858688510aeff9e47282692cccf72d58fe45b6bc128b49f3f5248d11e54f771c[.]exe

resource
858688510aeff9e47282692cccf72d58fe45b6bc128b49f3f5248d11e54f771c.exe
unpack001/$PLUGINSDIR/System.dll

858688510aeff9e47282692cccf72d58fe45b6bc128b49f3f5248d11e54f771c.exe

IMPHASH 56a78d55f3f7af51443e58e0ce2fb5f6
SHA256 858688510aeff9e47282692cccf72d58fe45b6bc128b49f3f5248d11e54f771c
MD5 a81990bb342611261db37a0eecab1a3a
SHA1 f848c1ff34bdbb82199de22c4c49d8ebef790031
SHA512 bd6f57bef5b21e651bb7de998640a961a6fabb2fc1073a2aa1867f4feffd405fff127bed2fccbf9f564a977ce938b7a47151c917b7e65a7afb78a71f914e5205
SSDEEP 12288:9bLlN73eJi4xLl7K3m1Ux4kRBA9/PxCGGd/9hKVZFDN:9bzSJikm7BA9/PxOd3KD
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

13613

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCreateKeyExW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken SetFileSecurityW RegOpenKeyExW RegEnumValueW

shell32

SHGetSpecialFolderLocation SHFileOperationW SHBrowseForFolderW SHGetPathFromIDListW ShellExecuteExW SHGetFileInfoW

ole32

OleInitialize OleUninitialize CoCreateInstance IIDFromString CoTaskMemFree

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

GetClientRect EndPaint DrawTextW IsWindowEnabled DispatchMessageW wsprintfA CharNextA CharPrevW MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW GetSystemMetrics FillRect AppendMenuW TrackPopupMenu OpenClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW PeekMessageW SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint EmptyClipboard CreatePopupMenu

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateFontIndirectW CreateBrushIndirect DeleteObject SetTextColor SelectObject

kernel32

GetExitCodeProcess WaitForSingleObject GetModuleHandleA GetProcAddress GetSystemDirectoryW lstrcatW Sleep lstrcpyA WriteFile GetTempFileNameW CreateFileW lstrcmpiA RemoveDirectoryW CreateProcessW CreateDirectoryW GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW CopyFileW ExitProcess GetCurrentProcess GetModuleFileNameW GetFileSize GetTickCount MulDiv SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW MoveFileExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
MD5 cff85c549d536f651d4fb8387f1976f2
SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Abekattestregens.lam

SHA256 a96d3d792516c5828ed57b10816b6dc2fe5aa246ba080aa8501f49bf560edba6
MD5 7fbfde26ff74a2acd804af064ab7d112
SHA1 b739aa12226a29fa1d4b128d7cf7a40cfaa3daeb
SHA512 dda3aa4b4e1948eb75d5996471a1a277d6527845843fc3d7156fc0bb57999d6b42a0d9f496717bd0f6e7af540e0ca9e97865609fa69edf5aa5740b83514afada
SSDEEP 3072:bq31y+S9N063fbLGceXz3VjUc0266W7QlHKON6e+JEs8Cw00vi7J4c4IikRs0543:bcHWN0YwhC266WElRcIsVwGwaspxb9X
MD5 SHA1 SHA512 SSDEEP

Flyttegods/foredrage.ist

SHA256 ffa6b8e79c50c209c700265222e6b02506e0b3b2f23a16019369b2829be537d4
MD5 24ea71f0407e3e687043303d28231c63
SHA1 cca06edb624b1bfeeb6c633f36009bed5aec4f9f
SHA512 0242ceaa70354affb2168a8c0f33e768a5479981c967a4f4f2fdc7ce3fdf0bc7f80fbfd82668f14c56cb794760558f9c3d6294419f5fb96c08325239aff66ea9
SSDEEP 6144:e07iKjEtYU+VuR77K3fR5dwLu1hf1QuolfJ1JuUT6AjFItDjZqH/sxmYSVr/EZeZ:nMEad
MD5 SHA1 SHA512 SSDEEP

Flyttegods/rigourous.mul

SHA256 e136aa4a221bcd5d1820eea0c06b48cff3847d2a0fe491b9efe8c0474b346742
MD5 b3695d027674ef62439a498f21eb8c6f
SHA1 db6d0d7bf105f5aeb25a4e330703794e1694511f
SHA512 fd1e7897281662de010aa135e5146e66da1cdfab4d60b0be96e2ec95d599d1e8ef77bc9ea164823ce70089915b26570b10156315abd6990b266c0a3750d6aa1e
SSDEEP 6144:XZMCipbVMuK++hbP30DcVUIRA2lsP4Lvv3/rlCuMhUM5d92MdI0jjMD74F/X1MxE:Rdiz
MD5 SHA1 SHA512 SSDEEP

Navalistic.lej

SHA256 d28fedecf66b264dcc7ad743656df5f48a9c86ac072586330b3031226f85cdd8
MD5 eba92093d6b63b93d514dfe10301b22e
SHA1 646f2228ab13e9e7510bbab9f1f7eb96291b0637
SHA512 f873c5a0cb048728e658c5af52d9df2694b6fa8a312f4b2d6ed5ab9975ea7edc28c2141ccdbe5e5835e3c90b6168263b4a4041b7cb05a01e9685638680eb75de
SSDEEP 1536:AdQ3Q4Yh7Jed1hAkjgpSEZY/K7i8yp35eTl/vK5r452cqZGt/OCw0sJPvs:hnuWh1jsF7i8yJg/vMUn1sJPE
MD5 SHA1 SHA512 SSDEEP

Panside.ini

SHA256 43b572cbf7cfa39bdf61d83e36f453181afbd1d16bb70e297c9a6854cd14daaa
MD5 55459b02b7f9f1c4459f7751b3541f06
SHA1 ec204bac631df91882f4297ecee10a9e1af00acb
SHA512 de4242222d238de603555e1b437cd74d3685a66a9ab6e00700e891df9edc03d689e14a4bf6050a3197ff6008e5e3c0f19a4994fbae938659cb564fa20d7adee6
MD5 SHA1 SHA512

eskimologi.ini

SHA256 b5d2c902b7f79a80861050f5bd12a42c574e8804a8e1dcca9a40988060a25545
MD5 edb8e7fb199a4f0c507fe8bb54a82fa6
SHA1 705fb8f0122c591e2a8d97d2340fc3200e2de90c
SHA512 56fc0a36f489ff1fd57e042a0973c74d5ba1f80c386e3ce1568127c7724f83007c11fcac27324388dbcdab87130fd65620da49a55ea3d3c5723aeb7da9166e71
MD5 SHA1 SHA512

858688510aeff9e47282692cccf72d58fe45b6bc128b49f3f5248d11e54f771c.exe

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Abekattestregens.lam

Flyttegods/foredrage.ist

Flyttegods/rigourous.mul

Navalistic.lej

Panside.ini

eskimologi.ini

Sharing

General

Malware Config

Signatures

File Explorer

858688510aeff9e47282692cccf72d58fe45b6bc128b49f3f5248d11e54f771c.exe

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Abekattestregens.lam

Flyttegods/foredrage.ist

Flyttegods/rigourous.mul

Navalistic.lej

Panside.ini

eskimologi.ini