021337ISOGENERAL[.]exe

resource
021337ISOGENERAL.exe
unpack001/$PLUGINSDIR/System.dll

021337ISOGENERAL.exe

IMPHASH e2a592076b17ef8bfb48b7e03965a3fc
SHA256 ce7202372e7e915e6cf9fb52e1ffe3083602f3a9b761f1d4b9e6045eabe065c1
MD5 d69326f0086f5a1915e317d460851185
SHA1 da4889b4a866fccf18cc4d580995d4e491459207
SHA512 f559b5584bccd64ee5784b3016b113f99f588be71ac19fc4adac850b993240d7596c91d3e85bc50a5290dd76ac3db3df7911d608f3c678ac4188db9c9b4757a5
SSDEEP 12288:bchSe04fsdrsdA6zKY/h1kMPJIN5yUBowyx9fag6vB:bqSe04s+61Y/LkMRSwgoxyrvB
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

13108

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetCurrentDirectoryW GetFileAttributesW GetFullPathNameW Sleep GetTickCount GetFileSize GetModuleFileNameW MoveFileW SetFileAttributesW GetCurrentProcess ExitProcess SetEnvironmentVariableW GetWindowsDirectoryW GetTempPathW GetCommandLineW GetVersion SetErrorMode lstrlenW WaitForSingleObject CopyFileW CompareFileTime GlobalLock CreateThread GetLastError CreateDirectoryW CreateProcessW RemoveDirectoryW lstrcmpiA CreateFileW GetTempFileNameW WriteFile lstrcpyA lstrcpyW MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GlobalFree GlobalAlloc GetShortPathNameW SearchPathW lstrcmpiW SetFileTime CloseHandle ExpandEnvironmentStringsW lstrcmpW GlobalUnlock lstrcpynW GetDiskFreeSpaceW GetExitCodeProcess FindFirstFileW FindNextFileW DeleteFileW SetFilePointer ReadFile FindClose MulDiv MultiByteToWideChar lstrlenA WideCharToMultiByte GetPrivateProfileStringW WritePrivateProfileStringW FreeLibrary LoadLibraryExW GetModuleHandleW

user32

GetSystemMenu SetClassLongW IsWindowEnabled EnableMenuItem SetWindowPos GetSysColor GetWindowLongW SetCursor LoadCursorW CheckDlgButton GetMessagePos LoadBitmapW CallWindowProcW IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard wsprintfW ScreenToClient GetWindowRect GetSystemMetrics SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharPrevW CharNextA wsprintfA DispatchMessageW PeekMessageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow LoadImageW SetTimer SetWindowTextW PostQuitMessage ShowWindow GetDlgItem IsWindow SetWindowLongW FindWindowExW TrackPopupMenu AppendMenuW CreatePopupMenu DrawTextW EndPaint CreateDialogParamW SendMessageTimeoutW SetForegroundWindow

gdi32

SelectObject SetBkMode CreateFontIndirectW SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW ShellExecuteW SHFileOperationW

advapi32

RegDeleteKeyW SetFileSecurityW OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges RegOpenKeyExW RegEnumValueW RegDeleteValueW RegCloseKey RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumKeyW

comctl32

ImageList_AddMasked ord17 ImageList_Destroy ImageList_Create

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb
MD5 17ed1c86bd67e78ade4712be48a7d2bd
SHA1 1cc9fe86d6d6030b4dae45ecddce5907991c01a0
SHA512 0cbed521e7d6d1f85977b3f7d3ca7ac34e1b5495b69fd8c7bfa1a846baf53b0ecd06fe1ad02a3599082ffacaf8c71a3bb4e32dec05f8e24859d736b828092cd5
SSDEEP 192:eY24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35Ol+Sl:E8QIl975eXqlWBrz7YLOl+
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10183

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Afvejede/Bndlet.Non

SHA256 4be42be616bd74d775f81dbb8864bb6f7e95bcb9679d12b1551bf096d48d4d2b
MD5 53b630ecd48f56d1280462486359fdf2
SHA1 e8f82f08f14d01763dc1ba24527a3473466af7c4
SHA512 a1c931e6bf776132042c026b0b9332d61c339e6fb4593fdab132add20802e84586aef80e112fa1a7d90396b8bde0035c043c7492f5ea3bcb8c10159c0a422b6f
SSDEEP 384:EfBUK3zEbSVH5WbEh6zNzm9r6AExc3LcJXQKz5mubqfqfvWyx1qsRTENsWqjo9x5:lWsEhmtm9uAoc9Kvlx5RT8s4LUbQ
MD5 SHA1 SHA512 SSDEEP

Afvejede/Muffedises.sad

SHA256 319e07896a3e1e03ba0e57af59cb063f18b749d2123855a0abcb53bbce89619f
MD5 17802e4e0d70ffe729d5d2e397ac8526
SHA1 68c0d706b8a9bd402d0beca7ccd1fa6e88ce0a42
SHA512 911a263684afaa8f72baa46cfc21efdd1c28266c0d5674c67d307df1dead44564ffeacf55740c22f1d9335a72fe70097c3bd2dac70136de4cc7257abefab42a6
SSDEEP 1536:yWsU8i3+0xxb4j7cMKathN7oQSdt1C40wJg1VunQ:dsUrb4c9atbtqt1CveQ
MD5 SHA1 SHA512 SSDEEP

Afvejede/auktions.mej

SHA256 7fb4876ebdf3d6a398692acfe22456ea99d73a41c30d80661636c93cba30981c
MD5 5cffeb80a36c01510fca07359b5ab823
SHA1 b0777d9c200fc2a6cff075e7d3f02dc47358657a
SHA512 1b1f7b5bfb8559e549674537ea380568b417860cebda9d0e0f0dca31bb31cd48a2511b2118734046822ba72695b2e3ea049d219add02ae076a8ca4f196c7c5e4
SSDEEP 768:scUKOwmy3GZaTKKup31qEYiMX1Yi9jpOk4ugY0qOIK08NbTritBZ9wF1+ubLCksl:kKVxSRn2JWcWI1ccgqT
MD5 SHA1 SHA512 SSDEEP

Afvejede/subcineritious.jor

SHA256 7726f98bcc1856a213031969bb780bd2a4a458d3a308eb41dd43a84ac63854b3
MD5 29198ac3c3e7111459efe708f850183b
SHA1 10089b708003a3922e643c885ff1f2e076d78b6a
SHA512 584e5290d99233118acc0aab6fe62023c52f92f94bcce4b63463347c0a36fa67f784be99071f6288076510b546b2c8c3102cf826885d4a32b00289238dc2fa79
SSDEEP 768:14SSMbtzH45+XXaTsmMo5Dl6meulSBmwkk5k3YpAHjurkjS3IAEOYjf8pMF4/8TS:iW/xH4MSQW8e4MFp0tYl6FsOfr
MD5 SHA1 SHA512 SSDEEP

Keckling.het

SHA256 67eec7221bf1dc1773ef7705c0544e2ee00ad47ca16c9b198d3afdd08041d898
MD5 4f145182241a8ce9041aa7672afa0b1c
SHA1 0082ee5b462551e7bb56698c5c08bbe44d2430cb
SHA512 f85aab2b842ca6275a7475eda40e042d8d4af9f3b798aa477021c72773b87f2992a34ae47c1767d5e8dad9263d420126cc60961344b9600783cab60bb20ceec8
SSDEEP 3072:WL2j65I5KIlaiNGN3W2CyfHNbIWpkVcXr4oCUVpRSdgvbqRvgPSaFT4H0ovtxFLf:WaU14oCUVyL2ZAFiyvKee3jnNigbM
MD5 SHA1 SHA512 SSDEEP

021337ISOGENERAL.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Afvejede/Bndlet.Non

Afvejede/Muffedises.sad

Afvejede/auktions.mej

Afvejede/subcineritious.jor

Keckling.het

Sharing

General

Malware Config

Signatures

File Explorer

021337ISOGENERAL.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Afvejede/Bndlet.Non

Afvejede/Muffedises.sad

Afvejede/auktions.mej

Afvejede/subcineritious.jor

Keckling.het