FYSWIFT09-MR7Y280-UR8993-93-KSLI0002-RD0003-D[.]exe

resource
FYSWIFT09-MR7Y280-UR8993-93-KSLI0002-RD0003-D.exe

resource
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll

FYSWIFT09-MR7Y280-UR8993-93-KSLI0002-RD0003-D.exe

IMPHASH 7eae418c7423834ffc3d79b4300bd6fb
SHA256 bae2b47193c08a9f98f390845d8a2d25040bc2b2cee6c36f10cfff5d245b24ea
MD5 999190bdbf9716143f68977747ec0824
SHA1 036d7322a3ca1cf24fabfb17e0676a3c8364f5cb
SHA512 e891ff3fb91180d9bf76db225cf1993f38a16e8cc98a218f27a40b47d4ce2a111eac453b40122fbfc4e893232b41d68db4cb2a2020abe90a9d7a6dbe31846a94
SSDEEP 12288:J6L45thap5UwTk26UjwTbcl6IyyBx/13MRkHZ:J6cthapq6k3owTbOyyD13MR6Z
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Minor OS version

0

Major OS version

4

Entry point

13271

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetEnvironmentVariableW SetFileAttributesW Sleep GetTickCount GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW SetCurrentDirectoryW GetFileAttributesW GetWindowsDirectoryW GetTempPathW GetCommandLineW GetVersion SetErrorMode lstrlenW lstrcpynW GetDiskFreeSpaceW ExitProcess MoveFileW CreateThread GetLastError CreateDirectoryW CreateProcessW RemoveDirectoryW lstrcmpiA CreateFileW GetTempFileNameW WriteFile lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject lstrcmpiW lstrcmpW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle ExpandEnvironmentStringsW GlobalFree GlobalLock GlobalUnlock GlobalAlloc DeleteFileW FindFirstFileW FindNextFileW FindClose SetFilePointer ReadFile MulDiv lstrlenA WideCharToMultiByte MultiByteToWideChar WritePrivateProfileStringW FreeLibrary GetPrivateProfileStringW GetModuleHandleW LoadLibraryExW

user32

GetWindowRect GetSystemMenu SetClassLongW IsWindowEnabled SetWindowPos GetSysColor GetWindowLongW SetCursor LoadCursorW CheckDlgButton GetMessagePos CallWindowProcW IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard TrackPopupMenu ScreenToClient EnableMenuItem GetDlgItem SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharPrevW CharNextA wsprintfA DispatchMessageW PeekMessageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect SystemParametersInfoW EndDialog RegisterClassW DialogBoxParamW CreateWindowExW GetClassInfoW DestroyWindow CharNextW ExitWindowsEx SetWindowTextW LoadImageW SetTimer ShowWindow PostQuitMessage wsprintfW SetWindowLongW FindWindowExW IsWindow CreatePopupMenu AppendMenuW GetSystemMetrics DrawTextW EndPaint CreateDialogParamW SendMessageTimeoutW SetForegroundWindow

gdi32

SelectObject SetTextColor SetBkMode CreateFontIndirectW CreateBrushIndirect DeleteObject GetDeviceCaps SetBkColor

shell32

ShellExecuteExW SHGetPathFromIDListW SHGetSpecialFolderLocation SHGetFileInfoW SHFileOperationW SHBrowseForFolderW

advapi32

AdjustTokenPrivileges RegCreateKeyExW RegOpenKeyExW SetFileSecurityW OpenProcessToken LookupPrivilegeValueW RegEnumValueW RegDeleteKeyW RegDeleteValueW RegCloseKey RegSetValueExW RegQueryValueExW RegEnumKeyW

comctl32

ImageList_Create ImageList_AddMasked ord17 ImageList_Destroy

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 6950991102462d84fdc0e3b0ae30c95af8c192f77ce3d78e8d54e6b22f7c09ba
MD5 8cf2ac271d7679b1d68eefc1ae0c5618
SHA1 7cc1caaa747ee16dc894a600a4256f64fa65a9b8
SHA512 ce828fb9ecd7655cc4c974f78f209d3326ba71ced60171a45a437fc3fff3bd0d69a0997adaca29265c7b5419bdea2b17f8cc8ceae1b8ce6b22b7ed9120bb5ad3
SSDEEP 192:BenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XB9IwL:B8+Qlt70Fj/lQRY/9VjjlL
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10719

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/modern-wizard.bmp

SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
MD5 SHA1 SHA512 SSDEEP

$PLUGINSDIR/nsDialogs.dll

IMPHASH 6b5c4f7d679059f68f1269aad3a5cecd
SHA256 c5ba017732597a82f695b084d1aa7fe3b356168cc66105b9392a9c5b06be5188
MD5 ec9640b70e07141febbe2cd4cc42510f
SHA1 64a5e4b90e5fe62aa40e7ac9e16342ed066f0306
SHA512 47605b217313c7fe6ce3e9a65da156a2fba8d91e4ed23731d3c5e432dd048ff5c8f9ae8bb85a6a39e1eac4e1b6a22862aa72d3b1b1c8255858997cdd4db5d1fe
SSDEEP 192:oRsHeylO012En8pqHtcE0PuAgkOyPIFc:sATI0d8pUP0WAgkBPIFc
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

7527

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Butikstyveri.Aar

SHA256 2dee964c0af20f0766033420b0d619d9351ddec01208d545c3a0152d07b8128d
MD5 346999d49f20d8010e00488a27aaab91
SHA1 878b0ee04345668265bb75c2a9d0bf3d8bcbfd54
SHA512 2849fcc3c18209b1f9ae36f6c82a39dcc526c478129bbfdbe8ebd085dfe9ceddd974953f9e50cc3e1d80783b1ef3bfa0a1408a3bfb810265ebf10a973b7e15f0
SSDEEP 384:A8wEHIR3a6/NBl9L3jnNd4OYQ9vCYSYGvpw/V:OtB7rjnX/lSYGvw
MD5 SHA1 SHA512 SSDEEP

Praemisser12.cha

SHA256 46235a9cf6ee1b4e886653fbcbb1dc5a6845d4de8d1d1f83f984c16c1cdc6b3b
MD5 f002ff1e3bfc914007868266ddbed61a
SHA1 8349c3596c01dcf4fadd5d8e278abd060656e008
SHA512 27258720fb08b87aca0fcc629e8a4df822bc39b6c64e6e6289129d11b587d7a67e62999c50697b9a27e1a4c1d470b92b9a3d2e8031207f528bf0208f23a08856
SSDEEP 96:vGIH9P8txG62Hm2g0faJIBSbIs7/3nE1R/:+wmzCglJIsNM
MD5 SHA1 SHA512 SSDEEP

Sammenfat.lys

SHA256 78522100830aa45573a598efe8ff175480b9a6be78ec502e1339fbf57fb2d4a6
MD5 322ef45132ef2144c948b4feda68b84f
SHA1 eefc234f81f58e72a7317327aac6881abe2efefc
SHA512 3dbbd0f9d81ac55823707c3a8a74a12e04666539f7ba7b40d71194c40a6fe516cc18240e94156c1a701df98f71a0759ffd57a7bf6d4b87f2282635c65e39d8b1
SSDEEP 384:rJURkOaoduwAHIMVSDcEeIDL5JL8uUK4LPUOuOaVW:ORkOaSgH5UD1lgf7LPUOuc
MD5 SHA1 SHA512 SSDEEP

Switchel/kronprinserne.pro

SHA256 da7e4a541086a75cb8cf91adf43e98d3aca271863727523f071d7f3eaf07d39b
MD5 a9253a057c984b8c5f3ba092406bb8e0
SHA1 829951b20d3475382593b68b6eacd672fdd5298a
SHA512 056bbbea2501b3c577f46a6b54e00b687c8c4ab98424e824df026c5a8bdaa7c0fbeecf6a6e7228e2bfb98b1770b96dd50cc5b9fa2d13665aacbdd5288f1d134b
SSDEEP 384:caw7BzBKXdYVHkOySdX7LBhle+rD+wrV9RFdPbA8QECvK3HdNb:Fw7vK0Byi7nle+rD1rV9/JSWb
MD5 SHA1 SHA512 SSDEEP

Switchel/malhild.cre

SHA256 b0b03d3346c14c9bfd7a57b9ef1bca23784ad19e81b0737e0967893ca2a0fe1e
MD5 b9b9ebb894500bb1701562d246081a1f
SHA1 a54423b3b2ea715a8e602eeaafb48bfd8f04181c
SHA512 a5c1c7e311815fb728b9f05994649bb3a280f30bde9f57157b1965b328ac1b6ce8f172c04bb7c8c211ac6e602ac6c8b05c007c6bf69df790eb4cc5dce8378caf
SSDEEP 96:AXeGEAOx1uV9ne1oK/obiIe6QCkt9ONDIM9eSVEXHOnVL1PboEzmKcVo4ZvNl:AJfimGPHvM9eR4M2dcnP
MD5 SHA1 SHA512 SSDEEP

Switchel/overwin.jen

SHA256 2da7e2d6dacd2c31210ffef5af85446de14432279cea02ba9b8140809f282d33
MD5 8671ad7d3058b9600086d46cde18799b
SHA1 f19e5dd36bfefd3f281a9e7a8be0152fff31b731
SHA512 192e47d9fe794f39f7166346e5371a63057b7d156ff64fd681d69e0351c3b9b6b27b6fb461d2ae137eda104a7b62a1722d62c1dd6295bf3f8a46e68554787e5c
SSDEEP 24:g2X00Whh87hFHvx4J2fSOByAQrYb6lUycUk+9VJBuMX7ovZyUxkNq:W0WYNF5UkUrSAnV7YR6Nq
MD5 SHA1 SHA512 SSDEEP

Switchel/scenopinidae.spi

SHA256 98b789a3f7931abc1652b492003ac3040cd80b1c454e5e3becf58ea3c817af1a
MD5 265ef22c9b52e285cbcb7c98559258c3
SHA1 55482a05fda66b250170e055647b6c716201ed7d
SHA512 2e0387d23a924b5366f0f4c53696f386b889bec7607f288196357303ac8830d72a99d79ec509d57474e9769acd22e0e57fc4ea3fed2433c11f9d3c86fc84c37a
SSDEEP 96:5PBoNlgYNzSQcHQIgXjhec5LzaYHnlwxfeui/GPwJ:5PBoNlgYNGQcHQI6jsc5LVnexfRi/GIJ
MD5 SHA1 SHA512 SSDEEP

Switchel/skifteprotokoller.ufo

SHA256 8c65e2f9c7b063ede9e44ff16a16246abcb3c4bbdee8e23f67b9c7409e4a7fb3
MD5 c86874d5180ceed9d23e5adfb9ab87f3
SHA1 4c2a2e122f3af3829b44ade99c960aa0409391d7
SHA512 afbe99968ab7ecb233f3a0c4c174f339750eb5e384477cb006874ab5b1a6eb6503ccc3438fa6d07d05635e83f83c6c0ae36745812389b166255d006b26e5584b
SSDEEP 384:B0UU/EcTD4SWr78XxkYCf8vc83P5s4OdxvigYY:B0LH/Wr78+P0EasBdxvtYY
MD5 SHA1 SHA512 SSDEEP

Switchel/snefalds.mum

SHA256 be3b1b0ad860cbdf1461563239a3a7ab778b639057e53e89d2a6af5c952e9ce1
MD5 1e1ae985f9c0c7cb83666365a44c9d49
SHA1 3bb97e7376f192f42e37fd1ed1ea71746aa35b27
SHA512 6475f97b61d185206cc95da54edfff0b523390a5f41f95be47b1a76d3d3497084aedb8eed1f02120df24e569de2a668782ad390441d82f490a53f1e07f8d3b36
SSDEEP 192:9gnX9p6Bp3hjEJHiVBdynSNm7W3jf4gashF46lhi2WHq4xDFXik8Iv6bnpIHS1:ymJ4JCTmSKWkFl6Dif/DFyk8Iv6bnpIc
MD5 SHA1 SHA512 SSDEEP

Switchel/sponsorende.bis

SHA256 87f3df1f503ae390960b93de2542582035cde458ddefadf64805b7b8ec871fd9
MD5 0feb6118a23cea0911142c52b37f4c69
SHA1 ba4f2c4593c780b95e1fdaf648632cfba9459853
SHA512 c0da63296a625b59d3dba7c8906c40791a5fc42b872245c4d1b2428268db9af7e5b03904f876e329e2ce327c4113c62f93ed382c85a656e0149d002f0254bf2b
SSDEEP 192:LkEIfbifT/NQkFRgPT8nwtT+Vkwnw2ya0EtdtmJLj:LkrfbINQURgPQwFfwnm7EtmF
MD5 SHA1 SHA512 SSDEEP

Switchel/sulphouinic.adr

SHA256 9dd7c337d6947a38e2026cb444a01ae79b6b8931d0275edb6fb7b54449d26d0c
MD5 562c6852658cf346e775cb531a8a1de3
SHA1 78e1fcca57271996a76ae60b01325369dc7c1cc4
SHA512 adcb3e19e071a86d04828487e479ce27207ac1f069f1b0cadb50b08ef68cf277aacfff4d913fc497d9141a05e08ecd835c2902d194b16a8f016936319891ba8a
SSDEEP 96:VfGw5Yk5231xO8SPoqVOIoGtdRg0uObNgpxBceej11Og/BWe8bztSjp/IzVlaxOx:ZTYeRP1XLtIQNKGtecAn8S28lg0h
MD5 SHA1 SHA512 SSDEEP

Switchel/unprotuberant.sne

SHA256 19ff0e98d5efc723cc4fded985ec413a509d86b62505ef43fa51c3f4c906e0b3
MD5 6d68dfc8458b3cdc10ada3e574d00010
SHA1 b4f162e18471b046cc57167d66a3038279caf414
SHA512 8afa65b756c1976633cb8e222c8de660a4edae27c5a1df8b6ea9363199d61649c8750613cac6270bc1d32648d7ca0106ce72cacbab1ae2b708f4c15c97b63a4c
SSDEEP 192:7pYWiai7IY+ZFoWkwNDuzO5aUz+zAjaWXUXDrQ0WGF:dYWiP7Id9dKO9RX8Dr5F
MD5 SHA1 SHA512 SSDEEP

Switchel/zymosthenic.mel

SHA256 8ef7a0fdc43ca39abeaab74c34f541330b977f410056303a748bad0a94e58fd8
MD5 a84189888ee13dc2c68d83c9bb5099cd
SHA1 4ab1b6d22b7b6ba5f29b2ac07eb5d0b3f84aaf1f
SHA512 591bb3f3c84c820e6f7bb16003b27191224a023f020b0271367bb9dd4d060b35e8a9f06ac2593602912b69c47ee37271b14af3c5e4c28e80ee11a5302b44d7be
SSDEEP 48:s/YZ51YMYMqr7Jf2PONPdbc1wfzlVmHbvSwOtc5xq5xDQWApdTT2fg:BjYMCkPOhdSwfzl4OtH5tQWApN6fg
MD5 SHA1 SHA512 SSDEEP

Tchervonetz.Alg

SHA256 e7b1432710116be4a66d5294e66195e2ebb3df995d9de29f55c4301c0dacaa44
MD5 0dd31d35bed8e0c3ec4221a120332cf7
SHA1 80d3795abc6c1607ec6bed55416c3e8666b5e174
SHA512 6687d3acc25af3e02fb0d0b7af20fa9654e341799a59fb2582a9e3c09936e73dc77eed804579b17d228c1743efb80e9997e810ad9e6a69b7e1d0dd42141504af
SSDEEP 6144:HmlKbOvMGJHv8c/gQwpxBSAelCVR6+cSqqSY6YDLSbgJLKjrE74JTj/U:Hm0bOhF8cVqr1j66SYFLhLKw4dU
MD5 SHA1 SHA512 SSDEEP

bughule.dun

SHA256 d5b00e5c84e5b03722024e081a28607e706e044ae7985f86ca6ec988a40980f8
MD5 2b5e80e481ed3bce4fd3ccf5f8c0ad2e
SHA1 66ba6186fe441dd79e5aa3bd6d21375e5c4d6da2
SHA512 49fc27431da5e3502df195c257452c8908b78d59c957ebca3b9b9a1f742539240714c6e2dbb252d2451caa5ad47094c09a659883f11339fba564e4fdecd4fa57
SSDEEP 192:e3iaWylu8ynAznO5Io9hi6O0fcLoHUAB5j:e3/NwA7wIFf070AJ
MD5 SHA1 SHA512 SSDEEP

hilary.str

SHA256 b0232023bbd7898ce8474252d23ff0eeb899326de8b59251bf4127882aedd6e3
MD5 f69aa65e4e42734c3c1a44f32b31ac2f
SHA1 81bc3083764e0bcc1f11369ae50594fba6f33e66
SHA512 d4f802c66b773c0c5ff36476d42ffa7a530d31dd5a97a7fac7458d13bdb55f2381086623018d4de41b369223b767d5ddfc870c0af9922b8f0198d524aaaea0bd
SSDEEP 96:Q0NH8riCnGemxW7p2wgmt2puQwkRk5OLnWROh:Jp2LZ9cW2
MD5 SHA1 SHA512 SSDEEP

hydrobromate.rea

SHA256 35633f65b3e6fd6020d7cc4f9e46d812da0f346ab6da4f44ac79c70b224cd65b
MD5 a87a1d0f1fec0bd067040741b99db128
SHA1 d2143902337f3e25ed4af72e6fbd9084c31c75f7
SHA512 c1e6b67617031b9b9d4659d4dd518eea433f64d4bcf75508d83130743f27dc212d7b269a0f4c5d02b84a41d38fc5fd376bd5b9fabfbf6a3f07be77d5be5e622b
SSDEEP 192:x16msc8ITrDHynr+/uG8vkaDMXGxljv9whGYcJcxP:n6msLIzynrqJcxSGx59wYZJcxP
MD5 SHA1 SHA512 SSDEEP

incalver.eft

SHA256 a428314e3458b16784eae328c019923628dd0f3edef262afcd109785d39378d5
MD5 a38294f7ce0b3e88f4aff867ab5d7529
SHA1 ecb0dc205efbfcc9beac46038a275a13eb566639
SHA512 7ff2e982977975da418b92531ea487080be6ec6ffc0753dc0fa1d443d1520fd787d3e72ed767fc34efcd1f3edee9a9a32b6e04a21af037bba02a9e910752a2bb
SSDEEP 192:0FTbE/EbTYS3xyl3kBS1u/xeKtrhIwNTRlOTz4QMJWhF4+Uv1D1HGN:0tsuxWk3/FxTsz4QiWf7
MD5 SHA1 SHA512 SSDEEP

Sharing

General

Malware Config

Signatures

File Explorer

FYSWIFT09-MR7Y280-UR8993-93-KSLI0002-RD0003-D.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/modern-wizard.bmp

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

Butikstyveri.Aar

Praemisser12.cha

Sammenfat.lys

Switchel/kronprinserne.pro

Switchel/malhild.cre

Switchel/overwin.jen

Switchel/scenopinidae.spi

Switchel/skifteprotokoller.ufo

Switchel/snefalds.mum

Switchel/sponsorende.bis

Switchel/sulphouinic.adr

Switchel/unprotuberant.sne

Switchel/zymosthenic.mel

Tchervonetz.Alg

bughule.dun

hilary.str

hydrobromate.rea

incalver.eft