b42f7b1685c9fa69b07eec4870ae1f573a48ad04c369e452482edbbfed654c24[.]exe

resource
b42f7b1685c9fa69b07eec4870ae1f573a48ad04c369e452482edbbfed654c24.exe
unpack001/$PLUGINSDIR/System.dll

b42f7b1685c9fa69b07eec4870ae1f573a48ad04c369e452482edbbfed654c24.exe

IMPHASH 7eae418c7423834ffc3d79b4300bd6fb
SHA256 b42f7b1685c9fa69b07eec4870ae1f573a48ad04c369e452482edbbfed654c24
MD5 ea3570960a117b551ef4d63afb90594a
SHA1 25e8d6660e6bdf88c78a484ecc49f1f5e862902d
SHA512 822fd9ae05be68403868ce69aa9944b90d6a3285c8a17d1009cccff02ebd2bc10dc6434cb0473a3e5a5c58c849e3dee112819bf5a6ca395d3447eba65f11d076
SSDEEP 12288:2ZPsXk8zK2u+4rYnH12g+ohTHPU66swKpUHsTx6I+0X:CWhu6H1ZtFPU9skMTxX+0X
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

13306

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetEnvironmentVariableW SetFileAttributesW Sleep GetTickCount GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW SetCurrentDirectoryW GetFileAttributesW GetWindowsDirectoryW GetTempPathW GetCommandLineW GetVersion SetErrorMode lstrlenW lstrcpynW GetDiskFreeSpaceW ExitProcess MoveFileW CreateThread GetLastError CreateDirectoryW CreateProcessW RemoveDirectoryW lstrcmpiA CreateFileW GetTempFileNameW WriteFile lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject lstrcmpiW lstrcmpW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle ExpandEnvironmentStringsW GlobalFree GlobalLock GlobalUnlock GlobalAlloc DeleteFileW FindFirstFileW FindNextFileW FindClose SetFilePointer ReadFile MulDiv lstrlenA WideCharToMultiByte MultiByteToWideChar WritePrivateProfileStringW FreeLibrary GetPrivateProfileStringW GetModuleHandleW LoadLibraryExW

user32

GetWindowRect GetSystemMenu SetClassLongW IsWindowEnabled SetWindowPos GetSysColor GetWindowLongW SetCursor LoadCursorW CheckDlgButton GetMessagePos CallWindowProcW IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard TrackPopupMenu ScreenToClient EnableMenuItem GetDlgItem SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharPrevW CharNextA wsprintfA DispatchMessageW PeekMessageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect SystemParametersInfoW EndDialog RegisterClassW DialogBoxParamW CreateWindowExW GetClassInfoW DestroyWindow CharNextW ExitWindowsEx SetWindowTextW LoadImageW SetTimer ShowWindow PostQuitMessage wsprintfW SetWindowLongW FindWindowExW IsWindow CreatePopupMenu AppendMenuW GetSystemMetrics DrawTextW EndPaint CreateDialogParamW SendMessageTimeoutW SetForegroundWindow

gdi32

SelectObject SetTextColor SetBkMode CreateFontIndirectW CreateBrushIndirect DeleteObject GetDeviceCaps SetBkColor

shell32

ShellExecuteExW SHGetPathFromIDListW SHGetSpecialFolderLocation SHGetFileInfoW SHFileOperationW SHBrowseForFolderW

advapi32

AdjustTokenPrivileges RegCreateKeyExW RegOpenKeyExW SetFileSecurityW OpenProcessToken LookupPrivilegeValueW RegEnumValueW RegDeleteKeyW RegDeleteValueW RegCloseKey RegSetValueExW RegQueryValueExW RegEnumKeyW

comctl32

ImageList_Create ImageList_AddMasked ord17 ImageList_Destroy

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 6950991102462d84fdc0e3b0ae30c95af8c192f77ce3d78e8d54e6b22f7c09ba
MD5 8cf2ac271d7679b1d68eefc1ae0c5618
SHA1 7cc1caaa747ee16dc894a600a4256f64fa65a9b8
SHA512 ce828fb9ecd7655cc4c974f78f209d3326ba71ced60171a45a437fc3fff3bd0d69a0997adaca29265c7b5419bdea2b17f8cc8ceae1b8ce6b22b7ed9120bb5ad3
SSDEEP 192:BenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XB9IwL:B8+Qlt70Fj/lQRY/9VjjlL
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10719

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Entosterna.Ang

SHA256 6a69fbee2c7a3717462d08d44c403baa2042a4999de09a958eabde687f0d4094
MD5 43254a2be104f9d710655d0c4ba6f731
SHA1 acc4e3d9f02a55f5960d1eadb8e2200bf86b5bb3
SHA512 b83ea7b539f38c99b422fb49c4e991e1d3ad95fdf82508a24fea213fbecf9c10fcf66f5c335030d457559add8a2b90a8d84f9eab421115d64189726f0ea5a807
SSDEEP 3072:DDiM1hXwDUu4YW7CMj+J/dR/IWaQMDaWoKMBizTfAL0l/1vK7xltM:/Fvgu52Mj+JVVIWaQJLLCTz5UltM
MD5 SHA1 SHA512 SSDEEP

Gradgrind/security.snv

SHA256 430e64a927a42ad22f7d87f7f211cdad6c746f44810e785a3a8ad3bbe2d4a949
MD5 8227552776ca3020cc5e15880eef0505
SHA1 16b90b79c5af441fc256690221c04a32bcbefb30
SHA512 e0119e221ed8bd9dadb9c1c34adf374559ba82d9c56520b7139be5c7eb5783a83a00c6951a5c864f6c8e01c540f8ee7e1bc69f2e6f1257c3397a3bfa32980002
SSDEEP 768:LpW+1tZeOFfs7DAM0UAnyYOTsJY5i5gAAQDdnP6WkVDtql40dELPIKS3KyAmA/lB:M+dnEPhG26mPyGPThF
MD5 SHA1 SHA512 SSDEEP

Hjerneddens.Sem

SHA256 f589a0411b49cd3ae198cc66a7006d7ed6ab47c92b895f9b5f48e25a4cd766c9
MD5 0b5c1d40d6b473500dfb2c980f7b5862
SHA1 d7790bee80436e712d5aad4c0a4f6f1b10bce9ad
SHA512 37b4e7fa1630ce4b529c54fe01d7f78dcf61f963c3e74242ecb40585dd684ab203dfd80b1b3f8bcfe432478acda913c76939062afbf380eaea7213509d8c0598
SSDEEP 1536:tzLLgvFCu2AsiqZhZ0KFINgF3Z6HXSH3szLUksxqMJh+xVef8NWNZ7iRL45ZaIr2:Zw2NFwzHcyn3QYAq8uPuIsRi/4141zSO
MD5 SHA1 SHA512 SSDEEP

crystaled.fog

SHA256 a31d01c33313fbc24db59f9b0d4bb86c455193cedd34f142d99a89f53410bf4b
MD5 94fc5485393da814056e446010c3f69e
SHA1 c3261676f44810b0ea7e33abd6d5d6d8de6430b5
SHA512 d396b47a9b44748304276c4778bbb5989e4dbe98a6ca26db9d252a5f9f5f5963d60dd8060a2362496bb0d69ffddfc35dc33368fe4d05a85be290d89e24be26ba
SSDEEP 768:0WWb1lbhesEVmtjirs14ofb/QJ+PGYKP8gRlk4bxWB9:0NEkfjQJLI
MD5 SHA1 SHA512 SSDEEP

glick.fib

SHA256 ae90f361b1a9409021445fcc0c83e20ec0c7b0959475946dee9b730a11b952e7
MD5 a863873fb1a1dbbf2688a4d1a962a125
SHA1 72742fbf506da2b7e49586fad9d10faf523024cb
SHA512 0a693803c45fe6a85cdb5d7fff4a38ca0c7ad590481d04cf05fc4f030562d9c1c03617e470744e5ee2da861892a2a2ad85f869dde1d129776c400544150b9c3c
SSDEEP 768:6tsqt5QbusIPQNVqco2VsS47kVyR/7qhXhMeefqJgPPVXvWO7IyAq8LN32Zdfq6O:VeiMNuf/UCqIwS6aLR
MD5 SHA1 SHA512 SSDEEP