Request for Quotation New collaboration[.]exe

resource
Request for Quotation New collaboration.exe
unpack001/$PLUGINSDIR/System.dll

Request for Quotation New collaboration.exe

IMPHASH e221f4f7d36469d53810a4b5f9fc8966
SHA256 cb076958b9db298f34a9eeaafc4796f6d902b19b1696b76179db10612d371608
MD5 1e4847dd3c262a4303261601f0197a42
SHA1 eaa9a7dbdf8211dbe248b739480e349c0fb56583
SHA512 76620c6decf9b5ae48ddf5eda391081d568a0de7e6d87c814040614000d9b1f989466ec8a8ea9395dd45ea927a77c2f3bc848bf8910ad578bef31299801b312d
SSDEEP 12288:xlYZmcRHOAXnPlX1V6loPrHA8P4xq0xnVBTjJ:UmcdOA3PlXularHbP4xfxPJ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

13146

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathW SetFileTime CloseHandle GetShortPathNameW MoveFileW SetCurrentDirectoryW GetFileAttributesW GetLastError GetFullPathNameW CreateDirectoryW Sleep GetTickCount CreateFileW GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW ExitProcess SetEnvironmentVariableW GetWindowsDirectoryW SetFileAttributesW ExpandEnvironmentStringsW SetErrorMode LoadLibraryW lstrlenW lstrcpynW GetDiskFreeSpaceW GlobalUnlock GlobalLock CreateThread CreateProcessW RemoveDirectoryW lstrcmpiA GetTempFileNameW lstrcpyA lstrcpyW lstrcatW GetSystemDirectoryW GetVersion GetProcAddress LoadLibraryA GetModuleHandleA GetModuleHandleW lstrcmpiW lstrcmpW WaitForSingleObject GlobalFree GlobalAlloc LoadLibraryExW GetExitCodeProcess FreeLibrary WritePrivateProfileStringW GetCommandLineW GetTempPathW GetPrivateProfileStringW FindFirstFileW FindNextFileW DeleteFileW SetFilePointer ReadFile FindClose MulDiv MultiByteToWideChar WriteFile lstrlenA WideCharToMultiByte

user32

EndDialog ScreenToClient GetWindowRect RegisterClassW EnableMenuItem GetSystemMenu SetClassLongW IsWindowEnabled SetWindowPos GetSysColor GetWindowLongW SetCursor LoadCursorW CheckDlgButton GetMessagePos LoadBitmapW CallWindowProcW IsWindowVisible CloseClipboard SetClipboardData wsprintfW CreateWindowExW SystemParametersInfoW AppendMenuW CreatePopupMenu GetSystemMetrics SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharPrevW CharNextA wsprintfA DispatchMessageW PeekMessageW ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage GetDC SetWindowLongW LoadImageW SendMessageTimeoutW FindWindowExW EmptyClipboard OpenClipboard TrackPopupMenu EndPaint ShowWindow GetDlgItem IsWindow SetForegroundWindow

gdi32

SelectObject SetBkMode CreateFontIndirectW SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW ShellExecuteW SHFileOperationW

advapi32

RegCloseKey RegOpenKeyExW RegDeleteKeyW RegDeleteValueW RegEnumValueW RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumKeyW

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

CoCreateInstance CoTaskMemFree OleInitialize OleUninitialize

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 7fe77ca13121a113c59630a3dba0c8aaa6372e8082393274da8f8608c4ce4528
MD5 fc90dfb694d0e17b013d6f818bce41b0
SHA1 3243969886d640af3bfa442728b9f0dff9d5f5b0
SHA512 324f13aa7a33c6408e2a57c3484d1691ecee7c3c1366de2bb8978c8dc66b18425d8cab5a32d1702c13c43703e36148a022263de7166afdce141da2b01169f1c6
SSDEEP 192:e/b2HS5ih/7i00eWz9T7PH6yeFcQMI5+Vw+EXWZ77dslFZk:ewSUmWw9T7MmnI5+/F7Kdk
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10125

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Astrolabe/Housemates.Irr227

SHA256 5ffebc9cf96f2bd70615553e4039f2d7fb22c352da278b1e01d428755bc8cdea
MD5 82571859c65da2518d77d22fdac0e8b0
SHA1 0dfdec2b5b9878a9fd66c3054b8ad28b835dd08c
SHA512 b6fa725e49d024c71dc8c5f71123644b9bc447e21ab3f62458c6bd6995b7b76a9ae48b29b2e8479c1eda7298cde0fc53d817641b8bffc5abb1a4527a47871295
SSDEEP 768:8NH3BldZACKhrgFgJBt1GuZOoLcoutzlEIPDn/zccQDvBZ3:IHRbeBhsFMBvGEY3Pr/zcck3
MD5 SHA1 SHA512 SSDEEP

Astrolabe/img2.jpg

SHA256 e5ee495a89e55467db6a396f012edb6a71d2e762cfc7fc6846fe7259528bf168
MD5 49daf4e74443d8502f3229468615185f
SHA1 9bb41bf5f382ee315893366f559fa26d57a4cd5f
SHA512 ee9abc6a19215fed64584ba24736ecba24139cd03a75530ff351c99a25628410472a28f4ee08e87ce1f75dc79396a2a9c1ac79c399720c320437bc18993b561a
MD5 SHA1 SHA512

Astrolabe/pinrail.whe

SHA256 e4c5f20595c446d20c978cf7b486579ba2ffc17e64b940733b40c89df4331319
MD5 3ad2fe4ea13486258eaddd1e5940a6d7
SHA1 06d0468a125d754d4534c182d79444dfb7a1cf61
SHA512 82328e01492bdb8b23555cb369279a5352b35e0b51a4a4ac88d9f9285bbdaba627fe01139b4f9669847252d5a59fc512b2463a364efd5c33b83309d6a8985d59
SSDEEP 1536:s3tr+hilKd11tUzcxZg7SBobbR5FF7b7IvSog:sRVmQc3u9F7b76
MD5 SHA1 SHA512 SSDEEP

Astrolabe/unyouthfully.ske

SHA256 50b1d7356f0cc22f2a9ae93a7cc9738c6bc0907724acdb85f68f594333b706dc
MD5 94c4b93474d07658fcbd411a20e68532
SHA1 66421117eb902b48d39a1514c88c868394085fcf
SHA512 bc1c40ff5b9fd71590e9b3e71d7b58a46e8afbe56dfbd22c39f5dc0952acedc96f2bc4d8428ea0bcd75d67bd32f2b095585925cd8141063801fb128ea46f7471
SSDEEP 768:HcPiBl7QD/ad4B+etLBBF64vscOIBiMFYnfBc1TS/HVtHlY4bDzZkmNQyFY670Fn:QaxOPt/G9V4yf7P/zZkX00b/h
MD5 SHA1 SHA512 SSDEEP

Genoprettendes/Emalje.kap

SHA256 b53dfb245a8d5a0f0faeec7e8b4ae273522ac29fd29b33608f9ba7f9adb90279
MD5 818d9b577c6a2ccb8c8d753c89b0aeed
SHA1 1912e60e75b47e0ac0b0acdb2b320f0b36d3ce22
SHA512 91993aa2e3e2666a3945886101b2b670cd3b0d76cf3cfff3684dcb310fe324a1c650fab5d5d00b8cfa49b5a7713fe2dbba6dc2d8bb8dac7a169495e6694ce4c6
SSDEEP 768:j91kr2E4uLB4rAvVSJUxZOKLuPYUIlh6njQqVK+P7T6r6hI4W7lD1jBCgUpo:94irAZug+TLg1cpo
MD5 SHA1 SHA512 SSDEEP

Woolwheel.Non

SHA256 9de8c350dd334bea379a5235ddda7c325ee1abad472f197d4cb6410371c921eb
MD5 aa6d4524c5dbec71e84d6aa704aecdd4
SHA1 e6c70157685ca6ffb2cc4cb6847663a18a61a238
SHA512 98e9caed8a5c47ca953d1681cd0a441538eeb02930c6eb901a8f412a245d04cc820b6323cc8e58d2fd04cbd41b5403d5255e9622362c71a317b44be2ffcc6118
SSDEEP 6144:kNydfTa+6Dxh9XUVhPW4KzP5Vcu6pUZ3BqMHazBC:GydfTa+aRU3Pl2onuFBqMKA
MD5 SHA1 SHA512 SSDEEP

Request for Quotation New collaboration.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Astrolabe/Housemates.Irr227

Astrolabe/img2.jpg

Astrolabe/pinrail.whe

Astrolabe/unyouthfully.ske

Genoprettendes/Emalje.kap

Woolwheel.Non

Sharing

General

Malware Config

Signatures

File Explorer

Request for Quotation New collaboration.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Astrolabe/Housemates.Irr227

Astrolabe/img2.jpg

Astrolabe/pinrail.whe

Astrolabe/unyouthfully.ske

Genoprettendes/Emalje.kap

Woolwheel.Non