𝙎𝙚𝙩𝙪𝙥[.]exe

resource
𝙎𝙚𝙩𝙪𝙥.exe

𝙎𝙚𝙩𝙪𝙥.exe

IMPHASH be41bf7b8cc010b614bd36bbca606973
SHA256 e2ba20a7a72a6d83bde9effedcb28c0afd58ed93584c2ecce5a87dd5a1b27e56
MD5 14b923295431fb3bc23d68de4486e5a9
SHA1 43253d069ea559dc3df23833223a0a2889975129
SHA512 676cef0705f505b65f257cc7931f74d88a417909056c81be33a604910799b3297e6d5c728d38eee2f3b0e2688921a9c93f45f4a1a07bd94b633be440e450623e
SSDEEP 24576:UflgyQbA3RC3s/VmOAdcUUqjq3sofJG6X4Dh9j8Xnvh:EC643s/cfc7qjq3soh4DzIXnvh
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

14511

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetFileTime CompareFileTime SearchPathW GetShortPathNameW GetFullPathNameW MoveFileW SetCurrentDirectoryW GetFileAttributesW GetLastError CreateDirectoryW SetFileAttributesW Sleep GetTickCount GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW ExitProcess GetWindowsDirectoryW GetTempPathW GetCommandLineW SetErrorMode lstrcpynA CloseHandle lstrcpynW GetDiskFreeSpaceW GlobalUnlock GlobalLock CreateThread LoadLibraryW CreateProcessW lstrcmpiA CreateFileW GetTempFileNameW lstrcatW GetProcAddress LoadLibraryA GetModuleHandleA OpenProcess lstrcpyW GetVersionExW GetSystemDirectoryW GetVersion lstrcpyA RemoveDirectoryW lstrcmpA lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalAlloc WaitForSingleObject GetExitCodeProcess GlobalFree GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW WideCharToMultiByte lstrlenA MulDiv WriteFile ReadFile MultiByteToWideChar SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW lstrlenW

user32

GetAsyncKeyState IsDlgButtonChecked ScreenToClient GetMessagePos CallWindowProcW IsWindowVisible LoadBitmapW CloseClipboard SetClipboardData EmptyClipboard OpenClipboard TrackPopupMenu GetWindowRect AppendMenuW CreatePopupMenu GetSystemMetrics EndDialog EnableMenuItem GetSystemMenu SetClassLongW IsWindowEnabled SetWindowPos DialogBoxParamW CheckDlgButton CreateWindowExW SystemParametersInfoW RegisterClassW SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharNextA CharUpperW CharPrevW wvsprintfW DispatchMessageW PeekMessageW wsprintfA DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW LoadCursorW SetCursor GetWindowLongW GetSysColor CharNextW GetClassInfoW ExitWindowsEx IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint FindWindowExW

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor SelectObject

shell32

SHBrowseForFolderW SHGetPathFromIDListW SHGetFileInfoW ShellExecuteW SHFileOperationW SHGetSpecialFolderLocation

advapi32

RegEnumKeyW RegOpenKeyExW RegCloseKey RegDeleteKeyW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumValueW

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

Name

.text

Size

29KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

458KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ndata

Size

Virtual Size

516KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

352KB

Virtual Size

351KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$TEMP/Al.bmp

SHA256 a76ecc85245e6d0b4a040968dfa1291cc456a4989235a993d2d3dfd033545983
MD5 e8b38b5adf04c2423ac6c311079b064a
SHA1 57832f4d49590fadce31fb3e7df25f3a63df264a
SHA512 c2e0f51b8f5121ad93433099aef59b6b66144f101d156b4cdaf7d05f7241bf57b734b99a0e925d293005419551f1856859d4b24ccf86ee5b13c3ad958541ca4a
SSDEEP 6144:PUbVox6VzWCY4IrpNk09rRNPjcSwmqKRtJFw/r1ER2w8bHIPAv7BcQal8yAK:PUb/qBTkEjsMtH0mjxUdc5
MD5 SHA1 SHA512 SSDEEP

Aluminum

SHA256 6bf4bb1b11dd9cb31833b8941b0b7e61b92cfac7f0141eed6ada09fb94a4c4fb
MD5 9b479189400975474b7e457862273570
SHA1 61f6a401dc8245072b731332f1329a5b53474810
SHA512 3c97e393be2634e77d391f5ef3573d87c2044a1b98bfc12c7d2c837efc1d079192389f7bac956610d6ac81eb803ac94d5f78aaa091d7df61e8cfa5375975d51a
SSDEEP 3072:3BxT/sZydTmRxlHS3NxrHSBRtNPnj0nEoXb:3L/sZ7HS3zcNPj0nEor
MD5 SHA1 SHA512 SSDEEP

Attacks

SHA256 128904bcf91b945a59184bc13fc9fc03019634fd26fb6d431dfcdfeb712fe891
MD5 84403f3cba7011dee07acd44ce6bf759
SHA1 745769f3d68ea8e233c819dceb24b4ee8d353703
SHA512 956a0ae7c7c2922dbc1fff64d08610aade28b5ca2b1e6bc03c97d06f049242d9cf6c5d8f504f68cc7367cddfe9cb995e36f8ce92e7d152cf69633bc97101d3c2
SSDEEP 3072:LxyA3laW2UDQWf05mjccBiqXvpgF4qv+3R:dloUDtf0accB3gBmh
MD5 SHA1 SHA512 SSDEEP

Cleared

SHA256 f6011a1a9faaff57cd54b2053e425378c40e699402bba7342deacdd915dc5e80
MD5 ba7818436d5bb2cc24c38700e11cfce0
SHA1 76eb191e97e14ffea57ec62f537346c48fb4365f
SHA512 66fc5fb9a9ff9ea24d4bf45b4008ee2eecbda8cd5869ca93cac99b434fb257c63fefd988ace29b5604093c843e4f2624974b27b251f08a50d598b7785c258b86
MD5 SHA1 SHA512

Downloaded

SHA256 f7f393be2c8dfb2378e3b3c4dfa79c96ede404b021ce40fdbb75de1d84cf0b6c
MD5 3c63e2850f2e1189da53bbfbc279fc90
SHA1 ab1878457be6f2d42e25e876499b09093f75713a
SHA512 f824092049e48d2305da8473c86d419370670ce476655612c86451b5edee27e4b3f0277969645ce7db2694d26456e8f168ac75a3248c1e8426946315c86be488
SSDEEP 768:uGKAGWRqA60dTcR4qYnGfAHE9AUsFxyLtVSQsbZgar3R/OWel3EYr8qcDP83:nKaj6iTcPAsAhxjgarB/5el3EYrD3
MD5 SHA1 SHA512 SSDEEP

Establishing

SHA256 815ddf3e79bcdf848fa133fe2ef77b8ee297ead8d64e6c2412164912f5965d3f
MD5 0c96f3cd47df73e235bad3c97bcd3f0b
SHA1 77f4071eccecd7a33c32888b66a18b91b543ebda
SHA512 dc6fe3ed8aaf97b1835d03246367c0784d6e6b14f8fe449738d40d0c880168da2ccea74f3670733366c881cefe1e42f2dfc1376f0cf8f1abebd951328a0334b9
SSDEEP 3072:8eOyKODOSpQSAU4CE0Imbi80PtCZEMnVIPP:8LsiS+SAhClbfSCOMVIPP
MD5 SHA1 SHA512 SSDEEP

Javascript

SHA256 8eb473b1c6fa200cef55e67cabfbb9375b227ad53b349a7a74c2e2dd18746940
MD5 274c71b18a11f3a2945b23b6c21a95cf
SHA1 379799cba23aefa9c532f52470aeaf90bb155943
SHA512 bdbdc710242aebb0ef200fb8a99e812fae33c0a7cfb4074cb5b3ff2f5b47422c6726def7d796cf7eaa584125acdf6377d572f10aa60e9c9be49ea1342c0f311a
SSDEEP 3072:/hfhnueoMmOqDoioO5bLezW9FfTut/Dde6u640ewy4Za9coRC2jfTm:/hfhnvO5bLezWWt/Dd314V14ZgP0x
MD5 SHA1 SHA512 SSDEEP

Settle

SHA256 06a6764a338fca46f0123c46091ce041d39b3bd681330fd0bcece36801632c08
MD5 59f80003c826493aee17a0d2ef71e7be
SHA1 8b3e87e20de2823ac971533655cbe2c82e4689ea
SHA512 0628952b9008b644e7d32c5cd0beb92f39b288ffa9a962461ba44b497f59d90a4ef87d57f9247da103aa9e252b3159cb89707e6d64c0da085c41635dcbd9bd32
SSDEEP 1536:BAD1EsdzVXnP94SGGLpRB6M28eFvMVpYhWoXElJUzdlDfFgQa8BpDzdV:Bg5PXPeiR6MKkjGWoUlJUPdgQa8Bp/n
MD5 SHA1 SHA512 SSDEEP

Sf

SHA256 42c85e90a58dfadc59ef6806e13431b86dce8f5f5583581c8a1f6f6029e17457
MD5 dc8a20f14ea652fdeb3970ed74dcebbd
SHA1 05ec7c5b117b687cac24710071ce6c0b006d3651
SHA512 66b3e4d66a817aaef9a034753ea7b313aa4bba13df99ae44dbe0eadfa415240b9adfbd9dc2e2ed50c1fc870a33db2996e978e91dc852bf34617920329ae87acc
SSDEEP 1536:F8anHsWccd0vtmgMbFuz08QuklMBNIimuzaAwusP5:F8QLeAg0Fuz08XvBNbjaAtsP5
MD5 SHA1 SHA512 SSDEEP

Whale

SHA256 161c5a4374790c32f5535db191a22e00b6525fbaa2d3d4390f30ee2ed21ad83d
MD5 d6c5a73e13a813f5d2b8848d3e68bb38
SHA1 dadbd4963e5487145f89a539743075b154ee1fb5
SHA512 9221827a2cbb82f595e0b8510e5cf02e0b47715944a0ab04385942efada38caea3536129bf555a7747a4086e1483e151f3f7af669a879da590cc670be1eaadc3
SSDEEP 1536:myu0uZo2+9BGmdATGODv7xvTphAiPChgZ2kOE6:my4ZNoGmROL7F1G7ho2kOb
MD5 SHA1 SHA512 SSDEEP

Witness

SHA256 e796a2ac03ea9743aca56b12af2458c1e6e608d12bc02fa59225c21088a0ccf8
MD5 11125e0e64d2a319a93c1b076e3a3895
SHA1 c9346cc1a7158fb55e42781484d4764068fae06b
SHA512 8120c3e79512a08c7f185ce6e1e7cbe35849ba88016ce2bd9ae0b6b6ad1aa0ab7fffd678af22fe854a994063dbb3d0bf568643e4dbaaa1548e1ef19ba3dee951
SSDEEP 3072:DmowS2u5hVOoQ7t8T6pUkBJR8CThpmESv+AqVnBypIbv18mLZ:Dtb2j6AUkB0CThp6vmVnjF
MD5 SHA1 SHA512 SSDEEP

$TEMP/Root.bmp

SHA256 3a56b4a444e3f172bbfc356e40c3241768c6450397bb981eb8ef22d7a49c07f5
MD5 2fdfbbf77cff01f6d57752ea286ca632
SHA1 d2ef64222ea443c0ae2389fbdd9b1891d1db5118
SHA512 96ae29b78382ba0f422c4719ea424251c694013ad61c470db9a0a2473e86f96f15548b39c85c3b90848f92eb23be88029e3b4d91c25d1663b5c88bd54fc9fe34
SSDEEP 1536:e8vICF04RZppzYHydoMIpQD7X/BIc/n0IIPhyUv:bvIMZjzYSbuQDLWcHMhyc
MD5 SHA1 SHA512 SSDEEP

InterpretedLet/Heater.bmp

SHA256 6afcf69fdd5903cdbcd4a074912b6c9c7bf10f1e9b91ef7a146d316230685092
MD5 2e4223a368ee8645464a28665862b358
SHA1 c9147946f4caec7a597beb28609df1ac58f73619
SHA512 160ec3fd02b6ecbd2035b5952881df25474561fab1a0a2d401109428a46e37eee741ebec0fd1d81d20b3c0037255bac5b1fd0f7c7f7d4f029675e01b66ba0453
SSDEEP 768:aZOepbcA7UXwz+s63Tj+vpda/4ng6Q9Ph629nmD3C3xVA4qUR4mtks:aZnbmPTj+vpPnRG6298UVNRxks
MD5 SHA1 SHA512 SSDEEP

InterpretedLet/Heather.bmp

SHA256 ca1083e92a59299d01e083661125cf84fbd2adbdc442ffd46a84a6c763157b38
MD5 91f3b745bc0e12a062ac03c3702a85f4
SHA1 84d0636fc023c2c06615dff6c737c7cec4b1eb5d
SHA512 5640795600e9a32458d133310a6e2585d49b9fb0063e0832d81f8809a373f0e6e3a6dd1fd76f31d835a6bbf6bd9e083fdee86e54d738511f349a6a4e9be6b9de
SSDEEP 1536:1rM+y+zZfJAueR7ocjzNImFDUXOWeF6CbXLfGmGgzx+iDaVLy9Job36LeD/6cwfy:xLy2xAue+cjBjUXOnFNfGm5V+jym36ir
MD5 SHA1 SHA512 SSDEEP

InterpretedLet/Startup.bmp

SHA256 bbde4745a805923e78d8aeda23ea3cbf23118cb35a4429253e6b010e70d4f868
MD5 710fc3f75dee7d793d3e448a23904587
SHA1 28009b2da20ed26b688f909fc0df1700fdf2102e
SHA512 272250a6b6b8d18aa2ca5543da6175f653046a8c7a7ad8153cc9b9f03ac1b833fc055388690875d78cd8c3daa87ac184626017289d9e07f323b3a16c96ab3d64
SSDEEP 1536:wEmLRT8b0OUkeqZopSuNWpu1JYJx6csPf6wA9BXO1a0+H41lHeZ:wEmLRYbxAqZoRsqw2pA9Byaj4jA
MD5 SHA1 SHA512 SSDEEP

NightlifeTherapist/Pack.bmp

SHA256 cb2b6f46eaa05c6354c2c1978f9a69d930e4e3c55b70a484e03aca804179be3d
MD5 45918458df1fa3e8ec67e7340546caac
SHA1 fca02a5bf542bcdaacdcc8f3b8ddda99c50952cb
SHA512 6c0637ca1411481a5dc49ce375e528f510fd7b8c6f366bdbf1a3ef2a27bb57bb3399fe833836cff5258cc7058b57b395b26e2076ebcd50f9eebf139bc5f4d5bc
SSDEEP 192:lkjeZPm7dIgiS14xR8DDMEAOWCaFNCx0w9yzzQCwvpOh78+h/J1hOQ2yYv:mjeJm5I+47iMEUCTiwwxN7j33Cv
MD5 SHA1 SHA512 SSDEEP

PacksBelle/Assumptions.bmp

SHA256 3a56706f4d9604d2ae0c39ba6ce7d7406fe60fd95b9561e8ff0ce0fde6c82dfe
MD5 3ff967a8f90a60316d6372adb992a6da
SHA1 0607ec263e72d1ad327690bc0d96edaa0d9a7ea8
SHA512 668680cd769ca2ccf7c4bb73650ed95ab0edd3fb9f74555d4702afbde0ae70c3e72734b09581e065a8b47732bc6358394126733617f58f04ff6539c6271d16a5
SSDEEP 1536:kZ6gsajjbhtpbgJru3YsrhL8Lr94oi2/CdCc2HS0+7Cps2/SZxNkhs:rAv/Stbslwr94/ay0+7ePyxNGs
MD5 SHA1 SHA512 SSDEEP

PacksBelle/Reference.bmp

SHA256 795e6a7e95fd821aac55f5c26cbc3e108a68eed7ec7a582d6fae98f3b64edbb3
MD5 34e6c5a3fc7e01e85d42d829740acb28
SHA1 d82aecd2e142a246f42605dd8b33d1d8590f9901
SHA512 4e797a501a06bfedb9be77746bd8828e2580d872fcc391467f9e0b9144404bcd8000851582502aa8df4a26f8507c59a7129bc33359a08380a0fe9b0a15fbf0a5
SSDEEP 1536:Vf+lqbdyc+hHujTGn0Or/I1LD/93z3DoZd:BknaiIx3/6d
MD5 SHA1 SHA512 SSDEEP

PacksBelle/Utility.bmp

SHA256 6d5a95cb9a9b0b922832985b5e83f36b14785a529cf1c3117c39272ee63e92ee
MD5 24e8dbf289942f813f5a446d82fac17f
SHA1 bb027ea17bdb8af91a76a67868199070ca2d16a3
SHA512 9de823e3077e396283ef412ef055405256fab9f847d6fc5442413b30e0d01076b09d74222ec039fb77ef4261393cde6b560471597198e363043856c040bdab9f
SSDEEP 1536:u6MdrrJLCZcRQ8wrJkPahi5HVmkFGGwTc1zK6Hmb1DTOsoyeirP2Fs78lOg/:u6Orr1mcRQfJThFiGGHtK6HK9TOsrei+
MD5 SHA1 SHA512 SSDEEP

Sharing

General

Malware Config

Signatures

File Explorer

𝙎𝙚𝙩𝙪𝙥.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$TEMP/Al.bmp

Aluminum

Attacks

Cleared

Downloaded

Establishing

Javascript

Settle

Sf

Whale

Witness

$TEMP/Root.bmp

InterpretedLet/Heater.bmp

InterpretedLet/Heather.bmp

InterpretedLet/Startup.bmp

NightlifeTherapist/Pack.bmp

PacksBelle/Assumptions.bmp

PacksBelle/Reference.bmp

PacksBelle/Utility.bmp