Śledzenie DHL[.]bat[.]exe

resource
Śledzenie DHL.bat.exe
unpack001/$PLUGINSDIR/System.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

Śledzenie DHL.bat.exe

IMPHASH b40f29cd171eb54c01b1dd2683c9c26b
SHA256 150fd2376495248906fe73ebcb41b3d0e085f00d1a814ef9b0cae8fd211db3ee
MD5 ad5493b5261351d24d035968b5040724
SHA1 30d188f983a22fa2c10db86c13ca515af02f46f9
SHA512 fa8095ef44dda4eb8388d9bec7360e12d882cd3173035259e716b9bf2f50924c4f575b0ab8a589397b7cea8c5df8cd3394f9a65fd5715f2adca30b383ef5a4c1
SSDEEP 24576:+5UHg7ycXa8ZYMexXYvRCEOYkYRU2fNYwYtYPY:+uHzfV5ovRH1bqyuXOg
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12508

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

Sleep GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA CompareFileTime SearchPathA GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess SetEnvironmentVariableA GetWindowsDirectoryA SetFileAttributesA lstrcmpiA SetErrorMode LoadLibraryA lstrlenA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrcpyA lstrcatA GetSystemDirectoryA GetVersion GetProcAddress WaitForSingleObject SetFileTime CloseHandle GlobalFree lstrcmpA ExpandEnvironmentStringsA GetExitCodeProcess GlobalAlloc GetModuleHandleA LoadLibraryExA GetCommandLineA GetTempPathA FreeLibrary FindFirstFileA FindNextFileA DeleteFileA SetFilePointer ReadFile FindClose GetPrivateProfileStringA WritePrivateProfileStringA MulDiv WriteFile MultiByteToWideChar

user32

CreateWindowExA EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard GetDC SystemParametersInfoA RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx DestroyWindow CreateDialogParamA SetTimer GetDlgItem wsprintfA SetForegroundWindow ShowWindow IsWindow LoadImageA SetWindowLongA SetClipboardData EmptyClipboard OpenClipboard EndPaint PostQuitMessage FindWindowExA SendMessageTimeoutA SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA

advapi32

RegCloseKey RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegEnumValueA RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

CoCreateInstance CoTaskMemFree OleInitialize OleUninitialize

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/System.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 3b6a5cb2a3c091814fce297c04fb677f72732fb21615102c62a195fdc2e7dfac
MD5 cf85183b87314359488b850f9e97a698
SHA1 6b6c790037eec7ebea4d05590359cb4473f19aea
SHA512 fe484b3fc89aeed3a6b71b90b90ea11a787697e56be3077154b6ddc2646850f6c38589ed422ff792e391638a80a778d33f22e891e76b5d65896c6fb4696a2c3b
SSDEEP 96:3IsUxO9udx4qYp7AJb76BykUbQMtHUOA5Iv+RnsrqeXV+d1g2IW9t2c+cEwF9oug:YVL7ikJb76BQUoUm+RnyXVYO2RvHoug
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

9922

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Flanged.jpg

SHA256 46448c5ba5eac738d347757fe1ed5f3594d8056aa74adc41f635c0aebb652e45
MD5 3ea7d423eaf43b499138920ed5914c5f
SHA1 a84001fd0b80c1b9d73b03e7101c552e0eb8d0de
SHA512 a69a44a5976bef88afc4d6bcd2c84d56655eca0feb3f7049e2449ffe1ac312e30ad62070ff88cb39dd94ef6f74fb165c40f9cce01b52df32642666cda4271e2c
MD5 SHA1 SHA512

NSIS installer

installer

Lajkas/Staffagefigur/Barselspatienters/kursussgendes.ini

SHA256 40e2bc57c5fe46d96781255b65349c70c48743f2c408435697a380943d0ad405
MD5 73d44d9fe658e156209a22b385d50ad3
SHA1 495bb1aa1eee7a36d2141912b2234a9884ea11f6
SHA512 599db945571b047308347bebfd715e3671cc962d2f4163f6070671bfa234cc1fe4baf3f47031f7853e08fb7b8988843bf0e145f89f553b34446b14f7642a6fff
MD5 SHA1 SHA512

NSIS installer

installer

Lajkas/Staffagefigur/Barselspatienters/modstningsslutnings.pre

SHA256 7b471f78e8a3ecbe9456378d995bedf164e5712e762f046dec09e8e9a0dcfb8c
MD5 be1b4cab29864afbc06a520272fa265a
SHA1 57a75b4d4b7d940a77ac8b700724d5c16eb7bd3c
SHA512 39a677a55edfbe62c6bdcdf9a466dbdeda333f2ae80cc25a4a8a5a1f94c1d2340196e6f7824002ecfda368c2ec57fe983065df54ec89459b9d2d90f09ab6fef4
SSDEEP 1536:iuJvieyW3/5OI4havrJuFw35rSpIsOEzU9suAVDwk9EOmo3P3pQAoTc6XcEeboR7:p4M
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Lajkas/Staffagefigur/Barselspatienters/ned.ini

SHA256 89da4d13eedf0d1128752be5993608a45d8b1d3377ce852cac6938c0514f7952
MD5 46d760ff5d80888a54a38d5bd968c3b9
SHA1 074ffba863941492da6fceb711fc6f6d49884d62
SHA512 5c1429bc19c1c154a746ba09376d35293b60a4f95196db3acbbc738d4f3a65c93fc67bdcfc4d15db5485d4bf8cc7bddd8d93c150e2760c88b1bca8aef0cb27c8
SSDEEP 768:/olVQBCvzurDuxHWQXoOKbT3KUgVuM5qBWosqI//oKo:/cVQB7/4Hu/vsucojI//oX
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Lajkas/Staffagefigur/Barselspatienters/nutcrackers.ini

SHA256 cd8d35482e6a73ab18d0c231faf509531427b9b968248b32ca727714c84ce496
MD5 a9da2674fe6be2898c38847de446fb1d
SHA1 9aa0c0dcbdd0f559cb91091b963658dfdf464d43
SHA512 d9d693685cd00d2e397464ef09ee71d09827abf2d017015a4a7802f665c98929e055d9910ca8c9a44c06bb840b6ce34db89f1148d70b0c72229b346028a85810
SSDEEP 768:/olVQBCvzurDuxHWQXoOKbT3KUgVuM5qBWosqI//oKS:/cVQB7/4Hu/vsucojI//ob
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Lajkas/Staffagefigur/Barselspatienters/oasean.txt

SHA256 ee56de39c1aa0137160e911ad2811a5d475bb88514a00fe896f4adb0daf63097
MD5 e90cf0cb7d1fed32a31a510e45e61cf1
SHA1 2e38c8b6f74aab55763f65642b7161d039f017fd
SHA512 f46ddecc7b99b3750d6425ca81461083316bb6a197071e445c5ec7e43966cd0b31fdeb2bc350f8e2a3b7e333b653852d32cedb1eb8940f3acc942b0ccf2c5de4
SSDEEP 768:/olVQBCvzurDuxHWQXoOKbT3KUgVuM5qBWosqI//oK:/cVQB7/4Hu/vsucojI//oK
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Lajkas/Staffagefigur/Barselspatienters/spndetampene.txt

SHA256 7d248516ebb2fdfe48310c6c191c7cb49fa1d1a5e046dd36793012df89171c47
MD5 029d885111aad24fa05433ba62a4f438
SHA1 9b927686a8462ff12081bf5aecd127931384ef78
SHA512 ea96a566de000e6d3c85904354b954c55058f514ff4e8aaaa6e84c8eea7730aabc4eba026e099c78983c20953a98446c0385ff695da1c5ceac57a55cc4452013
MD5 SHA1 SHA512

NSIS installer

installer

Lajkas/Staffagefigur/Barselspatienters/unpretendingness.ini

SHA256 3f909ad51547a30d5325628c9b7a135ffcea57ebf3638b5d358d361d4b6abf0f
MD5 740280916fbeeea27bb0d31285e050f1
SHA1 019c10f3198c48e0d6db30fb3c06719aaaad60d1
SHA512 afd3cd65040f37a87ea6e4daedafe5b1ce9e727518c85878c38a812d2ed55919c901a74c5ffdc5e31d69b3c2c22741c9664ad2a790acea8136ec5cf6193183c4
SSDEEP 768:/olVQBCvzurDuxHWQXoOKbT3KUgVuM5qBWosqI//oK2:/cVQB7/4Hu/vsucojI//oH
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Lajkas/Staffagefigur/houser.eua

SHA256 9710ad222541868e35201e576f9b82940fd058dda671def1694c2290202dade5
MD5 9f66ef1b27abe52dec26deebaf54050e
SHA1 158a9a5d5d95c72d0b8c94fc87acfe8dc2951564
SHA512 a9d2eea441aa6e24bcbc6b237f51ead082cea8d1e8bcd39f9b413ecd0907f34a2c067603140b1357ce9a4698730b05f5ba5dc1cfe86341dd4071699dcc67d22a
SSDEEP 1536:mTHqI9So3U1JDS9bjBrKZ6i2NcVJ2A6j6y1FV8xixMrEWjYfpruM0Lc/gMQ+QaGk:00Y9v
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Lajkas/Staffagefigur/inarmed.jpg

SHA256 56b9c96eb7bbbd89aab7d4a88f4bb5d6f812e8a927613533363ec945e041b110
MD5 c6f8ca068f395dd94ccf9f5684ed3d2b
SHA1 35c2186355a3861b9ee3e844365ce3dd8b25a8ae
SHA512 abcad7981f51dcf854d08db69660fd95a0755fdb5b7b7d689159d0ce7cc79cc2a8860e08970d440dbffb09f7a3051c22a771317e0057d54131267c960589f51c
SSDEEP 768:/olVQBCvzurDuxHWQXoOKbT3KUgVuM5qBWosqq:/cVQB7/4Hu/vsucojq
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Lajkas/Staffagefigur/kokassen.ini

SHA256 a712ca61b32808c5a568ddcd75f90ffb48e2c14320ecf56fa0ed97cc41cdae13
MD5 cef032fd7be6663d613caccc3b55e8ad
SHA1 6731331eba93aebf00130113f381825144ecf01d
SHA512 948b2ea789be41f71164e97279b8be498e13bf80564535d1e23a6968c4ceeee4e3c3ec6e2f60357156d253eda997ed489a84b748bc780586251f9c40d7594555
SSDEEP 768:/olVQBCvzurDuxHWQXoOKbT3KUgVuM5qBWosqI//8:/cVQB7/4Hu/vsucojI//8
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Lajkas/Totalsaneringen242.txt

SHA256 724c031992a4f4efd16f1765d956fc8b8f70e2ff0e66e521bff693c7acfec5e9
MD5 ad4baf3f4d32371e93f7e0423e950480
SHA1 c40f7755febd99ae87293d4a17504a49f4570344
SHA512 8116800a786f6478becc048ea1eae9e970b87713f314a75e2d75cfdc93ef4c56cfa2b302d82a3c81e08765ee72c45d8cc6ec04f754e4424d360d0619071b398d
SSDEEP 768:/olVQBCvzurDuxHWQXoOKbT3KUgVuM5qBWosqI//oKW:/cVQB7/4Hu/vsucojI//ox
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Lajkas/Verde.att

SHA256 e2fecb9b956353c36546c6f44ca921d44781c21f0de317157491d7a397b3acec
MD5 2e37f43945d3b68f417027432096eab0
SHA1 0f2e625ac9f1c89705ee39ad5d44a99ef2961ba7
SHA512 06f55697ade85f369cddc2e0bbc74b6af84f4093bdcac7088760d60dec50bd740dc7128a6bf0b1e54229bba17ef140e01161ad6cfa8e9566cf93d7444737ec1f
SSDEEP 1536:iLm/5NHAqGnZD88V8u1cmlR1V8Juws39WUkNumP5/Ad/hxzvacon78kAtGCda8bQ:z
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Lajkas/clumper.txt

SHA256 93fbe70a08e6737722b095bffcf54ddfa7a829de53c918563c29489f6cf04ec6
MD5 d02aeba4ab8a0bac90aecd7ea75f71dd
SHA1 36b81ba760526c1e9a02ad4f395581a880618d88
SHA512 cb1c2003a74feb9b22da03b42f70b3abf737411adeb721074916037c5dcba0b8a3f9bcbff168b1ab1d8b77fa055fde9f8be6ac8d4e34218a3439fef9f17d02a0
MD5 SHA1 SHA512

NSIS installer

installer

Lajkas/dianilid.ini

SHA256 5e409b92d7861a45b605be642c2ae321d67272107bb46af5451f5f40ffac9111
MD5 937845ded42e158e0a2689e744a644c4
SHA1 67222c4908590167a689b440e340fa02bdab90b4
SHA512 57d4524f5e925cf77cd1f8088716356fcba3a9ca613d97ad054f496a707ceaa41782d1ac79c429b2508ce50fa7c17dfc14bd8ff4dc3e6e3928cd28f6634f931f
SSDEEP 768:/olVQBCvzurDuxHWQXoOKbT3KUgVuM5qBWosqI//oKc:/cVQB7/4Hu/vsucojI//o7
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Malermestrene151.txt

SHA256 229cd0b808297559e6c9425985f9dccbbda0a0d6110ff8f131a8e8d469ec7be4
MD5 757f8064442fb9d3ede8cf59d08b2e05
SHA1 c20e734d33fb9498aa23f8980416ffc695ecdefa
SHA512 04e4aeb51580d6a5b4e70ac76ed4db9e54c34045b8ff658df182ab7494afaf96c86965467418a64a4516a8f38a48d855bfc658e041f9d49ae4359b8f1e39f977
MD5 SHA1 SHA512

NSIS installer

installer

Nongracefully.Pre

SHA256 5855910a94644f5e9f286e08c2fbfe60892332b1d15c7174e98da0866eeb208e
MD5 96043b921949fb873008d19933c80feb
SHA1 2f79c5c3fbc5a490b5093dee31be9d1f37357175
SHA512 9d3efeb44d39b0f43ece46f86df0f10e7164fb2b0f2b6e8da2361fcb95d68f6581924f706d3d8811d6fd04d46bb94690e946431c9377af21ae76953e402f8ae3
SSDEEP 1536:l2M9NXDOXV4yeFw9/XFRRA49aXL3r2ZN3OYZhsgFqcIP3dKH9yue+U/Y0bKx/tV6:3kv5qlrOjqZSqhv80B1uRLGIbnEKlk
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Trappestigen/Nsehorns.ini

SHA256 b8fabc110f9d67d169f84a41115d2bfa2829866a0e584bb80e18b41922f812ed
MD5 b9111fe075dcec86914dbe77a269b4ac
SHA1 91843df7b24c6887197342f3cdae26e526b5b123
SHA512 7190d9e71e9df246a54eb42c55cfc304d41d5baf356f59ba3b1d15cbe26c8693a8b7f2acb491e99310f039adab0367c1f7db9327b21c900de8d1a878871e137c
MD5 SHA1 SHA512

NSIS installer

installer

Trappestigen/Serolemma.ini

SHA256 16d3f71cc7bd4695318968a9735642702fc184ad1fbae233630d0cafbb739c1a
MD5 559a73c0083ae01220b205cf539e0c2e
SHA1 a1f133da3760e0ce6b4a9a2b942b4600a76c3a49
SHA512 f7238e299b595b836b13b06d5c26440d79e97c8735b054467c32bfdd89270e705ca5db1af94c2f8bb4a00e1bcf4b1a81197334fffee868ba1d38a419f0375e26
MD5 SHA1 SHA512

NSIS installer

installer

skyllemiddels.Van

SHA256 94b271bed1b4f61d0f7c3d81c9f1e94592c6f211788a4801ff6313cf2bbc5088
MD5 547270bd5cd37382fbe00534c2c60538
SHA1 6962a8e9d336089b6d981def49b69e99b9dcf688
SHA512 a8ad5b5bc401951c416ad03767e27c0b5f51f33f3b6633800aa702db681c6c79bd6f4f451214763737cafb87a9cd407377397d1ad61fa022edfb1b757584a626
SSDEEP 3072:Jia516BYsVy1u81XZX/SMMpv850IIrJvzzuVibRJBnbETtAxPtNwjpPgA8T6:Jia5167I17h/SMMpk50IIlvvuYnhoTiI
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Śledzenie DHL.bat.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Flanged.jpg

Lajkas/Staffagefigur/Barselspatienters/kursussgendes.ini

Lajkas/Staffagefigur/Barselspatienters/modstningsslutnings.pre

Lajkas/Staffagefigur/Barselspatienters/ned.ini

Lajkas/Staffagefigur/Barselspatienters/nutcrackers.ini

Lajkas/Staffagefigur/Barselspatienters/oasean.txt

Lajkas/Staffagefigur/Barselspatienters/spndetampene.txt

Lajkas/Staffagefigur/Barselspatienters/unpretendingness.ini

Lajkas/Staffagefigur/houser.eua

Lajkas/Staffagefigur/inarmed.jpg

Lajkas/Staffagefigur/kokassen.ini

Lajkas/Totalsaneringen242.txt

Lajkas/Verde.att

Lajkas/clumper.txt

Lajkas/dianilid.ini

Malermestrene151.txt

Nongracefully.Pre

Trappestigen/Nsehorns.ini

Trappestigen/Serolemma.ini

skyllemiddels.Van

Sharing

General

Malware Config

Signatures

File Explorer

Śledzenie DHL.bat.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Flanged.jpg

Lajkas/Staffagefigur/Barselspatienters/kursussgendes.ini

Lajkas/Staffagefigur/Barselspatienters/modstningsslutnings.pre

Lajkas/Staffagefigur/Barselspatienters/ned.ini

Lajkas/Staffagefigur/Barselspatienters/nutcrackers.ini

Lajkas/Staffagefigur/Barselspatienters/oasean.txt

Lajkas/Staffagefigur/Barselspatienters/spndetampene.txt

Lajkas/Staffagefigur/Barselspatienters/unpretendingness.ini

Lajkas/Staffagefigur/houser.eua

Lajkas/Staffagefigur/inarmed.jpg

Lajkas/Staffagefigur/kokassen.ini

Lajkas/Totalsaneringen242.txt

Lajkas/Verde.att

Lajkas/clumper.txt

Lajkas/dianilid.ini

Malermestrene151.txt

Nongracefully.Pre

Trappestigen/Nsehorns.ini

Trappestigen/Serolemma.ini

skyllemiddels.Van