c09072f999c05b30587725eb543d1accc5e32b33325977ff498eeec59856dce2[.]exe

resource
unpack001/$PLUGINSDIR/System.dll

c09072f999c05b30587725eb543d1accc5e32b33325977ff498eeec59856dce2.exe

IMPHASH e221f4f7d36469d53810a4b5f9fc8966
SHA256 c09072f999c05b30587725eb543d1accc5e32b33325977ff498eeec59856dce2
MD5 655a42b3b0b43d43ff89e9f5f560c257
SHA1 35e735e8876e73236df287474e5e900221d8f70f
SHA512 1987adfd2ffe75c563a4922f90cb3f9e32152596124484306af0813883e694a4803c2e3b288a7f1b9f221fd6c38cc53795d49438dab50a7e3aecbec6b73c50b5
SSDEEP 24576:uvYV0HT73uF7nYjKdhfbe1BzyhEl+BD0GPpu6CHAy7/:pOzaRfrbe1wEl+BQb6Cl
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

43:39:9e:6f:83:d6:f4:c9:a5:18:cc:36:0a:75:ee:02:36:2a:d3:66:b8:99:61:97:f5:f7:97:48:d1:52:f9:c7

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Beladying,O=Beladying,L=Schmalstede,C=DE

Chains

Nov 12, 2024

Minor OS version

0

Major OS version

4

Entry point

13146

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathW SetFileTime CloseHandle GetShortPathNameW MoveFileW SetCurrentDirectoryW GetFileAttributesW GetLastError GetFullPathNameW CreateDirectoryW Sleep GetTickCount CreateFileW GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW ExitProcess SetEnvironmentVariableW GetWindowsDirectoryW SetFileAttributesW ExpandEnvironmentStringsW SetErrorMode LoadLibraryW lstrlenW lstrcpynW GetDiskFreeSpaceW GlobalUnlock GlobalLock CreateThread CreateProcessW RemoveDirectoryW lstrcmpiA GetTempFileNameW lstrcpyA lstrcpyW lstrcatW GetSystemDirectoryW GetVersion GetProcAddress LoadLibraryA GetModuleHandleA GetModuleHandleW lstrcmpiW lstrcmpW WaitForSingleObject GlobalFree GlobalAlloc LoadLibraryExW GetExitCodeProcess FreeLibrary WritePrivateProfileStringW GetCommandLineW GetTempPathW GetPrivateProfileStringW FindFirstFileW FindNextFileW DeleteFileW SetFilePointer ReadFile FindClose MulDiv MultiByteToWideChar WriteFile lstrlenA WideCharToMultiByte

user32

EndDialog ScreenToClient GetWindowRect RegisterClassW EnableMenuItem GetSystemMenu SetClassLongW IsWindowEnabled SetWindowPos GetSysColor GetWindowLongW SetCursor LoadCursorW CheckDlgButton GetMessagePos LoadBitmapW CallWindowProcW IsWindowVisible CloseClipboard SetClipboardData wsprintfW CreateWindowExW SystemParametersInfoW AppendMenuW CreatePopupMenu GetSystemMetrics SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharPrevW CharNextA wsprintfA DispatchMessageW PeekMessageW ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage GetDC SetWindowLongW LoadImageW SendMessageTimeoutW FindWindowExW EmptyClipboard OpenClipboard TrackPopupMenu EndPaint ShowWindow GetDlgItem IsWindow SetForegroundWindow

gdi32

SelectObject SetBkMode CreateFontIndirectW SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW ShellExecuteW SHFileOperationW

advapi32

RegCloseKey RegOpenKeyExW RegDeleteKeyW RegDeleteValueW RegEnumValueW RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumKeyW

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

CoCreateInstance CoTaskMemFree OleInitialize OleUninitialize

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 7fe77ca13121a113c59630a3dba0c8aaa6372e8082393274da8f8608c4ce4528
MD5 fc90dfb694d0e17b013d6f818bce41b0
SHA1 3243969886d640af3bfa442728b9f0dff9d5f5b0
SHA512 324f13aa7a33c6408e2a57c3484d1691ecee7c3c1366de2bb8978c8dc66b18425d8cab5a32d1702c13c43703e36148a022263de7166afdce141da2b01169f1c6
SSDEEP 192:e/b2HS5ih/7i00eWz9T7PH6yeFcQMI5+Vw+EXWZ77dslFZk:ewSUmWw9T7MmnI5+/F7Kdk
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10125

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Kedlernes.vid

SHA256 568b8dee1985ceafe404b08549f7363dd53a667c7a2bdf80ca8c57ba7ed9fda0
MD5 2c2aeca05f67661a0a6798fd3da68257
SHA1 43140c33ee2a2c3b729cfde53ad2a7e4d2436bbb
SHA512 f833ef465cfdb410be15e2d647dffa91c3787d19e6155b7f33f2a3127368a20c35b15442aa9c5fe5953e85dca80db843e530705ac22e5a19abdb604ef85ec81c
SSDEEP 768:BObeQfxNU+OmdH9zR+FY73WLYZLbReg24pPjHp5IIHLP96H7ub2g9zEQyhOrqjUC:EfpiYZgCO4zTJJEQ56XsZ3W
MD5 SHA1 SHA512 SSDEEP

Mazard.Sel

SHA256 9e592cadaeb4e76b5e28857724f5d78a663891f74376669a556212e0937d48c3
MD5 fa6863f89bf9f92fab22c6aa0eb226e6
SHA1 d951df749e71a62ef5b555f1fcbf3000ef6a9657
SHA512 c18bf282b7215f866e6d692f4539ee5383976f0dd605497b7cff8dee110a15799ac29ba89874fbec08eca6310056ae23bc1908046a8feee69e368310a26c5602
SSDEEP 6144:ko1XnKycTyO5kOxo01OHkjXFW+EJuJlrSdKU9iAhaFcrlw1bm/WSPUYQ:31XKyQkOJYHAXFWOJlr89iA3hwhKNQ
MD5 SHA1 SHA512 SSDEEP

afstemmer/Kontaktformidlingens.unm

SHA256 033c22a52c94a106582a33b0c267681b6a4ee7d668e4aa7da9bd9d0df05dea1f
MD5 0d9a1ae53b3662eca9655ef20bb4e0ce
SHA1 ca647617571f73e4ff815ac7db91f3ff4bf170a6
SHA512 cf89e8ee9afb4491890d8af3fe2f7b855c41b68dee9746155e1e05cc0b91b390d69c0df905fde22e9f3580241a57b1a5050903ac32f2695ab5f6485acb5161e8
SSDEEP 1536:KsTb+NlXRBRrADr1ILH0FvruLfYOL3u4cF:rCNRRsY0FDSQaQ
MD5 SHA1 SHA512 SSDEEP

afstemmer/Necrotize.txt

SHA256 73f4d5e40cb4bbf5c59c41c8cddb8f9f7d320470538716b66aa7796eddb7c6c8
MD5 f9e44960fad1de9a72e38ed010895f2e
SHA1 56742a285f6af1d49a3c57941d7562b58601e072
SHA512 a7642172f96cfa0c3bfdb34fa575c40bd7ecd88c43dd4df3354aac3a0f7c6c8709b42ac88838cd5cbb4b3af32bb48b6a9d1d2eb77c5f55295a88876b271ef1fa
MD5 SHA1 SHA512

afstemmer/ensisternum.myx

SHA256 37b7f63261c13f15d9889f297b29273a7b81eb306009f466a0a4383c954f7f49
MD5 4f7a0e04c31521449860638552ddc981
SHA1 d6ff38322926347ded812c57690d26dd6bb167a0
SHA512 b5620e786b307ebf3259ae6b5aacd8e2a9b75427daa88c6cdebd0d0e62a5ace6983a131f2b70e35703bea0e3cefd4a9b26b7706aefbecb87f7afae0b38740cc9
SSDEEP 1536:uRoqTXoly8kLiqpTbJDQAw9WGCEHBg2Ed5:2IkLfpTlDQAOL
MD5 SHA1 SHA512 SSDEEP

afstemmer/mntende.spi

SHA256 06ab90d835d1ccff3cfd1ae37956891918190037d989b4072b4e7abd5b5418c6
MD5 43a8d782ad3a56d7ecd14e52caea0f41
SHA1 fcdff92ec42bedc2297ae1ecb3c8a009e9a900bf
SHA512 6eebac37056096ed7c0c97ea44a4fedb7dd54df826171f5733ff72ae0943c6d156f66ccd8239866180af8fc7793480edccace317be58f37befb12ca43a390871
SSDEEP 768:od51waTQFApCdHNsdUp09xiXes7NAnAC+qFvVdhVMtdubYN/UIC6mTtRzcScEfQt:hA6C9AG+alAKUcyZ9oE
MD5 SHA1 SHA512 SSDEEP

afstemmer/spelts.tru

SHA256 f3f32f4ee9a9cf103b9e6876518f46801aa187864024b28de7f36ab7a1a00b7f
MD5 a8d5999b820e9ba7ec8ae02ac64bd740
SHA1 162064d1816d6723954401e5ff406fb815b1ff01
SHA512 6d4dc54ea8653af4d088e8b058ed07f25f8e2b92571c688bdebf32759da813c34a3d5b9bcb1095619c67b5797b2881b2f227b8ea592bdccb3870b1e8a40e1312
SSDEEP 768:zQN1zNkWceUPEvf5mtuQTyT0Vupr6jgDTslr7WSn3Dpbvj33BIUaE6SKCBLnSOXQ:6GkbAmorbpf6nP6e6RlY8R2KNsyB
MD5 SHA1 SHA512 SSDEEP

c09072f999c05b30587725eb543d1accc5e32b33325977ff498eeec59856dce2.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Kedlernes.vid

Mazard.Sel

afstemmer/Kontaktformidlingens.unm

afstemmer/Necrotize.txt

afstemmer/ensisternum.myx

afstemmer/mntende.spi

afstemmer/spelts.tru

Sharing

General

Malware Config

Signatures

File Explorer

c09072f999c05b30587725eb543d1accc5e32b33325977ff498eeec59856dce2.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Kedlernes.vid

Mazard.Sel

afstemmer/Kontaktformidlingens.unm

afstemmer/Necrotize.txt

afstemmer/ensisternum.myx

afstemmer/mntende.spi

afstemmer/spelts.tru