dbc966bebe3e0c0482db9fdc1d5676120cc8d7252a8af463d4b539260a86a9a5_JC[.]exe

resource
dbc966bebe3e0c0482db9fdc1d5676120cc8d7252a8af463d4b539260a86a9a5_JC.exe
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsExec.dll

dbc966bebe3e0c0482db9fdc1d5676120cc8d7252a8af463d4b539260a86a9a5_JC.exe

IMPHASH e2a592076b17ef8bfb48b7e03965a3fc
SHA256 dbc966bebe3e0c0482db9fdc1d5676120cc8d7252a8af463d4b539260a86a9a5
MD5 3e19dde26e787c4e94c5be1ecc9f613f
SHA1 a07bf01d862f5ac56e138e6f84751ed89bd63037
SHA512 5dc75048f1c3b83b6db31eb24004cd14a23b6bd0f121d83915b40fe4fe8b03772105ca07a7e0ad5b393d285dc4f32744428ea7f657081f211e56b9c3bdf1a838
SSDEEP 24576:LN9+kioQTmkpDRfdLMUvGAu0IoIn2DEV0X1z+At4Yw6ZbWW:LN9+kidRlMUvDu0U2g+X1z+K4by
TLSH
T1443512133A54C527D38507394C1AE3791A47BE65AC01C9AE77A0FEAF39F2351590E2EC
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

13108

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetCurrentDirectoryW GetFileAttributesW GetFullPathNameW Sleep GetTickCount GetFileSize GetModuleFileNameW MoveFileW SetFileAttributesW GetCurrentProcess ExitProcess SetEnvironmentVariableW GetWindowsDirectoryW GetTempPathW GetCommandLineW GetVersion SetErrorMode lstrlenW WaitForSingleObject CopyFileW CompareFileTime GlobalLock CreateThread GetLastError CreateDirectoryW CreateProcessW RemoveDirectoryW lstrcmpiA CreateFileW GetTempFileNameW WriteFile lstrcpyA lstrcpyW MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GlobalFree GlobalAlloc GetShortPathNameW SearchPathW lstrcmpiW SetFileTime CloseHandle ExpandEnvironmentStringsW lstrcmpW GlobalUnlock lstrcpynW GetDiskFreeSpaceW GetExitCodeProcess FindFirstFileW FindNextFileW DeleteFileW SetFilePointer ReadFile FindClose MulDiv MultiByteToWideChar lstrlenA WideCharToMultiByte GetPrivateProfileStringW WritePrivateProfileStringW FreeLibrary LoadLibraryExW GetModuleHandleW

user32

GetSystemMenu SetClassLongW IsWindowEnabled EnableMenuItem SetWindowPos GetSysColor GetWindowLongW SetCursor LoadCursorW CheckDlgButton GetMessagePos LoadBitmapW CallWindowProcW IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard wsprintfW ScreenToClient GetWindowRect GetSystemMetrics SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharPrevW CharNextA wsprintfA DispatchMessageW PeekMessageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow LoadImageW SetTimer SetWindowTextW PostQuitMessage ShowWindow GetDlgItem IsWindow SetWindowLongW FindWindowExW TrackPopupMenu AppendMenuW CreatePopupMenu DrawTextW EndPaint CreateDialogParamW SendMessageTimeoutW SetForegroundWindow

gdi32

SelectObject SetBkMode CreateFontIndirectW SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW ShellExecuteW SHFileOperationW

advapi32

RegDeleteKeyW SetFileSecurityW OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges RegOpenKeyExW RegEnumValueW RegDeleteValueW RegCloseKey RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumKeyW

comctl32

ImageList_AddMasked ord17 ImageList_Destroy ImageList_Create

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb
MD5 17ed1c86bd67e78ade4712be48a7d2bd
SHA1 1cc9fe86d6d6030b4dae45ecddce5907991c01a0
SHA512 0cbed521e7d6d1f85977b3f7d3ca7ac34e1b5495b69fd8c7bfa1a846baf53b0ecd06fe1ad02a3599082ffacaf8c71a3bb4e32dec05f8e24859d736b828092cd5
SSDEEP 192:eY24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35Ol+Sl:E8QIl975eXqlWBrz7YLOl+
TLSH
T1E3325C12135081F3E4918138C86B3A276B6A15029BF98E57DFD39546BE31BE3BD7D603
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10183

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsExec.dll

IMPHASH 0b75f1007d3cc8e457970ae3e3fd53c3
SHA256 c4c6fe032f3cd8b31528d7b99661f85ee22cb78746aee98ec568431d4f5043f7
MD5 b55f7f1b17c39018910c23108f929082
SHA1 1601f1cc0d0d6bcf35799b7cd15550cd01556172
SHA512 d652f2b09396ef7b9181996c4700b25840ceaa6c1c10080a55ce3db4c25d8d85f00a21e747f9d14a3374be4cdd4ea829a18d7de9b27b13b5e304447f3e9268fa
SSDEEP 96:L7fhfKaGgchPzxK6bq+pKX6D8ZLidGgmkN538:RbGgGPzxeX6D8ZyGgmkN
TLSH
T102D1F7B832C20DF3D44D86743F22381717BDD47617B542A1CB932AD61EA2AE2FE21B41
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4231

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Driverkonfiguration/oddment/reprint.ber

SHA256 0b7f0ab1d6ff9be2d1367a8e4c4242d978a2ea750da5bbf2082375d7b7faa082
MD5 5eb8f4db5891e97365abc78582ce54b5
SHA1 661f034c144d378022f40aac2672bae1f90fe360
SHA512 598452b9f7a58758ed9c3f8b01e2db3ae73384df92de65a4ef975ffd49214dca26a5bc7eb6e5829de6140816ea86e258ae4ddea32eb4838a6dba84e849d13e00
SSDEEP 1536:R7swypmuphIBMyi8PFXL5fSXxnQk9H5JH/SFl+eA1IlCwDwsIx2kac4jcJq0edWH:NsjoZpJ5Sh1JfS/+rUCBsIhac4AJpekH
TLSH
T1E6C3121FD16B6587D675D8B74C11784DC70EA31529E2898A79CC3F292B0B4393B48D8B
MD5 SHA1 SHA512 SSDEEP TLSH

Driverkonfiguration/oddment/rump.hul

SHA256 626b1989684bad1111a40b6c83a331b3168c31d8acd6036e98e37fdbadcf2a5a
MD5 3633e928e6c3a81602e8d63a68946360
SHA1 11ff2ffdf765293b9574665dbe5c79ae01c9546e
SHA512 faa31746a4150c93c85147d864d5ebb2ffdba6f22109cccd7f3042f7a67ae91fe9b1dfb2bb9aec7b2bf2d6319d3f2572ab5337ab0345274034977f440503cf92
SSDEEP 768:c4FVWLwqW4THCX3sPmc1KdlldQjg4AjTHmbBH4FTwVfQB46x4ULKpeMZ+sQvtQdO:zFAbEaH4BgIB462nd2Qq94V4TG8+0R/b
TLSH
T1AE53012FA681C366E5588D39483D6AB278FB48D137FE37DB90D6401A84971D0ED844BC
MD5 SHA1 SHA512 SSDEEP TLSH

Moors/Societas/spinodal.thr

SHA256 0bf022047b1e7b2554fdb6e35a1e3f138d69521bd12b3e99e0536ba917428ebf
MD5 a2da075b477d59e64fae239b043422dc
SHA1 5a45e518aa8100458d94c35be4d112ce4430bdb6
SHA512 603d79ceea2e0b2979739b4847fdca08bba603e5b8eca8b5361543ff1ecc7955390d6238415cfd371b51d55b8e9f2a545fb45e42c95bd12bbb9cad2c0e11f08f
SSDEEP 3072:yDj7ff6HvywJxxNLr28qcGdneDdF9lwSIjVkT:yv7ff6RJjN5zBFzV+kT
TLSH
T1E3B3026188E07662E2066F718B5179B73BE084D71BB76C083C72E26F8F2E4E046A457D
MD5 SHA1 SHA512 SSDEEP TLSH

Moors/Societas/undergloom.par

SHA256 e6766cbee0950a3ac1f58a0541f9f1632151bded7ce2a24c697efcfa4025bd79
MD5 e122a624cf38c510bed9952c8ce55148
SHA1 e5c534ea14c7f436612ce2a66fe66805ac5db773
SHA512 73be81050a68feea4646299e77dccdc783cf106ae10969bd97a0a8ab283f1a3a0177d12c0d6a38b65f0582c9a7adce37b8d09afe2a64a2380e8b4902e04916d0
SSDEEP 768:XctZB1tYjlYHpVA3Jnl9lORR/LrCnLxfikvAuLKig:Wz1ttp+3vnORR6nLxIuFg
TLSH
T19BB2D1BE36BD9917DC7E45B877FF915A9934ABC046C6C4D70147F2052427D82CD29184
MD5 SHA1 SHA512 SSDEEP TLSH

Moors/Societas/vaporiform.sil

SHA256 02d70b7e1fd388bc6eb2a7a7825c665fbeba45711fc9ece16c8c223756aedeb1
MD5 e22dcd4492efc4bd518c5136e25e8d90
SHA1 9fa680b3665a149cc92d89cd502ba2cb4567f21e
SHA512 1ad10244fb786a40d47267c0cb38491b47d79d0995ea5fc7442d21108d52b4cd0393b15d08fed6d802dfed13e8a27eac99e64cf59cf4cac99262114d6dbf4e89
SSDEEP 3072:VvZo0dwVQHNoPVzLH3WVEZ6l6RrVOYfD2HtlYZ7K8:xZ0MkH3W+ZJVvGtl18
TLSH
T1C104239471683111D83B07FA151D2AA8F43F5C6DC97279AAA5E231F9EC7F038A20E5DC
MD5 SHA1 SHA512 SSDEEP TLSH

pyromani/Bobtailed.fla

SHA256 b3e100186d1df6aeefa4c761c4502edae57560926bf8cda3060295168102085f
MD5 be6135701a57592a019cc2bd5c93cdca
SHA1 3de01a02c5252524f7a353d9003929365baac538
SHA512 7f3f857e393a67681b5c9578c2e9fa9a3d9a059ad85d6a0abb63ad002f50067d19e0cf806a87138343977059a1795887076bfabbf0bdfea0bda2f7f453af0cd4
SSDEEP 1536:7uQSPMjF4CchNxNrFxMJ5TyqU4HU5cYMAqBgBCY9mUUDE2YuxtbCmpJq13UTywj:7aIFMBFxMJRY4HUQ9g8Y9mUUDBYCtbCO
TLSH
T1B09312E9151C891DF5C19B7536C4EA028A6435011373BBEE3DB7CAD982828CACFF7991
MD5 SHA1 SHA512 SSDEEP TLSH

pyromani/Cosmonautic.afl

SHA256 1ced2d051ea2043c0807475697771a624994f8ac5f26085636352f4cda407d52
MD5 b45da75453dbfe7a332d9548a210b9d8
SHA1 b291ab87640aea3f833072239ac00796bbd7d6b4
SHA512 8cf2f007b004bd7c1f0a3405d2bfaee1f14e112b2162b5ada34b31e0a72685d42f4f429f521d5b49f42b0a860977d78af31234ce1b37a91980933db10d2a9c81
SSDEEP 768:TliBgTeJt5IrNfdPJuxWQ7kGB9NepHOtkGWLZYAqExcy3bM0ukOSt3HaZGlvH/Jr:TMBuAkPbQIG7NGHSkz/7Fg0uk8Zsv9z
TLSH
T12E5302EDABE15F1EFEF6B570D1EAA115FB787C03318AC502BCF11E5C2D040AA1618A58
MD5 SHA1 SHA512 SSDEEP TLSH

pyromani/Raabaandsknobs156.fed

SHA256 e91305db28f66222b72ba5246e8394c6e9c16bebb1ae84c7733dba5016b023c6
MD5 e951ff2dda03aaa34e882e9410e71f76
SHA1 8d73507abd96add56a08c1756bebaa7aea331fd4
SHA512 00f81d0d782ece7358b7de9f68860aa32a89ebdda3c877600467bba8c0e9990a3bac68d3a74f5eaaa1d36bbcad5c0853bac616629f8d08ff0892f0cc84346526
SSDEEP 1536:BzBNQasT3IPWMyY7O2F0tvfv+DRsLydHHmzT3VW9DTcEf7vkxSzcgZE:BbQasc5fyv+2LyE/3ViDTTjvBztE
TLSH
T17A631275FD932345D85270B255FEE5466F84AA67201B0339E18FF62DF86923F5C8C908
MD5 SHA1 SHA512 SSDEEP TLSH

pyromani/Sidenummereringernes.Reh

SHA256 ee18e9b92b4927ee2ee259a5f66fe4c6e41b050e01c2695bc22930d4928a69fd
MD5 699348f9a11dc61415de6917b193b4c5
SHA1 acef53d1bdedad2c525d29d81b505c036dd80a27
SHA512 bf82e0b06357f387a35e7debdb92ca6d8401cbfa89df2bdd2116ece0164f13faa5b59da8dcf3204b73251fea98e9a2e23cbe289143b5e481deae7287ad4ed1db
SSDEEP 6144:SEtusWXWz+B74cqNO1k2bUTl6JGS6umhwTb98y2Kw6nap4:/jzUyNO1AGU/2TbOewe
TLSH
T19F3402DAE66562C1D0881F63158E2E71D4B51E92FBCDE3C48B82E7166F6AC3BD00521F
MD5 SHA1 SHA512 SSDEEP TLSH

pyromani/Thack6.Bin

SHA256 85608fdcc2077bb52dfd0884bc35f7a92f403a0e00493683b8a631412de5bd7a
MD5 c7e5525d217c967f409d36ee862a4754
SHA1 caf25244fe2e97c35e93b0cc02fa5aca61ffe040
SHA512 daa4e8b9d2d8d0fa75be481ca0b9be4a4c3045089117f740b54951c5798a4fe824c59b52c0998c6b1ce650fef3c4d2a14f95fb6e3a2a71cf63519274d63a329e
SSDEEP 768:+/JwEEE/jfdGfQASwBv97qEEE35PHFEEmay6qdVqJ4kezne6+vpGMR7k:+/BRojfCz2ikex+vp6
TLSH
T18BC23D6071C989E0F61A5984FA78FF7211733973AFCA1CD22324B5004BBE9513A8DA5F
MD5 SHA1 SHA512 SSDEEP TLSH

pyromani/hairlet.txt

SHA256 d51d8ec96bf17cfa02a5fb6f224d9b3c691495d3786279cc17a0e237e31dc4c8
MD5 1fd3da90c58618a246f129f1108d064c
SHA1 2c8f3d2e6736ce4cd1c25c58cd51d234a3e6ec0f
SHA512 46c442484160353da53a7ab479e76ae23001762376691e3061e3bf666e00c910fc5010cddc6e596c1e0845e123feb658fcec80a1980801a4f57e505fad3ee0d0
TLSH
T149F00E24EF9D2A42EC311FF1BC429A33193B11143A0904A43760338C3281438E760B19
MD5 SHA1 SHA512 TLSH

pyromani/presbytery.ret

SHA256 e4eb50eeb8c1188e33688efab7e489429155081922ab61ab3487ce57068da96a
MD5 8340a801f095e7a9da61a3da3bfba908
SHA1 3e8b0887f0a54415c686dffe9545585da08dbaf9
SHA512 f933b6af5dd170f25d0e82de749d60ae152397713df1e0098eaddc8f8ef0877a0c436ae863b315a88c670e4551dbe6eefe18a1d7519ca2312ffb482b57932df3
SSDEEP 1536:2pXLdAJHk/+oKYEZ5QV9V9U3Ceq/qMGVw0S+t7T0Zu7amX:0+syYEzuYySwhI7NumX
TLSH
T1559312D7677771D0FEFE42F95BE75E882D28A8023AF15693E9E0D19F9A8C4423002791
MD5 SHA1 SHA512 SSDEEP TLSH