1c3b40e16baa8378b035a428da10fd16fdd13da968c4222325d9bd72eb34b736[.]exe

resource
1c3b40e16baa8378b035a428da10fd16fdd13da968c4222325d9bd72eb34b736.exe
unpack001/$PLUGINSDIR/System.dll

1c3b40e16baa8378b035a428da10fd16fdd13da968c4222325d9bd72eb34b736.exe

IMPHASH 6e7f9a29f2c85394521a08b9f31f6275
SHA256 1c3b40e16baa8378b035a428da10fd16fdd13da968c4222325d9bd72eb34b736
MD5 5a5060bfe6e6b3aa2570756ebf3624a7
SHA1 4db4e7fac0fbe044cd7f60f55db322e24f6cc139
SHA512 b461487a55f7136c831f9cf4924fdc7b0c46487be16e2a1b26079b46cd2cf1e06388864861fff2f4d374f79bcd47aaebebcac91bb865d66532ca958cecc21f4b
SSDEEP 12288:XT/rmFskovj8WI1Rzv3TdPOXfPpitgMkAXfXZJkaCRUgU6gZaPTXVA:XTD3TL8J1Rzv3pmvxitgYfvFMUHMPJA
TLSH
T1C9E4029173238165DC394F31097A8DB12F116D7AAE8049DA72FCBB0EADB5761090F3A7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

13509

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCreateKeyExW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken SetFileSecurityW RegOpenKeyExW RegEnumValueW

shell32

SHGetSpecialFolderLocation SHFileOperationW SHBrowseForFolderW SHGetPathFromIDListW ShellExecuteExW SHGetFileInfoW

ole32

OleInitialize OleUninitialize CoCreateInstance IIDFromString CoTaskMemFree

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

GetClientRect EndPaint DrawTextW IsWindowEnabled DispatchMessageW wsprintfA CharNextA CharPrevW MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW GetSystemMetrics FillRect AppendMenuW TrackPopupMenu OpenClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetWindowLongW GetSysColor SetWindowPos PeekMessageW SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint EmptyClipboard CreatePopupMenu

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateFontIndirectW CreateBrushIndirect DeleteObject SetTextColor SelectObject

kernel32

GetExitCodeProcess WaitForSingleObject GetModuleHandleA GetProcAddress GetSystemDirectoryW lstrcatW Sleep lstrcpyA WriteFile GetTempFileNameW CreateFileW lstrcmpiA RemoveDirectoryW CreateProcessW CreateDirectoryW GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersion GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW ExitProcess CopyFileW GetCurrentProcess GetModuleFileNameW GetFileSize GetTickCount MulDiv SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW MoveFileExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 acf90ab6f4edc687e94aaf604d05e16e6cfb5e35873783b50c66f307a35c6506
MD5 6e55a6e7c3fdbd244042eb15cb1ec739
SHA1 070ea80e2192abc42f358d47b276990b5fa285a9
SHA512 2d504b74da38edc967e3859733a2a9cacd885db82f0ca69bfb66872e882707314c54238344d45945dc98bae85772aceef71a741787922d640627d3c8ae8f1c35
SSDEEP 192:MenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XBaIwL:M8+Qlt70Fj/lQRY/9VjjgL
TLSH
T1BE428D1193B089F2F590593805A67F2A6FBEAC5C27E44A63CFE345853D702DFA47A243
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10719

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Distancering/Faggingly.ini

SHA256 da018c7e6b63b753a8999b62364eecc9b1cc672bc91bbef95414a0a76eef69c0
MD5 9d3d191ee45de7a15aac5a5d5b119f04
SHA1 d9136f580dbfc4d932ed5adbc0fba584a64530a9
SHA512 2d66479af0dfbe8013e77912ccfa5c78938357863e794a8d661f3fa4cf607fb0f0f6d61bb437465767e93341d65831d212057b9d82dc35c0898d190fed15ac0a
TLSH
T1C4D0233A13CC1700CFA82F7599005095F72C50110CC1320DAAB701C4CF10043427307C
MD5 SHA1 SHA512 TLSH

Distancering/Havnevej.spi

SHA256 b16e0884681e87103612a3157d37e3c13f155620f9fd0ad1b24b810c77ec4aec
MD5 a372886ff35e23bd7ae8bf8f30e407ce
SHA1 a03dc270dc68ecccb1dc7e2c274055c1159aeaf5
SHA512 6555bc4fca4145fd8ac7b45dd6632c92180a5489c5a3bed82255eaaf594821660f339959e1334d2d4040e45467cfa2faa6a003df28da4e662286a10b98bfdc97
SSDEEP 1536:M4X+JTEXTnJvK3n4eImhSb4JCbY72q145rEl2FgqsRq/5YnIcYSSqAAxDG/GQL6k:+NEFvK3/lS6b9f7pyX6je
TLSH
T1119412333D00EE997D29345A647FF9DD88FDA862B646682FFA359F20843D7428537105
MD5 SHA1 SHA512 SSDEEP TLSH

Distancering/gipsplader.txt

SHA256 f208eb412b6c585c62340f7d2adc3720c5f7c61adc2d73586c2e6e5d200b754a
MD5 98640886a48ce9f43606e8131e849fd2
SHA1 6f40719e86e17a0e693f6c5f48e255f690fb8dac
SHA512 f1c32dc23e3747dd502ceed75339c1d1c372a68e577a5b01722961dc46778cd9a110a8b6579602f4a4aa3677d2b06f91029977d4a1e9d1b9efdc4c5d5eb675c6
TLSH
T107A002AE21478115CAF33D49C24509C586AE564AE5B340D8B4894FE2386B519C09E81D
MD5 SHA1 SHA512 TLSH

Effektiviseringer.ini

SHA256 9ba12b3ea0818a60dfef9146bd5ce227606fe1660e3e00034b760341499e0c45
MD5 b0dc7129d4143b4d0271f334281b6e48
SHA1 129c67e9826954ce0602315e6a8cc9c0873d5856
SHA512 5d79db60479555705b6056604de78f133e34badf0d9e8ee95c2f460e9bcb805ca97790f0b84421b559eb70cafe7b626a1d48f753549cd0517a2c821a52445495
TLSH
T122E0A360DC1052B74E9613E33C61C907445971437872297E65D307DF057CE84AB2E01F
MD5 SHA1 SHA512 TLSH

Overpot/syvaarskrig.txt

SHA256 ee65169eb9b4db09be2f1d7cebae7154b6f9ce7720959334df91f245e01ca581
MD5 72e98cc58c662ae86809d7f200ecfc08
SHA1 3a997c56aac320ace360df1ff3de0e1e2ca5cf9a
SHA512 97098f31f9930458f89779c937400563709d8d8b6dc40d2a5fe6ff9bd86c20a05d73f1f097d0836a97b34fb3928d0f61f09cc7e969728c0cc040032e5a7000b5
TLSH
T192014121D1A40E44CC47023BFDA846640C8DD100575B51F5E1FC276E571162CC13DAB5
MD5 SHA1 SHA512 TLSH

Russere.Esk

SHA256 4ec4deb5a560d749cafb60a5673773039146088ee165b7d9ce1b8d5fb30b5e36
MD5 a24c194abee9a5c2c76c9e4d92f30549
SHA1 475cc50822f84892ca42d2416fa9fe70f5d7c4cb
SHA512 b43433ca4d565662452e655d7db5315403665074c2bf82ebbd58141efbd1d7aa48492ff7596a0fd8918d993530491b0308d53a2c5e961a6eb020d84d32bd8b91
SSDEEP 3072:00kS23E8yfY0dmwEzOY/q25DyeFwOGQvdrNye2:USV8yfY8mwu62MeFw7Qv5Nye2
TLSH
T1B5A44E5075C98AE0F61A5984EA78FFB211733973AFCA1CD22324F5004EBE5513A8DA5F
MD5 SHA1 SHA512 SSDEEP TLSH

Tchads/kindergarten.jpg

SHA256 8b6eb5552b7d530187360922fb8e8b1d956b04e1bff198277c62185ebea63d4e
MD5 fc968589649d8aa78bbc1d82b4ca16a2
SHA1 b9c87103cccd97c1af676e1d59ea52fd0f1b8dc1
SHA512 43037ce5e786c6d30ae885a6dc3d2699b361ab4e77a8949ea9938008a6f0c58e89d0a2aa0044e0f26b755df0f78d037e29ed08540ec9ba6c035f7867baeaf92c
SSDEEP 192:L8TUv7yDCDrs18umf+zgZTJ5ZcM0oOK7w5iBs/4Bm4LxAEc/Dus+xb6bmJMpJQjx:4TsSwQ18Nxl2M05x5lwxzcdufJoeB
TLSH
T14A22BFC0265B5829CF6A4BA222265E7ECB74A6C174E49A341D90759EB4C5FB2CB08D22
MD5 SHA1 SHA512 SSDEEP TLSH

Tilbudsavisen/ulvetimen.sto

SHA256 58258be1ea69d5b8cd15e2d5c0e5c97ae20e720716168067c974e5ef59804a9b
MD5 3a0e78f5a8845a71040a95bdf38b42c8
SHA1 b4599aa271c348b56ff21db47acb99951e5e3d53
SHA512 a612e15f15e3d570493e5d688f335ee2b3e3fdf149a20d657101c98a7a1065217c09d98b9aa9c052c802ff17ffc5c279f66a5183b771e06f2fe51e94cfc93484
SSDEEP 384:LAze8+7/xryLZQ0qXSxxLKJ9o+cKoa58rwSpLH5+AEkiaNZe:cz1G/SQJSxxLKJCKoam08vLne
TLSH
T1AF53E1091A9236E87FEF29F7B8CD3D88C07BC56DBAC3DDC7943DE00A41B19848525098
MD5 SHA1 SHA512 SSDEEP TLSH

Tilbudsavisen/undermennesker.sub

SHA256 7183bbc0e23d9d07383e330fa10a48755c0914f319cc6dd0ba11c5535069ba9a
MD5 b7c1ddd9bbbc075286602bc26749a966
SHA1 e6b3f2782a0d40b8f3a0647ff40126c92129615e
SHA512 c8b6dea1f23608d2f6d4da30ffcb59303b5f80ff67a427c3457d91ff5e9cda4546dae0b51276b5ec228b97a56e81c97f02dbe70ebdcc846b2145cbcf5136a2eb
SSDEEP 768:rpL94NQa3vGa26mM0CleGL2zEdlPg2+GyZaq7zrMIRlPtW0pP2v2jnhLR7NCbw/:VLCzZLF2D7bXVDd
TLSH
T10414F1A6BEED961DAF50913F18473C9B780D05A2ACC6F2811512ED1ABE84C115FF70AF
MD5 SHA1 SHA512 SSDEEP TLSH

ursprogene.Kal246

SHA256 9fa06b4aeef278501256d1aa3b51b601a81aac55e324b0bf31513d3e69e24616
MD5 85d8504d0476f3e70084f37475f0696b
SHA1 8fb10bf2211abdd3cc349637c3d114a74beadf86
SHA512 cb91f367d10fa76135112bb0978b59f1310e523abe75a7dc569233a206d5963f797715d6bb3ff6aa3b3d616957546ef40c0f40cdd31fc49393ec60ce0fc6b902
SSDEEP 3072:U/2hiaxoOC78z9xqoIqZNAWC6HMPJ94jgWObQGkYdZX5AHe55su:U/QuOCtoIyNAz6HAJOjg8GDXJSu
TLSH
T17B24CF2352A2A417C9471138EE99F3FCC0F2DFB14E4D60379038725F6F35A94BA5899A
MD5 SHA1 SHA512 SSDEEP TLSH

1c3b40e16baa8378b035a428da10fd16fdd13da968c4222325d9bd72eb34b736.exe

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Distancering/Faggingly.ini

Distancering/Havnevej.spi

Distancering/gipsplader.txt

Effektiviseringer.ini

Overpot/syvaarskrig.txt

Russere.Esk

Tchads/kindergarten.jpg

Tilbudsavisen/ulvetimen.sto

Tilbudsavisen/undermennesker.sub

ursprogene.Kal246

Sharing

General

Malware Config

Signatures

File Explorer

1c3b40e16baa8378b035a428da10fd16fdd13da968c4222325d9bd72eb34b736.exe

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Distancering/Faggingly.ini

Distancering/Havnevej.spi

Distancering/gipsplader.txt

Effektiviseringer.ini

Overpot/syvaarskrig.txt

Russere.Esk

Tchads/kindergarten.jpg

Tilbudsavisen/ulvetimen.sto

Tilbudsavisen/undermennesker.sub

ursprogene.Kal246