AD150F5E04B3F3C97C21236AF691FE85[.]exe

resource
unpack001/$PLUGINSDIR/System.dll

AD150F5E04B3F3C97C21236AF691FE85.exe

IMPHASH e221f4f7d36469d53810a4b5f9fc8966
SHA256 e26acbf0b90fad1649cf131bec2dd9cf59352ee32545edd077fed9248fc2029c
MD5 ad150f5e04b3f3c97c21236af691fe85
SHA1 34e9106601394723a43fbfb6ae7457f3dbaa971e
SHA512 f74c776c4765c627a0d9c9c0d5902593ced5fc8195f9e2f90073eb48811d419f41fcffb836b713326e57de9ebc994d311b607703674930a7729cdcb843fffebb
SSDEEP 24576:hvYV0HT73uFVPJMNsjD0fLfES/zhWfN5c7/:6OzajPJiCD+fEezUfw
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

d6:34:f6:90:14:a7:4c:79:20:68:7d:bf:8d:7e:8e:d3:ad:92:e3:e7:e9:72:eb:1b:7d:06:75:f4:ca:1a:fe:fb

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Spekulationsformen,O=Spekulationsformen,L=Colton,C=US

Chains

Nov 11, 2024

Minor OS version

0

Major OS version

4

Entry point

13146

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathW SetFileTime CloseHandle GetShortPathNameW MoveFileW SetCurrentDirectoryW GetFileAttributesW GetLastError GetFullPathNameW CreateDirectoryW Sleep GetTickCount CreateFileW GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW ExitProcess SetEnvironmentVariableW GetWindowsDirectoryW SetFileAttributesW ExpandEnvironmentStringsW SetErrorMode LoadLibraryW lstrlenW lstrcpynW GetDiskFreeSpaceW GlobalUnlock GlobalLock CreateThread CreateProcessW RemoveDirectoryW lstrcmpiA GetTempFileNameW lstrcpyA lstrcpyW lstrcatW GetSystemDirectoryW GetVersion GetProcAddress LoadLibraryA GetModuleHandleA GetModuleHandleW lstrcmpiW lstrcmpW WaitForSingleObject GlobalFree GlobalAlloc LoadLibraryExW GetExitCodeProcess FreeLibrary WritePrivateProfileStringW GetCommandLineW GetTempPathW GetPrivateProfileStringW FindFirstFileW FindNextFileW DeleteFileW SetFilePointer ReadFile FindClose MulDiv MultiByteToWideChar WriteFile lstrlenA WideCharToMultiByte

user32

EndDialog ScreenToClient GetWindowRect RegisterClassW EnableMenuItem GetSystemMenu SetClassLongW IsWindowEnabled SetWindowPos GetSysColor GetWindowLongW SetCursor LoadCursorW CheckDlgButton GetMessagePos LoadBitmapW CallWindowProcW IsWindowVisible CloseClipboard SetClipboardData wsprintfW CreateWindowExW SystemParametersInfoW AppendMenuW CreatePopupMenu GetSystemMetrics SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharPrevW CharNextA wsprintfA DispatchMessageW PeekMessageW ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage GetDC SetWindowLongW LoadImageW SendMessageTimeoutW FindWindowExW EmptyClipboard OpenClipboard TrackPopupMenu EndPaint ShowWindow GetDlgItem IsWindow SetForegroundWindow

gdi32

SelectObject SetBkMode CreateFontIndirectW SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW ShellExecuteW SHFileOperationW

advapi32

RegCloseKey RegOpenKeyExW RegDeleteKeyW RegDeleteValueW RegEnumValueW RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumKeyW

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

CoCreateInstance CoTaskMemFree OleInitialize OleUninitialize

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 7fe77ca13121a113c59630a3dba0c8aaa6372e8082393274da8f8608c4ce4528
MD5 fc90dfb694d0e17b013d6f818bce41b0
SHA1 3243969886d640af3bfa442728b9f0dff9d5f5b0
SHA512 324f13aa7a33c6408e2a57c3484d1691ecee7c3c1366de2bb8978c8dc66b18425d8cab5a32d1702c13c43703e36148a022263de7166afdce141da2b01169f1c6
SSDEEP 192:e/b2HS5ih/7i00eWz9T7PH6yeFcQMI5+Vw+EXWZ77dslFZk:ewSUmWw9T7MmnI5+/F7Kdk
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10125

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Kapucinerabe.Emb

SHA256 198f7ff66f58e579ca6e59d26f7d3c4db395d1cd233882fc8ac5c7f2ff7ae454
MD5 6511b36b41bfae1163042917a3111fdf
SHA1 e9faab6705c575517ebbf1436e972bca78b72f53
SHA512 66a35ed9931733d5b8ddd41ea82993dff57f0ccb3225b00724aad18b4fa3ac93897d90991e6ff6e1445e3c3dab5c894907ee57bfe8e5b1b9a3f53bc501424561
SSDEEP 6144:f7VrhvbDTwV14xdybayD+4tZUbbeHTwpIL1AZ2nqS4w6VOPTbsYCv:f7Vrhbw34xYX++UbKHUpIyZ8ldsMLi
MD5 SHA1 SHA512 SSDEEP

Kedlernes.vid

SHA256 568b8dee1985ceafe404b08549f7363dd53a667c7a2bdf80ca8c57ba7ed9fda0
MD5 2c2aeca05f67661a0a6798fd3da68257
SHA1 43140c33ee2a2c3b729cfde53ad2a7e4d2436bbb
SHA512 f833ef465cfdb410be15e2d647dffa91c3787d19e6155b7f33f2a3127368a20c35b15442aa9c5fe5953e85dca80db843e530705ac22e5a19abdb604ef85ec81c
SSDEEP 768:BObeQfxNU+OmdH9zR+FY73WLYZLbReg24pPjHp5IIHLP96H7ub2g9zEQyhOrqjUC:EfpiYZgCO4zTJJEQ56XsZ3W
MD5 SHA1 SHA512 SSDEEP

Kontaktformidlingens.unm

SHA256 033c22a52c94a106582a33b0c267681b6a4ee7d668e4aa7da9bd9d0df05dea1f
MD5 0d9a1ae53b3662eca9655ef20bb4e0ce
SHA1 ca647617571f73e4ff815ac7db91f3ff4bf170a6
SHA512 cf89e8ee9afb4491890d8af3fe2f7b855c41b68dee9746155e1e05cc0b91b390d69c0df905fde22e9f3580241a57b1a5050903ac32f2695ab5f6485acb5161e8
SSDEEP 1536:KsTb+NlXRBRrADr1ILH0FvruLfYOL3u4cF:rCNRRsY0FDSQaQ
MD5 SHA1 SHA512 SSDEEP

Necrotize.txt

SHA256 73f4d5e40cb4bbf5c59c41c8cddb8f9f7d320470538716b66aa7796eddb7c6c8
MD5 f9e44960fad1de9a72e38ed010895f2e
SHA1 56742a285f6af1d49a3c57941d7562b58601e072
SHA512 a7642172f96cfa0c3bfdb34fa575c40bd7ecd88c43dd4df3354aac3a0f7c6c8709b42ac88838cd5cbb4b3af32bb48b6a9d1d2eb77c5f55295a88876b271ef1fa
MD5 SHA1 SHA512

ensisternum.myx

SHA256 37b7f63261c13f15d9889f297b29273a7b81eb306009f466a0a4383c954f7f49
MD5 4f7a0e04c31521449860638552ddc981
SHA1 d6ff38322926347ded812c57690d26dd6bb167a0
SHA512 b5620e786b307ebf3259ae6b5aacd8e2a9b75427daa88c6cdebd0d0e62a5ace6983a131f2b70e35703bea0e3cefd4a9b26b7706aefbecb87f7afae0b38740cc9
SSDEEP 1536:uRoqTXoly8kLiqpTbJDQAw9WGCEHBg2Ed5:2IkLfpTlDQAOL
MD5 SHA1 SHA512 SSDEEP

mntende.spi

SHA256 06ab90d835d1ccff3cfd1ae37956891918190037d989b4072b4e7abd5b5418c6
MD5 43a8d782ad3a56d7ecd14e52caea0f41
SHA1 fcdff92ec42bedc2297ae1ecb3c8a009e9a900bf
SHA512 6eebac37056096ed7c0c97ea44a4fedb7dd54df826171f5733ff72ae0943c6d156f66ccd8239866180af8fc7793480edccace317be58f37befb12ca43a390871
SSDEEP 768:od51waTQFApCdHNsdUp09xiXes7NAnAC+qFvVdhVMtdubYN/UIC6mTtRzcScEfQt:hA6C9AG+alAKUcyZ9oE
MD5 SHA1 SHA512 SSDEEP

spelts.tru

SHA256 f3f32f4ee9a9cf103b9e6876518f46801aa187864024b28de7f36ab7a1a00b7f
MD5 a8d5999b820e9ba7ec8ae02ac64bd740
SHA1 162064d1816d6723954401e5ff406fb815b1ff01
SHA512 6d4dc54ea8653af4d088e8b058ed07f25f8e2b92571c688bdebf32759da813c34a3d5b9bcb1095619c67b5797b2881b2f227b8ea592bdccb3870b1e8a40e1312
SSDEEP 768:zQN1zNkWceUPEvf5mtuQTyT0Vupr6jgDTslr7WSn3Dpbvj33BIUaE6SKCBLnSOXQ:6GkbAmorbpf6nP6e6RlY8R2KNsyB
MD5 SHA1 SHA512 SSDEEP

AD150F5E04B3F3C97C21236AF691FE85.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Kapucinerabe.Emb

Kedlernes.vid

Kontaktformidlingens.unm

Necrotize.txt

ensisternum.myx

mntende.spi

spelts.tru

Sharing

General

Malware Config

Signatures

File Explorer

AD150F5E04B3F3C97C21236AF691FE85.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Kapucinerabe.Emb

Kedlernes.vid

Kontaktformidlingens.unm

Necrotize.txt

ensisternum.myx

mntende.spi

spelts.tru