fc94d179b05d50bcaa14523b241ee1652fde502bb7a3a27727e0892d39452963[.]exe

resource
fc94d179b05d50bcaa14523b241ee1652fde502bb7a3a27727e0892d39452963.exe
unpack001/$PLUGINSDIR/System.dll

fc94d179b05d50bcaa14523b241ee1652fde502bb7a3a27727e0892d39452963.exe

IMPHASH d4b94e8ee3f620a89d114b9da4b31873
SHA256 fc94d179b05d50bcaa14523b241ee1652fde502bb7a3a27727e0892d39452963
MD5 8ee319986da68b9b96c808c9f159459a
SHA1 c8fea79c996780d876068e7f50b5f354d690a164
SHA512 00bafa0a476db01d84c8cfd2129ee8dde8615a78b48ec73344a58d239f00455df49e20519050e9fa9bdaa8748eead12d0b5fbf989d2dabd8a36f14ae2dde72a0
SSDEEP 12288:I5AsKs+wNUKZsmy+Si/FwJtyeap2JX+Hu7Jj1JK8s5FEeKZ:ZSLR2myNiFwJqwJXqu7Jj1Jicew
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

12960

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetCurrentDirectoryW GetFileAttributesW GetFullPathNameW Sleep GetTickCount GetFileSize GetModuleFileNameW MoveFileW SetFileAttributesW GetCurrentProcess ExitProcess SetEnvironmentVariableW GetWindowsDirectoryW GetTempPathW GetCommandLineW GetVersion SetErrorMode lstrlenW lstrcpynW CopyFileW CompareFileTime GlobalLock CreateThread GetLastError CreateDirectoryW CreateProcessW RemoveDirectoryW lstrcmpiA CreateFileW GetTempFileNameW WriteFile lstrcpyA lstrcpyW MoveFileExW lstrcatW GetSystemDirectoryW LoadLibraryW GetProcAddress GetModuleHandleA ExpandEnvironmentStringsW GetShortPathNameW SearchPathW lstrcmpiW SetFileTime CloseHandle GlobalFree lstrcmpW GlobalAlloc WaitForSingleObject GlobalUnlock GetDiskFreeSpaceW GetExitCodeProcess FindFirstFileW FindNextFileW DeleteFileW SetFilePointer ReadFile FindClose MulDiv MultiByteToWideChar lstrlenA WideCharToMultiByte GetPrivateProfileStringW WritePrivateProfileStringW FreeLibrary LoadLibraryExW GetModuleHandleW

user32

GetSystemMenu SetClassLongW IsWindowEnabled EnableMenuItem SetWindowPos GetSysColor GetWindowLongW SetCursor LoadCursorW CheckDlgButton GetMessagePos LoadBitmapW CallWindowProcW IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard wsprintfW ScreenToClient GetWindowRect GetSystemMetrics SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharPrevW CharNextA wsprintfA DispatchMessageW PeekMessageW ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW GetDC SetWindowTextW PostQuitMessage ShowWindow GetDlgItem IsWindow LoadImageW SetWindowLongW TrackPopupMenu AppendMenuW CreatePopupMenu EndPaint SetTimer FindWindowExW SendMessageTimeoutW SetForegroundWindow

gdi32

SelectObject SetBkMode CreateFontIndirectW SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW ShellExecuteW SHFileOperationW

advapi32

RegDeleteKeyW SetFileSecurityW OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges RegOpenKeyExW RegEnumValueW RegDeleteValueW RegCloseKey RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumKeyW

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 e94a1f7bcd7e0d532b660d0af468eb3321536c3efdca265e61f9ec174b1aef27
MD5 ee260c45e97b62a5e42f17460d406068
SHA1 df35f6300a03c4d3d3bd69752574426296b78695
SHA512 a98f350d17c9057f33e5847462a87d59cbf2aaeda7f6299b0d49bb455e484ce4660c12d2eb8c4a0d21df523e729222bbd6c820bf25b081bc7478152515b414b3
SSDEEP 192:eF24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35Ol9Sl:h8QIl975eXqlWBrz7YLOl9
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10183

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Grandniece70.Tri88

SHA256 ef8bba11da5bb376e653ed85884e72e0efb5cde63f35c02a06b0ed47e730c8ab
MD5 5db0027c4f0c5b1cf46eac87f89e943e
SHA1 1015a16e943e2e64fd1b4e5423927288f172a278
SHA512 944af816d8cb0ae485e397b06856cce65cd8dec3f9e9f71a73e651e3f5c99d5dd0e63ef849517e240084e45d7d0fe124a9d72312e086a08d5e2f553eedc4d31b
SSDEEP 6144:e1RVrtzEUsS+6ZnYR/wYBqm1JVaLWFMDSAKNG:mRgUs9QE/jYEVrG2G
MD5 SHA1 SHA512 SSDEEP

Jaundiced167.els

SHA256 7ec1d1262138166f8db01f8fe2a859760df0d0f4931b542357bfc4264b755b05
MD5 4ef25692a3f10e719b714f8b46c1ccbb
SHA1 642f56fc039c5d21f844fb873792a2461d423245
SHA512 db9f2c8fd9e0e83fbc83c46241b29f286525f5659ca6338d3ea33861199b8af9239d6961041bee3ab3db6af7ecd6170fcab54d6efdbef702e35b2e5788b3f400
SSDEEP 768:E5mvmAlKVZi4AmXI+4kOr+Rc7uZdGjDT0BBl2j:EM+WKW4mPuFiEl2j
MD5 SHA1 SHA512 SSDEEP

Riprap43.gaw

SHA256 87a7017021050071dbe5726bf9ac505763cd923e2bde93336ca0905802cd8d49
MD5 39c9a5f767d8c170b5ce38ea8d5734d4
SHA1 4b4ca81eb3d093645b504004f62a269d4eacdecc
SHA512 ae2d66b801251046fa4d3093391b916955b43be75a954dd398583b1b8881a9f109f51f81d6e4fe759f83ac7b921fa89b02185013afde16d3c8eab422be89b4ff
SSDEEP 384:vrBeaW6xu5Pd9GW0Zq+/HXF1qcGNMUd8phxiFQHOV7hpvZlq:t9+Pdop/306xixrlq
MD5 SHA1 SHA512 SSDEEP

forskansningens.txt

SHA256 6b18768503395c809263568d3a8858810404c2b7d49dc7cb6ce5f717f5d6c7de
MD5 ae69fe0f4d1e1115bc470031e661785c
SHA1 8d3799826fe457c61c1e8ee5e3071683a8125bc5
SHA512 969c0db048eac4a9b447a0c0c463a7983f1b4091b6206e274b9d249f8311439b6c33f5aa1edf9cd1aa27502da49378d3e1b45f16909c55df830e51684e9648be
MD5 SHA1 SHA512

fyldebtten.soi

SHA256 45f24543c01c9a11cc2246a9b27569af433eef61c877a4e191b683315d3566be
MD5 aef78d8d561e8802286a78aac6c73ed6
SHA1 ddf5da649482d0a553802827bb9f0ef64a7069e1
SHA512 93d43c0cecadf8e1f507f8e58d2b4d92995d8f7ecf213a23559938b380033a6d0d80b0816a8d6603864f821f4fedc988e0f79be14c6892089178970e08dc4199
SSDEEP 768:vBTwJOLxCIF0V6iLboHog6BQlsMqlN1R0pmGy30wbfq6+9GmlsNh34k0uJ/QohER:cJigyyDJnLH7zA
MD5 SHA1 SHA512 SSDEEP

wildwestfilm.sto

SHA256 83e9ce74259889dcabd39d41131f286882b224698dcdeb8d0b4074069aaa687b
MD5 bfea15c03ab295424981a73637a19491
SHA1 a5adabddc373d6b3004f96946d84b651e42d9f5c
SHA512 cb5969bffaed8af1791938e924e0cc9f876e45165f4e7ea5e9249131faca831c0600f14bd68ef041d18c81a3fbe087970043d1b3b8a6786c1e5e5049834d4d0d
SSDEEP 768:y2f405GRYtnSLOBbyCociR2TVuEpHsVURGxwGmXjyMB+CtKDOgt9rlHF1QOs+9m5:pIuagbnK7CwVwFpYogwhUsvCq
MD5 SHA1 SHA512 SSDEEP

fc94d179b05d50bcaa14523b241ee1652fde502bb7a3a27727e0892d39452963.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Grandniece70.Tri88

Jaundiced167.els

Riprap43.gaw

forskansningens.txt

fyldebtten.soi

wildwestfilm.sto

Sharing

General

Malware Config

Signatures

File Explorer

fc94d179b05d50bcaa14523b241ee1652fde502bb7a3a27727e0892d39452963.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Grandniece70.Tri88

Jaundiced167.els

Riprap43.gaw

forskansningens.txt

fyldebtten.soi

wildwestfilm.sto