MG710417[.]exe | Triage™

resource
MG710417.exe

MG710417.exe

IMPHASH e2a592076b17ef8bfb48b7e03965a3fc
SHA256 a56436df8a2fedd2624c035ab834db76f6ee24d636a9a72d5fa4c04f7b0daa54
MD5 66ef84b6805972a29ec37b229201a9ca
SHA1 a0bd886bfd638ad32eaf0a024aa02249a06ee96f
SHA512 ecca6d0cc05d3fabb747a045ca3b6491db136ea1e3a6249b7324841ce118378001a6e6e3dc46ef57f2d7f8efc1f8392bd6fa49a9d08f76f352ed2c5997561834
SSDEEP 12288:2i6dsV0pMDI2RM5Sl96gUIfK/URUiPn98zC/2qvhHWUnHZW9dF/:cckemG96zIfmetn+hWBWU5WN/
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

12960

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetCurrentDirectoryW GetFileAttributesW GetFullPathNameW Sleep GetTickCount GetFileSize GetModuleFileNameW MoveFileW SetFileAttributesW GetCurrentProcess ExitProcess SetEnvironmentVariableW GetWindowsDirectoryW GetTempPathW GetCommandLineW GetVersion SetErrorMode lstrlenW WaitForSingleObject CopyFileW CompareFileTime GlobalLock CreateThread GetLastError CreateDirectoryW CreateProcessW RemoveDirectoryW lstrcmpiA CreateFileW GetTempFileNameW WriteFile lstrcpyA lstrcpyW MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GlobalFree GlobalAlloc GetShortPathNameW SearchPathW lstrcmpiW SetFileTime CloseHandle ExpandEnvironmentStringsW lstrcmpW GlobalUnlock lstrcpynW GetDiskFreeSpaceW GetExitCodeProcess FindFirstFileW FindNextFileW DeleteFileW SetFilePointer ReadFile FindClose MulDiv MultiByteToWideChar lstrlenA WideCharToMultiByte GetPrivateProfileStringW WritePrivateProfileStringW FreeLibrary LoadLibraryExW GetModuleHandleW

user32

GetSystemMenu SetClassLongW IsWindowEnabled EnableMenuItem SetWindowPos GetSysColor GetWindowLongW SetCursor LoadCursorW CheckDlgButton GetMessagePos LoadBitmapW CallWindowProcW IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard wsprintfW ScreenToClient GetWindowRect GetSystemMetrics SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharPrevW CharNextA wsprintfA DispatchMessageW PeekMessageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow LoadImageW SetTimer SetWindowTextW PostQuitMessage ShowWindow GetDlgItem IsWindow SetWindowLongW FindWindowExW TrackPopupMenu AppendMenuW CreatePopupMenu DrawTextW EndPaint CreateDialogParamW SendMessageTimeoutW SetForegroundWindow

gdi32

SelectObject SetBkMode CreateFontIndirectW SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW ShellExecuteW SHFileOperationW

advapi32

RegDeleteKeyW SetFileSecurityW OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges RegOpenKeyExW RegEnumValueW RegDeleteValueW RegCloseKey RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumKeyW

comctl32

ImageList_AddMasked ord17 ImageList_Destroy ImageList_Create

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

Gastrokameraet.Cha

SHA256 9653a0947b897a846b2f955278b84325a5e3267ea9e8dee86496eddca468289b
MD5 d83ccec51bbcaba0f88b67aa85ddf261
SHA1 0dfe7c131dc15260f4b437534b1f175071726c7c
SHA512 5666cc7f05ff52daa1520682a9d8e5a8177c8ad658ac3edfecafe8150028fc45a5e6fcb1a6beb592f2a87ac146043c12b10f4599f540bb7d9a791143b1733831
SSDEEP 6144:U1tB1leiv0N6Ig+Ja4dnPE5wfH1ZxJdVUZUbXINoU7C5+hH4:U1tBPeiMN6V+YAnPKwfVnJwebXvN
MD5 SHA1 SHA512 SSDEEP

Los107.Raj

SHA256 b4bcc505d66a46af9185af84e5472ef5045cf4abfe722207076d34fbf6df40d7
MD5 fd68605dede5dff48ac0498675704de0
SHA1 f1150379e8b26b01329c9af71dcaee0baf3ce819
SHA512 36f1b2ed7cfe46141deef05cc236941363bd2ef54b3e627312f3f81d3217403a65ee4e1c94e6dce3edad99178e1263ab80f5d10b821bbf585ebdfd1b1400491f
SSDEEP 1536:XyhNN+u6AmjiFn3849RlX1Kdwfcdivcr8n:ihr4+nnlKTEUu
MD5 SHA1 SHA512 SSDEEP

Nondifficult.jpg

SHA256 6b8c4253c359ba7f429605330cca16c8d0b5b6e94169119d7d2b48329fde2d08
MD5 2777b20dc5798d21ed662f7aaa3b2668
SHA1 ab907641b2e301eaaba95f5ef0a51cd0ec7819ef
SHA512 349a07d896d8c1d677434aa152d8edee79abcfc637c268f1bae5fe9bc957677ac0e082276a970cc862fa43096eb77cd1bd61636b01815a7e04ce4bcc677ccb55
SSDEEP 192:LIF6nOxnAK5SrD9tf4DaD9a5xzgkVvSG/x2lrSodjPMCwWY+7pLTnvWCB3Ga:MF8ORPcD9tf4WDw5Vv7/QlrSod4WY+hv
MD5 SHA1 SHA512 SSDEEP

Stregninger/cheesemaker.ini

SHA256 9325cfdb6ce6b13beb4fc424467e557cabfd50ccaf61d688eb7f7d2ad9245839
MD5 a83dabf5f5ddf6e857c18fd5392e3938
SHA1 39d277a9d32e87e4f8781191e72692295eff0112
SHA512 0b5ec5c5bfc17d2401a78044feb0f321442dba669c7ed060427c71313c5a6d55605066eacf26deedf03f98412337b933b8c0af5336bcd53a3c9553c9530ccf27
MD5 SHA1 SHA512

Stregninger/forurolige.ini

SHA256 ad32b0f53d19d81040261b91410349e97484c3e573b1c41838639ea183f585c0
MD5 559057e9a32829c8af7ff94ca2ea8bdd
SHA1 a9b9b3431aac80b6e80299ac088d974306266d47
SHA512 2beb6bd54a26aecd694b7015314650d999343b0020e7a774e146e4d23976c25aaaf6bb5bd6e3a2e6ce95295be1e24cdd0893e6183f7a7f2280123b564a1a58fb
MD5 SHA1 SHA512

Tankrverier/grantees.ini

SHA256 e27833882b73a5a13de7916dcb30de9438221da5e460eced1922b4cfa98de27e
MD5 b1f9fe1016abe735554537f1050aee19
SHA1 4d96e924f26bc408abf93d038cb7c4bc344389f3
SHA512 e2bb67d185b7e4bf3827308e155ffd4581c48205dce95ece42c50e5fe08502c6c9bf41dbee17380cfc11a1020570c3ed756f34db551ea1370ce5d7a7e2adeeb0
MD5 SHA1 SHA512

arnold.jpg

SHA256 42bb5013df4ac9ac98ecd53b8a326862e25abe86c8922bb9973a5acdbb43743b
MD5 bdc550ff176914530d76ad2181625a54
SHA1 db237caa47b04ea361a09b2d436743af27a9e073
SHA512 618cab80e30081d98c871a45712ab5cac5c321daac2e9f320221efcd2442003054ffe6013892da183bb51ebb1e10600c2031a34ff5024a68f8179a324df334c1
SSDEEP 384:MHBzvyFQbWX6PgUEEh1RArJSkfQHlad/I:MhzXbWXEerJSkfS
MD5 SHA1 SHA512 SSDEEP

vammelt/maeandrinoid.bes

SHA256 81c9f559b77a93d785afe47336bdc1c10e3082efa63b695f0f766c822b2b9611
MD5 7a409671aed9a1cccaba023e6260d5e3
SHA1 e9a8e5095685d931cfe0f7f41fbd8f2d7163bd8f
SHA512 7d68dc8a032089ece678d774bb1f3731bdc985fb79046ea8da13f618fbfe1a69de1f49f6b7ec6ea746aa9c5e6161cb337e583606d6bcf233598529089ac81ed0
SSDEEP 1536:yubAahfbNfNtC26VNEdFQhdXft+2lVyWMR8:XHhfbNfDd6QTQhdXr0M
MD5 SHA1 SHA512 SSDEEP

vammelt/photolyzable.txt

SHA256 c6d5be95652cd1751aa9b24016943dfb2062a0e7d8555c451ed9f373587d6ad4
MD5 a602a21b58c81218bb58813dba2d0638
SHA1 f8c7684890acddffdb70b372d683652f6198b82a
SHA512 9b91d999c43227bde106406bc12ed2e79c9ad4ae054532b2d45cbf893f891585ca1aecf67886e2f454ed9b8cd31a34e34dc805aa7885a5dd13a0362f515d8416
MD5 SHA1 SHA512

vammelt/sammenslutningers.kon

SHA256 ee444a336b4e03b25697902b05ebe0811e3a3154a4c2fbf26ba5808b4251e1f7
MD5 8b5e318b95b94f3a5b43483c277e78b1
SHA1 753e19dfaa98e0c8cf96ba6c7786a629f366d5b1
SHA512 0d07ac957f3c3d8d7399d2048bc599fcd4aa2167b3464768bb7aa55b4f5181eb138bef8a0d3699ab7db593c5417833cdf23da7566421365509f99a3d0f35fdac
SSDEEP 768:x6hCshizdRPogSquuJXYgAhRv5B2zSBFcZ/VOEZV:sALogSq53Abf2mwZ/VOEZV
MD5 SHA1 SHA512 SSDEEP

vammelt/scratchback.txt

SHA256 c0bae17b95e49413898ddd5b28bbedc4835afbaebd9ca66452be5c53cb2330ef
MD5 72afc97b05952369573d2a726b3c1435
SHA1 e7433b0c4d17f65c81d99c3071d645078103117e
SHA512 93b5db272602dcab10a22b4d57d3b9859ea17043eb295a22417002942ec7d609d6ed25e48523112e5f4406705c3510dc7ae702a3ea13adea79193b915de1c02e
MD5 SHA1 SHA512

vammelt/segregating.jpg

SHA256 a37a56f2f00699e9dc5e2a9a7e91d6df9ee7625aacd3a909c9039301996c1290
MD5 ddd10b7c0045c66b56cda30b2543fef8
SHA1 abef383e1e14c50929888a594903f697e4c2174a
SHA512 91153db83d6836e8e159325761186525d5322b7a8ab89e280828fbc57bcace6123a15a1bf92c5cae561d2b812b9fa16124899d7a95011185336ae1955ce108fb
SSDEEP 768:DeVxdcowHG26vTa7rVOWZucOcCVo4zefyKzqEzXuYWmkDEIxPxQQ:DzLjVOWo6qKuEzGDEIJl
MD5 SHA1 SHA512 SSDEEP

vammelt/sletter.ham

SHA256 accc0e5a136ba7848fb3c970cd54954b8ac6e19e07b32a3edbd5fc113c311d89
MD5 259f3f73b07e97cd07b261d3c905e6df
SHA1 ef6625542e68b1073671b6265ed3211701487352
SHA512 32465eed9d2dea5f09d9c5dbbec323e52f49389e81ef523e3a0a07c2505a117e987d5140cf012850d7512c103a231b3bf0b3608c089a318e026f910789d3d826
SSDEEP 768:bSZbxgg993Mag6de9NVyl/YOF1D7az4WhAlC3FjZv82NwxUfCPvWImPkLV2npIqv:jG0AwSJwJBkOuKzRHexwp5oJS
MD5 SHA1 SHA512 SSDEEP

vammelt/spigerets.txt

SHA256 8af8914014cfde4c2f805cec62a1c0c0e0018c278fd81eed9af85c80724bf1a7
MD5 2c8f61b8ce1674af969a83a71dc377ea
SHA1 e5dbd8e824e9e4bb94e575dd4de4dfbcd85b561b
SHA512 123984731ce6e997dd392a24751793d965f0668b58d8d94ee5f088d5d05ef0d3bcd5048f44b4b48528d6be34e0d828e4965761a91057c9b836b87a50af6273cb
MD5 SHA1 SHA512

Sharing

General

Malware Config

Signatures

File Explorer