_17f1708d36917a3095a76e3c6dc49d345fb0d95309894ca3ac54097f2e22d104[.]exe

resource
_17f1708d36917a3095a76e3c6dc49d345fb0d95309894ca3ac54097f2e22d104.exe
unpack001/$PLUGINSDIR/nsExec.dll

_17f1708d36917a3095a76e3c6dc49d345fb0d95309894ca3ac54097f2e22d104.exe

IMPHASH 32f3282581436269b3a75b6675fe3e08
SHA256 17f1708d36917a3095a76e3c6dc49d345fb0d95309894ca3ac54097f2e22d104
MD5 7b7e236c2bc0bea4fccc47b9df46308c
SHA1 2a1f9c2d1cbdd9a123ecfce2a205655f1624f19f
SHA512 8fedd8b8822831f1111e6abf30c5c325239aed37d17721c20dcb3c3e55c363e6ede5e2517387b9995fb990c2a16694f0333e2030ab2269480c233a06e27546a1
SSDEEP 49152:ewy8g1tahTuvNZIV4vhI0uNP9Mbuy4hr7jTJn+br0L8tmOpL:w8Cta1rV4J4NlMbuy4djTxM4MBp
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

14864

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetFileTime CompareFileTime SearchPathW GetShortPathNameW GetFullPathNameW MoveFileW SetCurrentDirectoryW GetFileAttributesW GetLastError CreateDirectoryW SetFileAttributesW Sleep GetTickCount CreateFileW GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW ExitProcess GetWindowsDirectoryW GetTempPathW GetCommandLineW SetErrorMode CloseHandle lstrlenW lstrcpynW GetDiskFreeSpaceW GlobalUnlock GlobalLock CreateThread LoadLibraryW CreateProcessW lstrcmpiA GetTempFileNameW lstrcatW GetProcAddress LoadLibraryA GetModuleHandleA OpenProcess lstrcpyW GetVersionExW GetSystemDirectoryW GetVersion lstrcpyA RemoveDirectoryW lstrcmpA lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalAlloc WaitForSingleObject GetExitCodeProcess GlobalFree GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW WideCharToMultiByte lstrlenA MulDiv WriteFile ReadFile MultiByteToWideChar SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW lstrcpynA

user32

GetAsyncKeyState IsDlgButtonChecked ScreenToClient GetMessagePos CallWindowProcW IsWindowVisible LoadBitmapW CloseClipboard SetClipboardData EmptyClipboard OpenClipboard TrackPopupMenu GetWindowRect AppendMenuW CreatePopupMenu GetSystemMetrics EndDialog EnableMenuItem GetSystemMenu SetClassLongW IsWindowEnabled SetWindowPos DialogBoxParamW CheckDlgButton CreateWindowExW SystemParametersInfoW RegisterClassW SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharNextA CharUpperW CharPrevW wvsprintfW DispatchMessageW PeekMessageW wsprintfA DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW LoadCursorW SetCursor GetWindowLongW GetSysColor CharNextW GetClassInfoW ExitWindowsEx IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint FindWindowExW

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor SelectObject

shell32

SHBrowseForFolderW SHGetPathFromIDListW SHGetFileInfoW ShellExecuteW SHFileOperationW SHGetSpecialFolderLocation

advapi32

RegEnumKeyW RegOpenKeyExW RegCloseKey RegDeleteKeyW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumValueW

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

Name

.text

Size

29KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

458KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ndata

Size

Virtual Size

708KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

49KB

Virtual Size

49KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PLUGINSDIR/nsExec.dll

IMPHASH 8700d0ebbb41c81ea52718af1ab70a93
SHA256 8165c7aef7de3d3e0549776535bedc380ad9be7bb85e60ad6436f71528d092af
MD5 08e9796ca20c5fc5076e3ac05fb5709a
SHA1 07971d52dcbaa1054060073571ced046347177f7
SHA512 02618317d6ab0302324aae4d3c5fca56b21e68c899e211cfa9412cf73820a1f931e56753c904fd7e510c638b4463aedbfe9536790279e096ea0387b67013e0c4
SSDEEP 96:/Uspq2y5jOEEQrhySvUgfj74/vvrTBzfYZA4YF3Telac1nIq/2:/erjOELhySv5f2vvBjiAflaB1nIq
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$TEMP/Alphabetical.midi

SHA256 78520564e48f4e4dd816d629696194001aeefa653539dcf3acc7decfd58fcbb1
MD5 4be533e657ec828917b51b69e48d7f32
SHA1 af660967aed17d5d059348d7fbe9712d3e88bc78
SHA512 6a5635049f29387a0d32ad6c05fc4287483997e40d1ef29ec86fa69d5f2b00fd75a55e530d026058aedfde57449a56849ad3b508cb73cc1c6a3a8b960e2b519f
SSDEEP 3072:MG7qQrAJrVM98/zGXw8ie2KdeQ5IcrLJj2lTk7XLVr18nwWZ33NIYVN8GD3gJzku:MYAJxaDXjDIQ5RIlYr185zI4yTl0xgKA
MD5 SHA1 SHA512 SSDEEP

$TEMP/Charles.midi

SHA256 f906d1a4e802c87acc380b0d19adb3e7ed55ec1baf696b8fb1928cdc7cb006f6
MD5 73d6d0f759afce904202308dde084f48
SHA1 ca1444d5bdb9850f35a1f8b2f9055588e9219ea7
SHA512 8b31cb518be4fc12d60a03e2d9538a72a23c604ce22466e5fb37f3ae869c54c62826dcd0f21f927c26e2bd78290d751a1c5bf71a0257c162c8e549ef9eab2aa2
SSDEEP 3072:lWztNJLLLI6UNq6e6kG012MAGPVcEZJy7OaohOitQ:uTJLfIt9k73AOVcEnoOzOitQ
MD5 SHA1 SHA512 SSDEEP

$TEMP/Dragon.midi

SHA256 af08e16306b1f6bb8c11b6f9bb026543e2e8f7627c3d5d8670ab76506a011f2a
MD5 b9adeeb84c2f02376c4aedd3aa36640b
SHA1 1a200116ee121f363b9c4ff1cd46cb49e243daa6
SHA512 9242fd2597efa10f51d1e0c7994dffd0eb9d76cc4ca0c5716d11231f05e1315acac47c0877101e7c723f3ad42c8e258d2ae5494992cbdd8fc142eb483a4937f9
SSDEEP 12288:lnBwsSGbm2NKPFowkqwH/y/ymIa0E4FrhhrhRc/1qvpNZd9V/:lBwsSajN+oW/5Ia41he1ol79
MD5 SHA1 SHA512 SSDEEP

Ar

SHA256 d9c968756bbd062ebc2d89c3702318461b368cefce9cff9d1e740cba3b9aa208
MD5 3f6f46252568380bc190159e95d72fe7
SHA1 f97b64478f19b6283cb0f7f7db9be5a91d48d323
SHA512 d356e4007611c321cca92f56731eaa5c465142c46675d6fd8e3bf41f413263a443283a6e0b23f30df002a96be3d32f0f454e98fe31cc67f4b7c06a53d8c439a8
SSDEEP 768:gRPPBvbCsOfE04GmvTQzMv/BnwwxWpAizWjg39SvYpeNingKxzUxIH1iY:gdVCsESNvmtpAi6JvAeInT1
MD5 SHA1 SHA512 SSDEEP

Beatles

SHA256 608bc987cba76e468460dc8aee95bd076edbb5c5e4c1666924266d666ab43478
MD5 2776203634e38b04da32aa39e9f34aae
SHA1 25d9a6c96e3300a9574df67fe54803d0b47dcc5a
SHA512 ef01b72ac0221a3796bce2a6db592d23824d6c192a62a9170d44952e6b24eed60c9a51eab71f6959c98028a6ac7e2416581b5d736e7e05bff783fdc669b2ec69
SSDEEP 1536:iPdJaGloaj6bs8jcd/TcI3s+uXkrfhrRj3oh63E/:iPfam6OzmkrJrRj4h6U
MD5 SHA1 SHA512 SSDEEP

Challenges

SHA256 acc7df05f4bb57551afe4a89cd0829135acb6db2ecce144a4d5c8ee0a97d7e46
MD5 02e0a15c9a18959fe92bcdc1f5cedda0
SHA1 54dac19b84f273ae238684170a81467316b76c2d
SHA512 db206f5ee767ed68ee2ef45f6f6c12f2b8a345801b92fe99d9d8e877b276e94ea6b589a86df3b0d96d2cfa086c3a54d84412e8f25a6240507459db429b549632
SSDEEP 1536:KJlrZlYR+68cNk3smxUsb1yAwsc8MxqVbD61HOyU/CX2CdXibOT0EdQGQ9EtSijc:QYR+HUDXOXT/CfXib+tSijpcVMy
MD5 SHA1 SHA512 SSDEEP

Charts

SHA256 cb87f93a49992100285e58a27aa94b1340dcfa60f85d33949c370acbf21d1b2b
MD5 45df8b6878c79bc7942cf651d83ded19
SHA1 e84b5acf8ede7185aa1aabcb0906df081f19453e
SHA512 ccbb1c1ae1dec9a947201f53d6bce0a5c558db4b021d8d870e14189b7607a6415b5e240c0740012cce2b25633fc31645ba91878d43f168c4b1571c9e0acc5d2a
SSDEEP 3072:d8StjOrOJGGMBwvqXQGYlawwBonasL9jC0O2iSW4QlXUxPrCtTRVB4Y3Iy:d8StQOAGlXuww8x1WUyB4Y3Iy
MD5 SHA1 SHA512 SSDEEP

Conventional

SHA256 430cf21031ffe5dc2dc10152048ed2008671e8ccb3cf0587b7a31c4725dc7d4d
MD5 ecff05a9c4091adf07ca6706799a9e40
SHA1 6beecd1533f465089b4974102ac05ad2fe6f9e0c
SHA512 bc14ac9a1c8a75525c500ca00adcec572948b6c380352f9c94a87db1ccb027cab9cacfcf172c26b6a9bb79329cbcdc7cbd1d7b4816b4cbc536b49b413f586468
SSDEEP 3072:vpMgKYbwR5Exe2/RTX/4gxRuNkdKF0vYNyet+JQ+HcnkL5:vfwc7/RTggXuN2KFIyt+5
MD5 SHA1 SHA512 SSDEEP

Determining

SHA256 efccd8437a4b79fb749caa519dab54708328984d4636851db63ed06a2921d4b8
MD5 45483f7f7fb37170c6f79b81dff9b07d
SHA1 c2274025d47daff8818d682e098d6377d42c163f
SHA512 8aba1e5fd25c5d6d7be26eb4d03f374b4861af00c7ee9cc86b3fe576730389ac1036416a5cbd5b7e5805a538859f3d8884514d8abdd737da4940b719c758b428
SSDEEP 1536:QrDWyu0uZo2+9Br+DATG62rt4dP+iX7DjfvSSuyxiQ:OWy4ZNor+D62rqd2iXbvSS7iQ
MD5 SHA1 SHA512 SSDEEP

Drew

SHA256 32731994084a62f3c6f87654005362d518ad7ff9c2083b08199bac00c0a7231c
MD5 eca56bf2474a6ade7d27095123c28005
SHA1 1af8a23e5031453b35010237eab24dbf591bb2d4
SHA512 864f7156157686c9c49c63e4ea50c584b7e0245f5c33f518a7d3525dc88ef7d70ee8a5069812183b47a48eca2ec01c1cd4c9fdac32e198f2d6791499ca89f017
MD5 SHA1 SHA512

Pace

SHA256 dae5d03a64142328ed48a3f62178164c1e70700e049a8b1140f97f68932f3c80
MD5 18d4b758ed8d739d0abc457b4639aebd
SHA1 1a76ebfbfaa2fbe0e27aa3d72d5f01d588d70a81
SHA512 836a66bc964dbaccc256afe79c92b54252474e6bfab97a26799ec622cb001b09cfadd0634f3d6ecf8d22ebfca06cdb83902c0ad100cbf58f4401abc5f34e8e15
SSDEEP 768:Dat/sIwNYwrhVZ25wTkNi8B08JOf7A3mU2+TFmmrCQO/f3hGEHMV1JqRKdci0fXJ:et0YwYwTkNJ3Rpref3ghV1SKOxqNduj
MD5 SHA1 SHA512 SSDEEP

Teams

SHA256 ee55fa34e9744c620d00fd5381a60e8d78402cfb7e854885897fe4e9cdee27cb
MD5 fff67fd1eefada225f9144ee326e4f4e
SHA1 2a36c8b3d2a83a5c216ae6f20033c541a890263e
SHA512 62509dba54e6c7cb49b944d17f802578c35ee75e40846731daa40846fbdcb03f57e6b23b02e986fc76bf456718427f2f7797dfe42dff512c7d47bc2b1e3141ca
SSDEEP 1536:KxCCfVYvLutohx6a+A3MDS661CZxbxY/jJHcUoNghHeqSkV4T2ubSWJKWNJELHWN:KxCSVYvlhx6vA3MD8jjJ8lghHzJi2ubT
MD5 SHA1 SHA512 SSDEEP

Waterproof

SHA256 f56d0becb4e3d35322f285eb4f23fcf8f98fa211590add2588c23083eb6bf656
MD5 838ee2831d25285eecac7df3d13a3071
SHA1 69f6d8fa1a4780b7cc5e20886b18869c34f6aae2
SHA512 6c6e4333602de2885d6d1f6bf8dc8d6decc2415a024c760f1a92995cf2331d67fff9a2f397adb2469f2953993751e5250228efc50322ac1b357cd5ded0676a07
SSDEEP 3072:H9JwCIj4BPb1XuE/gc0Ag0Fuz08XvBN3vaAt+Y:d5Iuh0AOz04p1dsY
MD5 SHA1 SHA512 SSDEEP

$TEMP/Mfg.midi

SHA256 72c7580de487bb14b6f74ae843ab464d15451b3bb542833fb05fcf69d79dbc36
MD5 7ee144d9d503c879f5f22807912a7622
SHA1 2fbe1cacee7997ad0f697acf4559e8cc9c0868db
SHA512 bab28618ce86e1b8e968ece5641b560501d03a532c368bfa89965e853456ff29303541c7f57eebf7b62620854871cfdfbe9bb9e3f4f12c328bf1aa44a29e1595
SSDEEP 3072:BXGnQsry5uieFwKow7YBesSB1re9x6figt:BIQbM/ufS6WN
MD5 SHA1 SHA512 SSDEEP

$TEMP/Moisture.midi

SHA256 3e40647b9ae8da12365f7b998f4ebcf06acf8186c1deebcfd5c3022f2b10151e
MD5 935354814fd635fb6c127ced3e1e29e7
SHA1 8c496f1777bc929bf11f78db0321f82585b930a0
SHA512 1a15381c39c7ff9ca91f4de336542f1c1ef9f811c3e86e8b95d9aa8b3d40b6aa17790d25e9ca47624d20e280bc9c15f81a58747cc1a84836f774c0fb9e512782
SSDEEP 3072:0/5kY2h27HjuhkxHxCw2ir/6JN4k/HX9hxPJfpmlkOZuDnsMBvShI+xlIw0N0A3q:sTswaaxHiir/6JuqHNYkTD1kF0fa
MD5 SHA1 SHA512 SSDEEP

$TEMP/Professionals.midi

SHA256 d3bf68d5c3fdd746ef6209aaddabcb3d0ce890593eadd2dfb94977762f9a9f18
MD5 154299b650de77245d5baa4c4607ea44
SHA1 846d1b8e555ab3fc3b0641f75dbd3960a40f9992
SHA512 0d3418a45de53d081fe822c007093450157955ca05e1bf09e904f8529a9aaf28695ae8ef02c74db7991b47c186ec3bc9494883176b21565d406559bb6ccb4e6c
SSDEEP 3072:Q6wbyQK5xVC/QRLGbfJi0E8pJ2T6NlDGLNc47XDOhB5RhBPZ:Q7yjgoR6w8pVK//mB/PZ
MD5 SHA1 SHA512 SSDEEP

$TEMP/Sensitive.midi

SHA256 1e87d0a9ef8d703e83f7339d6c3e22f5cd7bc08da8cd9282adbf04505625284e
MD5 10ec1bff38e0cc5716c8e800a1cb1367
SHA1 002bdce490630cb99b95376199ba219101392f66
SHA512 27b9ce003065893de50358aaa2ba08c1517b8d3cd8d94a8ba522b2ef437bbff748a52710084462c26759c57b1beda5c5bf8dc1fc7290363507659e47784c6059
SSDEEP 6144:f8TzchlaghiDxChTuOjWL50C0MNFTPQV2pwDM:f8GlJisR9iLKee2pOM
MD5 SHA1 SHA512 SSDEEP

$TEMP/Tutorial.midi

SHA256 1389205778ec21ad3c70b206c1360ae94ecddb0cf4b66ae97e679435a04065c7
MD5 ac0d474450722dcec62680b901efd7e7
SHA1 4d6ccfa9aa22e35cf9ec2ebae00f5765e86186dc
SHA512 eeef57c55a54503e6f377fa2802eadf13ad2c114fef83fef090888066b29effcfd101b58eeb6349c25e000ebba4e770dcc2ffac217997f3bab33596ef2b0398a
SSDEEP 384:GvW1/SDnQIDfWJNi/tvV10FzC/yjm/toGwXOSn1vFtqyggs0CkpM:GvTMIDOcdV10NKyCIv1dz3M
MD5 SHA1 SHA512 SSDEEP