11a563757a79333564f1eda8325816a621d4f404c282245c8a382f0ec9e2dcfb[.]exe

resource
11a563757a79333564f1eda8325816a621d4f404c282245c8a382f0ec9e2dcfb.exe
unpack001/$PLUGINSDIR/Banner.dll
unpack001/$PLUGINSDIR/nsDialogs.dll

11a563757a79333564f1eda8325816a621d4f404c282245c8a382f0ec9e2dcfb.exe

IMPHASH e2a592076b17ef8bfb48b7e03965a3fc
SHA256 11a563757a79333564f1eda8325816a621d4f404c282245c8a382f0ec9e2dcfb
MD5 693d96e5e78e84dffa825682015ed434
SHA1 e4c82332c18ec8204e754fdf39119f02735adea5
SHA512 8758bf347a123607f5ca7c1beeff4368f99f8dd4dd9fc094937665ee5c9bb0fe31915b7dc15c0101c57a347fc4e21db8310a8c5f5dd340b56b5441426dd01584
SSDEEP 12288:Eq14BlXN3B44aZKwRFyR3oYVkWY04v2yItybWaDC:ElXJGjMwRFyKYVXX4oybWmC
TLSH
T156C402A42BB8CA13F780AA38F1E0F77DAB74EEA81E42D61356E93D4F75353655C24102
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

12925

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetCurrentDirectoryW GetFileAttributesW GetFullPathNameW Sleep GetTickCount GetFileSize GetModuleFileNameW MoveFileW SetFileAttributesW GetCurrentProcess ExitProcess SetEnvironmentVariableW GetWindowsDirectoryW GetTempPathW GetCommandLineW GetVersion SetErrorMode lstrlenW WaitForSingleObject CopyFileW CompareFileTime GlobalLock CreateThread GetLastError CreateDirectoryW CreateProcessW RemoveDirectoryW lstrcmpiA CreateFileW GetTempFileNameW WriteFile lstrcpyA lstrcpyW MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GlobalFree GlobalAlloc GetShortPathNameW SearchPathW lstrcmpiW SetFileTime CloseHandle ExpandEnvironmentStringsW lstrcmpW GlobalUnlock lstrcpynW GetDiskFreeSpaceW GetExitCodeProcess FindFirstFileW FindNextFileW DeleteFileW SetFilePointer ReadFile FindClose MulDiv MultiByteToWideChar lstrlenA WideCharToMultiByte GetPrivateProfileStringW WritePrivateProfileStringW FreeLibrary LoadLibraryExW GetModuleHandleW

user32

GetSystemMenu SetClassLongW IsWindowEnabled EnableMenuItem SetWindowPos GetSysColor GetWindowLongW SetCursor LoadCursorW CheckDlgButton GetMessagePos LoadBitmapW CallWindowProcW IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard wsprintfW ScreenToClient GetWindowRect GetSystemMetrics SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharPrevW CharNextA wsprintfA DispatchMessageW PeekMessageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow LoadImageW SetTimer SetWindowTextW PostQuitMessage ShowWindow GetDlgItem IsWindow SetWindowLongW FindWindowExW TrackPopupMenu AppendMenuW CreatePopupMenu DrawTextW EndPaint CreateDialogParamW SendMessageTimeoutW SetForegroundWindow

gdi32

SelectObject SetBkMode CreateFontIndirectW SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW ShellExecuteW SHFileOperationW

advapi32

RegDeleteKeyW SetFileSecurityW OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges RegOpenKeyExW RegEnumValueW RegDeleteValueW RegCloseKey RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumKeyW

comctl32

ImageList_AddMasked ord17 ImageList_Destroy ImageList_Create

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/Banner.dll

IMPHASH 767a5b32183c6c4ff645882480adc9a6
SHA256 f0339333b6fc5e1535fda3663d75eb221f360da6121942ff41411c1d64020de6
MD5 10a95c6950140ca851e3e72d74553677
SHA1 dfeda48e6c8ea40217689b4057cc187482a1ece5
SHA512 b72b6120835e7fe24d415464d44300c7919f6f08501ed045c12b5bc7f53747e87c99a96069b8f84397ae7858d839d75474f9644229307ef5d039d630da10df25
TLSH
T1C481853BB2F04EF7E563023300831BD325ABE9146B28461E4967A1ED764A9D7D53CB02
MD5 SHA1 SHA512 TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4760

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsDialogs.dll

IMPHASH e2ee55bddad4241d619d6a8a38e2d869
SHA256 067c77d51df034b4a614f83803140fbf4cd2f8684b88ea8c8acdf163edad085a
MD5 0d45588070cf728359055f776af16ec4
SHA1 c4375ceb2883dee74632e81addbfa4e8b0c6d84a
SHA512 751ebf4c43f100b41f799d0fbf8db118ea8751df029c1f4c4b0daeb0fef200ddf2e41c1c9c55c2dc94f2c841cf6acb7df355e98a2e5877a7797f0f1d41a7e415
SSDEEP 192:ob8cSzvTyl4tgi8pPjQM0PuAg0YNyhIFtSP:mBSzm+t18pZ0WAg0RhIFg
TLSH
T1E412F793E5A820B3C2D3533F35BE2B2EC7B95335B0512C0482739A497A6947A6E38347
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

7443

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Opdelingers/hydrocortisone.red

SHA256 3d5cd57150cdda02c327d04c739f2ec6a849a49f1a1e210d61a51fbf9344cec8
MD5 275f743282546296676a42a275764c0f
SHA1 218cd4b9a99971693412798f934c26440e0add3f
SHA512 3b0eca5ffb6a5534ba4b5912e1a5f0e34dc428991bea2370355813b023db374cd8c0288976c8fbe661f6d3210e4f48e946a1a58461b38ac949a812adb9d050a4
SSDEEP 768:yR4BIGtQ7Y8eBEZVCrFbPn2Yxj2DUTpfaWdJaXMPhZLz3:84yGKLiRXnZZn
TLSH
T142A3E1B9EB621C3BFDF8A037E3E329F11D4148A0705E57C42535274A583861B27ED1B2
MD5 SHA1 SHA512 SSDEEP TLSH

Opdelingers/krigshandling.non

SHA256 c7a7959fe2f5fdeef2b39b1b255e75a028d300b03ea4de37a0b5ea97163bfc8d
MD5 a1b87e2e6efdb541e679a72c2b9c3585
SHA1 9e24317ac6f4994ea4f99038efb4e0e528c5b1e9
SHA512 40e185be3853136e0385c77b34ea6a1c34e62e70f3bbe1ec8b6db821cf8ae8e43d665226872624b73fc88a3cfaed9fe2ef50fca9b416f7917f896d55fd89f1f7
SSDEEP 768:+UEH1TEYv82WIwfFMaVNPXpCTvSI9RMVABeottAUG3lPerhcFy71nteywtxIPtz1:+XcgfLvtzV/fOKqwbU5Hc4Dqz6Ll+
TLSH
T14A741272A5390853F4597131FF2B39DB0F94063FB3BCB2D656BBA108F81925938A8261
MD5 SHA1 SHA512 SSDEEP TLSH

Opdelingers/planarias.str

SHA256 984e55c2c0fecf2776b68a2c205b9b48a789f61927a903a8e258a15203855156
MD5 183eb13ef3e173776386955d77f288bb
SHA1 298724245f0cc962661e2508b07ab8ec2c4d5408
SHA512 ad6f237d5e044252d8be6526782b4dfc30fd5678ffcd2e2d5455c6c3c0b394a20d90fc230400e701a13c4ff40d5456a1ab5ccc6c45c29056f7f296518d67357f
SSDEEP 768:krKm9+rbjq8XXvGCtzmTrN1m5wjDnrrGTHe1tEBmyfIfn:HfjqQ5wjznqVIv
TLSH
T18EB3F11F02A48D57DC1E777EA811E6AD35DC0BF6BC0B6B18051A0B263B50EE2071A1EB
MD5 SHA1 SHA512 SSDEEP TLSH

Opdelingers/stickwork.txt

SHA256 b1951d11e401f56ec7528eaa8404b8c28332784f7b930ff589113fede951c34e
MD5 28370ca4544068cab58bccd44ed15124
SHA1 1830bf80cb65de35ca97e0914e378dce75e32a4e
SHA512 7860de5f3f289a099627bd74d45e2921279517f8ecdf66c162b1e31e8601a4d00145f2b9236a792713022085ff3ebcfa3087ab688ad6ae189b2db0c77163749a
TLSH
T15DF023D2E611B5B6F22BCE67EC903F1682D50218400A8D334120131858346ADD37D3F0
MD5 SHA1 SHA512 TLSH

Superadmirableness.Try175

SHA256 37e7b9e4eaf3e13125ad62838b25ce25edffbe3a0fb71cf47e85497cdff8c8e1
MD5 3f549e46116163f2d9a8189ae7ad0cba
SHA1 ec9443f302da84297c243e1bf15b4c96c62ddc2e
SHA512 d5ae815e7a43845c237dc67d663d106ec45f76e814dbad61283aa22e62be8347b0313e1676496c6268d3491b9776bde8f04e8360a6728b65f053f098828ef482
SSDEEP 1536:colsDQnfO+46VY0Etmcdjl30bnlIAmk3+k99n+i1xfELi:c3QnfOP6VyRK9z9nt9
TLSH
T13F63BF10EB51097E5E8523CED8C94F120F284A36A53584EBE3EB139E9046DDC5A3DBBD
MD5 SHA1 SHA512 SSDEEP TLSH

aflytningsudstyrets.Mis14

SHA256 325a8b6a1497f94df2b63e9ac107830eb304a670a200277a9efa1385687204e8
MD5 c90bcc35e236617c43ab9b25f767fe8c
SHA1 68409bd2966dd39ed61ab01c1941b6fbdebc572a
SHA512 5c56895d6698bde9f4aafc884b5143e7f971ec40ffa9af31fddd8a17bad5fdf2f518ddd5f0aeae13632e362ade75660d1da2694dbbe09e3c47291485589bc3d2
SSDEEP 6144:/zG8YbDa7+77X8z/EkywI+XkuCd2KeS6V6flgYDSYvoomPoWmRzM5:/KBna7G7XPwIqkJJ60TWW/msV0
TLSH
T10A7401A9648E9C93F240C138F816C414FBA223F5EE5E94B93055DE624CE7798E03E57E
MD5 SHA1 SHA512 SSDEEP TLSH

11a563757a79333564f1eda8325816a621d4f404c282245c8a382f0ec9e2dcfb.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/Banner.dll

kernel32

user32

generic

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

Opdelingers/hydrocortisone.red

Opdelingers/krigshandling.non

Opdelingers/planarias.str

Opdelingers/stickwork.txt

Superadmirableness.Try175

aflytningsudstyrets.Mis14

Sharing

General

Malware Config

Signatures

File Explorer

11a563757a79333564f1eda8325816a621d4f404c282245c8a382f0ec9e2dcfb.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/Banner.dll

kernel32

user32

generic

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

Opdelingers/hydrocortisone.red

Opdelingers/krigshandling.non

Opdelingers/planarias.str

Opdelingers/stickwork.txt

Superadmirableness.Try175

aflytningsudstyrets.Mis14