𝗦𝗘𝗧𝗨𝗣[.]exe

resource
𝗦𝗘𝗧𝗨𝗣.exe
unpack001/$PLUGINSDIR/nsExec.dll

𝗦𝗘𝗧𝗨𝗣.exe

IMPHASH 32f3282581436269b3a75b6675fe3e08
SHA256 0040cda86058738ebde0150d7ed174aeb24b06fe9c11c17aa41a1385b0a258bc
MD5 fcf115a2c2df78895428fcc07627c264
SHA1 317e7923fb2133218eecfc6c8ae82c5522bd3b3f
SHA512 d191c69fc6049f90cca3970952680d6aca70f2ea58c912c80401684e2bee7de54936496425969d84d8a541ff54c86091a8e158f6bcd5b998575ac8a171469795
SSDEEP 24576:94iTSPWRK+0J9m659CYEDegd2YRL06edUy6UjyUyTTVqpCqVksXVIVj3:ai+ORF0J9mi9CygngjaUys4q2slI53
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

14864

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetFileTime CompareFileTime SearchPathW GetShortPathNameW GetFullPathNameW MoveFileW SetCurrentDirectoryW GetFileAttributesW GetLastError CreateDirectoryW SetFileAttributesW Sleep GetTickCount CreateFileW GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW ExitProcess GetWindowsDirectoryW GetTempPathW GetCommandLineW SetErrorMode CloseHandle lstrlenW lstrcpynW GetDiskFreeSpaceW GlobalUnlock GlobalLock CreateThread LoadLibraryW CreateProcessW lstrcmpiA GetTempFileNameW lstrcatW GetProcAddress LoadLibraryA GetModuleHandleA OpenProcess lstrcpyW GetVersionExW GetSystemDirectoryW GetVersion lstrcpyA RemoveDirectoryW lstrcmpA lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalAlloc WaitForSingleObject GetExitCodeProcess GlobalFree GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW WideCharToMultiByte lstrlenA MulDiv WriteFile ReadFile MultiByteToWideChar SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW lstrcpynA

user32

GetAsyncKeyState IsDlgButtonChecked ScreenToClient GetMessagePos CallWindowProcW IsWindowVisible LoadBitmapW CloseClipboard SetClipboardData EmptyClipboard OpenClipboard TrackPopupMenu GetWindowRect AppendMenuW CreatePopupMenu GetSystemMetrics EndDialog EnableMenuItem GetSystemMenu SetClassLongW IsWindowEnabled SetWindowPos DialogBoxParamW CheckDlgButton CreateWindowExW SystemParametersInfoW RegisterClassW SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharNextA CharUpperW CharPrevW wvsprintfW DispatchMessageW PeekMessageW wsprintfA DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW LoadCursorW SetCursor GetWindowLongW GetSysColor CharNextW GetClassInfoW ExitWindowsEx IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint FindWindowExW

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor SelectObject

shell32

SHBrowseForFolderW SHGetPathFromIDListW SHGetFileInfoW ShellExecuteW SHFileOperationW SHGetSpecialFolderLocation

advapi32

RegEnumKeyW RegOpenKeyExW RegCloseKey RegDeleteKeyW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumValueW

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

Name

.text

Size

29KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

458KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ndata

Size

Virtual Size

708KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

69KB

Virtual Size

69KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PLUGINSDIR/nsExec.dll

IMPHASH 8700d0ebbb41c81ea52718af1ab70a93
SHA256 8165c7aef7de3d3e0549776535bedc380ad9be7bb85e60ad6436f71528d092af
MD5 08e9796ca20c5fc5076e3ac05fb5709a
SHA1 07971d52dcbaa1054060073571ced046347177f7
SHA512 02618317d6ab0302324aae4d3c5fca56b21e68c899e211cfa9412cf73820a1f931e56753c904fd7e510c638b4463aedbfe9536790279e096ea0387b67013e0c4
SSDEEP 96:/Uspq2y5jOEEQrhySvUgfj74/vvrTBzfYZA4YF3Telac1nIq/2:/erjOELhySv5f2vvBjiAflaB1nIq
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$TEMP/Capacity.swf

SHA256 478095b34c9575c9c912ab7f4a09850bfda14b37d520f77fc5712a4cfe03b8a6
MD5 4703d0497dbe41daa5793816fa8ac867
SHA1 5e6c29b0bbdc147166d661529fcd0466ca896b66
SHA512 bad08ba6c03a336684d565b2c5246d3f60cdbf61d6b8b49793889507653ab246810436811ebcf1bc3c23b5bbca52240724f0b26fa9e57f0e306183cbd7eb01fd
SSDEEP 6144:beAvUHADRK5/4rAK2+yhDqRh4bMu8SPWb25W0QpdLVGL5TP1:qaCSaQrN2jBqvNu8oWbWep5V21
MD5 SHA1 SHA512 SSDEEP

$TEMP/Constantly.swf

SHA256 a7970d83fe5d51b656b777cbe307b46016d2f33ff7c6a8de101f3ce0a9106abe
MD5 383effa9644d414063205ee95c146cfb
SHA1 7813c223edf20accac832b4f94fd6b113f95ba5d
SHA512 504f470937ffd0804d27cf093333125814646d48a4aaaccc0a9f885d9769d9b28011758b6f82e2398aca4253404eadec5fdadb3fe3ae4c23ede66a2d900beddb
SSDEEP 768:qDNoKnNInheKbKGL1Fl+4e20i/oePpX8ZvNSF5+Af6/sNrx5LIHFmpENAntPK:qDRnN8kAj+4eDOoQ18ZF0+Af6i2nAti
MD5 SHA1 SHA512 SSDEEP

$TEMP/Example.swf

SHA256 727138f17650563887846240251d034ea2a7cb2bb462e4e972be5d1331dbbac7
MD5 c270e3f590223d318786671d21c10be4
SHA1 494d1e411a6642be0117fa84b169cc59d182991e
SHA512 b65a0189585de1ca322bf6c7d0ecf848c9ca2a605ebb3d8270938d06fab0f774fdde0153ef7c37d3cc2b7d286f0858cadab3116c22617ef0e17dc4ba543af639
SSDEEP 384:FrY7KkW5WDxwWa5vYazCBBJs1Rlm6fxwzCmCN4CI4W/Wx:FcuJ5Wxw/wt4Rlm6OzCD35
MD5 SHA1 SHA512 SSDEEP

$TEMP/Itself.swf

SHA256 9f50c0f16779c2a03a5ceaaa75ec7d208d42aae36278bd5ada88f854b90edadb
MD5 151cf0fa13bec5cbdd028d84966599b5
SHA1 63be88fcb28b06ba91bf63a34176d3696753631a
SHA512 5ca73db392e3fa817fcb90cdcd37b00db2d9eb7cc85e8a40754e9349302a29f73ab3f3a1b0b8685d4642796f7a388113acd1e6ea8a9eeb19be8acd97e7e38d96
SSDEEP 12288:xddOTeQdmk20B6HU13b3V7pCWL41ky8XghoKt:xyTeQd1kSTV7pC4gk5XPK
MD5 SHA1 SHA512 SSDEEP

Electricity

SHA256 cf0e9637b51a25289aa0bc98c059e474a18e4132d3696cd1db8f3bbb78757bf7
MD5 feda320237d34cc5be9992c5fe3a39aa
SHA1 1fd3b959803cb1cd3bd28a4eda1bf13905708b75
SHA512 225497e2a8d9743484b5ee9751ba07e0f4acec59aac96bad957d3af2f83715f3dd6123929a118c5b78d465fc245e89825434a84a33227f1fb8188c6d37edd7a5
SSDEEP 1536:Qaj6bs8jcd/TcI3s+uXkrfhrRj3oh63EV:56OzmkrJrRj4h6G
MD5 SHA1 SHA512 SSDEEP

Figure

SHA256 98a2a2f9b7936dc60abec8433afa0dd8b9cb44faa6ad9f85c1d8727f55c4a18f
MD5 9027502032ed31af8ed561c89cf59526
SHA1 139ba90e12769277138bbc1af5448c7780e6db78
SHA512 52ba40d75376d49ecd4bef82c1614907bb257082b424bd0f72419cfb0c011a35f98e0cb73f2d854979e9845ca07aa08e4dd3266deff7255a301edffec72783c0
SSDEEP 1536:kcUoNghHeqSkV4T2ubSWJKWNJELHW/EJlrZlYi:LlghHzJi2ubSW4wC2mYi
MD5 SHA1 SHA512 SSDEEP

Holders

SHA256 4204d9b3c2c6b040eb03212bd5dd311fd5ea7e03126910baa845eb73d6810488
MD5 543eeb1bbb7a02a9cf93f9d100eef283
SHA1 c0c40eee5c631fe3680f36566c6e2e4c1ee18e6a
SHA512 fdc13bdfd823e8ac093f9a97bcfc63764d7c103ec977cc1a17d3191b419472ab7ac84674eae5f1cf52f036b89a45a15ade951a36e18187f3516f4d0460eb90f5
SSDEEP 1536:zxCCfVYvLutohx6a+A3MDS661CZxbxY/jJc:zxCSVYvlhx6vA3MD8jjJc
MD5 SHA1 SHA512 SSDEEP

Ids

SHA256 b286c881cbba008cff0061a472d3014f0698a25644b1e92367dc4f4ae6a00c42
MD5 edc32154857fab5c5caa0cc22761d9c9
SHA1 97f2f102dbf0017940a449a7a945080e90c1fbcb
SHA512 a28e6783a963d2a8e227b9fe00bd286052b8783b7229f233e6754ca3c3a649c1e4a17ab6b49e85097c609f1021d93e598520a010787153a857539eefd02155e7
SSDEEP 1536:xpAi6JvAeInT3VCLIsLS8ZIjOrOJ0ou3GerIUhj18Ehs5VqX25G5ClCQEiV2XaRQ:xpAXoegz8StjOrOJGGMBwvqXQGYlaww
MD5 SHA1 SHA512 SSDEEP

Mazda

SHA256 c5fe5620e138fce0363c3db640324448850f71158a692e52bd5c37001c16a459
MD5 84f57c90c200cb54d4bd72940fdde8d5
SHA1 b04e20e0b9b1f3a85ca7bf2886b1d05ca4908ea1
SHA512 42820766a1ec14eb3c4dc505f035f6124c693dc615610c953299b257a06c7754845716b38844d7a4c8987ee297753d70743690fa6f7754b83d4bf6e2017c06c9
SSDEEP 768:qr8qcDP8WBosd0bHazf0Tye4Ur2+9BrKHD9OTGQfi:qrDWyu0uZo2+9Br+DATG6i
MD5 SHA1 SHA512 SSDEEP

Pamela

SHA256 754c779f817e5e184b81953629c552db2663de3c97e0659f4136196c26cc1fe6
MD5 3ea1f383f9106b792ac35a7cef7a6798
SHA1 87a8cfc00bd6bde8c96820099fecc94774cfddfc
SHA512 27a19fd196bdbba0fd483475337fe907aae956d01127f9f0dc8fe1b0a35d2cf8aea1d2c35a60202e6a156e24306d4ffaf7f800468c32468e947e38c3fcff7f56
SSDEEP 1536:zoJqvtmgMbFuz08QuklMBNIWPuwaAwu+1P5:zc0Ag0Fuz08XvBN3vaAt+1P5
MD5 SHA1 SHA512 SSDEEP

Rooms

SHA256 1f271c4bfe36de9a30d5b28dc1105bc5384273a385c01cd29cdd43759dd0387c
MD5 0430a033eab2be62c7902f0314d9704c
SHA1 37f421806b165955060ecc8b87d1e643cb1b550a
SHA512 bd683294e2caf5a48ed6b6a46dcec38c271a063bbe55fb20a80834989b4934d9993713986ce1392473ff1ebc6f459b5987331b6ce29c229290ed517f17634f1d
SSDEEP 1536:EYwYwTkNJ3Rpref3ghV1SKOxqNdunCMfu:EeVzOqD1IGu0
MD5 SHA1 SHA512 SSDEEP

Rpm

SHA256 d550aed56ad8d240c3e6ffed001122c40edab381fb67a980adf8a9be8f625a7b
MD5 a5be7213b55c97aff4d98f806d8720c8
SHA1 f56d3cb05234303a223d9c60c05b7f0f967dbec2
SHA512 d4c4e04edd52eef02bf82c02ad75052cb046d9bc14b8a50bdbbb2a6024f8f56969185aecb6fa638cbcb82ee2747b947b7b4d05b0f640552280738ec78f659893
SSDEEP 3072:QpMgKYbwR5Exe2/RTX/4gxRuNkdKF0vYNyet+JQ+HcnkLe:Qfwc7/RTggXuN2KFIyt+e
MD5 SHA1 SHA512 SSDEEP

Soap

SHA256 f4dd08284b13764d73d7ec0a6056130ea622381f48f452f210322ace06ccd764
MD5 3a2ebaea9545bee818c09af671e70183
SHA1 4f7b61ef29443d05c4b393e5943b18a4dfa6449b
SHA512 0cee6b604ed27a6e96ec0270953091d14a3e6c7eb6450c8a355a713d3ee0a3eb1d862ce9f6cf7aadf24057fd7b99830d72a07c242b410d480849c872285143ac
SSDEEP 3072:TBonasL9jC0O2iSW4QlXUxPrCtTRVB4Y3I09JwCIj4BPb1XuE/Q:T8x1WUyB4Y3IW5IuU
MD5 SHA1 SHA512 SSDEEP

Unfortunately

SHA256 3996fecc68f4d3ce186c1bbdf9f4800d08b4d2951586b54f04da0da049b2a304
MD5 36c039c8effd9dec8ac57b3889dd551a
SHA1 269262f3273d36c834b0a2d4828c539e8dac8ac3
SHA512 d7d2e1f730dd987ae2dd334a4c7fd92ba75561fbea09e855da56f5d2bf2cd559d638f34a1e7aae953e5c3fd6e78798cef500a6f6f517525b9b4192a6aa5b9864
SSDEEP 384:R9u88888888888888888888888888888zv888888NfU84444QnoooooooooooooD:z/SGJaGl/
MD5 SHA1 SHA512 SSDEEP

Virus

SHA256 a6b18dc9cbee08f5ce1eab2e4ef0670c11a2db5823e5e80e89521da61e69ca5b
MD5 ff3132a6ee6b28a39a0498a46c1f0541
SHA1 7754010f5e7bcfb476720b54c6375934c0f9d62e
SHA512 28e9ccc409268131788007ba20003e1b3c4a56bbdd5bdab2fd150d432bfa213f97c6a2948fa6b59300d3bceda68abd06b0f21ef86f9d13b06bacaf28c6aae6e2
SSDEEP 768:qXu68cFrPM08smqbe8wab/sFtKJeVnXiAwsCgh4WcnZgLaxXJTyxOf87M4osuwN+:q+68cNk3smxUsb1yAwsc8MxqVbD61HX
MD5 SHA1 SHA512 SSDEEP

Vote

SHA256 b73abeef28c0f0cc7b5eb2429a1c24101bdf63efbb1877d71223aad71610f15c
MD5 d995f06b2a8ed539fc8c98c54bc3089e
SHA1 d5fd8f7b92d8fccc0c0ec68d87ddb5bcb94f0560
SHA512 a82b7f76b0d837db8332aea94a480b89670aab7050f92cc6f2b76d6c3e5cdb42f7f0d6289f135116b4203f7a4391ea2a4cfed3cb9e52f2e849d6e52a9dd84a58
SSDEEP 1536:+yU/CX2CdXibOT0EdQGQ9EtSijtNOKc+48918JsdVCsESNvmD:y/CfXib+tSijpcVMFXD5q
MD5 SHA1 SHA512 SSDEEP

Wants

SHA256 e342a914803c3abe595da497ac3e33271bd2939269fcb98cce5c2f2606ed2f5e
MD5 8605c739387203a5a51fe7e715bd52f2
SHA1 91682610af04e5f26ff94fd4fd4145e345b52df2
SHA512 780496e5012f2f6557decbcc1435873d62960dc879cb78501da57cc224d8ee1b140e00c79c0ebe13eebb1a920830ac340b7f5bd88b7a4010e2ba133645496384
SSDEEP 768:Fz66t4dP+8pN5XvrsY916ojfvSb2Tal0xiVWV9+k:Rrt4dP+iX7DjfvSSuyxiQ
MD5 SHA1 SHA512 SSDEEP

Wells

SHA256 7b6234fad5c8f5d8b2def091d7c3482c274951cf8c87850b3a5289d4250a8f63
MD5 6387117f8e3f08298b5f2227944195df
SHA1 6efaeb0ab31b2787b8cf981b7c7ff2d0758933ef
SHA512 3a2733e1bdf2758c8f1e079df1282c6646894421972bece09df73e33755638944e733ae81d83d1ba30bfc5debaf7f50f34cd01d31505f0af6972b2366fb4bf3f
MD5 SHA1 SHA512

$TEMP/Neon.swf

SHA256 f4932170f3e9a79f3624b1fa290c7d95d5209f9e0a796342dff98c42f3897255
MD5 de33d93585b41fb1bc680ce015743a36
SHA1 142dfff3acc2c3ef42d156f091b9ced208de7646
SHA512 2c4629b4972e5fadc3dcceba6c3f49a5a0a02daa73eecc37e7c3c5f596bfabe8f4c6e98e94e1d4a51c3526e50dd26e30bc29c09222744b8e3c71db4f4fff9a4a
SSDEEP 6144:MZzVVzYdcIijPlARJWfhbWsakGoh/z+m9iGbdaag:MxvrjPl0JWfhby3Aim0qdQ
MD5 SHA1 SHA512 SSDEEP

𝗦𝗘𝗧𝗨𝗣.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/nsExec.dll

kernel32

user32

advapi32

generic

$TEMP/Capacity.swf

$TEMP/Constantly.swf

$TEMP/Example.swf

$TEMP/Itself.swf

Electricity

Figure

Holders

Ids

Mazda

Pamela

Rooms

Rpm

Soap

Unfortunately

Virus

Vote

Wants

Wells

$TEMP/Neon.swf

Sharing

General

Malware Config

Signatures

File Explorer

𝗦𝗘𝗧𝗨𝗣.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/nsExec.dll

kernel32

user32

advapi32

generic

$TEMP/Capacity.swf

$TEMP/Constantly.swf

$TEMP/Example.swf

$TEMP/Itself.swf

Electricity

Figure

Holders

Ids

Mazda

Pamela

Rooms

Rpm

Soap

Unfortunately

Virus

Vote

Wants

Wells

$TEMP/Neon.swf