45a470f4e0156015e0e7feeffdcaf87979bf9525d350d85bd97c223d9f007b96[.]exe

resource
45a470f4e0156015e0e7feeffdcaf87979bf9525d350d85bd97c223d9f007b96.exe
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll

45a470f4e0156015e0e7feeffdcaf87979bf9525d350d85bd97c223d9f007b96.exe

IMPHASH 46ce5c12b293febbeb513b196aa7f843
SHA256 45a470f4e0156015e0e7feeffdcaf87979bf9525d350d85bd97c223d9f007b96
MD5 67c620efd97ba554777c357882fa1c1e
SHA1 0512e31f8b394e980b4d3031476781757753d43a
SHA512 c970d1f10a9f1839d837ac72b0e7b9f9c96184558bc18000112bcf06e170d75a2d5f9df5d66063e62bf2eada7da742b3382b1ef544c8840183cb426b0988007c
SSDEEP 12288:0X4jwQq23qFUIEy0ldirKsMPnK1tlFbEnS47G8+hjKAyCx2a9xfaeqf/MA9IhJiX:u4jwQqoqFUndtnK1xbEv7LBhCcSx9qRF
TLSH
T16DE423013380EEF9F92687F76D71CE77A469B83C8255497773807F1ABCA18A11938297
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

13983

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegOpenKeyExW RegCreateKeyExW

shell32

SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW ShellExecuteExW

ole32

CoCreateInstance OleUninitialize OleInitialize IIDFromString CoTaskMemFree

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create

user32

MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW CreatePopupMenu AppendMenuW TrackPopupMenu OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW IsWindowEnabled SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CharPrevW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint CharNextA wsprintfA DispatchMessageW CreateWindowExW PeekMessageW GetSystemMetrics

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor

kernel32

RemoveDirectoryW lstrcmpiA GetTempFileNameW CreateProcessW CreateDirectoryW CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW CopyFileW WriteFile GetCurrentProcess GetModuleFileNameW GetLastError GetFileSize CreateFileW GetTickCount Sleep SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW MulDiv lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject ExitProcess

$PLUGINSDIR/System.dll

IMPHASH 509a34b3a68a773e0afb4259e68f9f82
SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
TLSH
T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsDialogs.dll

IMPHASH 3b477381217c97b22146297f93df2a92
SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
MD5 8f0e7415f33843431df308bb8e06af81
SHA1 1314272e6ad3be1985d4a1607b890a34b0bde8b5
SHA512 5450b2070c40b257c28ba9a472d762f91b78928d1e8d4d88e0576992065a61fb9a6513006e6b5947c415c9e02ae80a90a85b58da7e016a424331c8cd596ed684
SSDEEP 96:obEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YHNqkzfFc:obEvCu5e81785qHFcU0PuAw0uytIFc
TLSH
T19D12F892E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

7527

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Bankoverfrsel.lys

SHA256 f03bf547616928bca4754b11b6935b6488b92f68ad5bc5bed89af1c33fed0df5
MD5 bc9d0fb6747a7327d2c65eb455121690
SHA1 743e65fd92469f58fd19d584dcaa1dd50e8107ba
SHA512 b02472675c3aa1fd8463e6ff41e348b92ea78c0bcc1e4c94ffae6cf707fc6ccac25dff7f6e3d23476fe6a27451201cb31c3a44ad149cdf92073b2a796f3ce294
SSDEEP 3072:nZ5VaONleqRazLrjz1DXzOz7UgNg2BwxJoRErB0kvta8fLTPeqbzNP0+3ZgW91:E
TLSH
T18D65E1021FEECC37E26DB09B89FEA1DD18D7983F6556474DC50C524782BD81E2E78509
MD5 SHA1 SHA512 SSDEEP TLSH

Inability

SHA256 2190bc2f0105363327e35ff2180ea21b2ed4e6c7170ab63d1d3d753732026846
MD5 1d819e2e3b0f2af96fcf9753bb9e71ef
SHA1 b0c6a97a20ff39742212842557f4742cc56bbb09
SHA512 87a4e90af8fda31eed796017bcd09e686d930fa072ba92e7dc987fc3ccf3ec17ffa30ec16b0a07a051e112a238fb6250c9a645a35cb7c63abc920f27088f3205
SSDEEP 6144:StXaHC8i//qhZyLCG2HRdOuVm/okRWj3l5yhikT/Y:SlaTi//qZSuVCUl5Y2
TLSH
T10944E161FE9298F1C9CC92B59C16E09FEA6431DE4C0D84E9460FB1D8E7182BBF2C49C1
MD5 SHA1 SHA512 SSDEEP TLSH

fruticant.txt

SHA256 4f436519823415011ce276de78854b662f34ab7fd879c3c36fda0d3a7538850c
MD5 4fbd4477ffb0529d223d27c90baf3e73
SHA1 ee0459ef2851ed39d68a9f782cb82b4ef5cba071
SHA512 5f7a49f1c5955a2c91487d2cde8f99125d377d04b00f9fbc0e1ff16b8b41f6608348ed43bf9c6df28c72fd243cff75833a55893916bbc903af8b9f34ce851f8f
TLSH
T105E0F1135C833BA24AC72554A0205835208C87177B140DD4B1C1FB0F350BBC9C39B059
MD5 SHA1 SHA512 TLSH

ingestion.mag

SHA256 5fd575528787c5ec1e95dea71817398fcb6db1fda43d575884540c83b787e0fc
MD5 6447265d8a08f3583b95fbc5a68b577b
SHA1 b1c482e8ce5dc4630d13b71825ab8a4a6172c7e2
SHA512 d68a253a46a01bd8a8592e62e72df683c5fa6ddc7d011c478a6cd0155f57f653207397f399bb6e4618f79d25064f352711ccd26b3c6c36846f486af4ea4e13b6
SSDEEP 3072:acJsumwkBnAId7JRaDYE4Wb7Uy0SFYdXlRUfE+2HGqNj6NA2DlRuMkd3IVJrW78L:dgq
TLSH
T19B16123E0159C892FD0A8E1C1C183772C9A473E652DC5DD7AC754ECF25746BE2A05EE4
MD5 SHA1 SHA512 SSDEEP TLSH

kassemanglerne.fre

SHA256 e708ef0144c42b8da914b866cf5313fd2da7e0b187bafe71e97879faead2b8ce
MD5 41656073740f15dd978a5f0f14191f0e
SHA1 59d13231be0ae40c58b5d0e12b9e376d96cf8b55
SHA512 d79cff72051826a3b50e6bf4cc659cbbc21497c31a647d1b422d6c1b2c92296ba27abf01b562fc72d7a9ca46820c9b64ead46154ad66db424ac3a2423d2b0970
SSDEEP 3072:3hkkINMNJuixkV/PwHIOy94BQcaVi+3j6RgJNrFLUl7aF2KToTRDTfNiaYZtvMms:9
TLSH
T18B561292D7CF863D3AF655476F9895C326C0890B158F2A9791BDB7C80A928B470C3D8F
MD5 SHA1 SHA512 SSDEEP TLSH

trikinse.txt

SHA256 ed698a40927963349750ee51ac7de5a402c6ae0206d72ea8e427d23c6cd40a3b
MD5 fe76112e534d9f6cc02edc376b04645f
SHA1 10bb3cbab7e7a5684a0e58aa58e745c53d1ca6a3
SHA512 55c1a3c5215f66f84ff9b7e96674a2c1b2e1b53d6a26b152e8fbf0870cb3727112bf0190d037170841d9d397b788e066189f39d2c4c08e5c59cd05bcbeca6ed5
TLSH
T1AFF0C090D8892A649C0696FEED890CC6253C8959EE512711B68B434D84544B953BD3E7
MD5 SHA1 SHA512 TLSH