AutomáticosAutoPáraPC_patched[.]exe

resource
AutomáticosAutoPáraPC_patched.exe
unpack001/$PLUGINSDIR/nsExec.dll

AutomáticosAutoPáraPC_patched.exe

IMPHASH bf95d1fc1d10de18b32654b123ad5e1f
SHA256 f973cfe37510b144d313faa545954367870d3193e35c8426cfd4553262f08377
MD5 d621f2321fe7f1e24e228ea535951f35
SHA1 b1e9d3c85b172a0b7238d316194b97d15517fb40
SHA512 30df53d5eaff7169689522cd8b552843cbf9aeafd991b82788647addb9e2e24de7f104b382ce487da90d60c133066479803f08a75a0fc991dd47a877fe8934d5
SSDEEP 24576:i0auex4/768v0t7angA5NTjaZ9ewvERjca8rrrRo3MWxsdagI6:iUe47v7JN3aZ90xchrBRWx+N
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

13289

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetFileTime CompareFileTime SearchPathW GetShortPathNameW GetFullPathNameW MoveFileW SetCurrentDirectoryW GetFileAttributesW GetLastError CreateDirectoryW SetFileAttributesW Sleep GetTickCount GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW ExitProcess GetWindowsDirectoryW GetTempPathW GetCommandLineW SetErrorMode lstrcpynA CloseHandle lstrcpynW GetDiskFreeSpaceW GlobalUnlock GlobalLock CreateThread LoadLibraryW CreateProcessW lstrcmpiA CreateFileW GetTempFileNameW lstrcatW GetProcAddress LoadLibraryA GetModuleHandleA OpenProcess lstrcpyW GetVersionExW GetSystemDirectoryW GetVersion lstrcpyA RemoveDirectoryW lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalAlloc WaitForSingleObject GetExitCodeProcess GlobalFree GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW WideCharToMultiByte MulDiv lstrlenA WriteFile ReadFile MultiByteToWideChar SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW lstrlenW

user32

ScreenToClient GetMessagePos CallWindowProcW IsWindowVisible LoadBitmapW CloseClipboard SetClipboardData EmptyClipboard OpenClipboard TrackPopupMenu GetWindowRect AppendMenuW CreatePopupMenu GetSystemMetrics EndDialog EnableMenuItem GetSystemMenu SetClassLongW IsWindowEnabled SetWindowPos DialogBoxParamW CheckDlgButton CreateWindowExW SystemParametersInfoW RegisterClassW SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharNextA CharUpperW CharPrevW DispatchMessageW PeekMessageW wsprintfA DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW LoadCursorW SetCursor GetWindowLongW GetSysColor CharNextW GetClassInfoW ExitWindowsEx FindWindowExW GetDlgItem SetWindowLongW LoadImageW GetDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint IsWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor SelectObject

shell32

SHBrowseForFolderW SHGetPathFromIDListW SHGetFileInfoW ShellExecuteW SHFileOperationW SHGetSpecialFolderLocation

advapi32

RegEnumKeyW RegOpenKeyExW RegCloseKey RegDeleteKeyW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumValueW

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

$PLUGINSDIR/nsExec.dll

IMPHASH 8700d0ebbb41c81ea52718af1ab70a93
SHA256 8165c7aef7de3d3e0549776535bedc380ad9be7bb85e60ad6436f71528d092af
MD5 08e9796ca20c5fc5076e3ac05fb5709a
SHA1 07971d52dcbaa1054060073571ced046347177f7
SHA512 02618317d6ab0302324aae4d3c5fca56b21e68c899e211cfa9412cf73820a1f931e56753c904fd7e510c638b4463aedbfe9536790279e096ea0387b67013e0c4
SSDEEP 96:/Uspq2y5jOEEQrhySvUgfj74/vvrTBzfYZA4YF3Telac1nIq/2:/erjOELhySv5f2vvBjiAflaB1nIq
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

CdnaSupporting/Adapted.jpg

SHA256 2f71e70642775ab6adb07073e286e19323c0409cc01fd001300ad2f540cb5399
MD5 2578dc20150fa3ea16b8516a6d6d19d7
SHA1 aa9d5900b1b4952ffb307c38cab997b018cd25a7
SHA512 791bcf7ffbeeaaeec5de936fd07d2933ba70021ccc24a17b2be329e7e4db6d53e86a77153e0dd4d01b5a0cef766e656be6ce027534170d2b7c3a8545f8a55908
SSDEEP 1536:BoZxelr7NzGwx5VxehnJdFOZEyNEfWopo+ueeiApwb4Rc6sC/m:aXehQwPVxidoNEfWMhenpwbX6sr
MD5 SHA1 SHA512 SSDEEP

CdnaSupporting/Attention.jpg

SHA256 0c3f3023d8ae0e94465fdaa7dafaa321e4010e8cdb5e62fedc3bcb2d03ac47b8
MD5 3951c66527e617d9e4be275db5a5e70a
SHA1 ce9ce57c1c5db3ead5c5cd5d8abe7de94d4d503c
SHA512 3ca0f2cacbd939da0e3611294f3390e84764c4cfcdd6ff40b5b2242e487aba13adbbce70f3140d5bb1ba6814050448429e224e777e9b192c90411fcad1da3694
SSDEEP 12288:CMlZCPbFGBNAKyTT4N9WVr3LCfrSaIOHeW1q61MhDfDk:beIuKyTMvs7LL4ALk
MD5 SHA1 SHA512 SSDEEP

Asian

SHA256 4cb51149b221890d996f0f54ef5465c8ad39d7aab7200cfaf58e978569fb5f9b
MD5 1e6c7a5d1cd87ae5b5912f169d8f1114
SHA1 db85c8b8505eab0fa2c232921d76c9ac3ae36351
SHA512 dc1f6d191c2d5f0baa2557915280992077e1fa3da0dc5f436c7d9d978b61c77fda95aa65f5dd1b60b235ee1b7603cb520c34d8317635417f4d5ab0d5fae657d0
SSDEEP 1536:iel3EYrDWyu0uZo2+9BGmdATGODv7xvTphAiPChgZ2kOE6:ielDWy4ZNoGmROL7F1G7ho2kOb
MD5 SHA1 SHA512 SSDEEP

Biography

SHA256 28bdf43c1e8fbd3c6007a73c0792354c19060883ee61742d955763aa9e90f8f2
MD5 5fa21466cdabd65a9b0dd4023d913665
SHA1 3c3b9ec7752e8a3e80eb73e4c480e34183236eee
SHA512 c022d045d0bb63235c25103dde5febd5e39dc61d8ce4b3e41d3860954543800a349dfd4a026df31ef32fbdf5eb7c6f661e645a75aebe97ec44dd7a9d821eaf91
SSDEEP 1536:3h2zGc/xv5mjKu2IwNnPEBiqXv+G/UXT6TvY464qvI932I:x05mjccBiqXvpgF4qv+32I
MD5 SHA1 SHA512 SSDEEP

Estimate

SHA256 15b6b6ef3d1d67dc0f55532ecb4eedfed299b1a763bf31b4808b47200aae778e
MD5 52c18453e553fa01cc50ee17f9b86576
SHA1 59ce0a75744dfcb6744d9b9b24773874a9ee4aac
SHA512 9ced97e6b513d33a7cf35979e1696f2e5a60ae86340895ec4af7aac4fc3589d425704736480a2ee9b16b51d9cf4756e382e6318114b07c267759da46f4781e46
SSDEEP 1536:DVGHj1vtK7h6R8anHsWccd0vtmgMbFuz08QuklMBNIimuzaAwusPr:9q8QLeAg0Fuz08XvBNbjaAtsPr
MD5 SHA1 SHA512 SSDEEP

Implied

SHA256 78d2580a185908180f044d6cf13501f71cf454f5771030de1b28e4ac0fbf284f
MD5 dacdf05ce39335ef8335a2d623113060
SHA1 a4246f12a646a2b6025a4f653a4ed9ad8531a00b
SHA512 9c84b75304b2b1765e1d839fc2c932d25f24dd5168b26132ffb382ba7ededb8aa396918a907b92a1986f079d60a2516ca64beb04b0669541e66d3ffc61075652
SSDEEP 3072:hZg5PXPeiR6MKkjGWoUlJUPdgQa8Bp/LxyA3laW2UDQWl:hK5vPeDkjGgQaE/loUDtl
MD5 SHA1 SHA512 SSDEEP

Involves

SHA256 48b60b81fe6748a6eeae4da02149487c5c4b1da2bbf87a66d99e811d4dd14090
MD5 d84499dc09936ebb74dd08fa0abf0a10
SHA1 1e00e926cd91330bd881706108a0f0c9f1eacb19
SHA512 bf177f847d622dc11f24ffd5bd656a0b20da025ff56b1f32e28e516d65c368e01e076113664c060e25183389aea35aad8b2586c2d0e6cb4b986e5f5d9c0cd022
SSDEEP 1536:RMmOrrHL/uDoiouK+r5bLmbZzW9FfTubb1/Dde6YF640L6wy4Za9IN3YRYfv2j68:RMmOqDoioO5bLezW9FfTut/Dde6u640K
MD5 SHA1 SHA512 SSDEEP

Nuke

SHA256 6997ef7109bc2968b71230b962aa1c9aab6f451c09ff76e1dcc1f0250d49bb09
MD5 9ed87da65cfe023c06487c98c442dd78
SHA1 b70b7d6f7d342f10e363b973ba42bb3346d47b91
SHA512 202c75f0d61ea341de066cf303a0a914275ab92230b56a723f4514a8b4e622f60e80f83105a9ab43e6ff49a0a8c9e8cdf17388db39a747d9d7e13666ae0dda10
SSDEEP 1536:rvRmLORuCYm9PrpmESvn+pqFqaynB6GMKY99z+ajU1Rjv18fRQLTh/5fhjLueu:rJR8CThpmESv+AqVnBypIbv18mLthfh6
MD5 SHA1 SHA512 SSDEEP

Other

SHA256 6563fd1cd510bca886d8df45eee8552046818a3da1e47411920a6940de7aa2c8
MD5 1926dd986d764b6c844bf1f80a811c5c
SHA1 d5ab7f3c2727e5b73aa48be2a6805e4b7130f9f8
SHA512 2d132a116cf1fe68af3c48667d914fe8d39112c91753c1a9c86307944e04338ee05f23316906e51ca8b9d65d3eada6da62543f45bbcfa50eba4d9fc1750cdf46
SSDEEP 1536:Hr5C03Eq30BcrTrhCX4aVmoJiKwtk2ukC5HRu+OoQjz7nts/M26N7oKzYk5:h0nEoXnmowS2u5hVOoQ7t8T6pUk5
MD5 SHA1 SHA512 SSDEEP

Pale

SHA256 53eb9cca37797d7fc96e5016985cf7b430d52edb5865d245fe63280bacecb8e7
MD5 b8464e69082db440dcab9222606c949d
SHA1 72f49a40792a46f52246c5ed0800e117cc96ee10
SHA512 0d7c2df9ed8383a7ed53dd3271bf3b930bb9adce0a399282273059e518b516b64eef03b54e7a31c89bb2db5e0ffc3c31cd1282ada1cbd24cbb7cdfcaa4ea6d2b
SSDEEP 768:IGKAGWRqA60dTcR4qYnGfAHE9AUsFxyLtVSQsbZgar3R/:pKaj6iTcPAsAhxjgarB/
MD5 SHA1 SHA512 SSDEEP

Shakira

SHA256 96e5980889ce5ed62e229bd97a31b003d72bd1505d862633e56c3f899d74a5cd
MD5 1c83921ee50bc239dd0299ccb2a92a34
SHA1 40fdeed811278737ea48f8618a9d824bb0a93ac5
SHA512 5379db36086c72c1be544039771095e7d291e9b4cc915147406e5cde35dad5b72f8361a088d1ed2d1204810e64c779b9e36b59f07e3c3e35014171bfedb06be7
SSDEEP 1536:u6/sPYcSyRXzW8/uC6LdTmHwANUQlHS3cctlxWboHdMJ3RraSXL21rKoUnx:v/sZydTmRxlHS3NxrHSBRtNPnx
MD5 SHA1 SHA512 SSDEEP

Temporarily

SHA256 0d5bd05403e2fe76fc43a9e775d2914bdad746b615c618c3352b554f8ebcbff1
MD5 feabbfc0079f64af70991af2cc49493c
SHA1 6b9b54e072f7e95a41e98aa2f2b4e3c01dafaa68
SHA512 a8f51c09d3e540133228737a07fa0ff8214dfcccf4c76223cb198a3b225db33acd9ed6e7523e0fb49a68b26d800392503e794ed2563d3fd013976ef1daa13c45
SSDEEP 3072:HOyKODOSpQSAU4CE0Imbi80PtCZEMnVIPPBxj:usiS+SAhClbfSCOMVIPPL
MD5 SHA1 SHA512 SSDEEP

Threat

SHA256 b44e0edb2eedccf444ad8c6eea92c1ab0dbed4322ee988bd51458cd620e3e932
MD5 cbf2b0197a138356d58d6e81d7d36f1e
SHA1 8feca3c2a523b9aebcb748d0bbeb825505fdc6bd
SHA512 8560ea3cbe0fde6ee87a5fa60052903d37036be3fbc1c0bc8147158eb19df72adfdf856c501f16434ea34b9116f9e9392ab22052077d705c696ff0005eb0f6f4
MD5 SHA1 SHA512

CdnaSupporting/Begin.jpg

SHA256 8878148d3276dcb4e5075c36fc95757195c3a6a439b1028565a49b0f39f6424e
MD5 9aaff66172e51a535f660a0e53690b29
SHA1 a18e4fb46c6ed25e0c6f4fb75dc9c30d6f86ffc0
SHA512 ee12afa9f13c8767893b4c857c9c7d05af471e6b3ec464dc570354cbbd7de5d054b028b87da76f691a633f1475648cde9d702aaa313707da41504f210f261abf
SSDEEP 1536:ht19AcxKSawJHnP9CdFtySHVJgpEUZ1+KVybAF:hD9AcxrvHwdFTVJg3gAF
MD5 SHA1 SHA512 SSDEEP

CdnaSupporting/Canon.jpg

SHA256 ec842acf2871aca8cff8dde24cec4df4848178bd7461449d06b595294fe43438
MD5 b68cf4028919f2707d6728679ad1156e
SHA1 62d53b282839beeb2d3b64e15b26d83e425a8f40
SHA512 6693116371a281b667feb4fc7340ecdc439680b45cefab4c96aa155c80c8804bd3f9f8c403cecf571b88011bea799c8e9ff1874e4a089ab8a51c6169ebd4cbe1
SSDEEP 1536:v0YrPQBeyxSNnbAz42jV8ugF1shoXQrYQPD+OpxhBG4i74rHkP0:v0AQsyx6A82jV8NvArfysTBGqd
MD5 SHA1 SHA512 SSDEEP

CdnaSupporting/Decor.jpg

SHA256 c087772aea37b33de5a7096750c9e86bb53ff9efb0019ce0c122de9b6503184d
MD5 6ebaac2c5b5262abb38ff28153b0dce7
SHA1 54a8c0f5050dd6c4fa5a610fac26e9bf021e6198
SHA512 3e2d3939229d962ce8df5f0657781eb7d9c35786f0fbf52865604afd6729468497036fd6e5bf96a631b1cdb9a585ac01d37d85a2aafd818b0d2e129f09dde152
SSDEEP 1536:EkFDlYq0XuZNIZw4T/N4xp4fQ27XNU3wAgSU/zTP2Z8EaD6Efbp:NquZw/uruZNU3wAG/zLhDt
MD5 SHA1 SHA512 SSDEEP

CdnaSupporting/Same.jpg

SHA256 e4066426bf74732f8664d1f89d0f5b6995cf29643693db914f74cc90159f02e4
MD5 d3cd242d9f82724dfc8a3ccb04302643
SHA1 cbcfd332da537b55a9e32f5fc2701106e9b6caee
SHA512 bde8fb5d08d4c97797cf28113e75405fb9a92185fb27cab4cd1997bdab9a3e64565990c715c5eec10c6fa590cdf867d59e8fce145602801376950d053e026508
SSDEEP 1536:Cvp0Th/Db36pvfx3y3yHL3I7lLC3GcAv/Y88guRda5IhOEeduPl8ckzEa6jC99QU:C+1/DbKxxCCr3WlLsGcsA88gtlut8ACP
MD5 SHA1 SHA512 SSDEEP

CdnaSupporting/Tgp.jpg

SHA256 12aef0198d4609a6886cd53e1e4feda7b8dc47a27e0ea815e5cbf5f82ef49f07
MD5 e2b53db52115e15d2b2c5735eafce154
SHA1 a70dd8804417e21e39b0fdc2c64d177badd8f4c1
SHA512 0101fa654b24c21b418a59e4e11787bb134e8ed0fc93f32f273ee62b10cd086b2aa881819a9394b8e706105d0a78252aa5291e93cb50f3d81f2ad387b0bfd1b3
SSDEEP 768:i14yVA90B6UerMpuHjRD3yvhfdMFvFlx6knPlkTqRTc9g:o4yq9w6hyuHFIfqbkilk6+g
MD5 SHA1 SHA512 SSDEEP

CdnaSupporting/Trim.jpg

SHA256 0053811b611179de87dc34e0269522ecff13bfdfdedc9df44fb37fb2322da1f7
MD5 76a5b013d26efc48dbdcd71f8e569f86
SHA1 1a54915735fa15c5f503e38ca8c06822096093fa
SHA512 1efe369460b377c3b90f45b64e990e680dd5142724cb81210aff2c998d7b69e6f8b9bed17ffee6935bf73eec6b1a719866b34df228d00e4ad2e7c660262ccd2b
SSDEEP 1536:7gbHzsSPEKO10BeC5D3o/e61YwAZf0LNfF+qAyg/q6PqcYAGjQoXlV+WEajjBCZJ:7iLOyBJ5Lo/e61IZf0LSY0qcYAGjQoVE
MD5 SHA1 SHA512 SSDEEP

CdnaSupporting/Will.jpg

SHA256 84f7c0d3bf9ede580911051d7f0c4ce04ee4c4524a3d1ebb4f379ee3445a7cff
MD5 e68041c1602f9e2c86e95a7356fe4676
SHA1 5162394327f1549b2b02cbacde748a1268cd4c5a
SHA512 78700cd696f40982cd66d7212ce86ad9fa6921e4cfa253de21c8e0ea7c46e4fccf5098c83db3b6f691a384ab4cbca15643ee3420ffac1a64fcf7d6924c930818
SSDEEP 384:n/SvU0dnq+Uvusj4OUN+4lwjwCqMHiB6riceaUsRUKioyMix0K0QiCo2:/n0dnDUvusjAohjOB6eRwi6Mno2
MD5 SHA1 SHA512 SSDEEP

AutomáticosAutoPáraPC_patched.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/nsExec.dll

kernel32

user32

advapi32

generic

CdnaSupporting/Adapted.jpg

CdnaSupporting/Attention.jpg

Asian

Biography

Estimate

Implied

Involves

Nuke

Other

Pale

Shakira

Temporarily

Threat

CdnaSupporting/Begin.jpg

CdnaSupporting/Canon.jpg

CdnaSupporting/Decor.jpg

CdnaSupporting/Same.jpg

CdnaSupporting/Tgp.jpg

CdnaSupporting/Trim.jpg

CdnaSupporting/Will.jpg

Sharing

General

Malware Config

Signatures

File Explorer

AutomáticosAutoPáraPC_patched.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/nsExec.dll

kernel32

user32

advapi32

generic

CdnaSupporting/Adapted.jpg

CdnaSupporting/Attention.jpg

Asian

Biography

Estimate

Implied

Involves

Nuke

Other

Pale

Shakira

Temporarily

Threat

CdnaSupporting/Begin.jpg

CdnaSupporting/Canon.jpg

CdnaSupporting/Decor.jpg

CdnaSupporting/Same.jpg

CdnaSupporting/Tgp.jpg

CdnaSupporting/Trim.jpg

CdnaSupporting/Will.jpg