurityW OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges RegOpenKeyExW RegEnumValueW RegDeleteValueW RegCloseKey RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumKeyW

comctl32

ImageList_AddMasked ord17 ImageList_Destroy ImageList_Create

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 9b93c61c9d63ef8ec80892cc0e4a0877966dca9b0c3eb85555cebd2ddf4d6eed
MD5 fc3772787eb239ef4d0399680dcc4343
SHA1 db2fa99ec967178cd8057a14a428a8439a961a73
SHA512 79e491ca4591a5da70116114b7fbb66ee15a0532386035e980c9dfe7afb59b1f9d9c758891e25bfb45c36b07afd3e171bac37a86c887387ef0e80b1eaf296c89
SSDEEP 192:eS24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35OloSl:S8QIl975eXqlWBrz7YLOlo
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10183

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Idszforladt/Nabalism/rhodesiers.ple

SHA256 f65ed4d3d08ee3bcd24d7957b47d569a93fcdb2ee8c72fe7f1336da9fd2ba480
MD5 7cf78554ac36533fbebcbe2f9b91aa82
SHA1 ad02353cf993e8a2563f5e0ee157149db89c8f50
SHA512 25ff47ee6f51ae8e1316d3fa39b3e28c797d5c8fe26c35b182ffb96fbf420195c81d021deea32fada9cce1dae99f79f1bab98b5574f4b1fd333ac17080f5eeae
SSDEEP 96:HOc7VStmIpZ+eDa8EhwfDuj/stzIj7RYCnozWmZ6SnCnd7veG5rj1a:HzPIPJDa8Ehvj/sGyJau6SnAd7vb3a
MD5 SHA1 SHA512 SSDEEP

Idszforladt/Nabalism/saddlebows.ind

SHA256 272e4376cdcd6668dcd5e1278e1f68681c8db2aa494e22a245a5354862199998
MD5 37bf1167e5878c647b86d1cad03a0b68
SHA1 5a80a8e912612cb6a2b4421016f6605789b6ae6a
SHA512 c3724be6778cde2b1ddf7938cdada03dddf7dff86dc297ff3eade87461f3af660cf6cd464bf60735a53bba93fca654891e1c7f2256d2a82d0b44741a8dd3ab83
SSDEEP 1536:0/QlshdFgUyE9Zv5RlXTCcNdiNSyTAfFsl0NhCAjwFC/dN:0/6sPFryWvBXG0dio9Fw0zx/T
MD5 SHA1 SHA512 SSDEEP

Idszforladt/Nabalism/udmaerker.txt

SHA256 bdefd81ed347c21ab57c4397c8d266226e1596684a182e3f0bc30f4ef89c863c
MD5 8083f8d48d9985247fb0ed6f0d4a4654
SHA1 596e0b52a2436f609208f735b3431524961ead4b
SHA512 60d04580dcc9e23bd91c34a2ac8220498f55521a13d1b3adba1064b4a2278892afcfda0ae850330dc6534f67990a234ad854fa0e6d3fb3245e81d847082e5d09
MD5 SHA1 SHA512

Idszforladt/Nabalism/udvlgningers.amm

SHA256 68f30568e1398f9d39342c5f8af2ed714ff1ab0e072f359199f3010ea79e6cc5
MD5 66fbcb40c83476508097f7adb9951996
SHA1 009afccdc5c38c8dc4e28ac706a457420eed1c4e
SHA512 4511171c47c27065b22e222e6bf3756492938447e8e6f354a04895e24a7f3312fd5fafb51dfb3f55790c90ce70a1804e2dd9dac3427b146e4dd85850f9e2f8f6
SSDEEP 1536:JTIJ2ew3AopFWYwD1DnmjCoMjOvUyqKCs:J8ANAh3Nmjj5cyj
MD5 SHA1 SHA512 SSDEEP

Idszforladt/quantization.dia

SHA256 664fa755d8cd7c057136644cbc04fd544f205db9e33b7e2bfe91a8aef491c2d0
MD5 3844619dafa3eb3cdf402f5f421d021e
SHA1 de75e8ba7c347cd4d052f48c7f00bff680d978b2
SHA512 475b64e2b9883cb0af8b004399ca365f04d1e204154b05e1be6aa4c52bbb6fd2217d478a989a2cd8ee2765f7b1f6be72475c251648e14e480080ac34ea9adf21
SSDEEP 768:9STOyW1quTY8NPkUod4A+bjz85/BXam7F6slzufqNoJSJhUMvXRaVr4SabNs8741:9IbvCYg2fDzBf3bNh4U8D63OXm7q
MD5 SHA1 SHA512 SSDEEP

Idszforladt/rare.pri

SHA256 1574c2c03a2c7ae6991815c58f40a641db9a1207bf48364363733a7c409ecb9f
MD5 eeda6f78eaccb216ec4cef98aec6cb1e
SHA1 af16db62e623a9f9d1304ce19964725ffddd1931
SHA512 41a8dbba41e0a760d46ed2dc788683479e7e419b241d6cd5b5d6e13757c4c994a63518d649a4b269d20b233d3ae8fe7032c261ec87748ed47ce4f85b916a74ca
SSDEEP 1536:uoqomrFt6HQT+4bC04uUqZNM70EM2p15Cgkd+4PAc:Hwr6wC40qa0KoQO
MD5 SHA1 SHA512 SSDEEP

Opfrsel.dra

SHA256 14faa7370708f72db1a0c519b6386ee0d6c364ccf38c69f59265bb3131cdf9e6
MD5 149e41fcd1014bd867112f28f300f802
SHA1 a11f3509021760044c6ee2d5977a4077d724705a
SHA512 146322598172a48e6ba06ab66fc65519a304e393402d15fc7ff4a916ecb2d8a0cdbf23947e3ee5aef546b68c9e5a60f3e38bc3df871f1a3f0089a426eb7cefc0
SSDEEP 3072:8FqQzxVyU2zKjasYaXZq1eDxponmThoW0k7THpE4oCkY8rvSNgZMPvcdOPzsvijT:8Ff1VyU2zKjasYaXZq1eDxponmThoW0A
MD5 SHA1 SHA512 SSDEEP

Peppier/bygrnsens.pal

SHA256 2594c9eefc61f1c19eb720e591ae22060270ace06829460ba2d0f21b3fa7eed9
MD5 da31cf0adabf3581a1d844096ec182c6
SHA1 c1a3a900c39021b2eeeefc9edf595bb87c887767
SHA512 563cb4f544e65fdfe3d200e283a409b201b072c115cff60811b1f42f2d7bf2f8604322601ed17e495640c233dbe3eddc96a2df6ffd29fc0e14a7acc03f68c6cb
SSDEEP 768:mlSy9vKs1ZM/EXNF1oYDNboI/9Y7OJ5I5XqS6tpUsZoT+J0i//hxX:mI7rYZ3pNL
MD5 SHA1 SHA512 SSDEEP

Peppier/dandyens.mor

SHA256 2e7a3385a44771ddf7b0d090caedcc1e0348a015f3d6da7bbcb53ba88924413f
MD5 c71bcd077d8355eb483f6ef9eb265180
SHA1 9be05c4ee5a8b6389b742e5123e3c69c350939f9
SHA512 2904665d9682866a638b94f3092949b21185f4372dc52f64179d09e61eb55dbc7037d9557f8f1a447258504449b9bee122c47056a428d449a3241ba72ee11d19
SSDEEP 768:LsWYmSCVcUeoOWRIesLJnYs8GKA3ZPIe0jsy2oSi9Kt+u4kT8sL0+0JULkPzU3RH:7VmoOr970nBKD4CXTEAy8kFlhMmLW
MD5 SHA1 SHA512 SSDEEP

Peppier/egetrsstol.ind

SHA256 7b493110ca5e9dc635dfd9f1a27263fc74bdd19bba7b5ce06fea4fc2bbb9d22f
MD5 e53a9e2f124b595cd0bf45973ff631b5
SHA1 b98e3f82726f9e4d1329b08e3dc0b0a38997b31d
SHA512 d9c092b49a703d084a149b11077ab8d5a12c4f04ec1382ccecc7c3c4370a0b9f65add199b69497be19cdf25ce26a574b00573c61c445fcc42c604226969fdb52
SSDEEP 768:nfQBi+W5gCID376kj7IcOC74cMkfvieqm6aLskHSc/gBs9iuzlBgR3jnIfClvY99:MDISM+bYR2gRFbUDecbnhb
MD5 SHA1 SHA512 SSDEEP

Peppier/kammerjunkernes.thu

SHA256 6fac0248efbec07f9394a9c830fc62a1e1718666b6bd48ae549dacf5f4f89995
MD5 238766483290001d68a2c93b44da7cf4
SHA1 06b641f48890b323cc2498287c56611c67798b11
SHA512 0fc237ed169c6069d1367aafcc802d0c07427cf6edddd86dee243950e37b0121f97370b9d507fccc95d73fd6ddd523d5c9c19d1ec1360906a28043bde11569f1
SSDEEP 1536:vJyeMX4YJTb5p5kHobfHPSxchptG+lUxI:hyeclKHofvSGhK4UK
MD5 SHA1 SHA512 SSDEEP

Peppier/lampshell.van

SHA256 4641e36803dbbe6deb3f95e1a214ce837dc3ef1cc3ea63eaf4d93b19811c56a4
MD5 b64387cbec3970d11b086af2e334b0cf
SHA1 60e229f8e770f04ada68f9a87074a3f6f4069aeb
SHA512 81437104bacf6fcdbd191a95b5297a810554a9e265c110112a7e0ec00bd42404827fd57341138583ddfe2f8643972ea6e626edcfa533100ed99cff1f7fa79048
SSDEEP 768:wv+5vB/7vwKofCWNRK4szLl1I4/9fn6CPMCba:B/UlUzBFpba
MD5 SHA1 SHA512 SSDEEP

Peppier/leveringsstedets.hov

SHA256 98d5e3862a4d6093172c1aa2c97833dfc19bdc9d733fcecf3105e840cd942f44
MD5 4671e4c2f2003a5b662d240446be44dd
SHA1 7d1dd9ceb6aea306196d0a5df9ff35e28903e842
SHA512 f34a3837c3cacf4e627bec551504b97f68364a8f715fffc0291d498f0de3676aa63b671f2c34147e5e23d1e34d46fa114e62a2b7e01692419b7b2a4780a87491
SSDEEP 1536:54GgtNcBYDxRnVNDmJlF5qwL22A5wl+OSm7:q8iFNPmJxqr2YOz
MD5 SHA1 SHA512 SSDEEP

Peppier/meadows.bot

SHA256 18ce40c179b9220237aaf7e2c73347359c64de42bcf96e964dfa9527b2ae64c0
MD5 c9cfceeb03bd40571c976a74a05e4bd3
SHA1 19ed151e8ac812f570f8786245678d45a6ee09d5
SHA512 564df7ae0c6ef21647d6f0ea5e5b2ca2a4325b7f6b81e5b9faffc49c361de53a8a9572b7f5b571a2267ca08a5fd8d98a0d0a1887a3739221b3befd879fe3089a
SSDEEP 1536:4avv8SPlAwyGJeLP2pMdnC4MbzoJpOKvLPu:4i6jGJuFPJsW
MD5 SHA1 SHA512 SSDEEP

Stiftmosaik56/Aarelangt.Cit

SHA256 adef59c3f808fcd42aded272cba5c3475d9a19959a3994771e1b1c56c1095d4b
MD5 76ef487c1f2a489197ce707455a0f2e2
SHA1 ebb97e846177bdd05b6574c2d5c25c2fff844ad8
SHA512 fe3bf84958adb8bc8fbfd2a0251c74ae399bcf8699cf271d5a61c9f588cb83c272d020a63c0eee3f430ddb3af67d222cbc829474124ac2f20814f77ce6944f60
SSDEEP 192:YmcNlQ6K5xqc2oRUVtawXadz0p1/oTXvRF+IGRZUIkAhco:HcLQFbsVtaakzm1CeZxkAj
MD5 SHA1 SHA512 SSDEEP

Stiftmosaik56/Blyholdigere142.fas

SHA256 8898c0f280e737ed1960a8f9d43987fbabfb83a45f7d5bb18f8398b11b9fb5a9
MD5 1c0502d3c78bed84ce7d07093cf8495d
SHA1 c3e82aa8c43e330fa48073de32ec85a99a297e2c
SHA512 8e6571349252fc9c78059f10221fbd8b4776c0b7045bed7b6b20b560bdb9136beab82543832fc50edf365e8b47b766ff9dd94c62b94e91a3e0dd623353e20715
SSDEEP 768:yGm8X2YPrXK8E+MyOzWHiXjjqWfnIEDh+IRUJ3MC1OvXjclYG5Ou+miV8vT/ihip:tIWahlTSbviV04YS1WM3OBqI
MD5 SHA1 SHA512 SSDEEP

Stiftmosaik56/Maskingevrerne113.ovo

SHA256 07e6cfc15b6113d833026abb683cf3473585be3329fedd2d37134d8e2f8d087b
MD5 b70f25055993e19a4f92170451c38de6
SHA1 afedcf20a863b7fbd347642a24c0b2e34b7257e6
SHA512 6d9004555e0ac567e091125e1a7859fef63ec07a86ddc599b5be16eaddda35a2ef1686aded6ca7c3a64942be2144d6b3e782600a71a9708ae6054a6f78535f83
SSDEEP 1536:vo/pg3ik4GqhuwMI3dFgTAHAs5oDKjlFIhN+Pzxj69gLZw9:vOQii5w2TAHNoWj/gNozVAiw9
MD5 SHA1 SHA512 SSDEEP

Stiftmosaik56/bambushytte.fus

SHA256 1c48cb267307819dc8a9951cf1caa7eeb15531f5f8a6078c325190e27e7e682d
MD5 876e71c93992b4bf8deecdeaac3df9b3
SHA1 3682b1a73459959ccfb4ebecdd3dcd17e1a55e75
SHA512 9ed4b8ce6a8d6bf7b3ea4f67110f49d03d60691c292747032ca505721f9c18571865dc7bbfdcfac5ef4ec161681e3207994acd8fb44b9961c1c34f70835d82d7
SSDEEP 1536:UcOM4u+oOeqzjufr1aZnX79UurkAovNSw9:kRjgo79k5vw0
MD5 SHA1 SHA512 SSDEEP

1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Idszforladt/Nabalism/rhodesiers.ple

Idszforladt/Nabalism/saddlebows.ind

Idszforladt/Nabalism/udmaerker.txt

Idszforladt/Nabalism/udvlgningers.amm

Idszforladt/quantization.dia

Idszforladt/rare.pri

Opfrsel.dra

Peppier/bygrnsens.pal

Peppier/dandyens.mor

Peppier/egetrsstol.ind

Peppier/kammerjunkernes.thu

Peppier/lampshell.van

Peppier/leveringsstedets.hov

Peppier/meadows.bot

Stiftmosaik56/Aarelangt.Cit

Stiftmosaik56/Blyholdigere142.fas

Stiftmosaik56/Maskingevrerne113.ovo

Stiftmosaik56/bambushytte.fus

Sharing

General

Malware Config

Signatures

File Explorer

1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Idszforladt/Nabalism/rhodesiers.ple

Idszforladt/Nabalism/saddlebows.ind

Idszforladt/Nabalism/udmaerker.txt

Idszforladt/Nabalism/udvlgningers.amm

Idszforladt/quantization.dia

Idszforladt/rare.pri

Opfrsel.dra

Peppier/bygrnsens.pal

Peppier/dandyens.mor

Peppier/egetrsstol.ind

Peppier/kammerjunkernes.thu

Peppier/lampshell.van

Peppier/leveringsstedets.hov

Peppier/meadows.bot

Stiftmosaik56/Aarelangt.Cit

Stiftmosaik56/Blyholdigere142.fas

Stiftmosaik56/Maskingevrerne113.ovo

Stiftmosaik56/bambushytte.fus