4ad4bb99aa68ac6d5828c71c3f3d5d2983ead0626fd77aba7bb98de727a4b90b[.]exe

resource
unpack001/$PLUGINSDIR/System.dll

4ad4bb99aa68ac6d5828c71c3f3d5d2983ead0626fd77aba7bb98de727a4b90b.exe

IMPHASH 3f91aceea750f765ef2ba5d9988e6a00
SHA256 4ad4bb99aa68ac6d5828c71c3f3d5d2983ead0626fd77aba7bb98de727a4b90b
MD5 5bdcc2d33ca974c1d8448afcf83f74d1
SHA1 f693dea01991d995173a5934d478ad43c50e28e2
SHA512 35633187911d09542892a55671ce6d2953418466185b57aa506fabf039c97a7375c8ad4268f3ded8f9fe5bb7a36a3c688d2321056b7c0aff3546a630df30bbbf
SSDEEP 24576:X4nhDoAFnNn+rb27TGQwpoxmBNFt/ZNXLGQ7WczkxFnfbP9:X+hkSNwbwGlym5tBNXKQKczg
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

f0:4f:86:95:42:13:42:22:35:54:2f:71:e8:20:58:82:e9:d6:1d:79:8c:1b:a3:36:a0:6c:e1:34:89:10:9e:cb

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=pgntt,O=pgntt,L=Sainte-Menehould,C=FR

Chains

Nov 11, 2024

PE Signature issue

Digest

2a:3f:12:4e:10:a7:4e:dc:7f:90:0c:65:9e:eb:ef:9e:58:e5:8f:74

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=pgntt,O=pgntt,L=Sainte-Menehould,C=FR

Chains

Nov 11, 2024

Minor OS version

1

Major OS version

5

Entry point

14042

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCloseKey RegDeleteKeyW RegDeleteValueW RegEnumKeyW RegEnumValueW RegQueryValueExW RegSetValueExW OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueW SetFileSecurityW RegCreateKeyExW RegOpenKeyExW

shell32

ShellExecuteExW SHFileOperationW SHBrowseForFolderW SHGetPathFromIDListW SHGetFileInfoW SHGetSpecialFolderLocation

ole32

OleInitialize OleUninitialize CoTaskMemFree IIDFromString CoCreateInstance

comctl32

ord17 ImageList_Destroy ImageList_AddMasked ImageList_Create

user32

DispatchMessageW wsprintfA SystemParametersInfoW SetClassLongW GetWindowLongW GetSysColor ScreenToClient SetCursor GetWindowRect TrackPopupMenu AppendMenuW EnableMenuItem CreatePopupMenu GetSystemMenu GetSystemMetrics IsWindowEnabled EmptyClipboard SetClipboardData CloseClipboard OpenClipboard CheckDlgButton EndDialog DialogBoxParamW IsWindowVisible SetWindowPos CreateWindowExW GetClassInfoW PeekMessageW CallWindowProcW GetMessagePos CharNextW ExitWindowsEx SetWindowTextW SetTimer CreateDialogParamW DestroyWindow LoadImageW FindWindowExW SetWindowLongW InvalidateRect ReleaseDC GetDC SetForegroundWindow EnableWindow GetDlgItem ShowWindow IsWindow PostQuitMessage SendMessageTimeoutW SendMessageW wsprintfW FillRect GetClientRect EndPaint BeginPaint DrawTextW DefWindowProcW SetDlgItemTextW GetDlgItemTextW CharNextA MessageBoxIndirectW RegisterClassW CharPrevW LoadCursorW

gdi32

SetBkMode CreateBrushIndirect GetDeviceCaps SelectObject DeleteObject SetBkColor SetTextColor CreateFontIndirectW

kernel32

WriteFile GetLastError WaitForSingleObject GetExitCodeProcess GetTempFileNameW CreateFileW CreateDirectoryW WideCharToMultiByte lstrlenW lstrcpynW GlobalLock GlobalUnlock CreateThread GetDiskFreeSpaceW CopyFileW GetVersionExW GetWindowsDirectoryW ExitProcess GetCurrentProcess CreateProcessW GetTempPathW SetEnvironmentVariableW GetCommandLineW GetModuleFileNameW GetTickCount GetFileSize MultiByteToWideChar MoveFileW WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA lstrcmpiW lstrcmpW MulDiv GlobalFree GlobalAlloc LoadLibraryExW GetModuleHandleW FreeLibrary Sleep CloseHandle SetFileTime SetFilePointer SetFileAttributesW ReadFile GetShortPathNameW GetFullPathNameW GetFileAttributesW FindNextFileW FindFirstFileW FindClose DeleteFileW CompareFileTime SearchPathW SetCurrentDirectoryW ExpandEnvironmentStringsW RemoveDirectoryW GetSystemDirectoryW MoveFileExW GetModuleHandleA GetProcAddress lstrcmpiA lstrcpyA lstrcatW SetErrorMode

$PLUGINSDIR/System.dll

IMPHASH 4f33ea844b96a31c8f4690530ba63854
SHA256 f917aef484d1fbb4d723b2e2d3045cb6f5f664e61fbb3d5c577bd1c215de55d9
MD5 d6f54d2cefdf58836805796f55bfc846
SHA1 b980addc1a755b968dd5799179d3b4f1c2de9d2d
SHA512 ce67da936a93d46ef7e81abc8276787c82fd844c03630ba18afc3528c7e420c3228bfe82aeda083bb719f2d1314afae913362abd1e220cb364606519690d45db
SSDEEP 192:acA1YOTDExj7EFrYCT4E8y3hoSdtTgwF43E7QbGPXI9uIc6w79Mw:RR7SrtTv53tdtTgwF4SQbGPX36wJMw
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

6730

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$_41_/Emmens.udk

SHA256 1b6dc1ead079db05b998725b154e803e6e1504e7e5b49c5611d55e018cd45e6d
MD5 1d099f6122f4b7c8a78925726b59e5c3
SHA1 eea154e31ff04cd1a2ced0193f7633ed219cfa47
SHA512 f31f0a285c5a6eb2236ccd49a8bf939e46624f270e0270fc4c5640b37684bc1c7780c5350f778da8e9d0b8cd25320c1909a9cd937f15bb3a7cddbceee94c47fb
SSDEEP 1536:+yiLw81PnsncGiIsTVODPOqNbsVEVWZkZA4:G/Pne9iIyVODPsVpZkZA4
MD5 SHA1 SHA512 SSDEEP

$_41_/Modernized.Fil

SHA256 c5357ead0e6be3b4632516bca653edf8edc122c368f80bbecd7317801fcdfaa8
MD5 d22e3279808203240637b86177a5923e
SHA1 95f285e86fdd84bba740bfceed2a8b1fffd38c90
SHA512 a3ad08b814568466af4ae38ed952c2be0090827e88de9c264a78aeda2ff06f44be81b79423c3e1f79dc007f58a230340190e0aad5874c8426e966e33abcf9c0f
SSDEEP 6144:B0DsdxHOonHNzzc7TH8eLNpzi7EXXLNwk5ZdloCV1PA4AZ2mvDq:Kyxt48eLLi2lllrPA48/O
MD5 SHA1 SHA512 SSDEEP

$_41_/Proprietrer.bet

SHA256 645c325f62af720972466322b09a7e396e46d8e640b138d582374b68d763a3a7
MD5 0b62328c4966f6b879b3c13b7fbd9c0d
SHA1 6dd81f12e739e81e06778067513ed1178a06afc9
SHA512 2f738a2950352f124f7b969d38b52bd2e4453ff42bc8deb7566620e6cdea30368a6dc16230ba49050f8c0327175cab71dc4a1709541f08a3ffdcf55faf5b75b8
SSDEEP 768:l1SkOmjqFRV/HZzy6+19kZBH4YVHCdJS7G5iOUEEaXXLlgHHl7MRY9hN+418WPK5:KOqvBJzC5vBhp8KT9AGCbQTZkkR
MD5 SHA1 SHA512 SSDEEP

$_41_/Revolutionsraadets.Bim

SHA256 cb82d952004afd4e0673b0948fd9f283edce71d413e8b3c1ac31d0d9c9c5adb5
MD5 ed9c3e5e3dea88c54708f64ffa3cefbc
SHA1 2331cab7644adaf10c0614edd529b951fe893929
SHA512 0ce07a554ca33a61586fcb6757e83f947d2b259d6a8dd976234aebf1a5d577c7ba81d0dc04aa9b912c01bdc1222ec5a403d5ab2dd668630e8f028ca904f6828d
SSDEEP 3072:sTyvrYiIBN1I+3nMEIg9Hkb5pn4ItMwcyo8uO:OqrdIr7XbJWz48uO
MD5 SHA1 SHA512 SSDEEP

Konditorierne/Trikstanks.pra

SHA256 a55dac07fb586d4b64f0ddf812087a2eeec6f5286d9bc73ad648ed3220abdd3a
MD5 49be0e06f2e4f0ccffb46426ee262642
SHA1 ff9c56c31a824e4ca087705c23d01d288fe34239
SHA512 27e9d035708943dd257186457c15488c9405747fc77f7c76760c96ee011c239f9fa53b5da17958038fb2ba1c4e27e643e7924a37e6164e250b9f45a109d92e53
SSDEEP 768:AgVdAd1etxyZmQhZgJwrQTTwKuiTGrJqCoIEsPkZnFFSKsOI4v/3n35lB3LiADa4:5TxLsV5IjQ3xx12
MD5 SHA1 SHA512 SSDEEP

Konditorierne/boyaus.rom

SHA256 a56351ed69a301f5d9d89b6530280b7a85f998a806e1648911c37b6983ba9426
MD5 f130ec3095dbecedc791d8c58a59040c
SHA1 dad2300b487f31f199520e1b41ab02b7d677b352
SHA512 8599200f472f2d59390e8f2c497331640b12ab9faf71817160c6d450edf8a99f78cef28cc3b57581d6aecfc1ec90a49947a6685c606321b6ee300d483c838360
SSDEEP 768:jby0EUrStmwpKcx/orVcYZ+M3ok1I7vZFCDrlv2UV5t3votN6cGia46OGj3OkYSk:FaZaukRTadSdbrJ5N275Ea3nRYS3r
MD5 SHA1 SHA512 SSDEEP

Konditorierne/gear.dra

SHA256 fad1b5e641dc44b5a51048470d4e0fb47664cf2b994cea24304495d99323b9de
MD5 53ff1a157920ae92c9bf891d453d6b65
SHA1 b7bf3b7b16048f38132d8acca841130d73db44c3
SHA512 e739381c24627f89255db55b2da39a09f055a322c577c3604ba048fb2c817ae7f63b12131f8461491f6140953fb33dd94eb66d8cb3b13b36717143342ce270af
SSDEEP 768:NFXORpsqJLOaVDzzoIgUPRGRoYNxHVxyczaUz4pP9Nom56I4tY6UBh1Yc88LaAQo:TUAoYxPzqoIzdwWR1+/24cwZXeCPiIBo
MD5 SHA1 SHA512 SSDEEP

Konditorierne/jagtfalk.ill

SHA256 accd4911d88e808aed4a2aa27394628c62574810b0b47977b7103a246fdf2a10
MD5 169115c751dda5e021e8c86e8454b26d
SHA1 5a8254634c0c726bb18e42e626eaeb581d532dcd
SHA512 2b643014e8623cadba7ce78b91d3c751d60fcbf3fa69fa26f29a14e55679fc6a5c2074834b2496773a1756e3172ec7c898e2df29cb4a0513dbf8bc0dcdda7e04
SSDEEP 1536:XkYzjcLYszRzU5n1C900tMkYQx+gnpovYHO:XkYz4DzQB5sYYH
MD5 SHA1 SHA512 SSDEEP

Konditorierne/regill.ful

SHA256 4bc57a47b82b63ec20b393f65f3585eb81fe3f7748229cd19dec8fe8a41d67c3
MD5 b4fb425baf217f31e91aab39abf66dcd
SHA1 03de3bd0f923ab14213b6c4461c5ca73a0a6371c
SHA512 e72395fd6098130efd543c5941781a1aa80fce17c7701cb40fa8874271e0d43e0f7f082ebf5d458181287de41cf4b34f88dcaabe84d8ad51003ef5da1495d871
SSDEEP 1536:HMtjgMjMD1whyMu1IXCVAcFNpruXO+nBJH:stjgmYi03XDL+nBJ
MD5 SHA1 SHA512 SSDEEP

Konditorierne/sortlistningens.txt

SHA256 2ea079dede1b356842c5f5e0751b5e2b6565fded65dafb59a73d170c002abb27
MD5 46003c65aa12a0ebe55662f0141186dc
SHA1 739652c3375018daffb986302a7d3e8d32770b41
SHA512 59d394789f9eece97873d56aea64f353d3e13e007e4acbd396ac76cb68e91494eb65888049ef05cbe9b20597adadcc960d067f90aad3ea5aa46ac3a82f5b82fd
MD5 SHA1 SHA512

4ad4bb99aa68ac6d5828c71c3f3d5d2983ead0626fd77aba7bb98de727a4b90b.exe

PE Signature issue

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$_41_/Emmens.udk

$_41_/Modernized.Fil

$_41_/Proprietrer.bet

$_41_/Revolutionsraadets.Bim

Konditorierne/Trikstanks.pra

Konditorierne/boyaus.rom

Konditorierne/gear.dra

Konditorierne/jagtfalk.ill

Konditorierne/regill.ful

Konditorierne/sortlistningens.txt

Sharing

General

Malware Config

Signatures

File Explorer

4ad4bb99aa68ac6d5828c71c3f3d5d2983ead0626fd77aba7bb98de727a4b90b.exe

PE Signature issue

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$_41_/Emmens.udk

$_41_/Modernized.Fil

$_41_/Proprietrer.bet

$_41_/Revolutionsraadets.Bim

Konditorierne/Trikstanks.pra

Konditorierne/boyaus.rom

Konditorierne/gear.dra

Konditorierne/jagtfalk.ill

Konditorierne/regill.ful

Konditorierne/sortlistningens.txt