25e63b30d14cfb8e34d5223ad2d2eee2d684603b5e74b91fdecd2ff9b8945066[.]exe

resource
unpack001/$PLUGINSDIR/System.dll

25e63b30d14cfb8e34d5223ad2d2eee2d684603b5e74b91fdecd2ff9b8945066.exe

IMPHASH 6e7f9a29f2c85394521a08b9f31f6275
SHA256 25e63b30d14cfb8e34d5223ad2d2eee2d684603b5e74b91fdecd2ff9b8945066
MD5 964744dc0ee9f5fcb1c2d50553c1a080
SHA1 b097808717cf2aed2109c0191b6a32471a97b1c5
SHA512 9151bfa7447126013681209b92e46f8049a8bea2d09fb972a19942795d0a16274c191bbb654eb66465011da5260fc34c08b0eb456348ab377e5bde1aa90713f0
SSDEEP 12288:sMwaWgmqtOAmk6kIATs0yjE8HELsQP04nwNtsgw3PgAeeVhGctH74:sMwaWgqkJIAw0yghs2f2Mobev74
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

92:af:d8:ad:89:dd:28:7f:94:1e:f3:10:bc:b1:8a:17:2c:e8:f5:8a:8d:ce:15:0f:c1:37:7a:21:3b:cb:60:a4

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Behftet,O=Behftet,L=Andlau,C=FR

Chains

Nov 9, 2024

Minor OS version

0

Major OS version

4

Entry point

13455

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCreateKeyExW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken SetFileSecurityW RegOpenKeyExW RegEnumValueW

shell32

SHGetSpecialFolderLocation SHFileOperationW SHBrowseForFolderW SHGetPathFromIDListW ShellExecuteExW SHGetFileInfoW

ole32

OleInitialize OleUninitialize CoCreateInstance IIDFromString CoTaskMemFree

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

GetClientRect EndPaint DrawTextW IsWindowEnabled DispatchMessageW wsprintfA CharNextA CharPrevW MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW GetSystemMetrics FillRect AppendMenuW TrackPopupMenu OpenClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetWindowLongW GetSysColor SetWindowPos PeekMessageW SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint EmptyClipboard CreatePopupMenu

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateFontIndirectW CreateBrushIndirect DeleteObject SetTextColor SelectObject

kernel32

GetExitCodeProcess WaitForSingleObject GetModuleHandleA GetProcAddress GetSystemDirectoryW lstrcatW Sleep lstrcpyA WriteFile GetTempFileNameW CreateFileW lstrcmpiA RemoveDirectoryW CreateProcessW CreateDirectoryW GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersion GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW ExitProcess CopyFileW GetCurrentProcess GetModuleFileNameW GetFileSize GetTickCount MulDiv SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW MoveFileExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 7a9ddee34562cd3703f1502b5c70e99cd5bba15de2b6845a3555033d7f6cb2a5
MD5 564bb0373067e1785cba7e4c24aab4bf
SHA1 7c9416a01d821b10b2eef97b80899d24014d6fc1
SHA512 22c61a323cb9293d7ec5c7e7e60674d0e2f7b29d55be25eb3c128ea2cd7440a1400cee17c43896b996278007c0d247f331a9b8964e3a40a0eb1404a9596c4472
SSDEEP 192:nenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XBDIwL:n8+Qlt70Fj/lQRY/9VjjfL
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10719

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Aktionsenhedens/Dissuitable.Des55

SHA256 d880238efc8731582a22d3c6d263ad4a8a2df842fc6467072218a77296ce7815
MD5 a0415b1f2399393ebc9f763aeda38586
SHA1 bb40e5b6dd60c59254c4d5aeea2d2cce2f603a2e
SHA512 eb624791da981611944da0660d7eb647834822b0c70664e4e827bd07136b86498b83c0e604b1c8e774d2cb39585e83c9b153de3cb22d047fcc37c38e7ef4801a
SSDEEP 6144:d23lviRsJPireP3+F1794Ioje73iVuUQpbBVUWsEg8FjphLY:Alvi6JPoeP3o76vI30iRL+
MD5 SHA1 SHA512 SSDEEP

Aktionsenhedens/Gaslightness.dav

SHA256 d09cea291936283c3f9e24cf88c4aa506aa8fe1ca5ca9b971fe0cb89c827eece
MD5 5fe737ac4219c3290fb0da11a22b81a5
SHA1 b74d9013ddaa37247546a6ca096636dcf5168faf
SHA512 1fb9b8eb1b180393f6858209a698b507259dafc60d188ddff5ce571a4bdb1e9724eb876fa55122fc5be9aa2de03bf3c296731c1abc17f36e3a813ef761ed3b19
SSDEEP 768:gosaq+k68A0lbqieAxrOi4eqDopHay9OSwH0fpWLbiZw+kvcbiFRLu9Gsu0wQHzW:KLpQMha9n+fKR7Arg9
MD5 SHA1 SHA512 SSDEEP

Aktionsenhedens/Gitanemuk.hyd

SHA256 eca1a5f49c1554e091c23636863546b3c97cc7e84f7e977215dd33cd56af0439
MD5 ab16c812d4a6783639fee9f23ade8e58
SHA1 dc21d59f6d5547ae7bebf8fba277262a0bc2ce13
SHA512 18b69e1484bd2f9c7c0717cedde8b1063a8c33a16d2fe417b9de18c3beb96bad5ebc2e6b72c8623887ae0cf6854d4a2bea87aff2d23e5ea2b51a9f386426376e
SSDEEP 768:Ia+oCzPbaZQgf/aeJFxjC/q6GCeWilKnSS9QEF2QfoWzeHEMYJIWCycDGlNtNX/:I82gC/iEukoF8pMuDNJKu09L8cGx5
MD5 SHA1 SHA512 SSDEEP

Globularly231/angster.sal

SHA256 36f5ebeb6aa27931c3413ad92c681cc745afd265b0e68336c4df8910b8462a27
MD5 a62efa1ff0ed403ae715fb5bc2d3c209
SHA1 8c18e9680f3d12cf77be9be0e19845b5994ba19b
SHA512 68d932be8adfae6f94fdb5b98e6c97747bac3ef63df1e4c7f6c2b1e6ec93f3ddf204d4574df30efcebe66163e1f6fa0e64c2f2507b9e25de90b3c6e3f5e0cf91
SSDEEP 768:chmnjB72EGmP7BN96ZJUbklwGUryfiCvhGfepXgCpiiJ1xXFVUSUwEklDPeS8ruo:cOBnTSnzcGfusKycr8wpxqNH
MD5 SHA1 SHA512 SSDEEP

Globularly231/antiperiodic.txt

SHA256 b3685fd14692d9f81f334e06dd3571afa1057d1c82a844202e2a1ec7650b0121
MD5 fa65fee4ea82fade2e55f4c3f742476e
SHA1 2aac70e9d1301c6caac9f89959bcecf4d2d4abf3
SHA512 b0e230ed39342590082a6139f3d5ce09b497536150a4a6dbfd9c32763919277e621fcdc91ee50114fbdf9c001eeaf2316c4211ee6051d6b050f4c01cfa344b3f
MD5 SHA1 SHA512

Globularly231/forzinknings.vin

SHA256 7d09762e3add5c4da1b3d4dd9e59a5414336d1a3079dbf03e946d4113af114da
MD5 5fdf9a93ec041d3695f6053bc2c1fbdc
SHA1 0bac381e3967b12d12b64cd4579187e04723223b
SHA512 09396de55faa69b335b7666c8e71bda2ba981cc19511f8cd118beb912b1b3629087cbb7d8ca21d742a067a23dc55c5d3da713d68a6d1886edaa9bce91bbee019
SSDEEP 768:dSIym9lf1KoH1AGOigvBXAiccQTnJ2nJwC64Pe84ioAbCS1KHzUnPvq/+FzoXP53:dEQN+JMq67wPzlJwwPxXGOM
MD5 SHA1 SHA512 SSDEEP

Globularly231/skorstenspiben.nip

SHA256 6bdda4fcc1c0041374658b1002d604e325a587e3b779ae95634f312749d8324c
MD5 f51f323ef5d82058a519aea655e8911a
SHA1 7821d93819a31404bb4d0220db5baa21c3fc5bef
SHA512 00591bafec704bb8e8e0b42b85af8271d725ea602e36b6e2fa288d02bf3354f6b4bf41826088ae3fd98d240135a9a8f4b8066dfc1e192d9e13d94d100ac28cba
SSDEEP 768:VZkWb11IrSZaQL8OJwTrW+y4A1+ysSkSgv8rrlPSFBz8b0KCTZNv9vy7bsTUVkkc:wungUKNabSUV2YmqudD8Ol
MD5 SHA1 SHA512 SSDEEP

Globularly231/totipotent.inc

SHA256 d3fe834562c956140fd20eae83d0a866f95790f9686f2380296c517c95400fad
MD5 1f48b57f3d68e67c04e5c5d7b0968d2b
SHA1 90f1f539574bcb7addfe53dbb139c4d3575f885d
SHA512 24f1c22a4f48454c398a351e37bad75f25252e8f45bd96d86ed153b557ba3850f25192aaa12130f3d7b051e1a6a62a9281ac39f211f60c5b2d4905ea5afec8c8
SSDEEP 1536:NvOgw9RzVig2Ml+Iy2SE0qZ+wYHjgK0DM8B1IJH0S:mP6McV2SyZajMM8kZ
MD5 SHA1 SHA512 SSDEEP

25e63b30d14cfb8e34d5223ad2d2eee2d684603b5e74b91fdecd2ff9b8945066.exe

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Aktionsenhedens/Dissuitable.Des55

Aktionsenhedens/Gaslightness.dav

Aktionsenhedens/Gitanemuk.hyd

Globularly231/angster.sal

Globularly231/antiperiodic.txt

Globularly231/forzinknings.vin

Globularly231/skorstenspiben.nip

Globularly231/totipotent.inc

Sharing

General

Malware Config

Signatures

File Explorer

25e63b30d14cfb8e34d5223ad2d2eee2d684603b5e74b91fdecd2ff9b8945066.exe

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Aktionsenhedens/Dissuitable.Des55

Aktionsenhedens/Gaslightness.dav

Aktionsenhedens/Gitanemuk.hyd

Globularly231/angster.sal

Globularly231/antiperiodic.txt

Globularly231/forzinknings.vin

Globularly231/skorstenspiben.nip

Globularly231/totipotent.inc