scan[.]exe | Triage™

resource
scan.exe
unpack001/$PLUGINSDIR/System.dll

scan.exe

IMPHASH 1f23f452093b5c1ff091a2f9fb4fa3e9
SHA256 aba5cbb2ccd28f4b6ff7560dd3e30ef803cb5068c28a962ad32e3a011850d3e2
MD5 ba830e58388900f50bf27e6b6c0fbd0c
SHA1 31333b9ec43dbb132e5806c6003383c465ab67c8
SHA512 9ad09f6adfb3c0bd2a9828fa2fe0b70f379e197e42e09d8c3c4d666f155e40ab8be3ef7b6ca0764cd705605529f95ddee9c49d3bac2694d257a9d05a61b0d1d2
SSDEEP 6144:Zp+ggNsm8fQErfR76M90vdnTwQ3K7ZC6F6s0fLQpSQdCISDRMDQsplhrA6:PjmcrrxB05kQAC6Is0cSQAdMDR
TLSH
T16FB4020137519265C6B4CBB090D9E3F3DB6C651E3D62AA377B40DECBBA6D1DDA022324
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

13477

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

ExitProcess SetFileAttributesW Sleep GetTickCount CreateFileW GetFileSize GetModuleFileNameW GetCurrentProcess SetCurrentDirectoryW GetFileAttributesW SetEnvironmentVariableW GetWindowsDirectoryW GetTempPathW GetCommandLineW GetVersion SetErrorMode lstrlenW lstrcpynW CopyFileW GetShortPathNameW GlobalLock CreateThread GetLastError CreateDirectoryW CreateProcessW RemoveDirectoryW lstrcmpiA GetTempFileNameW WriteFile lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject lstrcmpiW MoveFileW GetFullPathNameW SetFileTime SearchPathW CompareFileTime lstrcmpW CloseHandle ExpandEnvironmentStringsW GlobalFree GlobalUnlock GetDiskFreeSpaceW GlobalAlloc FindFirstFileW FindNextFileW DeleteFileW SetFilePointer ReadFile FindClose lstrlenA MulDiv MultiByteToWideChar WideCharToMultiByte GetPrivateProfileStringW WritePrivateProfileStringW FreeLibrary LoadLibraryExW GetModuleHandleW

user32

GetSystemMenu SetClassLongW EnableMenuItem IsWindowEnabled SetWindowPos GetSysColor GetWindowLongW SetCursor LoadCursorW CheckDlgButton GetMessagePos LoadBitmapW CallWindowProcW IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard ScreenToClient GetWindowRect GetDlgItem GetSystemMetrics SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharPrevW CharNextA wsprintfA DispatchMessageW PeekMessageW ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow GetDC SetTimer SetWindowTextW LoadImageW SetForegroundWindow ShowWindow IsWindow SetWindowLongW FindWindowExW TrackPopupMenu AppendMenuW CreatePopupMenu EndPaint CreateDialogParamW SendMessageTimeoutW wsprintfW PostQuitMessage

gdi32

SelectObject SetBkMode CreateFontIndirectW SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation ShellExecuteExW SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW

advapi32

AdjustTokenPrivileges RegCreateKeyExW RegOpenKeyExW SetFileSecurityW OpenProcessToken LookupPrivilegeValueW RegEnumValueW RegDeleteKeyW RegDeleteValueW RegCloseKey RegSetValueExW RegQueryValueExW RegEnumKeyW

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 a632d74332b3f08f834c732a103dafeb09a540823a2217ca7f49159755e8f1d7
MD5 75ed96254fbf894e42058062b4b4f0d1
SHA1 996503f1383b49021eb3427bc28d13b5bbd11977
SHA512 58174896db81d481947b8745dafe3a02c150f3938bb4543256e8cce1145154e016d481df9fe68dac6d48407c62cbe20753320ebd5fe5e84806d07ce78e0eb0c4
SSDEEP 192:X24sihno0bW+l97H4GB7QDs91kMtwtobTr4u+QHbazMNHT7dmNIEr:m8vJl97JeoxtN/r3z7YV
TLSH
T1E0327D1293E044F2F191853C086B3B5AAB7A65099BE24EA79FE381817D15AD6BD3D303
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10647

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Aftensmads140.uns

SHA256 6a1ac6389ac43c587caae450d0b879aada3e416a4936c0867ddfd471bdedaa30
MD5 518651e913a18b5884d65dd441708b8b
SHA1 0dfbe7067451626c8dd896191abaeef0bcb8c28c
SHA512 34c927128d5b9e648ff68f9ec1106e5b1b1a7465ecdaaae81e7929f923fdb48e53487eab6e85686420d422feb0afd57e726da8878d8ea6bea29b664e05538833
SSDEEP 768:mMrHRjXWpis/xcPqJghaOIopdPH93r0ZR:kn
TLSH
T1EAB4D0D767461F02EC18B36160673EB9B88FFBC8D2CCE61E0770EA4E75D5D128816262
MD5 SHA1 SHA512 SSDEEP TLSH

Avocatory

SHA256 057e58b970fb797bcb4fa0cb4ef81885d9192b19cae073cf8ee91ea3ad7d742f
MD5 1aa5cf5b49adabd2ad82a0bf0b52ec85
SHA1 9c5a2c4e3579bee11744b990e198753789416dbb
SHA512 339a264475b22beafa919fdc36c28f6953b10a4c9f3a53b785313c8138ba608d3c3294810d174fd861225344d855b27f79d22cafb294c21a940dbb36e163fe9d
SSDEEP 768:3/ZxFt2bcXV4D6iMgupFQ28CdPdCxa8qVCUVN5jonyS2FyEHYxZXe:BxFt2bCeMgup628CHNNNoyS2DHYa
TLSH
T1CA33BFA7DFAACCFBDD11C538C5AE24A48CA9B015D78ED4EDA1327504C1572F252206FE
MD5 SHA1 SHA512 SSDEEP TLSH

Barskabets/modtagelsers.ini

SHA256 7ceafd584431711340396616c442d677b495fcb231233421fbfb354434f6a43c
MD5 84c397c2d09405b032512a688c9da28b
SHA1 e146b170794ac29d5e283fdc951c0a9ea521d583
SHA512 2a6c5be3ef5c0a7fcf6bcd540c450fc7d1df802952769d134dbe92256e464d71bceb4da58d0378d71dface9b9cdf441b88f446c04f2bbc69e91024c90f6e179f
TLSH
T19DD097481E5B160624030042A0289EC0B033091E8217523CE2AC0F9DE8EC4DFD60C538
MD5 SHA1 SHA512 TLSH

Bothilla/death.jpg

SHA256 e2de1d6f5ba057c33706edb1bf520540afe87d2d5a7b6c996b6e6a8ef1ef95c6
MD5 7d7b80861e05ddbf5ca6e1a2101d6db6
SHA1 30acb92c1fc3e791d1f389ee97571a3567ab9a89
SHA512 16c804a567498231a4da205ae3f19c2bfeea06d9b53097caabce0ec10d9cccb390564dab92fa4edc67cf812e8165a31f59fb4b9d529bdd96cb1ce6ca024f03ba
SSDEEP 768:YT/M3iLpHrhn2AYcKqEGdNVQn3S3yf1gGcwU1sNLtPlWd2E+Hk:YT/d1Lh2NcdlGn3SCxU1ewdxX
TLSH
T102E2E1E60EC8DB438E1C785961EBFF34890DA1A75A1AA3F87135323917C8E7E0911B5C
MD5 SHA1 SHA512 SSDEEP TLSH

Bothilla/graatone.txt

SHA256 71ef452e2241f56b6088ef9af6e1691ed8cda90f0701ff0b029e780dd59f6eba
MD5 ea833ff04473719dc8f82b017f3a446d
SHA1 9e0345267e671c288b0e10e1d8bd22e7a6f3a39c
SHA512 fcd7713ffb8577f08452813542252873e993ac318c802ec35ff4cb46a21a868bde4e7743b46b498aaa4425cae09fe906e65dda334540ef314aac7ac4c326e708
TLSH
T1B1E02363E15A2A257FC34972977355F1E87D89C07530042178BF4A1D814296E3680A18
MD5 SHA1 SHA512 TLSH

Bothilla/knebres.txt

SHA256 9dfed8330b9cdbfa70d6e4ffe316c5f1c16faf9513829fb3e7faf01ca35b59d9
MD5 4b71fc1e095eb407b58603bc0681148e
SHA1 b0d154c693c805dd964b89610c6ee9d24c91d1e0
SHA512 28f827513721c111e1f788b672b3d0edb3c2869de1663d248904416ac549756a600e9c710fbf81edfca2ac8af79ab89bc9bf1955bdd8697f21e1b988dcb14eba
TLSH
T181C02B604E3723A46F05351CAB794CD58397059CF0122280E0061500072F05863B914C
MD5 SHA1 SHA512 TLSH

Bothilla/lgnings.txt

SHA256 22dbb4e26f233994e71ebff7cc13d52ff4a9915615e832942257813c1989493c
MD5 f6d25eddb54a53ac8e8fc0824dcc8fb4
SHA1 c0607b918b2de69905a434740bfb29ad3f963d13
SHA512 5e662550186dafd152dfd5695ea2557517bba611439491eb9f0f0fdb2d473a866b3deb67db60d5677b72da30cdda90e5d54f673e0b4669fc7e2cf12955c5cc6e
TLSH
T158F0DC30FA4449CE5B2F67B04EE352614DAEA19CCC3398E8FA9A410DB7835318234B3C
MD5 SHA1 SHA512 TLSH

Charbocle12.ini

SHA256 0146f01a67d1838ff5ef8c34a5242e7421b313334db80193ae47fee8866ec083
MD5 c348ad562399a3b59f974640a3f9c229
SHA1 b5c32c51baf79f91d3d59b6bb39849ec65f3d894
SHA512 77c04360524cb4261cc808a86ea63e1c161da8d9abad73f7716563b8f9b6e0659e63a072d62b5af4eacd027103db0626cd025f50125d4ed88389b7e39f4d6240
TLSH
T13FE02B38C69B020ACF0D630AED1B8D200D984C281323A012FC1A0334E3039AC8B8854E
MD5 SHA1 SHA512 TLSH

Henrejsen.dan

SHA256 9ea5b0c34b3a95ffd11beb86f0cb47d93ad1d37f456d8d66878af4d859316e05
MD5 8633542fde594b13b13b52e80aba158a
SHA1 11cfe6454c09cd6ed744c01ae36c6c8f4c077508
SHA512 0e21ec89bdffc811e42bac442e1acb9e2cf820a176f178388bbace0f85da1e050f69c921e6b4427380df78a77e721440733a683b75a67aaaddf8dbcead5ed456
SSDEEP 768:bw6TwFnHCJH/26OLrCIJGfPf0gg+9kpETn/CKjTh5r6TfVC:9OHCJHOB49m0K7I
TLSH
T1BD84D17635930A52A6454B0E305BAC7B55DCEE86EFA2D94D043911434DBF7C8C7484DD
MD5 SHA1 SHA512 SSDEEP TLSH

Overstter

SHA256 ba46ad98e0a0653fe6e7a898e32d21e9e8fdf78186d826d17e7a1b317156dc18
MD5 90496994bf99b405f23888095e8e58a9
SHA1 4c56864bb3d3bcec09294adee82b8b07a665a114
SHA512 8f2fa6da4822291a966d12df0d81643da5f8fd38526354e2d6d7dca7ac45045671e87e636f285ec2e9745ad06e353a20c13817ccd150e127ae8202ed79522013
SSDEEP 6144:Ns+uYRSGqv6hN4AgtEOOPxTe83FIMhRe7d76AlWW23ME26:8YELvHAgDuderMPep6AlWh3Mx6
TLSH
T15A44F01BB34DCAA2D60F95BDDCD1AFEF94707F06742910371B49923381C2A869678E62
MD5 SHA1 SHA512 SSDEEP TLSH

Sexliv.txt

SHA256 fd5f1123a265448bedc7e688819452f4e6de196ec0f460baa78b60b27f3f41f1
MD5 d6e716edb739fe493f63599a4ce16c99
SHA1 85d2a2d536ed79b335e83545713be001404a8dd2
SHA512 40785b4b921eb6e2dd946f4cf00c2d990812db617f3932f18b6c49e9826c9b7408fd7223447c5d61236b87bb9b12ba868dc15a4714a12cee9ff9e7def0e1ceee
TLSH
T1FAF0542094A40B320DC0AA41BBC1CDD02225A04CC1C9D06EDDC5421FC1E940C826D0A6
MD5 SHA1 SHA512 TLSH

bryologisk.jpg

SHA256 c0a7f5a4080f1b47cdf0c076001102f4fa132fd83b7cbc33a8d22ee7df9b6f10
MD5 643e1e06715aaa778a8b8bc9ebcb7ecd
SHA1 24e432d1f7b6aee2c95d048c5ea0c414f6279681
SHA512 8e55b920c171412a82cb1e769abd2101b17189da149a6318d359e7eef2c33e28ba5da1b99b57aa42a7d47ddbba39dac4be30bbf081f75472719f3e1da7063987
TLSH
T15E61D657CE085AD3AB0C83FC3A022DF59E0E4750E1226FF309B11F847680EB75E0A128
MD5 SHA1 SHA512 TLSH

scan.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Aftensmads140.uns

Avocatory

Barskabets/modtagelsers.ini

Bothilla/death.jpg

Bothilla/graatone.txt

Bothilla/knebres.txt

Bothilla/lgnings.txt

Charbocle12.ini

Henrejsen.dan

Overstter

Sexliv.txt

bryologisk.jpg

Sharing

General

Malware Config

Signatures

File Explorer

scan.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Aftensmads140.uns

Avocatory

Barskabets/modtagelsers.ini

Bothilla/death.jpg

Bothilla/graatone.txt

Bothilla/knebres.txt

Bothilla/lgnings.txt

Charbocle12.ini

Henrejsen.dan

Overstter

Sexliv.txt

bryologisk.jpg