ad084a1c285369520a48712abaef5ebb566572f32e345d7e2356ada3fea0473f[.]exe

resource
ad084a1c285369520a48712abaef5ebb566572f32e345d7e2356ada3fea0473f.exe
unpack001/$PLUGINSDIR/System.dll

ad084a1c285369520a48712abaef5ebb566572f32e345d7e2356ada3fea0473f.exe

IMPHASH d4b94e8ee3f620a89d114b9da4b31873
SHA256 ad084a1c285369520a48712abaef5ebb566572f32e345d7e2356ada3fea0473f
MD5 fd7d65a4a49c3867970510443c8819d5
SHA1 088fa33f1e46a544ddec2d2493895abbf358b1d3
SHA512 39722036948fd74e97f6586122d86e2c7a4d16716fdd15020b73848345bcb5b3b75e1f956589fe4f6c4abfd658c20a712563b10abb701bfab06c8d417b0a0aec
SSDEEP 12288:I5Az4Ci9QbB5i3M5vmdmKEBmnSXu7Jj1JK8s5FEeKB:ZAiK3cvmPEBmnSXu7Jj1JiceI
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

12960

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetCurrentDirectoryW GetFileAttributesW GetFullPathNameW Sleep GetTickCount GetFileSize GetModuleFileNameW MoveFileW SetFileAttributesW GetCurrentProcess ExitProcess SetEnvironmentVariableW GetWindowsDirectoryW GetTempPathW GetCommandLineW GetVersion SetErrorMode lstrlenW lstrcpynW CopyFileW CompareFileTime GlobalLock CreateThread GetLastError CreateDirectoryW CreateProcessW RemoveDirectoryW lstrcmpiA CreateFileW GetTempFileNameW WriteFile lstrcpyA lstrcpyW MoveFileExW lstrcatW GetSystemDirectoryW LoadLibraryW GetProcAddress GetModuleHandleA ExpandEnvironmentStringsW GetShortPathNameW SearchPathW lstrcmpiW SetFileTime CloseHandle GlobalFree lstrcmpW GlobalAlloc WaitForSingleObject GlobalUnlock GetDiskFreeSpaceW GetExitCodeProcess FindFirstFileW FindNextFileW DeleteFileW SetFilePointer ReadFile FindClose MulDiv MultiByteToWideChar lstrlenA WideCharToMultiByte GetPrivateProfileStringW WritePrivateProfileStringW FreeLibrary LoadLibraryExW GetModuleHandleW

user32

GetSystemMenu SetClassLongW IsWindowEnabled EnableMenuItem SetWindowPos GetSysColor GetWindowLongW SetCursor LoadCursorW CheckDlgButton GetMessagePos LoadBitmapW CallWindowProcW IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard wsprintfW ScreenToClient GetWindowRect GetSystemMetrics SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharPrevW CharNextA wsprintfA DispatchMessageW PeekMessageW ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW GetDC SetWindowTextW PostQuitMessage ShowWindow GetDlgItem IsWindow LoadImageW SetWindowLongW TrackPopupMenu AppendMenuW CreatePopupMenu EndPaint SetTimer FindWindowExW SendMessageTimeoutW SetForegroundWindow

gdi32

SelectObject SetBkMode CreateFontIndirectW SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW ShellExecuteW SHFileOperationW

advapi32

RegDeleteKeyW SetFileSecurityW OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges RegOpenKeyExW RegEnumValueW RegDeleteValueW RegCloseKey RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumKeyW

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 e94a1f7bcd7e0d532b660d0af468eb3321536c3efdca265e61f9ec174b1aef27
MD5 ee260c45e97b62a5e42f17460d406068
SHA1 df35f6300a03c4d3d3bd69752574426296b78695
SHA512 a98f350d17c9057f33e5847462a87d59cbf2aaeda7f6299b0d49bb455e484ce4660c12d2eb8c4a0d21df523e729222bbd6c820bf25b081bc7478152515b414b3
SSDEEP 192:eF24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35Ol9Sl:h8QIl975eXqlWBrz7YLOl9
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10183

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Leawill27/Institutionalisering.Pla151

SHA256 e22226452363f45a87dc3b3d70ebc85bdf0b9cf806195e2d2b3477fd0d9cc19a
MD5 8159a2d86c670494afc0adb78b7c8d96
SHA1 c435997868d551d974292aee95148a57d74187ee
SHA512 7533001251fa85d6cb0a2bd0e6711899649e77b59b9a4bd50763d1205b570baf952f46218f503377c30f0f206e8635e4a9deb51f3f4bc6883b798c40271e3322
SSDEEP 1536:aadyq9kO2bRTYBX+RzIhnAdETUJRJFqIpvhdGprfP:XiRT649EQJRPjpg3
MD5 SHA1 SHA512 SSDEEP

Leawill27/Phonobsning.Nub

SHA256 ca037eb9952d7a6042b2dc32231ac5ff9b78d6b5d4f56522b882c0be721b5fd0
MD5 866d60cb22182941aa52f507e4bb366d
SHA1 dc7a87e547d91e96eae27603bd294e77f9ff65f8
SHA512 a8e8a93b1c73b7b49551cac78e418b56ee730b3bd2e1ad4ef05427c8fd9955e7193e7d0cad3224935cfa995e3c25ac55a753b847fc711ff7661a11ef02a98d69
SSDEEP 6144:7J+RkeB2X2w2mTIfT6sIDELqCEKD9CmfsDI4fYKnBIFuG:iTBBZ4ls+C/Eg9CwWB9G
MD5 SHA1 SHA512 SSDEEP

Leawill27/Riprap43.gaw

SHA256 87a7017021050071dbe5726bf9ac505763cd923e2bde93336ca0905802cd8d49
MD5 39c9a5f767d8c170b5ce38ea8d5734d4
SHA1 4b4ca81eb3d093645b504004f62a269d4eacdecc
SHA512 ae2d66b801251046fa4d3093391b916955b43be75a954dd398583b1b8881a9f109f51f81d6e4fe759f83ac7b921fa89b02185013afde16d3c8eab422be89b4ff
SSDEEP 384:vrBeaW6xu5Pd9GW0Zq+/HXF1qcGNMUd8phxiFQHOV7hpvZlq:t9+Pdop/306xixrlq
MD5 SHA1 SHA512 SSDEEP

Leawill27/forskansningens.txt

SHA256 6b18768503395c809263568d3a8858810404c2b7d49dc7cb6ce5f717f5d6c7de
MD5 ae69fe0f4d1e1115bc470031e661785c
SHA1 8d3799826fe457c61c1e8ee5e3071683a8125bc5
SHA512 969c0db048eac4a9b447a0c0c463a7983f1b4091b6206e274b9d249f8311439b6c33f5aa1edf9cd1aa27502da49378d3e1b45f16909c55df830e51684e9648be
MD5 SHA1 SHA512

Vilkaarets/fyldebtten.soi

SHA256 45f24543c01c9a11cc2246a9b27569af433eef61c877a4e191b683315d3566be
MD5 aef78d8d561e8802286a78aac6c73ed6
SHA1 ddf5da649482d0a553802827bb9f0ef64a7069e1
SHA512 93d43c0cecadf8e1f507f8e58d2b4d92995d8f7ecf213a23559938b380033a6d0d80b0816a8d6603864f821f4fedc988e0f79be14c6892089178970e08dc4199
SSDEEP 768:vBTwJOLxCIF0V6iLboHog6BQlsMqlN1R0pmGy30wbfq6+9GmlsNh34k0uJ/QohER:cJigyyDJnLH7zA
MD5 SHA1 SHA512 SSDEEP

Vilkaarets/wildwestfilm.sto

SHA256 83e9ce74259889dcabd39d41131f286882b224698dcdeb8d0b4074069aaa687b
MD5 bfea15c03ab295424981a73637a19491
SHA1 a5adabddc373d6b3004f96946d84b651e42d9f5c
SHA512 cb5969bffaed8af1791938e924e0cc9f876e45165f4e7ea5e9249131faca831c0600f14bd68ef041d18c81a3fbe087970043d1b3b8a6786c1e5e5049834d4d0d
SSDEEP 768:y2f405GRYtnSLOBbyCociR2TVuEpHsVURGxwGmXjyMB+CtKDOgt9rlHF1QOs+9m5:pIuagbnK7CwVwFpYogwhUsvCq
MD5 SHA1 SHA512 SSDEEP

ad084a1c285369520a48712abaef5ebb566572f32e345d7e2356ada3fea0473f.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Leawill27/Institutionalisering.Pla151

Leawill27/Phonobsning.Nub

Leawill27/Riprap43.gaw

Leawill27/forskansningens.txt

Vilkaarets/fyldebtten.soi

Vilkaarets/wildwestfilm.sto

Sharing

General

Malware Config

Signatures

File Explorer

ad084a1c285369520a48712abaef5ebb566572f32e345d7e2356ada3fea0473f.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Leawill27/Institutionalisering.Pla151

Leawill27/Phonobsning.Nub

Leawill27/Riprap43.gaw

Leawill27/forskansningens.txt

Vilkaarets/fyldebtten.soi

Vilkaarets/wildwestfilm.sto