1f718cbbd49a4acdb460945eb74a04fe48173802dd4ad1b05873dc63a0839b0a[.]exe

resource
1f718cbbd49a4acdb460945eb74a04fe48173802dd4ad1b05873dc63a0839b0a.exe
unpack001/$PLUGINSDIR/System.dll

1f718cbbd49a4acdb460945eb74a04fe48173802dd4ad1b05873dc63a0839b0a.exe

IMPHASH 573bb7b41bc641bd95c0f5eec13c233b
SHA256 1f718cbbd49a4acdb460945eb74a04fe48173802dd4ad1b05873dc63a0839b0a
MD5 1e00cdfab8f0c96ff7c511d3dbaf2c75
SHA1 e913d3ea7d8289c02d2c111043d93d9a539711fc
SHA512 9cea21f3a734bc7f488fd88c95a17aefc22dedff6978a71c3a31d2cd3ed981203fcedfd290de5573f414278cc9a0178d3f6368f08747d3294dd007968334c67e
SSDEEP 12288:5TA+Q4ew5hJduOwhDvTdU1EpDaY+6Vt0SGZNu49ezMgIa:5TAP4ea8N7haY+kuu8eAgIa
TLSH
T159B422111391D079CD52227952367BFDAEF53C606435970F6BE03E2A3AB0B42ED1EB12
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

13709

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegOpenKeyExW RegCreateKeyExW

shell32

SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW ShellExecuteExW

ole32

CoCreateInstance OleUninitialize OleInitialize IIDFromString CoTaskMemFree

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create

user32

MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW CreatePopupMenu AppendMenuW TrackPopupMenu OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW IsWindowEnabled SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CharPrevW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint CharNextA wsprintfA DispatchMessageW CreateWindowExW PeekMessageW GetSystemMetrics

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor

kernel32

lstrcmpiA CreateFileW GetTempFileNameW RemoveDirectoryW CreateProcessW CreateDirectoryW CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW WriteFile ExitProcess GetCurrentProcess GetModuleFileNameW GetLastError GetFileSize GetTickCount Sleep SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW MulDiv lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject CopyFileW

$PLUGINSDIR/System.dll

IMPHASH 509a34b3a68a773e0afb4259e68f9f82
SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
TLSH
T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Bonfires/Hvirvlernes.txt

SHA256 f6f7d3114b82b298f3a682554e98dc055cbb4170d107e516a6e0487bc74f8544
MD5 371843f9fbd635d6c3ed743614fe828b
SHA1 b4223203201d89acc810a8829b52fa73c7bff568
SHA512 8ca4b43b04793f8467701455be78c1f99e1850f58791c9fb3e5f5a75e2b784710fe38ebb0f7feb638e7d560296e154f4aa426ebf2f7f64d06e537c99ef96117d
TLSH
T133D0E79DCF53340302E219D1CC0040433497875551175DD076160F2DA063276839780D
MD5 SHA1 SHA512 TLSH

Bonfires/Troupes

SHA256 104e4b4b5fb412ceabe83048ec7a1cf7c8b0cc9168a14cdc4164220bed4345dc
MD5 487f0251b36d6f08c3fbb2f1dfc036ef
SHA1 6fbfbbf3fa383d8dcfdbb77eebef702c2fe9fcec
SHA512 dea6eeeff6d2fa735a75cec404cba121f650ab82a85b03635f3ef05a71923583a0d9204bf2dac75a66f84451e7e14cd0bb6a1202969db5f83b099f8f8335b385
SSDEEP 1536:jJp0GZOLqk3sRkWDgXEEJRiDb6TAsj9ZDOg+:jJKj8RkWDgXEsRcOcsj9EB
TLSH
T11253AE92D7650CBBCD16C53CC5FE60E648683015AB0F546EA17FAC24C18B3E367686BE
MD5 SHA1 SHA512 SSDEEP TLSH

Bonfires/guying.ini

SHA256 64fa7fc713725c08e8db6dcb529959267c71f56bc4c4c322ab40be78723056d7
MD5 518b22538ac9de2a8ace8e7a80623a4d
SHA1 2bdeea3e235ac7803803504f1e83d46c3eaf544d
SHA512 fc6f2a946141a14e5a30b0b53b1da2a6097f6f6842edf0bf47ee875450a1ef70a39aa77ba16ad64e25302d2f0f1a82f3065ef372d9f1f13103a3163fcf0d956f
TLSH
T1CDF0E132868C215A8D9A0EA6BCE05C6205DD4318C643603AE3760B4D2406DACC23B616
MD5 SHA1 SHA512 TLSH

Bonfires/helsebringende.txt

SHA256 ce2a4e3bcee27ca41701e929c9e81ec623d7f7f635b9852f1e6981859d0e49b8
MD5 3620bb6dd9a35523886ec9becca1168d
SHA1 e38f6654193f3e25d8f90e6ce0dae443dbdafc55
SHA512 09be81a2647fc4de50b98fc7aa87f05b85f3b2e177c6e0eed9a9584a8a3dac5378945aef4f2bcaad36aeb342c33ab846b8da93cc36175fe2ad53780e4783e32b
TLSH
T168D02E09D5022A6523AA11CB08FAAE8882C8C221C530D810BB9B6380012786CF63E88D
MD5 SHA1 SHA512 TLSH

Bonfires/incoming.sti

SHA256 9365a2f0a70073483480bd752b2d37314e8c897d1f07f79eea51995a70f1b675
MD5 d071f064bda2f90a612a6c365b71ed28
SHA1 c144aed44a3e0a5d1e3a5ba58e1ae691b6783ed3
SHA512 4dc5015ffd7730d97c24451863ac1c34786e56d063c2b2c0084d885d9ca36334f284d15d3f5ce090e0b6b4ccbae7e816ecd9b4f81c5e7acd890ff6750d1d398c
SSDEEP 1536:giHDObCMgw9ni7+8fT2XNSKK9Pa0wp9LiYr738YDKnMLj4aWcQbZfi/ndqIhs6R2:p9
TLSH
T1261612F74F8EA9C2C7D20ED0B0F28D95657344A7BD826509673112EA6BCC789277E40D
MD5 SHA1 SHA512 SSDEEP TLSH

Bonfires/okkerfarvet.jpg

SHA256 ed6b8ff57d344b103d0cf64ebb0e4c758c7a24dc77b7493b15af118718340dcc
MD5 0398e1344f0c5ebe0219bfe6409da76d
SHA1 53e15588ed05e030478aa2f720d140210683e594
SHA512 1c44c29ff8ae337bc80c172411bbbdcddf0ed8f54769da5d7f8cb75e8b180a159ce71bba69463038e761a089818cc17a6931263e8bfd736d87210b093e13dd5b
TLSH
T10141D8A9A39424E8CF1656F2166A2565E20AA4DB39443F30253171E9CB64DFA1289B3C
MD5 SHA1 SHA512 TLSH

Bonfires/posrens.txt

SHA256 1ba934c2d42b013b82df7d0663f0926e04da4e2389d66ababd30e2efc2ac99e5
MD5 8ab73fa7743f46f2659c19562bbce7c8
SHA1 bd4078ed05646021072d77d7712de35056af8316
SHA512 afdf0b50ae104cfed47e88f12db70a863546e2639dd57736b1f8a3f253ceb5e91b38cc7d87c1f1643f62245e03b1a42c20d9ba6f5f1e8cc1347d7a63e80da4de
TLSH
T1C5F05434556B3168184F8EAB0CC2A481882DC773098718B17F52230D5EC5821B33F6DB
MD5 SHA1 SHA512 TLSH

Bonfires/skakker.txt

SHA256 dbf3999dd964e08ef75065ebd8143eb68de49178cd3f20e5a296864d68f1b801
MD5 30bd590294717b55bac748b9135b4fe4
SHA1 73134900f11d40039e441fed8097df90ca2aede7
SHA512 e8272c6dc43030efb31b1a2ae6e4f841b76cb1ce70fbe76785326e6d101ff796476de47c789c0e4c9a2a9157259a8636ea120e79204edf84e399d23c8ec7a50b
TLSH
T176016520AEC6015F07CB4B437EA3D4F9A52A4A06E57B45D1E6DB1F98B88623603F611B
MD5 SHA1 SHA512 TLSH

Bonfires/storkeredes.txt

SHA256 a67b0ee66d49c7daca4cf76068a86880587036a7b8eb04201fe1b518f7df824c
MD5 73768f4e116b09029d43e52c018814dc
SHA1 e14b1e805f16659801259c40f311fe7694ead169
SHA512 9f92472d5540c49bb233763abeaf42971a6ca7d82559607d6bdd75406a7679c74f680221c70c016ad01356ea12b97e509495eb189e59b07feee9952f3c4c91d4
TLSH
T106F0A3198D183D6B9D4B1FEE1C025CBE55470E2A057B8CA5CF81070C5021C71D6ADD61
MD5 SHA1 SHA512 TLSH

Transfusionskanylers/xylocarps.jpg

SHA256 08a4a66f31d414d12ce16a3b0c1199daf6f457b3faefd76370d9b01a849156b5
MD5 2d05147eada1255a65ac4930d3be5a24
SHA1 0babe9a7833ab05c5d755cc69a502cc3afaf0bff
SHA512 78849b7bca229c5cc942c622e0ffada4f6da6e82f2da06c9ae2ecfc5f80c35fe5153a791c454f0e59d2b58ae317d865f6c4520e32d44908bcb668bf5a8dcccd4
SSDEEP 768:+5OLPgpjnAGOeW7uDzbaMNdimX68J13aDccMufgpMdBrebHQ:+5klGw7W7ziCJYhMuPmQ
TLSH
T185F2E1086EEE2D5DDB46BDF5C2C618A79130298DCB6503B0BDD68697E3C6DB884924C0
MD5 SHA1 SHA512 SSDEEP TLSH

diplomatiet

SHA256 6713f27fa43d6cb521ab9107d69193a67cc2777e81ee9a793314aeb5d8fbb36f
MD5 3a4b4fd917347220bd596cdd23171ad4
SHA1 15e47effe31a9aac03cbe716876b749a3eac92df
SHA512 c843da6e3fc860aea284d52ed56e6a3f93003ae6324aa8bda840a99083f4d0997ce3c793e712503dda901783357a4eceb1ed91365fb5b95253ac53e2864d7ed3
SSDEEP 6144:s5uC6EKPI8LCIqSjsKDfhku22mvJflplm/r4xBR:euCKPmIxj1KDJflPYyBR
TLSH
T19044F022F39AC559F2138678C1E3BA9C1864FE27C9E2DCD3A50D1877325BE4C4A7492D
MD5 SHA1 SHA512 SSDEEP TLSH

1f718cbbd49a4acdb460945eb74a04fe48173802dd4ad1b05873dc63a0839b0a.exe

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Bonfires/Hvirvlernes.txt

Bonfires/Troupes

Bonfires/guying.ini

Bonfires/helsebringende.txt

Bonfires/incoming.sti

Bonfires/okkerfarvet.jpg

Bonfires/posrens.txt

Bonfires/skakker.txt

Bonfires/storkeredes.txt

Transfusionskanylers/xylocarps.jpg

diplomatiet

Sharing

General

Malware Config

Signatures

File Explorer

1f718cbbd49a4acdb460945eb74a04fe48173802dd4ad1b05873dc63a0839b0a.exe

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Bonfires/Hvirvlernes.txt

Bonfires/Troupes

Bonfires/guying.ini

Bonfires/helsebringende.txt

Bonfires/incoming.sti

Bonfires/okkerfarvet.jpg

Bonfires/posrens.txt

Bonfires/skakker.txt

Bonfires/storkeredes.txt

Transfusionskanylers/xylocarps.jpg

diplomatiet