rendels_1023200000000000305[.]exe

resource
rendels_1023200000000000305.exe
unpack001/$PLUGINSDIR/System.dll

rendels_1023200000000000305.exe

IMPHASH 61259b55b8912888e90f516ca08dc514
SHA256 186a1d9c4703d9498b26d88451e31018ff66b7f9f135e0ed93f9ac10aa485753
MD5 ff83f495808f8837a41405726ce9d7b9
SHA1 186bb042c4a61b7905ed62bde58f062725897192
SHA512 89112cc0a4b7349bbb9b9c2b2e466f895375ee099a27b6a497be3860414f9ad9d8ec87b0dd521e029fc4827ee1e1560b76e319e5b4ea12ac1b76986626f2ddca
SSDEEP 24576:+YB//x9sjWsxFLFS8Tppg8bY6yEV+ztrHvm:j9//CWWTppm65wc
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

13888

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCreateKeyExW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken SetFileSecurityW RegOpenKeyExW RegEnumValueW

shell32

SHGetSpecialFolderLocation SHFileOperationW SHBrowseForFolderW SHGetPathFromIDListW ShellExecuteExW SHGetFileInfoW

ole32

OleInitialize OleUninitialize CoCreateInstance IIDFromString CoTaskMemFree

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

GetClientRect EndPaint DrawTextW IsWindowEnabled DispatchMessageW wsprintfA CharNextA CharPrevW MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW GetSystemMetrics FillRect AppendMenuW TrackPopupMenu OpenClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW PeekMessageW SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint EmptyClipboard CreatePopupMenu

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateFontIndirectW CreateBrushIndirect DeleteObject SetTextColor SelectObject

kernel32

GetExitCodeProcess WaitForSingleObject GetModuleHandleA GetProcAddress GetSystemDirectoryW lstrcatW Sleep lstrcpyA WriteFile GetTempFileNameW lstrcmpiA RemoveDirectoryW CreateProcessW CreateDirectoryW GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW CopyFileW ExitProcess GetCurrentProcess GetModuleFileNameW GetFileSize CreateFileW GetTickCount MulDiv SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW MoveFileExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
MD5 cff85c549d536f651d4fb8387f1976f2
SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Ambilevous/Inagglutinability.fug

SHA256 2c121ed02b618293b4402e6b21f2c732bc94085ef655406349c39f31831d498c
MD5 84fa0dd1b45fb180585f2e2f50699931
SHA1 0a0463be047f0429e8ecee07c01b2cf1d5877c60
SHA512 886ac6ae7ea0242f672d349e73804c24c4ef5406ecfdbaed52a96908bb32b719fac804abfa2f75d2c3c9b230c148881624938509ba012bc65cecaf963c9e7d28
SSDEEP 768:ac7PvH0g06m8EO44p5avB58Z4xunuY1TRicIrA/bjWGAgd+DArFLB+F0PNwhiV2y:Tnu+/YlZbezJVf975PexHNpRZwxM
MD5 SHA1 SHA512 SSDEEP

Ambilevous/Indbruddene.Obd

SHA256 7be06e71697fc66ca273f2a26b249d9f9ab7d9a113ca0c1878db8c4feadf82b8
MD5 78a2cc4c1635fdf52e244c6b50b690e7
SHA1 63cb7b1501fb000341dd107d383de152f7e8b6a6
SHA512 aa1902f8d29f40bb5dd78a4fc7547c0ba133165f93e58dedaf90fc381845b3bd99d6fc00f7164539df405a2cba7058d806a0c231fa287233db67ad7f3174712f
SSDEEP 12288:mdZ1laVl+7cVzst5g73O698WumZ0AY70TkXjON/:uZ1lau7UstSNNVzY70T0jo
MD5 SHA1 SHA512 SSDEEP

Ambilevous/bingy.uda

SHA256 82c098cee0901c5eab36e7e58f5be50bb6a4b730a1dcce30868a6a070b7d7b0d
MD5 63ab01179f7f08cb3fd31a84d307923e
SHA1 fe08fc38c13fbd2b2d3fac0ecb21a61fac348909
SHA512 5b5ccdbe1613bf6e0ad01568cf0730fa8e3782ff29a04fde9eba47fe9858e3827be61582fb19b451dfa8fae98d11a715458b114965fdae58b6a0181d7d318e7e
SSDEEP 1536:lsam/YZz1HsF/LIx4xzs+FxFWEYth0ZDmHmSwIHLh:yYXa8x4xzsbLmyHNLh
MD5 SHA1 SHA512 SSDEEP

Ambilevous/molge.gos

SHA256 56f956599d7c9c0279244826eef098087e0792d2df9fcdef56808096bb7171ad
MD5 b80d0cb89fe7fa621981d8d20875c6f8
SHA1 e9e5efcc9a0bf3fcb96ed74300cb3eda8824a903
SHA512 503b3cb4198976af94d07938f8a74da751cdabfead629fa84b50fa964e3aa7e5a9d9aeec38a530b84ebc6ca835d453a65fbb4be172bcc36f4b2f1716ac0af45b
SSDEEP 768:EoZQ4ffHokStkE7R3fsPebnEzwBFK/UGxsF7zd3axJXZUJ9uSPHH+Xwxo4wAlU0I:Eo3ITfBkCnaS/HuAiNNo5mzagNT
MD5 SHA1 SHA512 SSDEEP

Ambilevous/overissued.rei

SHA256 0ad6e32ab10e80bcdb3474b904a369af8e6ea7f78f7422d51843f43a4b0d8ff5
MD5 38662e787c7d317321b9352fe6269829
SHA1 918fd791b9a00725bcd818648c25e5cbcec3bc84
SHA512 7e707f205191acf77966283832ee364d26ca14670c820cd7d51f2fc407521cefd69eb17f04dee6c75c58f47c3085f9d1707f0dec4e81a40f67c1741c97e921b4
SSDEEP 768:u8Rnm6RqiOI7/5CnMuIXKM3+4MTe0vTGzJhhslmbnvlVD36APjFUNDVs1bcE8o48:RjXT6B6JmUDr5ahkRssMs7
MD5 SHA1 SHA512 SSDEEP

Ambilevous/ramessid.gla

SHA256 28b750c621da76e80615c113a689bf77c32d81f5d4c5445a433206e0b3b2f0a4
MD5 417fd08aa77f114479b10d88872bf95e
SHA1 1e4630475a91ea0dd64a136cadc446fa38649a41
SHA512 5079a3f462f38067cb572a43625c2b2d7eb98eb062459fe045408f3dda3e68770efb2bc78e12ad171e2b4aace97ad753a440e9ffb0f7f8b59d3c01608be7e288
SSDEEP 768:Nh0M1M+UE28IhUidpSGkmkNebfgnKMfExKsYzoi6tW0ySuHg3b38P8c34C7yzyEX:NqELXsuJHGCKoU1ilsGzaE7rE4zPBo
MD5 SHA1 SHA512 SSDEEP

Ambilevous/triaxiality.gen

SHA256 4229532b012088022c28b2aded22acb76d8882061ad020135dd761a9fab13090
MD5 60a38455325df314a0421f85af3dd490
SHA1 5edb899c3fddb7f242573e9afc9e92eb93c837fc
SHA512 962b89fa92a239878c75ae702e3deba81a9353ddfd9e130ae4b7c4749fb6d859a0d3629f1f901b949b7e370c0baa0024d6a92f7c2d7e656aed04219ded2568cc
SSDEEP 768:hCdYgMOEvuXzI1TjEbC35gF5MA2QF73GmDMi5BzXXhVVbD3507pldZytBoNpUq59:hXF0F5s82cHzHDZenqEfnpm+ijc2s
MD5 SHA1 SHA512 SSDEEP

rendels_1023200000000000305.exe

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Ambilevous/Inagglutinability.fug

Ambilevous/Indbruddene.Obd

Ambilevous/bingy.uda

Ambilevous/molge.gos

Ambilevous/overissued.rei

Ambilevous/ramessid.gla

Ambilevous/triaxiality.gen

Sharing

General

Malware Config

Signatures

File Explorer

rendels_1023200000000000305.exe

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Ambilevous/Inagglutinability.fug

Ambilevous/Indbruddene.Obd

Ambilevous/bingy.uda

Ambilevous/molge.gos

Ambilevous/overissued.rei

Ambilevous/ramessid.gla

Ambilevous/triaxiality.gen