HomeMpeg[.]exe | Triage™

resource
HomeMpeg.exe
unpack001/$PLUGINSDIR/nsExec.dll

HomeMpeg.exe

IMPHASH b729b61eb1515fcf7b3e511e4e66258b
SHA256 f9e5167d5adced0124cd4149ce339ee0ee2036dfb3bd89484c9feffbf7884650
MD5 c73098893e41026d7d4d7f99f250f3b2
SHA1 92cabdc184a2ce41b97169d16fb66d9fc88f4cdd
SHA512 18449f9e4efd7294e298f175bc2093d04b3f3a4a0410eb4577f425ffad568d0b0cd3cbb636f7dbdfe278b119834033b3a072d4af6494f0efb18402f9c1116e59
SSDEEP 24576:EVDwFklDYgXbcuXUpuZ2jSr3n1SJyDZ17igqatiFj6wml7OdPm2x1YPW3ZC9udhH:EVfHBESr31S4DbgFfNY+3ZbFo1VStYAb
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

13688

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetFileTime CompareFileTime SearchPathW GetShortPathNameW GetFullPathNameW MoveFileW SetCurrentDirectoryW GetFileAttributesW GetLastError CreateDirectoryW SetFileAttributesW Sleep GetTickCount CreateFileW GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW ExitProcess GetWindowsDirectoryW GetTempPathW GetCommandLineW SetErrorMode CloseHandle lstrlenW lstrcpynW GetDiskFreeSpaceW GlobalUnlock GlobalLock CreateThread LoadLibraryW CreateProcessW lstrcmpiA GetTempFileNameW lstrcatW GetProcAddress LoadLibraryA GetModuleHandleA OpenProcess lstrcpyW GetVersionExW GetSystemDirectoryW GetVersion lstrcpyA RemoveDirectoryW lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalAlloc WaitForSingleObject GetExitCodeProcess GlobalFree GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW WideCharToMultiByte MulDiv lstrlenA WriteFile ReadFile MultiByteToWideChar SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW lstrcpynA

user32

ScreenToClient GetMessagePos CallWindowProcW IsWindowVisible LoadBitmapW CloseClipboard SetClipboardData EmptyClipboard OpenClipboard TrackPopupMenu GetWindowRect AppendMenuW CreatePopupMenu GetSystemMetrics EndDialog EnableMenuItem GetSystemMenu SetClassLongW IsWindowEnabled SetWindowPos DialogBoxParamW CheckDlgButton CreateWindowExW SystemParametersInfoW RegisterClassW SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharNextA CharUpperW CharPrevW DispatchMessageW PeekMessageW wsprintfA DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW LoadCursorW SetCursor GetWindowLongW GetSysColor CharNextW GetClassInfoW ExitWindowsEx FindWindowExW GetDlgItem SetWindowLongW LoadImageW GetDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint IsWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor SelectObject

shell32

SHBrowseForFolderW SHGetPathFromIDListW SHGetFileInfoW ShellExecuteW SHFileOperationW SHGetSpecialFolderLocation

advapi32

RegEnumKeyW RegOpenKeyExW RegCloseKey RegDeleteKeyW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumValueW

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

$PLUGINSDIR/nsExec.dll

IMPHASH 8700d0ebbb41c81ea52718af1ab70a93
SHA256 8165c7aef7de3d3e0549776535bedc380ad9be7bb85e60ad6436f71528d092af
MD5 08e9796ca20c5fc5076e3ac05fb5709a
SHA1 07971d52dcbaa1054060073571ced046347177f7
SHA512 02618317d6ab0302324aae4d3c5fca56b21e68c899e211cfa9412cf73820a1f931e56753c904fd7e510c638b4463aedbfe9536790279e096ea0387b67013e0c4
SSDEEP 96:/Uspq2y5jOEEQrhySvUgfj74/vvrTBzfYZA4YF3Telac1nIq/2:/erjOELhySv5f2vvBjiAflaB1nIq
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$TEMP/Atmosphere.vsdx

SHA256 819e36604e5550bb0fc7025667f1f9fd1e18e87862627f18b7f23b401a310b0f
MD5 3648ef7a2eb809ddf1ce3916af06a132
SHA1 af4df2f760c0cddd1c758c76408f3c28c84f9970
SHA512 61dbb7fe33f76b7ab14a0fc7e7462bc78b5b5ed4c3d0d293a9591ce0150bbbc3daf2e6e558704f657627c3209c8b704094800991c31c7e6b35e2f30e60ff065d
SSDEEP 12288:xWIVexiUan3uSowHllPEyrHcoZjs0yviL:xpVuiUaeiln20bL
MD5 SHA1 SHA512 SSDEEP

Accessed

SHA256 0db925cd11829e5e4bee8628ee119f962036fb58b3437957221a8e5fc64e3cec
MD5 a40e3d5d13a7c5f1bf018f4ef4f5b34a
SHA1 5b036c1522d16bc9e858377518a261d79e76fb0a
SHA512 510199b0cb412bcc8d7317bd9a3111407c1c7b30b571883761d9307f8835ecb7a187cd5f52fa9ef1da28f0f414d44de88674016e167119cc692abccbd73a09d2
MD5 SHA1 SHA512

Calgary

SHA256 c472d46e978b0722ae864f7a66a8bfa1ecaeddb53af2bddc293a714c2037cc23
MD5 8a6fbe74115b2930511841451e9f00fe
SHA1 984528e8ecb52fcce7a5fb54cb2a9f69b619e6da
SHA512 8599019dbf7ac1e1022255d587067464bf88824ad2bb85a28ed51bd3410ec46256811c74080429bca35593f0606f94f0857f253c65e36f3d407f8fce90e5e802
SSDEEP 3072:N36sVtT6H04k5h6m/Fy0UhMsqu5OonZkFNrsjeiw:t6snrZ/FfUhMsqu53mFxsjeiw
MD5 SHA1 SHA512 SSDEEP

Centers

SHA256 f0e3125db75399342a83e76b91103451a67c2c6fabe6f1103a7470c0daf6d919
MD5 e8376f02fcf285ff6d267f8eeea31705
SHA1 6b52639c4ec373d444c5874cad48814c7ed880cb
SHA512 e1a3e516f95bae3e4bd6ccc791b47e43a8789fe7dcdf43b4ab9a4e960a42df174d25b3eb23b80092be5ed73d98f853a99eb47d107ac3dabe0b9df75bc47b1806
SSDEEP 1536:R1iNBTCUXIH42r7snyuXG5egqzIU15AG73prFCtNwFqGqUqHHM/cZ+nVzM:7iBZ4trwnNX51zt2wQGq/hoVI
MD5 SHA1 SHA512 SSDEEP

Eh

SHA256 3ee22a06321c6369a2b502c67646eacb58bec2306189c7c53edcb48468c91aae
MD5 22f7b01c610232458f9e36c8963f1065
SHA1 bddd5b57a2603455a2901bcb3ec4805d38a49768
SHA512 14ec31a4ce009e46399cf9acf6c1d376152cb9812f6051dd927db9c08dd31a7e7d0f04d3c9f764ce31455ccc48afbeee62157beb0d675694d80a8d4b86e630c4
SSDEEP 3072:ZRMsKz50/0DIPEXbeTjDiNyWEfGxciSvbDb4w8:ZRS505EXoiNy8xciSzn4w8
MD5 SHA1 SHA512 SSDEEP

Exception

SHA256 2620694dd68ce37e0f3635be022b34dc0b1b2eb24db5b3c30520787283d1ee4c
MD5 2443cd8773b0718847895f4c5130d7d9
SHA1 cde911724c458139ed42ca418471412e740a6427
SHA512 405e6ddca2de93c5ef363b94ac82487068dd14ede3832bf0eb693ecba30b3d7ff76aacef2ace45cd0268e180911c0302be7bd11b3d4b4cd78316bdf27415b36f
SSDEEP 384:yXoSpu88888888888888888888888888888zv888888NfU84444QnooooooooooL:yx/Sm1fI
MD5 SHA1 SHA512 SSDEEP

Footwear

SHA256 6d25c1b0db2b0dfb7e100cffb41feb59221a02c7137bb6093848f423bc41a180
MD5 d23e431aa6859f9a6191b32d4d6bddfd
SHA1 856b08c060b13611a24e33b94c7a74fedf8e6b8b
SHA512 a91bfdd4e25a0f41ef3324b44a13b291ee1f950c604c90ec1944036cb134f8c9d1e836d3a8c83abe7f5f1a2402ff28457aadf209e897d1ab2bac0d8545bfcfa9
SSDEEP 3072:lzxsPR1yciPWprowM3Qm23DjOH4IoVcfIHaAtri:xiPDviPWprowbzxIoyIHddi
MD5 SHA1 SHA512 SSDEEP

Highland

SHA256 d8bebe65ed8106cd2c18dcbd120c6ce0ca0e3f0ba3e43fb3adaa9785cc2cc8e2
MD5 a32fe555134dc9187a13a17f00d3e276
SHA1 d11fa6b6a0b2784fcefdaf92aa6f9a38261a9dc2
SHA512 5058b46183240e0cb929e6c40e91128cddce3626db104288b9a543cabb860abe9c817d5f5446a203aaec8a0e56f8e9f91ccd92571f2231dfd306cef1e637179e
SSDEEP 768:i3T3Xr63EYr8qcDP8WBosd0bHazf0Tye4Ur2+9Bkk2TalOSVWV9+k:inr63EYrDWyu0uZo2+9B4u0SQ
MD5 SHA1 SHA512 SSDEEP

Meant

SHA256 a27aba7030721814e2d3d8fa08fac3b0788a04173148cfd6d564e1b1cceeabc0
MD5 7d4c057994d5fea4333035d73f75412b
SHA1 034a633617f2607f9c0138e5245eb442e54abcc2
SHA512 7a9996b7fd6978794352ea7e495d4e6b9e27a3cb6b03f6d53c6aa81f4194033e7c2aa4659482c6cd2e737f0ac0ca63ca1e57a4de89321b8f48378c7472d45a4b
SSDEEP 1536:lvMp6EDRYJ7kIz8DkgIhPkN9KnmT1cg3ZDctGbKBXkWj4upDK9q4Dw3c61RG31M:6lsgIhs3kmTmwZDgGbDHVAc6jG31M
MD5 SHA1 SHA512 SSDEEP

Montreal

SHA256 941f5dd83c1aa71ff2540086c19504c79d7681c9211278de32645e8a3f31940e
MD5 7ef8a6d3bf8d0b6e959b13f0291fba46
SHA1 70cc95b80f79e12a6fff7b20aeaf90ed924ea87b
SHA512 43fe406603cde6a1da37b91f5eba9863135dcc69fc006a82aba9a3c1cbceac3ff6a52c8857396df4caac983f18634ac3b7c54e08ffddf29b6086d4ba159029be
SSDEEP 3072:OgNkSXF/U8QCgh+qLzxc9TvNU7DYrVUhijUvlg5:HkSXFsczqkC7aVUaUvi5
MD5 SHA1 SHA512 SSDEEP

Reading

SHA256 f75beff8826deaae9f963d79ca669d8a91a794e7e6dd5693d80d6cd9d78436a2
MD5 eb90a67256866f9cf94351131101c24a
SHA1 4868f8d1f7e4fc70ff26d128d997cc628ab045b1
SHA512 394d780e84c1fd1ce2ab685bb6be28a289cb2974c9dfbbcbb6f98b8832fe81d624102363f8f5806d4b17342734570d0385e38ad77983cf0961d1b593275beccc
SSDEEP 1536:J/29GTnb+aTOpA0KOWZ59Dqd2LoanG5Yh+f863I5DypFOlJL4x7KBgtIZnsjAZNF:JKenii0yD1LoanUveooL4x7KBgtEnsja
MD5 SHA1 SHA512 SSDEEP

Scott

SHA256 ff6212d7ccc5d9d48762d8edb28b1a45a0c7e1d660c7958d8ce70e12f6398b9c
MD5 e1a8f8a0f670f1ea341232e078b35f66
SHA1 4e6799bdfb02daef8cad21e9a106da40906ecddf
SHA512 94b161bc016bd19d4d9e65c2819f37df41a53e7e3dcbc3b3fc4c761170ff71255c9601f1cdb04ae54bf3732341ac1651af51a94264975e8723eb96773679d17f
SSDEEP 1536:46j6rs84dvTcAXjKd1bS1wwQOchO+534IY1GsTrkerRIb+cgbrnoZwB:B6uId1bvhOYSQurhrRIb+c2oZ4
MD5 SHA1 SHA512 SSDEEP

$TEMP/Emily.vsdx

SHA256 ca8d6afb89daae43de486a9eadceb89213da61659c144833778d7135d42b80ec
MD5 cfab8e128a6b57a37ac057aaf87ec04a
SHA1 78ce87cc9a6897514c14ddc24ead60d0ba5038c1
SHA512 60309732736e4871ee0686254315e0510d02f6c5c7353dee43239ab3ab5bc444a2d811fb56418c30d619b3834624c991818432b98c6698b89c93c3e5b77ba1f7
SSDEEP 6144:S+bRWJj7vdGIHT7GfZVQjB0pCGzQMVKQr8qZui8p:S+bcfXTuZ2jI+ir8gui8p
MD5 SHA1 SHA512 SSDEEP

$TEMP/Hash.vsdx

SHA256 6eb4ed45d1cd7c0747e7bec09425c347b9deb0f831ffa62a69d084ac4da58697
MD5 120d5103199290a8b075f86f6fa423a6
SHA1 1747a46f63359184128a6fa929a2997951586b60
SHA512 997a2ff8ecb878e799b249607d365958c06ea27317288bdee6110637dad72d7333e94dcb26dee12d91f4e894a253432e93ed370177dc93eaf763f5581eae52ff
SSDEEP 768:qaXNmMhd6ytl8rKTxmQgEJTqlVjUxj3Nx87uu:z9VAsTQQg9wxj3NY
MD5 SHA1 SHA512 SSDEEP

$TEMP/Latter.vsdx

SHA256 862dcf739fd5453a5584d021b73faff607037054308a7f4e37b956626e2a5242
MD5 0c5ee23ef98345d3c81bcae1d9b20faf
SHA1 1454b241e0062666110897790979cf3841676520
SHA512 2afe303c6640318e096f2c3deab07f2ca62ff615f31f2dd8c09fdab0e04caa17f3e52dd80d89c8f20f9b4bd9d03122f87b7daac34b55da3c8792df4279dc4fab
SSDEEP 3072:1e2Iw2nRS0VNGUzcqlN37sxiNeZU36JTdI64457yHHEPnRbSN:1e2Iwog0VkUwqlNLsxiN76tdlf57yHkM
MD5 SHA1 SHA512 SSDEEP

$TEMP/Licence.vsdx

SHA256 81a327e5a80f4ca2170b95f18a14b7e0e95e754785f64a39f977f9985582fbc6
MD5 8851737f0cc04239cda93ae36872993c
SHA1 5b39e98235adc90ac552a4408712137a5e86493c
SHA512 f56e7d79eab1018fb8c7033228309474e5af632d98586174d6025d38959ce85b8aff72858a3fba46ee8d7e80d8c1663ec9525ed7392dc5e05c5a0a138a861f7f
SSDEEP 6144:Cr3RKdHGhrF0St9yF9ayk8slhNg/MLh3JnvnwZk1u17xn4gNNhGThO8:CrBumhr1U0F8YL15vnwZ117NHjhwT
MD5 SHA1 SHA512 SSDEEP

$TEMP/Outer.vsdx

SHA256 6758c76bf8373c23e9525014b74ff699daa4f77ad8d434a950f6df7de279f5e5
MD5 6dc0ffc6e1825003e90eb6d77fe43c05
SHA1 3b4616ece5386e49ac7c2342a935d5f6bc216a26
SHA512 c6fd6b13e19adc2a470a40b8fa6ffc6a30f06a95b76f0872a6838c9b8748ff28612936513e8b4ed5860b71d5f1bfe6fbfb31fec6eefe0f83b21d7c4cc79c61fd
SSDEEP 1536:biB5ezAz8XBEqiNcBQE2kY+D+mVoiiuhg99Luan8uga:biBVz8Ni9E7VUuU38Ra
MD5 SHA1 SHA512 SSDEEP

$TEMP/Shared.vsdx

SHA256 bc6383b2458856bda10e489ccf4aff40b42684dcf1bb895e528113a41a645e66
MD5 358ebfeecdcbd3316aef52f32fbbc0ae
SHA1 57140f13563c329c11a1e0362ba26726e36523ba
SHA512 c53d709119e4e6e5e2ef6db7e89f2503e117b86451cf19f8e33d4fbe589441a99195b9fdcc214c819d30388e07667df69c005add33b3504f79375b894dfb6f82
SSDEEP 6144:bUed1qysCQGJBQKVejuSYATGOI7ilEXhPxPvB1dtUGTjIjHk103LVAT4KFi:4CqysCQGJBulT27WExVZ1gGQjE1+Bi4T
MD5 SHA1 SHA512 SSDEEP

$TEMP/Tube.vsdx

SHA256 9a0a0bcaabd8af4c46dced80ad3523358298b07b9d6fa0e1590f39b4d68097c9
MD5 616c5606664a88df3d47cdc4a67a0cc2
SHA1 71bd90287592d092e0780c9d10974490832a88d6
SHA512 e0d4b616bc3699ac7f7fec0ade2ed8455b780924a57586c67b475f6988e95ab9f914c708078ff1c6f139a59b27eaf46847e1e7402e995d354b961640df2cf8cd
SSDEEP 3072:uTqeqCBMOaL7Q5DVRl3eXhrNZ8JExoN7cfnYZDeAuJCPiJG4F3Rx5Id9Z5Zj/eCw:uWGaL74RNeXhrNZ8JE6N7inYUdYQRkd2
MD5 SHA1 SHA512 SSDEEP

HomeMpeg.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/nsExec.dll

kernel32

user32

advapi32

generic

$TEMP/Atmosphere.vsdx

Accessed

Calgary

Centers

Eh

Exception

Footwear

Highland

Meant

Montreal

Reading

Scott

$TEMP/Emily.vsdx

$TEMP/Hash.vsdx

$TEMP/Latter.vsdx

$TEMP/Licence.vsdx

$TEMP/Outer.vsdx

$TEMP/Shared.vsdx

$TEMP/Tube.vsdx

Sharing

General

Malware Config

Signatures

File Explorer

HomeMpeg.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/nsExec.dll

kernel32

user32

advapi32

generic

$TEMP/Atmosphere.vsdx

Accessed

Calgary

Centers

Eh

Exception

Footwear

Highland

Meant

Montreal

Reading

Scott

$TEMP/Emily.vsdx

$TEMP/Hash.vsdx

$TEMP/Latter.vsdx

$TEMP/Licence.vsdx

$TEMP/Outer.vsdx

$TEMP/Shared.vsdx

$TEMP/Tube.vsdx