Procentdelene[.]exe

resource
Procentdelene.exe
unpack001/$PLUGINSDIR/System.dll

Procentdelene.exe

IMPHASH b34f154ec913d2d2c435cbd644e91687
SHA256 1eb25e230346fb5ff10dfd8daad216200205b958046fb2729b8666ba2f18f2a9
MD5 68786837fdc79d05d4d183f7e4dd1546
SHA1 a28c215c0c5c807f05e44063fbaf69526cf7f3b7
SHA512 24af354f735e24ced6c4fa83e72d7a10ea97fefb6b09201b5b2d91b2a5b97d5cace1c44624e06168a81672c68db0fdb0c41b40020beaf7e66967c73002bd0284
SSDEEP 24576:GFMMMMMMMMMMj9sbv93+MEySx9KNQ6SW/AJIoK:GFMMMMMMMMMMjY+MEycKm69/AU
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

13117

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetEnvironmentVariableW SetFileAttributesW Sleep GetTickCount GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW SetCurrentDirectoryW GetFileAttributesW GetWindowsDirectoryW GetTempPathW GetCommandLineW GetVersion SetErrorMode lstrlenW lstrcpynW GetDiskFreeSpaceW ExitProcess GetShortPathNameW CreateThread GetLastError CreateDirectoryW CreateProcessW RemoveDirectoryW lstrcmpiA CreateFileW GetTempFileNameW WriteFile lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject lstrcmpiW MoveFileW GetFullPathNameW SetFileTime SearchPathW CompareFileTime lstrcmpW CloseHandle ExpandEnvironmentStringsW GlobalFree GlobalLock GlobalUnlock GlobalAlloc FindFirstFileW FindNextFileW DeleteFileW SetFilePointer ReadFile FindClose lstrlenA MulDiv MultiByteToWideChar WideCharToMultiByte GetPrivateProfileStringW WritePrivateProfileStringW FreeLibrary LoadLibraryExW GetModuleHandleW

user32

GetSystemMenu SetClassLongW EnableMenuItem IsWindowEnabled SetWindowPos GetSysColor GetWindowLongW SetCursor LoadCursorW CheckDlgButton GetMessagePos LoadBitmapW CallWindowProcW IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard ScreenToClient GetWindowRect GetDlgItem GetSystemMetrics SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharPrevW CharNextA wsprintfA DispatchMessageW PeekMessageW ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow GetDC SetTimer SetWindowTextW LoadImageW SetForegroundWindow ShowWindow IsWindow SetWindowLongW FindWindowExW TrackPopupMenu AppendMenuW CreatePopupMenu EndPaint CreateDialogParamW SendMessageTimeoutW wsprintfW PostQuitMessage

gdi32

SelectObject SetBkMode CreateFontIndirectW SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation ShellExecuteExW SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW

advapi32

AdjustTokenPrivileges RegCreateKeyExW RegOpenKeyExW SetFileSecurityW OpenProcessToken LookupPrivilegeValueW RegEnumValueW RegDeleteKeyW RegDeleteValueW RegCloseKey RegSetValueExW RegQueryValueExW RegEnumKeyW

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 c2f405d7402f815d0c3fadd9a50f0bbbb1bab9aa38fe347823478a2587299448
MD5 9625d5b1754bc4ff29281d415d27a0fd
SHA1 80e85afc5cccd4c0a3775edbb90595a1a59f5ce0
SHA512 dce52b640897c2e8dbfd0a1472d5377fa91fb9cf1aeff62604d014bccbe5b56af1378f173132abeb0edd18c225b9f8f5e3d3e72434aed946661e036c779f165b
SSDEEP 192:eX24sihno00Wfl97nH6BenXwWobpWBTtvShJ5omi7dJWjOlqSlS:D8QIl972eXqlWBFSt273YOlqz
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10178

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Decennially94.Gul

SHA256 08ca4f56e53be3e20d69c41f986b52c5d1f32c1958b15b8c6dcdd1aebe70a5f7
MD5 f4b9d2e7c7c4ac1bbec439f2e936b250
SHA1 f0e85463b25ae387c4c44129ec658f7a466ba30c
SHA512 a7892d4f8878b411c1be3e98669695bd8e32f0ee37030e87bd8ba859a21c523b55e8e0080502fdc928216ae4bf1897af7f6d3aa420560dbaf16a484157f7ca18
SSDEEP 12288:zhYcpfJeuwMe8BEvg23lEsvE4fO8C31C38mVts4Mqpy6gt:zqcjeZiE4oqsvEf8U1C/V+JAy3
MD5 SHA1 SHA512 SSDEEP

Gylper.txt

SHA256 8d0099b720e2da39667c6a215d0151d3392f0e75f800f53f0ec496b0b37bd24c
MD5 5b8552cd00a4b676be95a1be3aa1def9
SHA1 caa6b53974e7a21faed0b467a6363f7f860e8eb8
SHA512 6f6218debf86dbd80cec99f1cb76b686eed512f378d22279416f3d58e675bcbb723d1e74a473b81178af6618302a77d5abce5aa445c89a761261767759105ba5
MD5 SHA1 SHA512

Jenlaagets.ini

SHA256 ab19ff59e0784bfcd84a419c240e08d02a58d7863ac3a7aa1d5c084323c998ca
MD5 d5fa7d016828eebd081b38e5d72c1a68
SHA1 e5da34a79ef826e833c6e44e26c5523d121e8131
SHA512 25a6fbeafed04900a25bf9720f24a0d364797743d49ead79ede5ae0a40e029795e90199d2c7e963a30c61f027f76e2cd0f704afa867edad1a42e5d4b83332a86
MD5 SHA1 SHA512

Monarchy.hul

SHA256 6cb0e00e77993ca755c35e73b70ce2188169b084a304f1b3fbd1aa62272548db
MD5 f0955e545b12943bcb1eda3af938514a
SHA1 e0f997460a54fc513bb7f837fd2f4040e8db56ef
SHA512 b5c99f082c66cb4bde31a02db8d811318f031b7dbc5870477ae7f65f66f0310f735e3177e65297925012ed018300042d5d105eefef4a1ed76788c271a9b4a26e
SSDEEP 384:TblR0c0dCaSyAp9CcemCChZIA/qb4c/En:3h00aSyQwrCgAicIEn
MD5 SHA1 SHA512 SSDEEP

Motionerer.jpg

SHA256 03423dc24efd18281aee6b1832d31c1a4f427fd674396949aa354986d9c510f8
MD5 329882a26f4111ea7cbc5c441b8ac3ee
SHA1 5965b51302402e88da336bb89c14a3ab63268bf4
SHA512 0bca0eb7b0aa140eacb2828c38cdfa85a8865eb9cd70e18327f37c6193e072c72e7c3366f15ed93178db2499e5305c87f9458159cb2851bcd48ab5265556b050
SSDEEP 384:ZY9om9pM65whcMf4cSA6a18Mr+SjaWZ9Zp5oSxjyMp:ZhWM2w+Fk6OrLp5oS3p
MD5 SHA1 SHA512 SSDEEP

Multipartisan.ini

SHA256 69006f33efffcc9f1aa0d310e88f6384c78ea579f341e827b287e29a27a4afce
MD5 13d4896d2e074794dd4e9afecad1188b
SHA1 6ba6139981b56ac0797cbc602705786ffbf3cd93
SHA512 2c2b6594f9324cb5594b2c64b416e0a8ccc0a2f4e0628ec1c5e6e69792a6bf008616822bbc24722e58d2924fa8609a2430a889df93df9f7f0c97f8b461496697
MD5 SHA1 SHA512

Predeliveries118.txt

SHA256 b8c20e24ecffed31994d4a31907d8194002f9cd5f4f82d5689c72c1973f50475
MD5 c1ea0f8789bcfebbdaf4481f5628c1fb
SHA1 16db9ef33cf6ceeab3c4b7bb202dae86bed30a2a
SHA512 2db4e0de763b8814c0acef5bb1d27ead12dc1d5d9fbd3d60381d55e3dea57e0e2e557445a559c0ce2f43f668bf10719badbc5cd79346087d3b9a55eff8077e86
MD5 SHA1 SHA512

Spalteform/landstrygers.unr

SHA256 df86bdccd1a60c99683d0d1a1a4ef90568542c4f53c067bf6e760d87e732b0fe
MD5 34dc476e081672aa71f3c045cd05d214
SHA1 ff575683923cebec61dfc8bc8ea76c06ab31e415
SHA512 a8098e32778d826c1b57f0db45a1e6665fddee6973c462765cca176e294c79d36244ae1400fbfc511720df42f47577989e1ec30fddc1d36414abffdeef62b463
SSDEEP 96:onieyqVd+fRMxkNwDnfjwLwTN3fHfq9kt4R2vb2bhS5dKZcb:9ukZQkCUmukt4ybes5dKZa
MD5 SHA1 SHA512 SSDEEP

Spalteform/mistitles.ini

SHA256 29f54d34d82b18a63263198024ddc8b2b76dca340eb19455d509e6d670322afd
MD5 76b3538a1214f9d3da94ec4774ef1402
SHA1 fddf730180a4fd3a64d2ee5d99d8c4cbc0ab08bf
SHA512 8c42b9a90c2f92019da5acd228b1094ce05f5a23c20dc3ddc9a04d3545ccb86f157e113d03da142ede16674aa79fd66402b3decdf4ca68004ba1dfb8cb9a9de4
MD5 SHA1 SHA512

Spalteform/nonexaggeratory.tht

SHA256 a8748e0cc742af6e9568e07183bf5cd6fd4ea42d7a96e10ed8adda6d7c53f48c
MD5 db519accaced1da383b037c558b6e424
SHA1 e5033bdd977d97b47798f7aa19dcef35380d2e99
SHA512 2f2ac0f62cdfb1fffd7ad0fb5d1f15dc026dca6fd4c3bb9b8fd2b5593d2d19132ea37507cb5870358759c9fb622fc788331d3c263547c8b020e5eb312f8c218b
SSDEEP 48:786vlVd818AGK9FVX7iqSOPUsnGvj4rF8rDGmYecc:A6rAn3fPfGvGGKpRc
MD5 SHA1 SHA512 SSDEEP

Spalteform/releasibility.txt

SHA256 66b2e44eee2710acadd55655e4ea39c4b7095676333f21bee8b5e3250999c3a4
MD5 7974ea062d0815d0c94323a71a5c3583
SHA1 3dda9eb8b965a3fcdf4512d76dcff61187a9a7f4
SHA512 6fa2cf4e95568eff7cacb10d848cdbd5530812a62e23e7d7cd79125b36d2eced109d6a273c393500f7c143834fa8193d0f2d98e323255f8d4889ead6d27e2f8a
MD5 SHA1 SHA512

Spalteform/revaluerende.jpg

SHA256 ddec3ba2b3acda7515eb3e021c6241e7c45681be78d8a242a5a275ad095bd1ef
MD5 a5605286620a2acd752422ff3025518e
SHA1 b74c763633b656fe292d86514c2a17d03ccdbc74
SHA512 fe1b90f4b6fad18fc3709785142df12ee5e4c33f7b3373a5c5bb3cbda602c6617b56a5aaa8b7b391347b3f11b7b8e4046cc5ef333bb6a63f1ff7c50317248984
SSDEEP 384:EkjNqtrYXmSJvcQYWw396Pa8kRjJP2JzQpYzDukgkFG0pXAhKmBn/w:EkjNqtr1SySwAA2JcKzDVQ0pXAhKmBno
MD5 SHA1 SHA512 SSDEEP

Spalteform/shiko.jpg

SHA256 410e71873a1ea83fcacd0fe81d7b581e7739fe675223e82703371623c8681fc2
MD5 df5490859eab6bae5c758f5e4237659d
SHA1 220509170e20f6745a32e1b51a4e8a0e9fbefe4f
SHA512 38b690be9f25156b6209edcd8f61d09504f6fd8db38b4553b08e368d63da271216c74b5382997a888268fb8c27ce524d6438a89a99fb421aba8fd78d2220a4e3
MD5 SHA1 SHA512

Spalteform/srhedens.ini

SHA256 75a8849badd735cebcfb02cc66cc0696833fa292ecddc57e807914090d44f37c
MD5 41158ec30528bcb9a1859c9785f2a64c
SHA1 abe23c8ef70661a2a9494fbd87267224c6657458
SHA512 07241bbd4f93239ec1c24f4e7e00fe1e66208d5312b534f1eb45e8dfc2f29e6fb6ba75f2120aa11d372bf3ed8b8d1606a2137258175e5f4e458876ef42cf86eb
MD5 SHA1 SHA512

Spalteform/submeter.jpg

SHA256 9c063c9c5b7e377ea2c9f025591c560bf111fe6ca9e35a8c6a4428674c1f051c
MD5 65c6fba8ec4d192536406eaeaea90482
SHA1 32b9af818283f497c498435795ffcb138c779b4a
SHA512 9967cb4ce899f40de56d0b8c2a047c54527930175d25f4c411801b803a349d9dcfecd1e89ce329a3f2e643b6f049750ec3c88026cc4c2dc28bce9e49347c6ddf
SSDEEP 768:STNrUte9X4meArfaHWzmjLA3tznfuxNYibheK2tE03mBRY:STN6KDekWod2xJeK2tE0gm
MD5 SHA1 SHA512 SSDEEP

Spalteform/sulphocinnamic.jpg

SHA256 2e5400514026a31d1ed4c2c02ceca6b4bc30b08ed74304fa7e97b07de0a064c1
MD5 25b81c9de54aab30f7305683e52d0220
SHA1 97a7b4c968c0bedaabcbe45efcf7428d98e7d894
SHA512 794c786218eea38fb9e88407920b7bff4e554d69695bae4531dc2cbec2dd501deb9bb64eeb037bf2a93d8272b64b9222e305654576ea8180b99862582b63e8fd
SSDEEP 96:RhYEKUUS2qFhYBboh9y0E0jMh7hCKJroaNOMmDk+LqI1ngw8tHTIS1SQu6QK:LYrv0hvh60WhCKJLOMI5Vl8tHMvPK
MD5 SHA1 SHA512 SSDEEP

Spalteform/trainload.spa

SHA256 1e3e2f83a7dc6cfa283cb6741f23bce811d8685559f4089711a33071e0e2f8d7
MD5 4a65e36b34be3c90bc9c257ffe46ce0f
SHA1 b9163f016bb42f9286c2cf71b663c297d2fb0e72
SHA512 3f5a844fcd8e28c0279e803c6ce55c88962b02354fe16c7c7a151380e17966b68e00f77b275436e8dd6dd63cbf1105328af08683facaa9aef0c55758723e3a72
SSDEEP 192:Tl3qQeVOSz7RdrsfBAlGlkhBwSRZt+rm4soSgb/rLbsragJnNX5jAsBuH:ThCHL7zFV+rVSFOh
MD5 SHA1 SHA512 SSDEEP

Spalteform/udstykningsplan.jpg

SHA256 040dde87c523be8df1c59ccd268e1506a444898603d017c3419839071befb6aa
MD5 d03266902be42ae1c7388815b9367683
SHA1 9b9c044503c2db4d63b5e722418ff1af41d84f97
SHA512 2fef1685da1682bbbdc3247c3ae13069850e69b26cbaf8b8ae71617b6e858aab638a2e2f5d73d88e78d3139699799ddc0588e7a82638aba444171aeb55b2367b
MD5 SHA1 SHA512

befordringsmidlers.jpg

SHA256 6bfe81d2e853d1b3c918de1eeb9f411b8f16fa835a831ebb730c2532bb413edd
MD5 1dab1d099e73bc4ed18ab9216a8050fa
SHA1 acdb78ebdfca6c9d183f2fba6826f82a40532e9c
SHA512 fa1cc5e5d17c0bb5c341f040bb6a38e215e4ec31e88cce40eacc455040536f4f794bb2276ed7860ccab19f477ec4c8710768b5d94dde3d49104a99c2c327dc8d
SSDEEP 768:k6jsJxHZdHAgYM6s6wDzb4WefidBeDBlOqzqO+KTR7D5walvnJhWRKS:kC8BNx6sHDzbtdcDT7zSKTRH5w+vnpS
MD5 SHA1 SHA512 SSDEEP

bobtail.koo

SHA256 036e3b1b591109f3ce04ee676c7c4e608a2bbb1e5d6850f66994046520560dd6
MD5 d6593b4af256ac110688f331a872ee67
SHA1 032f98df56c831b271cbe68acda2248d4f5de54a
SHA512 81db658e08944cb19c1ca3235c82b271ebff4c9b9a39671e8f7c0548c24904dc73cf2401096d7f6ab4e73354e9a8b884449b66fdb959be9d3c09f18dc482c4fb
SSDEEP 384:bKQGwux8ffIK/3nlWdDketxbTijafyi45Gweo:bXUIfIK/lWW+xPFy75GwH
MD5 SHA1 SHA512 SSDEEP

flnseknivenes.ini

SHA256 0a46ccfddadcebbadecd294dd998be6f2cd6832b7f6cae1947781a9a3ccb6d2a
MD5 0502e65c77f02b439134f56267c852a1
SHA1 b44baa6943aa18a088a9692f51d6e5f3db43a6eb
SHA512 736559ced5dc20b5de940b6e97f8b31210e58720c94a5ab14a8f4ef6da674c82880c9878e4fa1bd1836c3a5a3b3a39f3ebf55306d6545af19d0f8be732b85166
MD5 SHA1 SHA512

Procentdelene.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Decennially94.Gul

Gylper.txt

Jenlaagets.ini

Monarchy.hul

Motionerer.jpg

Multipartisan.ini

Predeliveries118.txt

Spalteform/landstrygers.unr

Spalteform/mistitles.ini

Spalteform/nonexaggeratory.tht

Spalteform/releasibility.txt

Spalteform/revaluerende.jpg

Spalteform/shiko.jpg

Spalteform/srhedens.ini

Spalteform/submeter.jpg

Spalteform/sulphocinnamic.jpg

Spalteform/trainload.spa

Spalteform/udstykningsplan.jpg

befordringsmidlers.jpg

bobtail.koo

flnseknivenes.ini

Sharing

General

Malware Config

Signatures

File Explorer

Procentdelene.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Decennially94.Gul

Gylper.txt

Jenlaagets.ini

Monarchy.hul

Motionerer.jpg

Multipartisan.ini

Predeliveries118.txt

Spalteform/landstrygers.unr

Spalteform/mistitles.ini

Spalteform/nonexaggeratory.tht

Spalteform/releasibility.txt

Spalteform/revaluerende.jpg

Spalteform/shiko.jpg

Spalteform/srhedens.ini

Spalteform/submeter.jpg

Spalteform/sulphocinnamic.jpg

Spalteform/trainload.spa

Spalteform/udstykningsplan.jpg

befordringsmidlers.jpg

bobtail.koo

flnseknivenes.ini