docs917221433[.]bat[.]exe

resource
docs917221433.bat.exe
unpack001/$PLUGINSDIR/System.dll

docs917221433.bat.exe

IMPHASH b34f154ec913d2d2c435cbd644e91687
SHA256 1a77b488a1800828543b6983bbb531e06bd95b00ea26bc2eeb2994e0f2f60236
MD5 e60a53e87f4f3185b5d64b8f29d09e02
SHA1 51cce01f38c0199e8479caf757919b22de86e3b2
SHA512 3e840c8ce3d43bd7a875c21a77a808e74b87924e05af20603f447afdfe6760842010d16e95119029cf30d3be7adb562c86f12f2e527004c770273a38a77665ad
SSDEEP 12288:nBVdH/vKsFGF3/NCAC7+tVQQqM8HaKl6wLWgJTXrbEusK3sEMkwCp0KD:BnLWv87+RMaKvLWsk0kkRlD
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

13171

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetEnvironmentVariableW SetFileAttributesW Sleep GetTickCount GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW SetCurrentDirectoryW GetFileAttributesW GetWindowsDirectoryW GetTempPathW GetCommandLineW GetVersion SetErrorMode lstrlenW lstrcpynW GetDiskFreeSpaceW ExitProcess GetShortPathNameW CreateThread GetLastError CreateDirectoryW CreateProcessW RemoveDirectoryW lstrcmpiA CreateFileW GetTempFileNameW WriteFile lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject lstrcmpiW MoveFileW GetFullPathNameW SetFileTime SearchPathW CompareFileTime lstrcmpW CloseHandle ExpandEnvironmentStringsW GlobalFree GlobalLock GlobalUnlock GlobalAlloc FindFirstFileW FindNextFileW DeleteFileW SetFilePointer ReadFile FindClose lstrlenA MulDiv MultiByteToWideChar WideCharToMultiByte GetPrivateProfileStringW WritePrivateProfileStringW FreeLibrary LoadLibraryExW GetModuleHandleW

user32

GetSystemMenu SetClassLongW EnableMenuItem IsWindowEnabled SetWindowPos GetSysColor GetWindowLongW SetCursor LoadCursorW CheckDlgButton GetMessagePos LoadBitmapW CallWindowProcW IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard ScreenToClient GetWindowRect GetDlgItem GetSystemMetrics SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharPrevW CharNextA wsprintfA DispatchMessageW PeekMessageW ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow GetDC SetTimer SetWindowTextW LoadImageW SetForegroundWindow ShowWindow IsWindow SetWindowLongW FindWindowExW TrackPopupMenu AppendMenuW CreatePopupMenu EndPaint CreateDialogParamW SendMessageTimeoutW wsprintfW PostQuitMessage

gdi32

SelectObject SetBkMode CreateFontIndirectW SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation ShellExecuteExW SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW

advapi32

AdjustTokenPrivileges RegCreateKeyExW RegOpenKeyExW SetFileSecurityW OpenProcessToken LookupPrivilegeValueW RegEnumValueW RegDeleteKeyW RegDeleteValueW RegCloseKey RegSetValueExW RegQueryValueExW RegEnumKeyW

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 f004c568d305cd95edbd704166fcd2849d395b595dff814bcc2012693527ac37
MD5 8b3830b9dbf87f84ddd3b26645fed3a0
SHA1 223bef1f19e644a610a0877d01eadc9e28299509
SHA512 d13cfd98db5ca8dc9c15723eee0e7454975078a776bce26247228be4603a0217e166058ebadc68090afe988862b7514cb8cb84de13b3de35737412a6f0a8ac03
SSDEEP 192:ex24sihno00Wfl97nH6BenXwWobpWBTtvShJ5omi7dJWjOlESlS:h8QIl972eXqlWBFSt273YOlEz
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10178

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Ciliolate.ini

SHA256 1c1a054a5488315c731e95a967b2ba298c1a0b3a1a49ae1f7e46a520aaca0a01
MD5 f28e7cc6c520981a5327b59c0bb6be7c
SHA1 253f8c7d443ee42e4f026e8158b6d73086a09098
SHA512 251ef09b474613b1065eca153f8875557053f9fa552920925ade12eeb434628fcec63ef156c8236913c6b0251b14653b5d36ce5c3311bfbd8f6b9e2393588802
MD5 SHA1 SHA512

Dita.txt

SHA256 d06cf3ec962ebd9b7c413e63d187a2f12e9e61919f5f62022b06cbcb894f2d17
MD5 0a02734d82ae1a7a78ad67a45f6f152f
SHA1 8915476948e803f6b4b75081b0494b95d71e34bd
SHA512 90e08e3df957e8a7af55c68ee69c4aaeeedb2289a2f3ab37958cedd96bef9a3053b6b50c8fc377ba6bf750fdc49259ff3385896497755d38c08c611eda89a950
MD5 SHA1 SHA512

Imperspirable.Sou

SHA256 7a2d14db7017aeba8343db654c0274fb8ef826a851df8e5ffd96f6f57b771f27
MD5 1fe544f95372371aec912b0c58f1b4d3
SHA1 b960a97d175bc4e6dce7c926e16c0a37fbecb34f
SHA512 73afeb5f899e6a2c7f3ee23046cdec67a35ff0f9d975eedd72becbe7c61feb438362c1d06823b27f17797f3f63b1259047da62dc68d46d7de45200175ebd48ab
SSDEEP 6144:/s3N/scoeF3LxghejmmA+BpdS5UCTpcHaybnVd9ZeXK8ymdtae1q/:/hWLWejq+BphCTpaaG+XKFmdDw
MD5 SHA1 SHA512 SSDEEP

Iodyrite/pdagogikkere.ini

SHA256 df16170744d201ba5b7d0e1477504a22ab0e92b8a68cc8bd3e86f6bdcbecc343
MD5 e418cb1a5e4d47a7eb4e7c2f2c1cd901
SHA1 2f558487073e6933b5235158e7abf9f88e629b76
SHA512 e07a38d50460cc4fe723630383fc14aebc7cf20eb9d8a5e82a3748fc12b2baec839582988e7d2f621575d5df95c7db141b57f40028e294102e3f2c727a86f01c
MD5 SHA1 SHA512

Soberlike.Xxx

SHA256 450a33791ca132b0e7de034fe48a8c74d7be88f8d89b1684a7ed780e4f89ec7a
MD5 d297f4d95f869e06a27c2fcd37a7dd71
SHA1 22faf29d50eefd47c653bd9ff276282f0631e8a4
SHA512 3b03006e913a3d10b1463d6078aef5a2992b032ee8c1b07a3059dca68dd2cc614b0fd12fe5de9396ef437c9c6e8d8a4fe609a33f34fd516e7335ce8e86c6712f
SSDEEP 768:El7t7s3qQKR40y6SqtSsS2lMWenCrS+uxvm+euAQszE39:E3mKxy/2henCrsR7UzE39
MD5 SHA1 SHA512 SSDEEP

Stigningens197.ini

SHA256 17842a5e5b8440f1aedf37d83e8b8ff3d94094d6b1ddc4f9f1aed1910868ec1e
MD5 2daae4c6f0be9ead35c1c12c522f2b92
SHA1 9e8534f2d51f0cf35c9b68e0b3db2f1abd6529b4
SHA512 37a7a43270985e70bed5d7e0aa3edf0bdbe16480fe5d98b88a68f1bf129a3a2cd860bcbb34f49f8e79a23f275cbe5b8174301a257371c595a417d94d863f5645
MD5 SHA1 SHA512

Umodent.jpg

SHA256 a95c381738acc40cd72f2f1ba982b48ab695eca4034eb7c5b6241b2339fdc931
MD5 6f148712e845b1f194a43865178db1ec
SHA1 8e77b7daf719fce5bcc66407cbc4fb996c14ce98
SHA512 317b7ab111c9182d0cf083a8077bb2c270d5d04c31f8df73a2512564c5661ee2c79f4527578eada90ccf78996ba20a97c48ef929b66d7e563a4248b3c9eb3c59
SSDEEP 768:16W51Jm0R6tsquIJibrjixM423Wh6vaSHDi12FhruNd31NDZUZF550+Jfaaz:16WwGPqusibTWhcTHDi12n4dFt2Z75dt
MD5 SHA1 SHA512 SSDEEP

centralvarmens.jpg

SHA256 3b71f4ca9978e24649c79621059454e00cfc01832f1aa7378f63a9e2507f4c9b
MD5 44aac8481bad03a0f82cc07cb2410d51
SHA1 abdc0dbc17d9da0cb41c7dabbfe23b13e05c9432
SHA512 86e01df080cb92745c24b6936e24ebdbf42c64cbe6995b5634d7c06d385dbbe97e61b5b4724695e89c04c28c4fbd688384e2d64cdda1fe954b7564ed02eb6760
SSDEEP 96:RhdEvUy/IRn5h75T9p9vcdnzprf0kFieVGva8j3bx667oxXBQf3UgatWSUtwfs:LdA/IRn/Xp9vGr/Uva8/467Btwfs
MD5 SHA1 SHA512 SSDEEP

emberiza.ini

SHA256 89dc5d9ae1e1bdf9c48b623d14db885e8dcc30da2708599fb1a2acb5ba4690d8
MD5 5b98b19b7b13c8cc48c49512babd9125
SHA1 c2e7be2542874060945f7353f40004d0a173276a
SHA512 5a13c94880fed9df4b661fbaddfe570476e9b4e6663fe6448b01305a027ac75444bc979c83780c71aa01182e2c92cd0dfb5c05cf42800c09963fd782f8beb447
MD5 SHA1 SHA512

figurises.cul

SHA256 afe043eb1b9b3d1794757057cf5b949cd3d8719dacd55d1224559172d1eda315
MD5 7d068aa107729a103d5fbdc1d91a25c1
SHA1 d4f713c023cdb8746a97c7e200c634ea5fa67f4d
SHA512 befa99fd24a5acff6f7a6ca225a71daf614aaa9d36e92ebcb67470bba8e3028e05b4cf18f42740ee392da6a1290752f8063942d2adfde0f26a062993708f2d0e
SSDEEP 768:WMOAzUmb15jlpL3OOgKSjG88O/VzbKd00HUozGypqv+1V42R3gkg3LjPMiq9do6A:DumFiUawA6Asm4YCHBRtW8ZY
MD5 SHA1 SHA512 SSDEEP

forhandlerstrukturernes.txt

SHA256 9093d6fbab768319195e72a010b5ac40ed2223c17263b6ea39edcf52a90b4d9b
MD5 23a35cf2b6426df941a9be34aab5b63a
SHA1 b31d13de0e0feff9b3e108ee2cd31b1fb6b5ece1
SHA512 a7e6ec1ef986dce7ecb0b3b6dabebbd1b463b1db2055cb84f9664d14303a2c5f12a3f8ebc458538e0ff4336f6cd467d6f75a08000c24c3cf75e461ea5ab4ffd3
MD5 SHA1 SHA512

genuin.ini

SHA256 56f7391c3ff798cec93fe47797540afcc0360eaba14ff700b1ca3578346c0152
MD5 29217d90cd853bee2a4b507593f58413
SHA1 c8c753042db9665dd635adedf7196ff7dfad3d9f
SHA512 b03f34beb2904baa02928a1476bdaa184a1015be6b801198e75b2a952252623346b6e716f27e00f8099c57fb1fab4422304f76c28353de9d80dcd8a98ad6aa62
MD5 SHA1 SHA512

kakofoni.jpg

SHA256 1be482aa0ba9f37caa95e66f2840985c7c96543549472e86970cf09e0d0a69c7
MD5 cd4732d1b6071ecb63b9ba880be95e15
SHA1 de254e0517139194b7205be549ed166847ab7f42
SHA512 f8663ae0a718b8968e0657685dc4e5b69bc58e8cbce34256bb3435005a26e9a6e2d12b41d4f6917b5a1cc3f0ef5acdb11d10676ae3c18fd601055b552155944d
SSDEEP 384:/w1aloDE25T5yS7PQZqPczFaTWel5bzSLexGmw:/iaCjJeqPqFaT3XSLeQN
MD5 SHA1 SHA512 SSDEEP

lepidodendrid.txt

SHA256 a82b0200b36d3460eda938c7895c4b52868c925515614cfe46279f3efdc19374
MD5 a49e1b9c2bfb7ab99afd82a3cd9a2e17
SHA1 e51c49c5d79cae104eba27448fa019a22642636d
SHA512 8745a528f158ea140f19c68b5b40ab7173640fb01e9a07c465441c9f36a81f464790fc0c289bfef254094512fab8b90c9691062397e509a1f6719880cb1090bc
MD5 SHA1 SHA512

mealproof.aar

SHA256 54475777ec1d914ae06483cedf426404dd675c7fbf2981f2dc423e90cb92312a
MD5 4d33412e9b5bb50bed2599b538e07ef8
SHA1 47d681add7c1912938d8d48eb827500b612671de
SHA512 b833c6b09349cbe521298f59ca52cf0dff37cf86a72d03e84b4531264818ad691104819a496d18e91cc52657f95ca70a9032c7039c17c4e9d490d0b0a2fa1237
SSDEEP 768:mREr1i6rkqMNMKkXm2l1tshmepZdrclATkrAC3L1o9VFs5mcsEQmScU80TPx9YTx:mRSkjNMKf2vm0efTi1ivcFvqMBJ/d
MD5 SHA1 SHA512 SSDEEP

omryster.txt

SHA256 a2a76c85ae6d6e20dc37c14dc239c002d1d7a3083ea4101d38a980ede346f4b7
MD5 6a8f3e14d497586adc0c045980750944
SHA1 10fd756b8cf170b49588182e5ceafd41a343258e
SHA512 e8041efb28171845107b059d16697ae0f6e1304c88a95b2ada9f6958ae15c2cb5f5f0e475170753703ab07d9940b73164d2c3bbfe0af12a5c033bf4ac11c0874
MD5 SHA1 SHA512

stimulerendes/stoopgallant.jpg

SHA256 16f34de1446753d0cb263330f6b555b9631d371fad5aac34f310d6a44327a6f3
MD5 aa156765ab9ee9631c1fd84e0d5a0679
SHA1 4c5287520f30910df965eaef858592d1bb1809b4
SHA512 03458e797a31286720997bcee8bb6a9e839a892aff8114256c6fe9cbd93a085513ae65bd3b722bbcc0168a0b24456f7c3b16855716a6566b3c610ea0e4b0b055
SSDEEP 3072:VofWHqlXORx7AiD9IbvyPD6vLHhkXThrx:OyqlXosKDrshkX/
MD5 SHA1 SHA512 SSDEEP

stimulerendes/succumbs.ini

SHA256 abe4c050525fa3ca13869938ef5b5f6ca4e41e3a0019e1bd8797a98f3312a5b6
MD5 ff4f59480c5022208c9d785a37ef5947
SHA1 799a99e2e8ae079b7fb2b7a2a5004de13b5409a5
SHA512 e87c935ee2778fac1c3922971ab8c40e289d27c98725b963004885daac569acdcf330944de36319f59924650ac805db9c023081d75d86b89767a5b61421b4201
MD5 SHA1 SHA512

stimulerendes/ynglingenes.tan

SHA256 220f435720bfbc6fe3f6c5d4fd6055cfdd820e54bcd63e4c15c4adcfcf319613
MD5 a4f4c9de7c415a5a98f3b876fb4bc0bc
SHA1 559aec43f945e256d443f6e3189366525fe77698
SHA512 6909d72dec9bf2db8b36941c27a409a3aa45decf845706508a971f817fe14b48342152544ddae7619f26041d5fd017c5ce99c8f023fcd2f8bc59d0675be94082
SSDEEP 6144:hxsK+pse84Dr/GszvDARO8M3UZdf5nvIdmWF+WJP8EJBaqbRr7Y8B:hxsK+pse84Dr/GszvDARO8M3UZdf5nvM
MD5 SHA1 SHA512 SSDEEP

docs917221433.bat.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Ciliolate.ini

Dita.txt

Imperspirable.Sou

Iodyrite/pdagogikkere.ini

Soberlike.Xxx

Stigningens197.ini

Umodent.jpg

centralvarmens.jpg

emberiza.ini

figurises.cul

forhandlerstrukturernes.txt

genuin.ini

kakofoni.jpg

lepidodendrid.txt

mealproof.aar

omryster.txt

stimulerendes/stoopgallant.jpg

stimulerendes/succumbs.ini

stimulerendes/ynglingenes.tan

Sharing

General

Malware Config

Signatures

File Explorer

docs917221433.bat.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Ciliolate.ini

Dita.txt

Imperspirable.Sou

Iodyrite/pdagogikkere.ini

Soberlike.Xxx

Stigningens197.ini

Umodent.jpg

centralvarmens.jpg

emberiza.ini

figurises.cul

forhandlerstrukturernes.txt

genuin.ini

kakofoni.jpg

lepidodendrid.txt

mealproof.aar

omryster.txt

stimulerendes/stoopgallant.jpg

stimulerendes/succumbs.ini

stimulerendes/ynglingenes.tan