422ea7c485f3c82c72b2adf62961cb61ded05226ceb12ec503bccba25e23886e[.]exe

resource
unpack001/$PLUGINSDIR/System.dll

422ea7c485f3c82c72b2adf62961cb61ded05226ceb12ec503bccba25e23886e.exe

IMPHASH 6e7f9a29f2c85394521a08b9f31f6275
SHA256 422ea7c485f3c82c72b2adf62961cb61ded05226ceb12ec503bccba25e23886e
MD5 679962fd58f49f4d2f57a70a60aa287d
SHA1 3e3a3e5bc5e49ab7212e5ae5f340dd820fccd643
SHA512 597a1678322ade7c14d1181b9a2e4e09a7a9f841d5c2f3f0e0e64c40801eec25112dca1c5eaf53834dd1fdf8f5003f69d64e6cf5dd4ea46e42c73018690d4348
SSDEEP 12288:aMwa4IgEP4mLbAcLit9eIAnZ21gvG4nwNtsgw3PgAeeVhGctb7U:aMwa4BEP3Qc+t9eIAnEgB2Mobej7U
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

27:d0:9b:59:86:2b:a0:a2:03:ec:c0:a8:81:69:47:50:b4:63:ee:5b:7e:ca:fb:af:38:71:c2:97:58:52:fa:29

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Nonposthumous,O=Nonposthumous,L=München,C=DE

Chains

Nov 7, 2024

Minor OS version

0

Major OS version

4

Entry point

13455

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCreateKeyExW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken SetFileSecurityW RegOpenKeyExW RegEnumValueW

shell32

SHGetSpecialFolderLocation SHFileOperationW SHBrowseForFolderW SHGetPathFromIDListW ShellExecuteExW SHGetFileInfoW

ole32

OleInitialize OleUninitialize CoCreateInstance IIDFromString CoTaskMemFree

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

GetClientRect EndPaint DrawTextW IsWindowEnabled DispatchMessageW wsprintfA CharNextA CharPrevW MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW GetSystemMetrics FillRect AppendMenuW TrackPopupMenu OpenClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetWindowLongW GetSysColor SetWindowPos PeekMessageW SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint EmptyClipboard CreatePopupMenu

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateFontIndirectW CreateBrushIndirect DeleteObject SetTextColor SelectObject

kernel32

GetExitCodeProcess WaitForSingleObject GetModuleHandleA GetProcAddress GetSystemDirectoryW lstrcatW Sleep lstrcpyA WriteFile GetTempFileNameW CreateFileW lstrcmpiA RemoveDirectoryW CreateProcessW CreateDirectoryW GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersion GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW ExitProcess CopyFileW GetCurrentProcess GetModuleFileNameW GetFileSize GetTickCount MulDiv SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW MoveFileExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 7a9ddee34562cd3703f1502b5c70e99cd5bba15de2b6845a3555033d7f6cb2a5
MD5 564bb0373067e1785cba7e4c24aab4bf
SHA1 7c9416a01d821b10b2eef97b80899d24014d6fc1
SHA512 22c61a323cb9293d7ec5c7e7e60674d0e2f7b29d55be25eb3c128ea2cd7440a1400cee17c43896b996278007c0d247f331a9b8964e3a40a0eb1404a9596c4472
SSDEEP 192:nenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XBDIwL:n8+Qlt70Fj/lQRY/9VjjfL
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10719

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Gaslightness.dav

SHA256 d09cea291936283c3f9e24cf88c4aa506aa8fe1ca5ca9b971fe0cb89c827eece
MD5 5fe737ac4219c3290fb0da11a22b81a5
SHA1 b74d9013ddaa37247546a6ca096636dcf5168faf
SHA512 1fb9b8eb1b180393f6858209a698b507259dafc60d188ddff5ce571a4bdb1e9724eb876fa55122fc5be9aa2de03bf3c296731c1abc17f36e3a813ef761ed3b19
SSDEEP 768:gosaq+k68A0lbqieAxrOi4eqDopHay9OSwH0fpWLbiZw+kvcbiFRLu9Gsu0wQHzW:KLpQMha9n+fKR7Arg9
MD5 SHA1 SHA512 SSDEEP

Gitanemuk.hyd

SHA256 eca1a5f49c1554e091c23636863546b3c97cc7e84f7e977215dd33cd56af0439
MD5 ab16c812d4a6783639fee9f23ade8e58
SHA1 dc21d59f6d5547ae7bebf8fba277262a0bc2ce13
SHA512 18b69e1484bd2f9c7c0717cedde8b1063a8c33a16d2fe417b9de18c3beb96bad5ebc2e6b72c8623887ae0cf6854d4a2bea87aff2d23e5ea2b51a9f386426376e
SSDEEP 768:Ia+oCzPbaZQgf/aeJFxjC/q6GCeWilKnSS9QEF2QfoWzeHEMYJIWCycDGlNtNX/:I82gC/iEukoF8pMuDNJKu09L8cGx5
MD5 SHA1 SHA512 SSDEEP

Indhylling.Akt

SHA256 56c0bddb00dd3acdf7a9f4d3b58935b6dbe46ef9d7bcb895e090c29db9cfe2ee
MD5 a322fc46b6cb96d610ce0dcd0b0b45be
SHA1 b3252f4651c71e84d9800eb4921956f4dbe5c44b
SHA512 bc4da3c913be180f4230aca03d7cf5215ddb1c2a0b4a6218b1dd2f6fc79531fd6a43c0523866e974ba81b57185138aff0d0612f8c06cf811a64213a31eec1f35
SSDEEP 6144:VDKqEs1ACqNhJbQxrFcS3b4ZppT881W9qw36XaqRymFSEOi:VWM9J3Z4bCjJQUi
MD5 SHA1 SHA512 SSDEEP

Wheyworm/forzinknings.vin

SHA256 7d09762e3add5c4da1b3d4dd9e59a5414336d1a3079dbf03e946d4113af114da
MD5 5fdf9a93ec041d3695f6053bc2c1fbdc
SHA1 0bac381e3967b12d12b64cd4579187e04723223b
SHA512 09396de55faa69b335b7666c8e71bda2ba981cc19511f8cd118beb912b1b3629087cbb7d8ca21d742a067a23dc55c5d3da713d68a6d1886edaa9bce91bbee019
SSDEEP 768:dSIym9lf1KoH1AGOigvBXAiccQTnJ2nJwC64Pe84ioAbCS1KHzUnPvq/+FzoXP53:dEQN+JMq67wPzlJwwPxXGOM
MD5 SHA1 SHA512 SSDEEP

Wheyworm/skorstenspiben.nip

SHA256 6bdda4fcc1c0041374658b1002d604e325a587e3b779ae95634f312749d8324c
MD5 f51f323ef5d82058a519aea655e8911a
SHA1 7821d93819a31404bb4d0220db5baa21c3fc5bef
SHA512 00591bafec704bb8e8e0b42b85af8271d725ea602e36b6e2fa288d02bf3354f6b4bf41826088ae3fd98d240135a9a8f4b8066dfc1e192d9e13d94d100ac28cba
SSDEEP 768:VZkWb11IrSZaQL8OJwTrW+y4A1+ysSkSgv8rrlPSFBz8b0KCTZNv9vy7bsTUVkkc:wungUKNabSUV2YmqudD8Ol
MD5 SHA1 SHA512 SSDEEP

Wheyworm/totipotent.inc

SHA256 d3fe834562c956140fd20eae83d0a866f95790f9686f2380296c517c95400fad
MD5 1f48b57f3d68e67c04e5c5d7b0968d2b
SHA1 90f1f539574bcb7addfe53dbb139c4d3575f885d
SHA512 24f1c22a4f48454c398a351e37bad75f25252e8f45bd96d86ed153b557ba3850f25192aaa12130f3d7b051e1a6a62a9281ac39f211f60c5b2d4905ea5afec8c8
SSDEEP 1536:NvOgw9RzVig2Ml+Iy2SE0qZ+wYHjgK0DM8B1IJH0S:mP6McV2SyZajMM8kZ
MD5 SHA1 SHA512 SSDEEP

angster.sal

SHA256 36f5ebeb6aa27931c3413ad92c681cc745afd265b0e68336c4df8910b8462a27
MD5 a62efa1ff0ed403ae715fb5bc2d3c209
SHA1 8c18e9680f3d12cf77be9be0e19845b5994ba19b
SHA512 68d932be8adfae6f94fdb5b98e6c97747bac3ef63df1e4c7f6c2b1e6ec93f3ddf204d4574df30efcebe66163e1f6fa0e64c2f2507b9e25de90b3c6e3f5e0cf91
SSDEEP 768:chmnjB72EGmP7BN96ZJUbklwGUryfiCvhGfepXgCpiiJ1xXFVUSUwEklDPeS8ruo:cOBnTSnzcGfusKycr8wpxqNH
MD5 SHA1 SHA512 SSDEEP

antiperiodic.txt

SHA256 b3685fd14692d9f81f334e06dd3571afa1057d1c82a844202e2a1ec7650b0121
MD5 fa65fee4ea82fade2e55f4c3f742476e
SHA1 2aac70e9d1301c6caac9f89959bcecf4d2d4abf3
SHA512 b0e230ed39342590082a6139f3d5ce09b497536150a4a6dbfd9c32763919277e621fcdc91ee50114fbdf9c001eeaf2316c4211ee6051d6b050f4c01cfa344b3f
MD5 SHA1 SHA512

422ea7c485f3c82c72b2adf62961cb61ded05226ceb12ec503bccba25e23886e.exe

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Gaslightness.dav

Gitanemuk.hyd

Indhylling.Akt

Wheyworm/forzinknings.vin

Wheyworm/skorstenspiben.nip

Wheyworm/totipotent.inc

angster.sal

antiperiodic.txt

Sharing

General

Malware Config

Signatures

File Explorer

422ea7c485f3c82c72b2adf62961cb61ded05226ceb12ec503bccba25e23886e.exe

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Gaslightness.dav

Gitanemuk.hyd

Indhylling.Akt

Wheyworm/forzinknings.vin

Wheyworm/skorstenspiben.nip

Wheyworm/totipotent.inc

angster.sal

antiperiodic.txt