8a4d38092e7f0245aa376d724cf3dbe08d4b563a86db3c99e70defaa38beb969[.]exe

resource
8a4d38092e7f0245aa376d724cf3dbe08d4b563a86db3c99e70defaa38beb969.exe
unpack001/$PLUGINSDIR/System.dll

8a4d38092e7f0245aa376d724cf3dbe08d4b563a86db3c99e70defaa38beb969.exe

IMPHASH d4b94e8ee3f620a89d114b9da4b31873
SHA256 8a4d38092e7f0245aa376d724cf3dbe08d4b563a86db3c99e70defaa38beb969
MD5 745504717878bb22b600df7e2c2dd9f4
SHA1 9515d0277803511a4f401674f40f022ed69c85d7
SHA512 8035ff6f18deaaec620acd824bbcecf07d38f2e2f77e322942f635320af75bbc4bd60250f0e61094eed22cfeef652791d61476bd7b4c613ebb6fb7952ae48e4d
SSDEEP 12288:I5AlMIL/obq71R7Oj6rgcPIcXuQd7lxu7Jj1JK8s5FEeKN:ZtL/o2BR7Zrgcwgpxu7Jj1Jiceg
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

12960

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetCurrentDirectoryW GetFileAttributesW GetFullPathNameW Sleep GetTickCount GetFileSize GetModuleFileNameW MoveFileW SetFileAttributesW GetCurrentProcess ExitProcess SetEnvironmentVariableW GetWindowsDirectoryW GetTempPathW GetCommandLineW GetVersion SetErrorMode lstrlenW lstrcpynW CopyFileW CompareFileTime GlobalLock CreateThread GetLastError CreateDirectoryW CreateProcessW RemoveDirectoryW lstrcmpiA CreateFileW GetTempFileNameW WriteFile lstrcpyA lstrcpyW MoveFileExW lstrcatW GetSystemDirectoryW LoadLibraryW GetProcAddress GetModuleHandleA ExpandEnvironmentStringsW GetShortPathNameW SearchPathW lstrcmpiW SetFileTime CloseHandle GlobalFree lstrcmpW GlobalAlloc WaitForSingleObject GlobalUnlock GetDiskFreeSpaceW GetExitCodeProcess FindFirstFileW FindNextFileW DeleteFileW SetFilePointer ReadFile FindClose MulDiv MultiByteToWideChar lstrlenA WideCharToMultiByte GetPrivateProfileStringW WritePrivateProfileStringW FreeLibrary LoadLibraryExW GetModuleHandleW

user32

GetSystemMenu SetClassLongW IsWindowEnabled EnableMenuItem SetWindowPos GetSysColor GetWindowLongW SetCursor LoadCursorW CheckDlgButton GetMessagePos LoadBitmapW CallWindowProcW IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard wsprintfW ScreenToClient GetWindowRect GetSystemMetrics SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharPrevW CharNextA wsprintfA DispatchMessageW PeekMessageW ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW GetDC SetWindowTextW PostQuitMessage ShowWindow GetDlgItem IsWindow LoadImageW SetWindowLongW TrackPopupMenu AppendMenuW CreatePopupMenu EndPaint SetTimer FindWindowExW SendMessageTimeoutW SetForegroundWindow

gdi32

SelectObject SetBkMode CreateFontIndirectW SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW ShellExecuteW SHFileOperationW

advapi32

RegDeleteKeyW SetFileSecurityW OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges RegOpenKeyExW RegEnumValueW RegDeleteValueW RegCloseKey RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumKeyW

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 e94a1f7bcd7e0d532b660d0af468eb3321536c3efdca265e61f9ec174b1aef27
MD5 ee260c45e97b62a5e42f17460d406068
SHA1 df35f6300a03c4d3d3bd69752574426296b78695
SHA512 a98f350d17c9057f33e5847462a87d59cbf2aaeda7f6299b0d49bb455e484ce4660c12d2eb8c4a0d21df523e729222bbd6c820bf25b081bc7478152515b414b3
SSDEEP 192:eF24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35Ol9Sl:h8QIl975eXqlWBrz7YLOl9
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10183

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Verminly/Normalfordelingernes.Tep

SHA256 ac87b5b811677f1a060bdf7600fd496c3fe7206e477af66e9e87e8e31494a414
MD5 42f88ecdcf508ca1f030ab99654b1b94
SHA1 f2d3f277a442d52beac7d580f54965b52b7a1da9
SHA512 2acd83002bf2a2978e6867e0dd6e8c63b558f5b46a8f09c93da7e324e6d4a4a11e9d9f59cde92abffc7cb67cf270945c3ddda974aae5a62f4d91a643e8bed197
SSDEEP 6144:9+IYOsNolNiweVFXz/H3qABowdHC6giUXb2vq1pk:YIYOsNoCz/HjnHC6gis2cu
MD5 SHA1 SHA512 SSDEEP

Verminly/Riprap43.gaw

SHA256 87a7017021050071dbe5726bf9ac505763cd923e2bde93336ca0905802cd8d49
MD5 39c9a5f767d8c170b5ce38ea8d5734d4
SHA1 4b4ca81eb3d093645b504004f62a269d4eacdecc
SHA512 ae2d66b801251046fa4d3093391b916955b43be75a954dd398583b1b8881a9f109f51f81d6e4fe759f83ac7b921fa89b02185013afde16d3c8eab422be89b4ff
SSDEEP 384:vrBeaW6xu5Pd9GW0Zq+/HXF1qcGNMUd8phxiFQHOV7hpvZlq:t9+Pdop/306xixrlq
MD5 SHA1 SHA512 SSDEEP

Verminly/Unvenom.Lib

SHA256 2950a96c82c080b013e477ac109cea7823019329145ae64f81532b93c46c6480
MD5 93a2d636570664ed4b7ee832bc0032e3
SHA1 235eda5d6ff2bba8924b02201a19f363ce45c1ae
SHA512 ef4887a3a677b0f165e039ad891f2a4091a415ed234b6a9912eb7556b5cd1f2a2b69a5d2d783c225bc98d14bee87ae84105b745dc62414462fe296fc047b489a
SSDEEP 3072:WNPMSzD4yit9jfrvktCtUkSbywTZpryomlD:WNloyK9zbWO/miD
MD5 SHA1 SHA512 SSDEEP

Verminly/forskansningens.txt

SHA256 6b18768503395c809263568d3a8858810404c2b7d49dc7cb6ce5f717f5d6c7de
MD5 ae69fe0f4d1e1115bc470031e661785c
SHA1 8d3799826fe457c61c1e8ee5e3071683a8125bc5
SHA512 969c0db048eac4a9b447a0c0c463a7983f1b4091b6206e274b9d249f8311439b6c33f5aa1edf9cd1aa27502da49378d3e1b45f16909c55df830e51684e9648be
MD5 SHA1 SHA512

Verminly/fyldebtten.soi

SHA256 45f24543c01c9a11cc2246a9b27569af433eef61c877a4e191b683315d3566be
MD5 aef78d8d561e8802286a78aac6c73ed6
SHA1 ddf5da649482d0a553802827bb9f0ef64a7069e1
SHA512 93d43c0cecadf8e1f507f8e58d2b4d92995d8f7ecf213a23559938b380033a6d0d80b0816a8d6603864f821f4fedc988e0f79be14c6892089178970e08dc4199
SSDEEP 768:vBTwJOLxCIF0V6iLboHog6BQlsMqlN1R0pmGy30wbfq6+9GmlsNh34k0uJ/QohER:cJigyyDJnLH7zA
MD5 SHA1 SHA512 SSDEEP

Verminly/wildwestfilm.sto

SHA256 83e9ce74259889dcabd39d41131f286882b224698dcdeb8d0b4074069aaa687b
MD5 bfea15c03ab295424981a73637a19491
SHA1 a5adabddc373d6b3004f96946d84b651e42d9f5c
SHA512 cb5969bffaed8af1791938e924e0cc9f876e45165f4e7ea5e9249131faca831c0600f14bd68ef041d18c81a3fbe087970043d1b3b8a6786c1e5e5049834d4d0d
SSDEEP 768:y2f405GRYtnSLOBbyCociR2TVuEpHsVURGxwGmXjyMB+CtKDOgt9rlHF1QOs+9m5:pIuagbnK7CwVwFpYogwhUsvCq
MD5 SHA1 SHA512 SSDEEP

8a4d38092e7f0245aa376d724cf3dbe08d4b563a86db3c99e70defaa38beb969.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Verminly/Normalfordelingernes.Tep

Verminly/Riprap43.gaw

Verminly/Unvenom.Lib

Verminly/forskansningens.txt

Verminly/fyldebtten.soi

Verminly/wildwestfilm.sto

Sharing

General

Malware Config

Signatures

File Explorer

8a4d38092e7f0245aa376d724cf3dbe08d4b563a86db3c99e70defaa38beb969.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Verminly/Normalfordelingernes.Tep

Verminly/Riprap43.gaw

Verminly/Unvenom.Lib

Verminly/forskansningens.txt

Verminly/fyldebtten.soi

Verminly/wildwestfilm.sto