48a0c3b93362dae744c054e94cd1e62f6e02e5f0ae8b3b48ae0ca24c5da51340[.]exe

resource
48a0c3b93362dae744c054e94cd1e62f6e02e5f0ae8b3b48ae0ca24c5da51340.exe
unpack001/$PLUGINSDIR/System.dll

48a0c3b93362dae744c054e94cd1e62f6e02e5f0ae8b3b48ae0ca24c5da51340.exe

IMPHASH 7eae418c7423834ffc3d79b4300bd6fb
SHA256 48a0c3b93362dae744c054e94cd1e62f6e02e5f0ae8b3b48ae0ca24c5da51340
MD5 a03ca2d71feb691db1ce725b9983739d
SHA1 be86d6d149b0b814c45c71131aabdd6375b955d2
SHA512 f3dd02b35631448036b00ab72f539d0dd7dceae9a352c2a79c2f9f9a3e067a95af97e3a735597c4d837d4007c88fe77b1553e8ea58e9449ff5673838113b313e
SSDEEP 24576:Lo0blzGT6ZmeCpRrFH8JmC+KlUunOKZQYuObYX2/tqJahTuIk:ciURrR8YC+MUuJZww3VxE
TLSH
T1D345D09CA8FF4497D77D3A70FBE764794A9392BAE2F22A6A357540214F52F000D0B523
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

13306

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetEnvironmentVariableW SetFileAttributesW Sleep GetTickCount GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW SetCurrentDirectoryW GetFileAttributesW GetWindowsDirectoryW GetTempPathW GetCommandLineW GetVersion SetErrorMode lstrlenW lstrcpynW GetDiskFreeSpaceW ExitProcess MoveFileW CreateThread GetLastError CreateDirectoryW CreateProcessW RemoveDirectoryW lstrcmpiA CreateFileW GetTempFileNameW WriteFile lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject lstrcmpiW lstrcmpW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle ExpandEnvironmentStringsW GlobalFree GlobalLock GlobalUnlock GlobalAlloc DeleteFileW FindFirstFileW FindNextFileW FindClose SetFilePointer ReadFile MulDiv lstrlenA WideCharToMultiByte MultiByteToWideChar WritePrivateProfileStringW FreeLibrary GetPrivateProfileStringW GetModuleHandleW LoadLibraryExW

user32

GetWindowRect GetSystemMenu SetClassLongW IsWindowEnabled SetWindowPos GetSysColor GetWindowLongW SetCursor LoadCursorW CheckDlgButton GetMessagePos CallWindowProcW IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard TrackPopupMenu ScreenToClient EnableMenuItem GetDlgItem SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharPrevW CharNextA wsprintfA DispatchMessageW PeekMessageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect SystemParametersInfoW EndDialog RegisterClassW DialogBoxParamW CreateWindowExW GetClassInfoW DestroyWindow CharNextW ExitWindowsEx SetWindowTextW LoadImageW SetTimer ShowWindow PostQuitMessage wsprintfW SetWindowLongW FindWindowExW IsWindow CreatePopupMenu AppendMenuW GetSystemMetrics DrawTextW EndPaint CreateDialogParamW SendMessageTimeoutW SetForegroundWindow

gdi32

SelectObject SetTextColor SetBkMode CreateFontIndirectW CreateBrushIndirect DeleteObject GetDeviceCaps SetBkColor

shell32

ShellExecuteExW SHGetPathFromIDListW SHGetSpecialFolderLocation SHGetFileInfoW SHFileOperationW SHBrowseForFolderW

advapi32

AdjustTokenPrivileges RegCreateKeyExW RegOpenKeyExW SetFileSecurityW OpenProcessToken LookupPrivilegeValueW RegEnumValueW RegDeleteKeyW RegDeleteValueW RegCloseKey RegSetValueExW RegQueryValueExW RegEnumKeyW

comctl32

ImageList_Create ImageList_AddMasked ord17 ImageList_Destroy

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 6950991102462d84fdc0e3b0ae30c95af8c192f77ce3d78e8d54e6b22f7c09ba
MD5 8cf2ac271d7679b1d68eefc1ae0c5618
SHA1 7cc1caaa747ee16dc894a600a4256f64fa65a9b8
SHA512 ce828fb9ecd7655cc4c974f78f209d3326ba71ced60171a45a437fc3fff3bd0d69a0997adaca29265c7b5419bdea2b17f8cc8ceae1b8ce6b22b7ed9120bb5ad3
SSDEEP 192:BenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XB9IwL:B8+Qlt70Fj/lQRY/9VjjlL
TLSH
T121427D1193B089F2F590593805A67F2A6FBEAC6C27E44963CFE345853D702DFA47A243
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10719

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Punchable137

SHA256 735d9cce6f19941ceb2ecd68604bf710a73978f5b966a9e9497f0df9605e45e6
MD5 ff13f61bf7fb4f71762e77645736060d
SHA1 f3daf315bbd6016e87ee19735b8430d73529ebd9
SHA512 40f8279de2c19aedddd89cc8d7f50f55972dc4e05ea1489d4e8e7b40d7a8d31825930bb976f3cd8d467b0c8e16a22f89ca52e7f45c62b3e91f1f8c25381f85a9
SSDEEP 3072:A6+QJDgQPeVbbawVnY5Fmeke+q+Sf5zm3CWRTF6xk:HcQPeFYSGlhzLU0xk
TLSH
T1C714CEB10EC1F861F77EF6F5383341E8F1599297E22D6078012A5BE0C89C1A7871EEA4
MD5 SHA1 SHA512 SSDEEP TLSH

afrikanerhoved.sta

SHA256 8ec915700a9e05e0eb65836818e8b9e36167dc34a0e9c0e044ecdc6abc1cbb1a
MD5 de177f5eb18e2a99b778c9a0f06cb5f0
SHA1 ff82bd748d8eb33482a7dbada8348ea84de32cbe
SHA512 ad03de126f320a241ec61360634cac9eb171ca7b7b972a39bf767fc0ad07ca387de9d2cfa045dc783100c43cf8060112a6d33c23db5b1db2a2a119884cabf753
SSDEEP 768://EM9xNYAY2z9SUbci2hvtq2c5FQyS4D2PqUvvHWS369D8sWClFK+aZ45lwq2KdW:/I
TLSH
T1FF4502612889111B7DF0C7C6A7E6C744846D8C8AB627C4D0FB0B956F20DC6B5C9EC2AF
MD5 SHA1 SHA512 SSDEEP TLSH

arbejdsevnes.jpg

SHA256 99d89c50d6e51cbe259d828427a88c839234a06d361bff2f67346534194ae3a2
MD5 f495ea87c2597d5a54836961569344ca
SHA1 770ea71a6ee76244724aa3ff852ecfa1f04c8f86
SHA512 89e450f1b30e65219f668a8be7b75afb837179704bcb83fc39ef2459b808245e6b475f3dbebfd95da63893d59459df33bf88ec6cb1c73da88040ef0e89a10b0d
SSDEEP 768:ul7Iv4fBTY16s7g4PRam3NvJoKkfRzVKTRc90YRgLBZYr9wJ1HgPa9U6w:ul7Y45TiyUvOF+6OLB6r9wJVUr
TLSH
T17923F1AFCD1E4B879B6BD3743E1184B9B9A63A8A1D856BFF05310DC96D04C29CC5870E
MD5 SHA1 SHA512 SSDEEP TLSH

oceanografis.end

SHA256 3835137c12eb27dcd1f071d6fd07a929d8bf77fd242c73cc5cc12b75d54947cc
MD5 03055437a1f888e92784f145ec698a00
SHA1 7d7d672312c05c7f81386c9a09f5e68319da5774
SHA512 7db1a4fb0982810717833fa1baebc444651d550be00fc4bb8b2053f04249168940dab7fe27f27026abc00029c943ae42da56cd07f5e229a6cb0a92bb0351aee0
SSDEEP 3072:EcqGSE+v61F1p7URFSYVhmHIksnVLjWwEzYZ2GtbhABHRwcr4MMEY9vYmD3ueIXJ:8a
TLSH
T11A4612F13109E2AF7B4CB249438404B82A078E7C4EDB5B77FD8EAC7A5D4602A1D76479
MD5 SHA1 SHA512 SSDEEP TLSH

ophthalmocopia

SHA256 0e82cbebff71d86bccec7ab9c14d14b9c7a47861fccadf030209d2ef84b66359
MD5 40c8b9d2c2c3f4ef7897b794e4732f15
SHA1 e83b7dcdc97ddf676a0142d90c702582a7cf8dea
SHA512 546a33b1e2abd26dca739325636c23b2cc07093e540fd2cdbee0874fe83c70e89cc50b51468c97ba5b6a95dd4fe937aae7387001403bfe67a30cdc4504d1b7b5
SSDEEP 1536:ca0NkjznpwC/mCuKLgCTbuRtjVGT+g+yzWkjOC6MwEY7z/P:caxzn6COC5KjV0+yzLV6Mw3
TLSH
T163D3BF52C7628CBACC0B9138D09A31E5881D70135B4FD4BDB276A929C2876F367247AE
MD5 SHA1 SHA512 SSDEEP TLSH

potmen.pis

SHA256 e1add967cec10bf5dc73aa6afb9573147f1f71ac5fd4507618e1d80e98412d3a
MD5 fcf27a547aa2bc27480a652ae154ee37
SHA1 5cf9374322eca7db176cd8606954e305c04f755d
SHA512 01200b6dab5657cd9932991d0d11766e53b9209b34695ed3e1dc85c753ceef0241558282208b55da4e1db175039a9f30b2977b734f48ebb5f1e7316e63a39ae5
SSDEEP 1536:nRhKYZZP9iSlvtStLbQvDemvUdqPdfGdlCg1H3HXW33QOBOkDE4YMPtGbF+31ffV:SC8A
TLSH
T13B461269ABE55CFE1DEB31F47F6774F02168403D60A7E3624884BE90F2C5015B598B93
MD5 SHA1 SHA512 SSDEEP TLSH

rensningsforanstaltningerne.ini

SHA256 b9a58224b247be707a5f52521796d8838bfc1f04e57e850a7abfdbf8e749dd5f
MD5 ca87c20edfeb968e4c595dc12c55b131
SHA1 46095abe1be74b81f9bb011a49ffa7998d13d1fe
SHA512 676a7c53e589dbfe95542d98ee63fcac624ad436dabc8be7ec4a35d70c3c09ac4aa117f7967e150a71b68883b9f0207be981854389f775ca06577cb87833967d
TLSH
T138F0D43CC69659391D43991078B40E87856D8341CCD53278F4CA470D342905D972F40E
MD5 SHA1 SHA512 TLSH

ringduers.jpg

SHA256 87d3b608050bffb41738cd38c919440a315b2b6a4afe584aadf4a43429abfdb8
MD5 007e53faaab2c71ba997b8ec50d4902f
SHA1 1dbd6d2b1cdbaa347efe9e068fc3ab9e7be64e11
SHA512 f0054c20b7a00df61df24a47db4c21dd28d86f762e4a309f5865d151bd32bdec9b46c6d4acd90822577244a8b4559a213f194644242d2d9a637b7267d3d73414
SSDEEP 1536:IDzP2g7Lg+yT9B/V+nPdkT8AuzG2EZn5RMIT8:kzD7UDEnPdkTlua2i5lA
TLSH
T17073029E053DD60DFF3218C52495FE1BE1C0735334CA3B252ACF2A35167687AB82D986
MD5 SHA1 SHA512 SSDEEP TLSH

semipupa.arr

SHA256 f6d292319650c84ce3e7e824801b56b66ab8bed6fa0b593f3e7cf90c49e14013
MD5 2d2ba6bded3c898ce62919781106af08
SHA1 22e58dece2d4209319bd31a3e69cdce0f71bc813
SHA512 ba1d11b2f43984e40166855e2458afa41c17ab92a5b0789e27dea28514e8e65d4d3a776d3c1596bb9b23e52b83681bbe164c36a5afb0c600ddc942c4dfb54c96
SSDEEP 1536:ostDaIai/7gdxFXc0ORZWcZGq8g6j0D0sN1BqIWJ2maGSG+GOksldBq7VYwRWmWF:3Ygx
TLSH
T18B36232A21BDAC07523632DAC5E048D706EBC7B320BE3B4EF6B2152460B3591AF7D556
MD5 SHA1 SHA512 SSDEEP TLSH

48a0c3b93362dae744c054e94cd1e62f6e02e5f0ae8b3b48ae0ca24c5da51340.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Punchable137

afrikanerhoved.sta

arbejdsevnes.jpg

oceanografis.end

ophthalmocopia

potmen.pis

rensningsforanstaltningerne.ini

ringduers.jpg

semipupa.arr

Sharing

General

Malware Config

Signatures

File Explorer

48a0c3b93362dae744c054e94cd1e62f6e02e5f0ae8b3b48ae0ca24c5da51340.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Punchable137

afrikanerhoved.sta

arbejdsevnes.jpg

oceanografis.end

ophthalmocopia

potmen.pis

rensningsforanstaltningerne.ini

ringduers.jpg

semipupa.arr