be0b05580938cea205cb3e035bf9f814327b30a59ea80bae55255530519d1fcd[.]exe

resource
unpack001/$PLUGINSDIR/System.dll

be0b05580938cea205cb3e035bf9f814327b30a59ea80bae55255530519d1fcd.exe

IMPHASH e221f4f7d36469d53810a4b5f9fc8966
SHA256 be0b05580938cea205cb3e035bf9f814327b30a59ea80bae55255530519d1fcd
MD5 4d05eac9c30331683fe59038aba0d873
SHA1 683812ee2e76037ac4cf1ad0858778fcea44bad6
SHA512 eb9f3cd33ee8fd311da446041450a62be3cdcae02c34fd01c2610355fa87795c77e2d0b8fc3208cbf699838f30a1160c6b1f81b20dd68c4fe2a2809ee5bae0a8
SSDEEP 24576:jvYV0HT73uFB1vuQoj5RvdulhTzGB/bNlVC7t:cOzaYQmZ5FNlVg
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

d5:ec:f5:5d:5c:39:bd:0f:76:79:a1:17:0e:d6:d3:28:d0:5c:a5:e2:78:7f:d5:01:ca:4a:2f:14:a1:80:5a:49

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Trevlemundene,O=Trevlemundene,L=Rückersdorf,C=DE

Chains

Nov 11, 2024

Minor OS version

0

Major OS version

4

Entry point

13146

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathW SetFileTime CloseHandle GetShortPathNameW MoveFileW SetCurrentDirectoryW GetFileAttributesW GetLastError GetFullPathNameW CreateDirectoryW Sleep GetTickCount CreateFileW GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW ExitProcess SetEnvironmentVariableW GetWindowsDirectoryW SetFileAttributesW ExpandEnvironmentStringsW SetErrorMode LoadLibraryW lstrlenW lstrcpynW GetDiskFreeSpaceW GlobalUnlock GlobalLock CreateThread CreateProcessW RemoveDirectoryW lstrcmpiA GetTempFileNameW lstrcpyA lstrcpyW lstrcatW GetSystemDirectoryW GetVersion GetProcAddress LoadLibraryA GetModuleHandleA GetModuleHandleW lstrcmpiW lstrcmpW WaitForSingleObject GlobalFree GlobalAlloc LoadLibraryExW GetExitCodeProcess FreeLibrary WritePrivateProfileStringW GetCommandLineW GetTempPathW GetPrivateProfileStringW FindFirstFileW FindNextFileW DeleteFileW SetFilePointer ReadFile FindClose MulDiv MultiByteToWideChar WriteFile lstrlenA WideCharToMultiByte

user32

EndDialog ScreenToClient GetWindowRect RegisterClassW EnableMenuItem GetSystemMenu SetClassLongW IsWindowEnabled SetWindowPos GetSysColor GetWindowLongW SetCursor LoadCursorW CheckDlgButton GetMessagePos LoadBitmapW CallWindowProcW IsWindowVisible CloseClipboard SetClipboardData wsprintfW CreateWindowExW SystemParametersInfoW AppendMenuW CreatePopupMenu GetSystemMetrics SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharPrevW CharNextA wsprintfA DispatchMessageW PeekMessageW ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage GetDC SetWindowLongW LoadImageW SendMessageTimeoutW FindWindowExW EmptyClipboard OpenClipboard TrackPopupMenu EndPaint ShowWindow GetDlgItem IsWindow SetForegroundWindow

gdi32

SelectObject SetBkMode CreateFontIndirectW SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW ShellExecuteW SHFileOperationW

advapi32

RegCloseKey RegOpenKeyExW RegDeleteKeyW RegDeleteValueW RegEnumValueW RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumKeyW

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

CoCreateInstance CoTaskMemFree OleInitialize OleUninitialize

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 7fe77ca13121a113c59630a3dba0c8aaa6372e8082393274da8f8608c4ce4528
MD5 fc90dfb694d0e17b013d6f818bce41b0
SHA1 3243969886d640af3bfa442728b9f0dff9d5f5b0
SHA512 324f13aa7a33c6408e2a57c3484d1691ecee7c3c1366de2bb8978c8dc66b18425d8cab5a32d1702c13c43703e36148a022263de7166afdce141da2b01169f1c6
SSDEEP 192:e/b2HS5ih/7i00eWz9T7PH6yeFcQMI5+Vw+EXWZ77dslFZk:ewSUmWw9T7MmnI5+/F7Kdk
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10125

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Ekspederede64.Sev

SHA256 5b9d7d5b2ebc13a34d58de3fafc1ef56fab00ce7a7267fd93e1452b9e563523b
MD5 27f11b932fe5e59d9cea7311da85ffca
SHA1 3771f0e8716e060af212847719aa3a72ea8cd2ed
SHA512 63b5b5209e2a2f9f2c6f7aeede857b51ebde14a4fb80c9f0394e7e712867f2000598b22420193c141447e0a14c2fa79ed72b2e2ce27bc0ef37be8515416eb0b2
SSDEEP 6144:/eRoR7O0bta2ba1FYokMx0aGko7tvfaBLQ4SCOR82CfAG0+0TNZ2:mR83I2mFUMlGl9fwrDC82Cfxtme
MD5 SHA1 SHA512 SSDEEP

mortify/Kedlernes.vid

SHA256 568b8dee1985ceafe404b08549f7363dd53a667c7a2bdf80ca8c57ba7ed9fda0
MD5 2c2aeca05f67661a0a6798fd3da68257
SHA1 43140c33ee2a2c3b729cfde53ad2a7e4d2436bbb
SHA512 f833ef465cfdb410be15e2d647dffa91c3787d19e6155b7f33f2a3127368a20c35b15442aa9c5fe5953e85dca80db843e530705ac22e5a19abdb604ef85ec81c
SSDEEP 768:BObeQfxNU+OmdH9zR+FY73WLYZLbReg24pPjHp5IIHLP96H7ub2g9zEQyhOrqjUC:EfpiYZgCO4zTJJEQ56XsZ3W
MD5 SHA1 SHA512 SSDEEP

mortify/Kontaktformidlingens.unm

SHA256 033c22a52c94a106582a33b0c267681b6a4ee7d668e4aa7da9bd9d0df05dea1f
MD5 0d9a1ae53b3662eca9655ef20bb4e0ce
SHA1 ca647617571f73e4ff815ac7db91f3ff4bf170a6
SHA512 cf89e8ee9afb4491890d8af3fe2f7b855c41b68dee9746155e1e05cc0b91b390d69c0df905fde22e9f3580241a57b1a5050903ac32f2695ab5f6485acb5161e8
SSDEEP 1536:KsTb+NlXRBRrADr1ILH0FvruLfYOL3u4cF:rCNRRsY0FDSQaQ
MD5 SHA1 SHA512 SSDEEP

mortify/Necrotize.txt

SHA256 73f4d5e40cb4bbf5c59c41c8cddb8f9f7d320470538716b66aa7796eddb7c6c8
MD5 f9e44960fad1de9a72e38ed010895f2e
SHA1 56742a285f6af1d49a3c57941d7562b58601e072
SHA512 a7642172f96cfa0c3bfdb34fa575c40bd7ecd88c43dd4df3354aac3a0f7c6c8709b42ac88838cd5cbb4b3af32bb48b6a9d1d2eb77c5f55295a88876b271ef1fa
MD5 SHA1 SHA512

mortify/ensisternum.myx

SHA256 37b7f63261c13f15d9889f297b29273a7b81eb306009f466a0a4383c954f7f49
MD5 4f7a0e04c31521449860638552ddc981
SHA1 d6ff38322926347ded812c57690d26dd6bb167a0
SHA512 b5620e786b307ebf3259ae6b5aacd8e2a9b75427daa88c6cdebd0d0e62a5ace6983a131f2b70e35703bea0e3cefd4a9b26b7706aefbecb87f7afae0b38740cc9
SSDEEP 1536:uRoqTXoly8kLiqpTbJDQAw9WGCEHBg2Ed5:2IkLfpTlDQAOL
MD5 SHA1 SHA512 SSDEEP

mortify/mntende.spi

SHA256 06ab90d835d1ccff3cfd1ae37956891918190037d989b4072b4e7abd5b5418c6
MD5 43a8d782ad3a56d7ecd14e52caea0f41
SHA1 fcdff92ec42bedc2297ae1ecb3c8a009e9a900bf
SHA512 6eebac37056096ed7c0c97ea44a4fedb7dd54df826171f5733ff72ae0943c6d156f66ccd8239866180af8fc7793480edccace317be58f37befb12ca43a390871
SSDEEP 768:od51waTQFApCdHNsdUp09xiXes7NAnAC+qFvVdhVMtdubYN/UIC6mTtRzcScEfQt:hA6C9AG+alAKUcyZ9oE
MD5 SHA1 SHA512 SSDEEP

mortify/spelts.tru

SHA256 f3f32f4ee9a9cf103b9e6876518f46801aa187864024b28de7f36ab7a1a00b7f
MD5 a8d5999b820e9ba7ec8ae02ac64bd740
SHA1 162064d1816d6723954401e5ff406fb815b1ff01
SHA512 6d4dc54ea8653af4d088e8b058ed07f25f8e2b92571c688bdebf32759da813c34a3d5b9bcb1095619c67b5797b2881b2f227b8ea592bdccb3870b1e8a40e1312
SSDEEP 768:zQN1zNkWceUPEvf5mtuQTyT0Vupr6jgDTslr7WSn3Dpbvj33BIUaE6SKCBLnSOXQ:6GkbAmorbpf6nP6e6RlY8R2KNsyB
MD5 SHA1 SHA512 SSDEEP

be0b05580938cea205cb3e035bf9f814327b30a59ea80bae55255530519d1fcd.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Ekspederede64.Sev

mortify/Kedlernes.vid

mortify/Kontaktformidlingens.unm

mortify/Necrotize.txt

mortify/ensisternum.myx

mortify/mntende.spi

mortify/spelts.tru

Sharing

General

Malware Config

Signatures

File Explorer

be0b05580938cea205cb3e035bf9f814327b30a59ea80bae55255530519d1fcd.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Ekspederede64.Sev

mortify/Kedlernes.vid

mortify/Kontaktformidlingens.unm

mortify/Necrotize.txt

mortify/ensisternum.myx

mortify/mntende.spi

mortify/spelts.tru