appFile_patched[.]exe

resource
appFile_patched.exe

appFile_patched.exe

IMPHASH bf95d1fc1d10de18b32654b123ad5e1f
SHA256 8972f78a13ce283e5e66aa5fda7757883cee93bc9002c456505c1dcfcfbb9204
MD5 9407b38f6c8d6b4afabbc6f597b35e1f
SHA1 ff140526b06570c7172347e783e9053aa37b1962
SHA512 efbe5bc617618df9987417f12ff645684dc170b60d2823be81234c1bb68d6bd9c5bb5a7c807366739fd81cac168bd25e11089badd052701130ba7efc6c8a4a08
SSDEEP 786432:IbGpKdgptIcuhmdBs04e5XBJ9JzXnlhdDUekq6Yf8ki:I4K2ptMhmbL5v9JzXnlhdf6YfNi
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

13311

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetFileTime CompareFileTime SearchPathW GetShortPathNameW GetFullPathNameW MoveFileW SetCurrentDirectoryW GetFileAttributesW GetLastError CreateDirectoryW SetFileAttributesW Sleep GetTickCount GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW ExitProcess GetWindowsDirectoryW GetTempPathW GetCommandLineW SetErrorMode lstrcpynA CloseHandle lstrcpynW GetDiskFreeSpaceW GlobalUnlock GlobalLock CreateThread LoadLibraryW CreateProcessW lstrcmpiA CreateFileW GetTempFileNameW lstrcatW GetProcAddress LoadLibraryA GetModuleHandleA OpenProcess lstrcpyW GetVersionExW GetSystemDirectoryW GetVersion lstrcpyA RemoveDirectoryW lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalAlloc WaitForSingleObject GetExitCodeProcess GlobalFree GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW WideCharToMultiByte MulDiv lstrlenA WriteFile ReadFile MultiByteToWideChar SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW lstrlenW

user32

ScreenToClient GetMessagePos CallWindowProcW IsWindowVisible LoadBitmapW CloseClipboard SetClipboardData EmptyClipboard OpenClipboard TrackPopupMenu GetWindowRect AppendMenuW CreatePopupMenu GetSystemMetrics EndDialog EnableMenuItem GetSystemMenu SetClassLongW IsWindowEnabled SetWindowPos DialogBoxParamW CheckDlgButton CreateWindowExW SystemParametersInfoW RegisterClassW SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharNextA CharUpperW CharPrevW DispatchMessageW PeekMessageW wsprintfA DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW LoadCursorW SetCursor GetWindowLongW GetSysColor CharNextW GetClassInfoW ExitWindowsEx FindWindowExW GetDlgItem SetWindowLongW LoadImageW GetDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint IsWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor SelectObject

shell32

SHBrowseForFolderW SHGetPathFromIDListW SHGetFileInfoW ShellExecuteW SHFileOperationW SHGetSpecialFolderLocation

advapi32

RegEnumKeyW RegOpenKeyExW RegCloseKey RegDeleteKeyW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumValueW

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

$TEMP/Conducting.docm

SHA256 5c005ae7afd586c938fb13ae9911f625fa54dd98340eb1ef2983844ce0a16c90
MD5 96200f432a7b3fade86b7b9d58bcce48
SHA1 806f1b52792d7cb84a4b41f8f1f5a528da4a795f
SHA512 6845839071a3e1eff25dc3eb52cce91cfcb9df4602cb113c0dcc7ece331916d979ff16c9038350de5e784e2cdcfa62f5348f9cd40560de970320f29a6af20f8b
SSDEEP 12288:vYR/DbM9/tpqhIrH/4DAs+ON+XleGv+4My1K:2/DWXqhIf4D+ON+XleGvW/
MD5 SHA1 SHA512 SSDEEP

Address

SHA256 6c308d3229b5641f13adf3e72d5589ebc7d58522b0b6fd29ad9fe68f14ab6d69
MD5 295d4ebf54d97ad604c9f879254ca45b
SHA1 b8ba41dc75940cadeacf74a8413ea8b5593fae68
SHA512 d89384ab6070edf009d54fffa8e0fe57206346776a2264def7b1e7cedf3a3db6fb1c7e4ab6f09e68b1593e08155eae78179cdf4ceebd131f909459f6390252b7
SSDEEP 3072:XDoioO5bLezW9FfTut/Dde6u640ewy4Za9coRC2jfTq8QLeAg0Fuz08XvL:uO5bLezWWt/Dd314V14ZgP0JaAOz04D
MD5 SHA1 SHA512 SSDEEP

Distinct

SHA256 9b80897b79744672f5f803e6b5130b18a47f87fed7235b2e238c9d95984c1751
MD5 0f9e2baf469810b1244de24f61562eb1
SHA1 e5fbb9cd1e43a1fae81a31a71c74f6acbd0a38f2
SHA512 3413ae4b7ea7551f960abf1df30407c6fd1700ccc91b1aa19af6db25a06cd15b71705a1b173473d27e1dd825358179f1429b366cf25325cb5bd416d679bcbe4b
SSDEEP 1536:u2ukC5HRu+OoQjz7nts/M26N7oKzYkBvRmLORuCYm9PrpmEX:u2u5hVOoQ7t8T6pUkBJR8CThpmEX
MD5 SHA1 SHA512 SSDEEP

Guarantees

SHA256 454f08f6fd428e549b85f0b9ac9cc7645b8dc0b0a45c0a176aee655589ba252c
MD5 c25fcaab9c8ca078fb7f699e1617a09b
SHA1 ac5a35253469621c85e9e87c79422d38f6b6ac3a
SHA512 1ddadabd6817f5ef6ca0c125742d74ce8e5102f491fa75da53b881b5c7b3ea4603eed129405c1608fdfb6c40753317df201d41be3801ef7032cd137c2321e7fb
SSDEEP 768:WKAGWRqA60dTcR4qYnGfAHE9AUsFxyLtVSQsbZgar3R:WKaj6iTcPAsAhxjgarB
MD5 SHA1 SHA512 SSDEEP

Passes

SHA256 a714cf775080e4163217342019d071e42377d2431a2a1c0802cabd9ebe8b91d4
MD5 c3c5b9e2266f55c65879a4cac16a9995
SHA1 bd9efed107321a1ac89eb7f03bce6bda8057ccb5
SHA512 37aa2ed24ad32ac3892f6152c4556e3e6fbc71dd2ff9e7534e0f321e88261dc923d41881e628674d919604e32836a413379a02a77f62a82edd0c5c0bd0dd9216
SSDEEP 3072:qA3laW2UDQWf05mjccBiqXvpgF4qv+32eOyKODOSR:7loUDtf0accB3gBmmLsiSR
MD5 SHA1 SHA512 SSDEEP

Performs

SHA256 fc840d61581074226e43c1874b77a13750cd57a0ba899d73ff6124b13a84de2e
MD5 6a211846474d5b4a9a38327edbe731f6
SHA1 678435196152a3dca595077e7eba23a0204b3c10
SHA512 7f884659678ee798582f74283109049f24f7a09bb68aeef1fae0032c5e4ea4d848202408ffe7ff1a8622df4db491c3f24447063c7f4d8c2384299991643805f8
SSDEEP 1536:p8yDGVFE5gOHu1CwCMIBZwneAJu7QnswIPumV3BxZxu6/sPYcSyRXzW8/uC6Ldc:p80PtCZEMnVIPPBxT/sZydc
MD5 SHA1 SHA512 SSDEEP

Period

SHA256 f7080e03fba22423182243d3f9c76d804681e200907c4050e243e3797a27c311
MD5 ac3a0b8ab9c95deb20242a981140abd9
SHA1 fc92fab2e6ba8c0d243bf4953d19b71b6886e906
SHA512 2025870818fc8997f812f27b17ac8b7e9fcb92ee478be60389c6f6b0ed3df2442f68f7ec827a6d000866a236313a0c8359912250596ace056c7f74c9add73506
SSDEEP 1536:X/AD1EsdzVXnP94SGGLpRB6M28eFvMVpYhWoXElJUzdlDfFgQa8BpDzdZPp7HEY:vg5PXPeiR6MKkjGWoUlJUPdgQa8Bp/L5
MD5 SHA1 SHA512 SSDEEP

Powerful

SHA256 ca54c4c41478f79a28d5c797e07f94b577faabf6fff1062f6669233679b54604
MD5 b18a9e486642cc9887339636185572ea
SHA1 944808da4b1ce8c5776f4786d2eff2006d47ad9b
SHA512 ad1266410b1c267aa1c2291b60a1585cebbe9da20d2f0a72fff1c7a06adfc631d4aa7cd60c5cbc1c563b4c46c47ecc109415c9fec039ea1c5e321e99e261b170
SSDEEP 1536:CmHwANUQlHS3cctlxWboHdMJ3RraSXL21rKoUn9r5C03Eq30BcrTrhCX4aVmoJiR:CmRxlHS3NxrHSBRtNPnj0nEoXnmow7
MD5 SHA1 SHA512 SSDEEP

Puzzle

SHA256 68aa8bd38aaa985cae52912e3f8c6e9aaec7569e27ad2e2cd8dbdc19c2da22e2
MD5 5b99b749affe49cfec9c63ff3167dc14
SHA1 fe72ef281ac2651db5e3f8c33c2acfc58bdc20c2
SHA512 96c634fc7122209fc4bd5210f929f098738e7d85d4f93b0eeeb9c22440f4bb715e592dd182716eb19228b296cd0f1fdd43fa340ae3b176acff84e95512d81af4
MD5 SHA1 SHA512

Pvc

SHA256 e6961864fb45f8de59124c41d6bdd26f36b2b23416591eb57a57de3f2ffd6952
MD5 075cd03d6b68ed71ab06e1395052c1a8
SHA1 ffdad8c366b272483f61ec023b6f961be0936c99
SHA512 60218ae65dbc4950e3844894889367a8e73d093715b3d082e22bbd41c2ad4ca2a1183bb519981bb41635a42a77f0d4654892123e0d2bf6487d9664d2e102fd49
SSDEEP 1536:Z5el3EYrDWyu0uZo2+9BGmdATGODv7xvTphAiPChgZ2kOE6:Z5elDWy4ZNoGmROL7F1G7ho2kOb
MD5 SHA1 SHA512 SSDEEP

Referring

SHA256 60185c8a23816cbd6d54465e7659a3ee65849a5d1bea1fdc3dbaf6059cdf461e
MD5 4ff9f6abe9e62054e2abff19ed1845f3
SHA1 60d9a8d2a3b926306af495a9538eafca8b2a9a0e
SHA512 829cb637914d55c1a1891a38e4a5e64110f6cf4cea3bf494a45419844c459e18a0ce98b4b7ec04fe63a8efc5443e2a765a8249f4d5c70aa7dfa3ddd173d28fbc
SSDEEP 768:vduPbOU7aI4kCD9vmPukxhSaAwuXc/mex/SX:vIimuzaAwusPa
MD5 SHA1 SHA512 SSDEEP

Underlying

SHA256 7c076c215ffe35c968cf15dc431230f45a429d7ba7e37ae85176437077f7669f
MD5 ad15ad8add7c396c4bd76c107c7185d2
SHA1 afeaa3edb4e3bf6c3bb57639211bfda2cc2e7baa
SHA512 5b580dfdf38f566b9db4e32b9a42d6921cf382f41ffa32a069601561e2244a6ec50bd3130b570fff3b2af44fad06173ca052326aaa481d15af3db4314b732e44
SSDEEP 1536:Cvn+pqFqaynB6GMKY99z+ajU1Rjv18fRQLTh/5fhjLueoMmOrr2:Cv+AqVnBypIbv18mLthfhnueoMmOW
MD5 SHA1 SHA512 SSDEEP

Vegetation

SHA256 c69331622c4c716e9394666c1112bd8702fb63742ae56c914d68ff42cefe578b
MD5 5fdd6bd298beececb2550ca9acf02471
SHA1 bcc53b7108808691d5aecb69ad8bb3e2d60eb731
SHA512 efd0855258ae37c55fa08df64ac18d0a3b8f80bb492d56902e651cec00cfb549995d58e05a947d6cbbf539b09d1457fe149488aa78adc374fdd2ab19307fd326
SSDEEP 768:TDNFoDu+XdoXSMf17+sVXnQkdFLILu8rbPDmhdimkIXqURPN2mldrfa04VQv7Qfr:3Z+Sh+I+FrbCyI7P4Cxi8q0vQEcmFdno
MD5 SHA1 SHA512 SSDEEP

$TEMP/Excellent.docm

SHA256 5d7a466980cb8b71cb130901bed9c5e1d845f59b1f0e4d389eea4315801fa177
MD5 0d5628d68fd08197bc9d7ece13b9034a
SHA1 60e4a6c1ec0f06561a40c1d919dab0773755db6b
SHA512 58755c85a9c9991cdc1da649c5ee0acb527302df3b738dce80b4b5823e664141e9fd11a8f895b96ce80734211703cab699addbaae2e85b0d463cf0732d16fd1e
SSDEEP 1536:BDeoEsYD+9OhRjPy8/qqoB6puTY+pdZv0zv7mD7s:BDeo/YD+9OhRj6mpoB6pf+pdZsXmc
MD5 SHA1 SHA512 SSDEEP

$TEMP/Sisters.docm

SHA256 a7fa65ceaba7e37558ef89825b4d499596d1801e42a0d78b715786d5c2a0006a
MD5 c85c3755858af3c5fa1b17c4dde239fb
SHA1 a943196499f858f6bdae6a5040cb5618bca33cb5
SHA512 a8d31ba506eca7768f618c8e16ff572d9f8cd1fb35a14938ade2f2be1d2112beed9cca701f459f6c00e37450d8a829df930fd4a470324a4a86daddced10677c7
SSDEEP 1536:kLIiYdM2LR+3a+EhrEerzP762zh1GxI38uvP/f9+DJ+iR3PvbH+b2m:kLIiYh+qJrxT62zcI38uvP/YDJHR3PA
MD5 SHA1 SHA512 SSDEEP

NameEng/Reverse.docm

SHA256 94ffa0ab6c75641adda19b3f6cf53bc16a73e9b3a2f05a0068988628dc7f65a7
MD5 facda68219167a38acb149c0e85c16da
SHA1 ffcd9cb5bd8e8d701b92b48ae1925306defc9b3c
SHA512 eb2ce123c40c349fec999ef0c64411428c5e51994da3b5aaede697cb819294d558873d4ec451414b13c8d0b64c66c2e3fa7e012dcc2b15c6dfe342730389f360
SSDEEP 768:RN0sgCS71spIl6qIcSiwhzWm0st/sPkngYVrdT9dJTIjs:R9qxz6RJ0sRVZT9fTIo
MD5 SHA1 SHA512 SSDEEP

SpecialtyAnnouncements/Katrina.docm

SHA256 2c967e8ac256f3faa5effdb316af1cf291666ab6aaee621b07ae029d8ca58bf9
MD5 6511f098d77dc109488b53cace8db111
SHA1 c0c6bd05767becfbc30a67308c2a596e9006628d
SHA512 ee429155306e97a45c30ea1f94d2619d98ac0cf47ef8e03a9fe10a5a4ae9d9d51c960a50e452e5c8ef517bc2c526b7f99aade565b41922d77be2e28af9c6e0d5
SSDEEP 1536:UZGXrDQhMQ/VdO81qn6ZhApLy9Ehj+s+TDVKAKbat15Ys8P:U8XriMQ/jO8VZ/Eh4BZKGT5YsK
MD5 SHA1 SHA512 SSDEEP

SpecialtyAnnouncements/Operators.docm

SHA256 ccea178ae66b31ac0e185acc71c47c500776c7aebfd674b1c1725ba7eff93820
MD5 ea3d04199dd012d7fce8545e25836a78
SHA1 fb95d8152fbaba9a5bd6b0987dde1b26426d06f4
SHA512 2cc35a579ad16ec4229c57fff6e8fa1a7048ca7b8b4603fe405df28e4badb99d6a81c8b9df1da5ab2e317b936a994e47808b8534633c935957381b5e27a07a51
SSDEEP 1536:rez9rbrUIS3z10qm9lGVbPwgnvBL97kCi7m3XAfgdlxt8w9QAkeUi:UnUI81q9lG1oCrkdS3XFlxtSGUi
MD5 SHA1 SHA512 SSDEEP

SpecialtyAnnouncements/Preservation.docm

SHA256 2ce90e79656cec167082fbdcd05054e6011f6823ad4e0d06bd5307045e67674d
MD5 8ca4beff6aff7c4129ed3a1c7e419b09
SHA1 18e9cf997b8c6a75ef5bb03639a34ea2600cc85b
SHA512 4f0c229c3801e6f13fab231b9d5eaaeee7ff2337e02dcf8fdf61e3afe63b864432c126dfbd8a4655f6d79fadf7efc5495e3b3fc55915476213ae8b5ac62343a8
SSDEEP 1536:7PSHeQQJgLcM9ogsBaKjk318SzRBFJfPo:DSHeTJA19pnKgaSzPF+
MD5 SHA1 SHA512 SSDEEP

SpecialtyAnnouncements/Recipients.docm

SHA256 85e9c2f1047c066003f3bd62b141e627edc369cfa14e489f982ad1f41b75a262
MD5 b96774f4fbaf41fef538f13f13e211f7
SHA1 17a5fd166ae50c4a008c049a5afd0677200a4576
SHA512 1031b59cf8a9ec06ec5cccc1b0436c6038380fed75b71de852616a98d9aa4b03338496f363540863a87fdd8438a2460a01187a127eabde5024bde8483b17c7a1
SSDEEP 1536:3JkrlvAZud6INTukOB8/JvH88UnpkJly/UyH969+:3Al6jd9cJ08Uulu09+
MD5 SHA1 SHA512 SSDEEP

SpecialtyAnnouncements/Tu.docm

SHA256 a599cc839786c2b54ffba36c0edbdeb0c4378c90ff9a952c9aae8c9720421805
MD5 47932724e92c5c8274fff2278bef79c9
SHA1 163bb4eec5f8086a6a99ede107aa25db0130c027
SHA512 71a5e9adad7ae0b59af25732ad9882c6ca2dbef94a9e8aecad220f19a47995c0244b52770213f0f232ac19c1fe9d5ccf393ea150050f37981e097f29fe698c65
SSDEEP 768:Uhd92VB76WO8Fl8xLJb46EL/ZWAyDd1XSk:UB8iHLx1EjGDdtSk
MD5 SHA1 SHA512 SSDEEP

SpecialtyAnnouncements/Vacancies.docm

SHA256 6f31679d60fd8a755a7bab7669185b4ea100671c638bd8c7309313c3b9247ddd
MD5 5339704f2ad1f1260236297e4eda25a9
SHA1 d829ea24b2d51dffe433947ef43767c385241107
SHA512 18544a6ad1868bc93b0940fba9d2c77decad6aeed7ab20e443b76d04aaa2a241b678d78474193c9f925c200c9c7020c5b00f2774a18bfdf27c351fd2f05fa8f8
SSDEEP 1536:h/gIejiFIu6RcjUSV/NrVxTnB1lSSUfFvirIhLHzInorq1XibWPb4/lFRF3a:pgmIu6VS3nHYbFaPor4XiN9jF3a
MD5 SHA1 SHA512 SSDEEP

Sharing

General

Malware Config

Signatures

File Explorer