inv[.] 5234353[.]bat[.]exe

resource
inv. 5234353.bat.exe
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll

inv. 5234353.bat.exe

IMPHASH b34f154ec913d2d2c435cbd644e91687
SHA256 b7d239db797326e43a96fb228e93bbbfa1e12d610c8a79ba3148b74b0021ecb4
MD5 d3b97d3a820e8c78fc00f08ddfc54690
SHA1 ee6640fa3f2ccff294b65d60ee9b6a2dc4b8e13f
SHA512 94520279e360aec3468b9f383ee7f794c6236e607018164a1e3ecbb4266eac2e91bc2d03a90d0d6e46051c08fb5befc4390fe8566e7947459dffb95dc5ebe145
SSDEEP 6144:fQ606xV8H+lc7SGd7UAteVk8I1if8b3eBNTXnqdqEC8tTVefpcjM1JymU+/GIBe:UecGGRUdk8/Eb3EXqFyCI1JymU+/v0
TLSH
T1D0A4F1103646EA07CEEC06B544BF86EE4E759E7BA9818B43F381F76E7C712C5B928114
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

13171

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetEnvironmentVariableW SetFileAttributesW Sleep GetTickCount GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW SetCurrentDirectoryW GetFileAttributesW GetWindowsDirectoryW GetTempPathW GetCommandLineW GetVersion SetErrorMode lstrlenW lstrcpynW GetDiskFreeSpaceW ExitProcess GetShortPathNameW CreateThread GetLastError CreateDirectoryW CreateProcessW RemoveDirectoryW lstrcmpiA CreateFileW GetTempFileNameW WriteFile lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject lstrcmpiW MoveFileW GetFullPathNameW SetFileTime SearchPathW CompareFileTime lstrcmpW CloseHandle ExpandEnvironmentStringsW GlobalFree GlobalLock GlobalUnlock GlobalAlloc FindFirstFileW FindNextFileW DeleteFileW SetFilePointer ReadFile FindClose lstrlenA MulDiv MultiByteToWideChar WideCharToMultiByte GetPrivateProfileStringW WritePrivateProfileStringW FreeLibrary LoadLibraryExW GetModuleHandleW

user32

GetSystemMenu SetClassLongW EnableMenuItem IsWindowEnabled SetWindowPos GetSysColor GetWindowLongW SetCursor LoadCursorW CheckDlgButton GetMessagePos LoadBitmapW CallWindowProcW IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard ScreenToClient GetWindowRect GetDlgItem GetSystemMetrics SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharPrevW CharNextA wsprintfA DispatchMessageW PeekMessageW ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow GetDC SetTimer SetWindowTextW LoadImageW SetForegroundWindow ShowWindow IsWindow SetWindowLongW FindWindowExW TrackPopupMenu AppendMenuW CreatePopupMenu EndPaint CreateDialogParamW SendMessageTimeoutW wsprintfW PostQuitMessage

gdi32

SelectObject SetBkMode CreateFontIndirectW SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation ShellExecuteExW SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW

advapi32

AdjustTokenPrivileges RegCreateKeyExW RegOpenKeyExW SetFileSecurityW OpenProcessToken LookupPrivilegeValueW RegEnumValueW RegDeleteKeyW RegDeleteValueW RegCloseKey RegSetValueExW RegQueryValueExW RegEnumKeyW

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 c2f405d7402f815d0c3fadd9a50f0bbbb1bab9aa38fe347823478a2587299448
MD5 9625d5b1754bc4ff29281d415d27a0fd
SHA1 80e85afc5cccd4c0a3775edbb90595a1a59f5ce0
SHA512 dce52b640897c2e8dbfd0a1472d5377fa91fb9cf1aeff62604d014bccbe5b56af1378f173132abeb0edd18c225b9f8f5e3d3e72434aed946661e036c779f165b
SSDEEP 192:eX24sihno00Wfl97nH6BenXwWobpWBTtvShJ5omi7dJWjOlqSlS:D8QIl972eXqlWBFSt273YOlqz
TLSH
T1BD325D06235081F3E1914138846B3E175F6A15069BF58E97DFD38646BE30BE7BD79503
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10178

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsDialogs.dll

IMPHASH e2ee55bddad4241d619d6a8a38e2d869
SHA256 86c8ee210e6611383a634dcb8c60455063ddae3d7adccbeacf3adf7bf2a46676
MD5 d2e45dd852a659e11897df573832f381
SHA1 19990ee627c95b6c18d3b5c5f0ec5c24791d0af5
SHA512 93c9fa1767f3e861fe5765f2940aaba9eee6396d069c443ac6cbaccc88441b2bfc3c3af50a8044161f96bb7eb81af1bc6c1fa754d89740d0a2a8d591fef11073
SSDEEP 192:o18cSzvTyl4tgi8pPjQM0PuAg0YNyfIFtSP:8BSzm+t18pZ0WAg0RfIFg
TLSH
T1A612F793E5E420B3C6D3523F35BE2B2EC7BD5335B0512C0482738A497A6947A6E38347
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

7443

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Rejsegodtgrelsen202.adj

SHA256 d2e8e2c5965e5b5411dd82a599f94d4389b89cfe3de703d10e334c2758ad9754
MD5 60893a0fd8f01d597eb33f083ca4804d
SHA1 152100f5fbc7ef15ecf016f3b550df159567040a
SHA512 eba4165f629995b50d3e97d332153565647484b6477b0b775d4af76fbee8f07c70c9d36cd45ac5c568c99a56cfbd9068f2d3331f5ae5e302517f7ddafdc0d2c1
SSDEEP 96:fZp6xkZKyrLBPkwWq7dEjB0wZ8TnSWKGRGup2PQg:fZpKsKyrLBPtdEl0wZInSWKGRGup2PQg
TLSH
T11A534D2D819921E1287A005E296CAE395263633B617CF437B89F435F5135F11EF6D12F
MD5 SHA1 SHA512 SSDEEP TLSH

Syncarpies.Hus

SHA256 22998ee95d6c546c8779d9755b527750c75d2d0fcec054ddb1ff3764db51964a
MD5 3e67884b8a51b026163562fc6c61ae36
SHA1 f55cae24edbe15419a1c7b4ac8bc2a2a853fb44b
SHA512 1bb03f3f80fa926261424f4ce0dd80e51890cf2b79a6ca37e9333435d46e73e55c92d51285b24ddcafea40f58cac9824e9df86da8b23ee7018ea8d5078246040
SSDEEP 3072:nuGZl3AKadTSPvWPZ6FKxBfcCR8HsBr0ShJuce1m6HcU+P2YvW/2E:nuGfadTSPvOYFKxGCqHbe0R1DH1YvW/t
TLSH
T12814D0249CDFFE53F40CD93A4D97001E07DF79A809B2C47BA8FD05DD954CAA01AA4EA9
MD5 SHA1 SHA512 SSDEEP TLSH

keepworthy.Neo

SHA256 fd13fe922076beba4de0cf2a64e491c98577e6cd3aee8d2de4044c675f88a67e
MD5 4c7ef39ae646ef9df05013a1e677f673
SHA1 ef32e1fb9881f35481324d931dc362a42b526890
SHA512 0feecc0b0baa2fbf7d381b8d5cf45fcaa324a1d7c84f8ed217061d24594fd916625f112a7eaccb7124fd717eb58db91b128f86bc2465d170e46a38cdf58c1b01
SSDEEP 1536:SEWFn8Mb4mUIiQVQ6mdRsK21z/+zmON57/CQ8LYpgVCMeUrNCFyQWt:Sthb4/v3rK4N57q2SVCJ8Qi
TLSH
T12CD3BF51D7568CFECD06C53CD9AEB1A64C3870168B4FE4AD7177A814C1832E36338AEA
MD5 SHA1 SHA512 SSDEEP TLSH

sightworthy.mis

SHA256 fc1bf3de0a61fa657d052f5782f1458b38d190645c22c62689249db05f989771
MD5 de3f64327346c944457c013db3c8168e
SHA1 4600c6ca8e72d8723df5d3004e78f19c08878867
SHA512 bc5f39dc4b6fc28104aec11fd3cce7b0c75dd42698ee0c9f9ddf0efbc97b0fe8ce5d6ed200ebbfdea824254bb58cf648c524cfb425b621789273464e40c15b4e
SSDEEP 48:CKbE1ei0tW5cLtkEvjd0TrknZksZsdDNOI8cCTniTQ76O5VzClp75gkIAFe2MmOA:O7IWen5cXOIJQvc5gDUQZHV4Flljf
TLSH
T183435EC99C4E4C72C04C39DE87D17B192F3AE0E01378DAF5B50A6AD25ECBD466809365
MD5 SHA1 SHA512 SSDEEP TLSH

inv. 5234353.bat.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

Rejsegodtgrelsen202.adj

Syncarpies.Hus

keepworthy.Neo

sightworthy.mis

Sharing

General

Malware Config

Signatures

File Explorer

inv. 5234353.bat.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

Rejsegodtgrelsen202.adj

Syncarpies.Hus

keepworthy.Neo

sightworthy.mis