PO[.]bat[.]exe | Triage™

resource
PO.bat.exe
unpack001/$PLUGINSDIR/LangDLL.dll
unpack001/$PLUGINSDIR/System.dll

PO.bat.exe

IMPHASH e2a592076b17ef8bfb48b7e03965a3fc
SHA256 81c7f5b291b1fcd6d64f7f12208b0134a8462f156dbda97188ec0ba5ff869478
MD5 e66902c532dd0fd4f019200e4599f17c
SHA1 6306e266e3d9dcd3671aa81f77bb7502e3ae76ff
SHA512 bfc0fb98f0921f370e55fc8d9ad8cd79c0280e0de9e6a49fb28cac5eebdf28e6bf14c5f1b94c23405dd387e5495c5f754568b20600ee7fd449a123a14a3b756d
SSDEEP 12288:9s6eULcXcekO8cHzf2l4t5musvXsD6En3kV117Dd:MMetHzf2l4KvXgn3kJ7Dd
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

12960

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetCurrentDirectoryW GetFileAttributesW GetFullPathNameW Sleep GetTickCount GetFileSize GetModuleFileNameW MoveFileW SetFileAttributesW GetCurrentProcess ExitProcess SetEnvironmentVariableW GetWindowsDirectoryW GetTempPathW GetCommandLineW GetVersion SetErrorMode lstrlenW WaitForSingleObject CopyFileW CompareFileTime GlobalLock CreateThread GetLastError CreateDirectoryW CreateProcessW RemoveDirectoryW lstrcmpiA CreateFileW GetTempFileNameW WriteFile lstrcpyA lstrcpyW MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GlobalFree GlobalAlloc GetShortPathNameW SearchPathW lstrcmpiW SetFileTime CloseHandle ExpandEnvironmentStringsW lstrcmpW GlobalUnlock lstrcpynW GetDiskFreeSpaceW GetExitCodeProcess FindFirstFileW FindNextFileW DeleteFileW SetFilePointer ReadFile FindClose MulDiv MultiByteToWideChar lstrlenA WideCharToMultiByte GetPrivateProfileStringW WritePrivateProfileStringW FreeLibrary LoadLibraryExW GetModuleHandleW

user32

GetSystemMenu SetClassLongW IsWindowEnabled EnableMenuItem SetWindowPos GetSysColor GetWindowLongW SetCursor LoadCursorW CheckDlgButton GetMessagePos LoadBitmapW CallWindowProcW IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard wsprintfW ScreenToClient GetWindowRect GetSystemMetrics SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharPrevW CharNextA wsprintfA DispatchMessageW PeekMessageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow LoadImageW SetTimer SetWindowTextW PostQuitMessage ShowWindow GetDlgItem IsWindow SetWindowLongW FindWindowExW TrackPopupMenu AppendMenuW CreatePopupMenu DrawTextW EndPaint CreateDialogParamW SendMessageTimeoutW SetForegroundWindow

gdi32

SelectObject SetBkMode CreateFontIndirectW SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW ShellExecuteW SHFileOperationW

advapi32

RegDeleteKeyW SetFileSecurityW OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges RegOpenKeyExW RegEnumValueW RegDeleteValueW RegCloseKey RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumKeyW

comctl32

ImageList_AddMasked ord17 ImageList_Destroy ImageList_Create

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/LangDLL.dll

IMPHASH 3e8d18bb71c7ebbda2ddc2a4bb03547b
SHA256 f577b66492e97c7b8bf515398d8deb745abafd74f56fc03e67fce248ebbeb873
MD5 174708997758321cf926b69318c6c3f5
SHA1 645488089bf320f6864e0d0bc284c85216e56fbd
SHA512 214433597e04ca1ff9b4fe092d5d2997707a7c56f0f82c85d586088a200e4455028f3b9427d87b4f06f9252557d5be4b7a9138ea6a8d045df6209421fd8ca054
SSDEEP 48:S46+/ZTKYKxbWsptIpBtWZ0iV8jAWiAJCvxft2O2B8mCofjLl:zDuPbOBtWZBV8jAWiAJCdv2CmpL
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5439

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 982c5fb7ada7d8c9bc3e419d1c35da6f05bc5dd845940c179af3a33d00a36a8b
MD5 0ff2d70cfdc8095ea99ca2dabbec3cd7
SHA1 10c51496d37cecd0e8a503a5a9bb2329d9b38116
SHA512 cb5fc0b3194f469b833c2c9abf493fcec5251e8609881b7f5e095b9bd09ed468168e95dda0ba415a7d8d6b7f0dee735467c0ed8e52b223eb5359986891ba6e2e
SSDEEP 192:eK24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35OlASl:u8QIl975eXqlWBrz7YLOlA
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10183

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Blaakilde.Paa

SHA256 9edb74b1e6e4372d2f3a2e06e9194402aeef3bb4281458f6b84146b284bba345
MD5 96804b8105cf76b77f4ddc0e791b3c32
SHA1 ec119fe44412214b6b779d8521bb35a428403b79
SHA512 5509514537c9a50f8b5ef90a6d3fd62c8fdcbabcd7ea17eeab91936fc57cba72a77b97480db5c75bc794faeae8d08a60bcf62d9d640ed225057b894c922fd7b3
SSDEEP 1536:XMY/uK3iZ9gdane0g3nDWQKz/F8H549HYeW0oZ/1qXiFEG9//F+:7uKd7ZEyF+
MD5 SHA1 SHA512 SSDEEP

Nonrurally/hklem.jpg

SHA256 00bd731f641c6fda09b0bf32caffca53d1887d8133b4863b4e966d86ea7f5dd7
MD5 b86928217ca21bba5d0b6a255057d80a
SHA1 7c38dd3ee2318afaea9c05d8c38717be9369584c
SHA512 be4f594ba57b81598c8a40999a602823be238d7f475f83be21b4de8e5b5d9caac180ff9bd95475d1b221d8e0c9f52402d60c2abd301f1f5eb56f971fea67a053
SSDEEP 192:qDZ2OGlqrOO79sfZoPcbYY63jWWZbHd6K8YZ5cUD+08pG:qd2vWZs6EbYDCUb9CutD+7E
MD5 SHA1 SHA512 SSDEEP

Nonrurally/severization.eft

SHA256 d6005c17a71e1ce1f3ec4aa5242f196bf8e6c54b2e59540878f83ac9252be0eb
MD5 f254de295a9c52fd75eecbb334912422
SHA1 5b60d5edd3cdcb1488e006b164a8b430c4a0d3fd
SHA512 aa6601f44a9ea93684b49d9275cf64150afc369403ee71e8933ef9a906dbc2dbfa346eb856a682660dceb9912c2752bb162363f3303c047c7a88e3833cc041a6
SSDEEP 768:VQBqKzvCpaPU1/rXtxEnech8SE42//VZJrnqe6XxLP5qgmvIpbVnYmzj2UpPq8fW:Vze329sqTCyyxst+cUEfq8
MD5 SHA1 SHA512 SSDEEP

Pensionsydelsen.vgt

SHA256 c891b2a28c2c1622624f9cf580382e4a8ea2d43113c5799e61b09a0811c203c8
MD5 13ba1b51aa5fc0e7dfdef86c4a38c1a2
SHA1 f28d33c6f5a9db1346c9dcbfe41fbb0d8b54c546
SHA512 07b5c326b61dda30b92d5dba980ba2f145d512fffea033c9175cf0c2a79de04da863ef1a57b265fb5e133422c77ee27261519ec9fd2d2134f30a8bbf19353285
SSDEEP 768:sXyTTGl/+cqQOxyvv0/7ycon7i5gVxH8BrUjcGFTN4CMjP7AnowKLuduCRxrsvET:6HPETVITY/7mQvE0n3SxD
MD5 SHA1 SHA512 SSDEEP

Rubinsteinkager107.ked

SHA256 4a35f9216e5b557a3f982c2a9decfad60695cb042a569b6f62f99d484b90f929
MD5 b9291c4c10d8f463f4c1fccbb0bc6d53
SHA1 41f3d2a90964293a4761b5d580b22833d8c6deb2
SHA512 4a51e34b20923190a9c3bec4ebf9186cd9c6103ddf4c25659e7373405d304f88cd3e8c4b567ea6b2718a212af64fb79352949844b76a9195f0a1c1ae8ebd2a11
SSDEEP 6144:4Yc/SKD0ZRxKxSabqTu9qsXtC23QRmr0wH9VOnOxp/aESyGBUESOl:GjDyPKRqTu9XgRvxOb/BqBsC
MD5 SHA1 SHA512 SSDEEP

Unrightful.acc

SHA256 00b67b3f6a15b292f1468f92d7052e340ba692333d49b182284b9d7834068f41
MD5 f6771b4f63e40d55943e242c195996c0
SHA1 8bf943ba20bb84cab4de09eb82420fc34a4da9ad
SHA512 b8c70b1d022aa48a8e58620e7e410f67699f3cc529bad55eb2b6be8a62763b1328e691a9fc8b4e247a6deac66d4b102aa61b87ac9fa23c5b6f10c3d07cd81881
SSDEEP 768:G8Oe0JB92KonU/P2dW0wTBWF10YucFZIGf5XQddEYxHffInJkFYOQgtMHXa6jowD:LEVxyJuTKBZ
MD5 SHA1 SHA512 SSDEEP

adulterizes.txt

SHA256 65d0ca125f86127bda56dac071df99e92700f0c769008e8d341d08531bcd0108
MD5 fc4255100098c387e429d7dc5d98aac8
SHA1 78920275678f8eb4202e8d3e865b9d95e126d13d
SHA512 4a68d72326d650d0b1d2298aa8ca064c459136f55801c47987f10d3781444905f9f43d2b45b01b8f7242bd32368d8c68ebef9628bfc42beb12bb6c02d8b7b772
MD5 SHA1 SHA512

PO.bat.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/LangDLL.dll

kernel32

user32

gdi32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Blaakilde.Paa

Nonrurally/hklem.jpg

Nonrurally/severization.eft

Pensionsydelsen.vgt

Rubinsteinkager107.ked

Unrightful.acc

adulterizes.txt

Sharing

General

Malware Config

Signatures

File Explorer

PO.bat.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/LangDLL.dll

kernel32

user32

gdi32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Blaakilde.Paa

Nonrurally/hklem.jpg

Nonrurally/severization.eft

Pensionsydelsen.vgt

Rubinsteinkager107.ked

Unrightful.acc

adulterizes.txt