15c7cf02ae7d2aac1a3d7eb5015d2f387ba3b820f315dc9799e7b847964dcc04[.]exe

resource
15c7cf02ae7d2aac1a3d7eb5015d2f387ba3b820f315dc9799e7b847964dcc04.exe
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll

15c7cf02ae7d2aac1a3d7eb5015d2f387ba3b820f315dc9799e7b847964dcc04.exe

IMPHASH 6e7f9a29f2c85394521a08b9f31f6275
SHA256 15c7cf02ae7d2aac1a3d7eb5015d2f387ba3b820f315dc9799e7b847964dcc04
MD5 a1b82f225e543e784438fec0fe7b5b28
SHA1 234eade4317f742c743f67c5c85952f49a63fdfb
SHA512 fc247edaaa13775a8124170b5e5d67320eb73cc87654c4c5eee972ff2d036861e2a37dbcf5635ec29d6049ff8dbcbd2afe0715dc98a86736053668c53109b35a
SSDEEP 6144:vMm4CCAd/4TGMXA6w+WjYdpQxItQhUY9w39ZZCS9WoUduv:vMw1d/o7XA6w+WIpjGhvOZvWoUdI
TLSH
T18B44028477D8D04FC16690701917ABBB6F6BFC5C1435824B2B34AF9D7B3A2C2692B391
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

13455

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCreateKeyExW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken SetFileSecurityW RegOpenKeyExW RegEnumValueW

shell32

SHGetSpecialFolderLocation SHFileOperationW SHBrowseForFolderW SHGetPathFromIDListW ShellExecuteExW SHGetFileInfoW

ole32

OleInitialize OleUninitialize CoCreateInstance IIDFromString CoTaskMemFree

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

GetClientRect EndPaint DrawTextW IsWindowEnabled DispatchMessageW wsprintfA CharNextA CharPrevW MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW GetSystemMetrics FillRect AppendMenuW TrackPopupMenu OpenClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetWindowLongW GetSysColor SetWindowPos PeekMessageW SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint EmptyClipboard CreatePopupMenu

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateFontIndirectW CreateBrushIndirect DeleteObject SetTextColor SelectObject

kernel32

GetExitCodeProcess WaitForSingleObject GetModuleHandleA GetProcAddress GetSystemDirectoryW lstrcatW Sleep lstrcpyA WriteFile GetTempFileNameW CreateFileW lstrcmpiA RemoveDirectoryW CreateProcessW CreateDirectoryW GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersion GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW ExitProcess CopyFileW GetCurrentProcess GetModuleFileNameW GetFileSize GetTickCount MulDiv SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW MoveFileExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 7a9ddee34562cd3703f1502b5c70e99cd5bba15de2b6845a3555033d7f6cb2a5
MD5 564bb0373067e1785cba7e4c24aab4bf
SHA1 7c9416a01d821b10b2eef97b80899d24014d6fc1
SHA512 22c61a323cb9293d7ec5c7e7e60674d0e2f7b29d55be25eb3c128ea2cd7440a1400cee17c43896b996278007c0d247f331a9b8964e3a40a0eb1404a9596c4472
SSDEEP 192:nenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XBDIwL:n8+Qlt70Fj/lQRY/9VjjfL
TLSH
T1F6427D1193B089F2F590593805A67F2A6FBEAC5C27E44963CFE345853D702DFA47A243
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10719

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsDialogs.dll

IMPHASH 6b5c4f7d679059f68f1269aad3a5cecd
SHA256 6bf9cccd8a600f4d442efe201e8c07b49605ba35f49a4b3ab22fa2641748e156
MD5 48f3e7860e1de2b4e63ec744a5e9582a
SHA1 420c64d802a637c75a53efc8f748e1aede3d6dc6
SHA512 28716ddea580eeb23d93d1ff6ea0cf79a725e13c8f8a17ec9dfacb1fe29c7981ad84c03aed05663adc52365d63d19ec2f366762d1c685e3a9d93037570c3c583
SSDEEP 96:oFsvUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YuNqkzfS:oFsvWyNO81b8pCHFcM0PuAgkOywIFc
TLSH
T19112F992E5A450B3C5D6533A35AA2F2DCBBD5329B0926C00C7738E4D39355B66E38343
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

7527

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Betndelserne246.adv

SHA256 b3933eba5302cd6a53503da2d2c6334077b45c9176262c0281ddf976e009a19f
MD5 c917a479d08dc9bcd4bd2ab7c6b02848
SHA1 af8b96c5db3845d8d148326c1dd045f009e45f28
SHA512 186408cc2dd869aff99a4fac224d952769a67a448482a4c2057511f0dbd9ef66fa7277a875fc4d35eb8b9c267d57b83b2ebd2c6789482435c193033ff0c1b96e
SSDEEP 24:ScqUsV+vVLtmzpMSvanBqfPjH6eKB9yiQQD7aJf9TNVhRpo3s2TVgDcF61Px+cqZ:SXCUkyaytA7ylNtp6hpv6JMZ
TLSH
T1B0732BD1D0B88D93F9375BD01F655A44492B34C232F38D083CAE59B92C41AE16746B31
MD5 SHA1 SHA512 SSDEEP TLSH

Handelsattache

SHA256 078cacf94e98a22f8769db210a18c84c0daba64a877327214a6204644eb35999
MD5 624e3cf3cae9a607b77379333080d785
SHA1 5c47166446fbbd410c0e0160e711e27d253699cc
SHA512 fb4aaf527ce73f18c0b3e0f54137081cc9925655e7187ce0d45609b7281e025848b674de9df6be34066b318c8ebe7440eebb08987fbdea8ba275b1ae1ced177f
SSDEEP 3072:q05hTz+d9a8ZSUuIm7KXCdKYactbQpP0sq:DbSaExfUwv7ctbgRq
TLSH
T11BC3F126D9BA68E5E09C4C35DC189269EB353C6B93E0DD14936137CB21F1CF1A016ABF
MD5 SHA1 SHA512 SSDEEP TLSH

Mandataries.kor

SHA256 91932a75d21d7179cad90b5e7a5d9b6cf17f42979c90c3a95946045f2b616e4d
MD5 87a9c2641e007db302a3a5087e8ef54d
SHA1 63833f7c250dc8e6eb075bc220be143028ecf287
SHA512 32329c55191174f75ee7e2c3d05ba6bc2398ea5634ac947ede00a7611874423ba9dc50f796a276d2e9b82ac0f341af41ef1345c29b23591f80a175fb76136b0b
SSDEEP 48:tjGrymhlGO5K+VwO6BZu7Q6dDJeiI9FtAMVrREui4x:lGmmhllc3HBZu7QIDJe7/tddRE8x
TLSH
T102F2A8D6F22C48CA3966BD2DB94B0F5E3909C250911DCF5C81741B54D162E3891DECE7
MD5 SHA1 SHA512 SSDEEP TLSH

Prostration/Semidiaphanousness196.ass

SHA256 81ba056c87493ce34966ac2da6027fba0c06d84d604957599d6a09c5dbbaa09f
MD5 0a98b4f9f296d827a10b8be8f418718f
SHA1 d57c736eb58354170819d8e144e9da2a3feac2de
SHA512 48de78ba571a9d4a71fad3d84d423de31b24db0ad0ae3f3869567195c7f11a760aa6c00482dedcff5469fbb4f98a41690559e4bfc508cfb86efd23b7973b4290
SSDEEP 24:qhYIkATOnygJA2JCgRbv3c6kDCoQh6LjOao2XcprZkKupjvR2M6HMEIjn:q+IPTOnygJA2VJ3R+TjpXcprZ64M6Qjn
TLSH
T19EC2864C50539BDEE1FC50656188D99CB8099AF9CB083F09217A105637F3639E3C9AF3
MD5 SHA1 SHA512 SSDEEP TLSH

Prostration/alarmklokkens.lyk

SHA256 ac5bfb2b79e2960116a64d74afd4dd51671200ca1c3e1114e2f4fc432fd0f76d
MD5 65492a2902846eb4b2dc274c717fd8d7
SHA1 2f4b3e006d3ca9549c1d229c6c32bf354f1be050
SHA512 c4fec8a585a5306f73def91a758c62ae8400f76be323f45a927bc39af19c39562585945a25ddc8deebf0fb89e53eb88aa3d676849fe3ff418aa9bf1c9e231dd5
SSDEEP 6:6Km2RRAiwQLK72Rb3l9Ib2hx42vD2em2RrK1QkR0KLKqRwQ+Km/ovRYKo:ZBjAi5PdbIS74FeBhICHkU72G9
TLSH
T1FFF197D769EC4BCB028E407006EC2C1859E287B3280D7F02D32C8D12A6F783461C252B
MD5 SHA1 SHA512 SSDEEP TLSH

Prostration/honnrmarch.bri

SHA256 2c288833687a2ac7bf24cf506c427e39d6054fec65186016e6f80ee1ad597d6d
MD5 649cf95b0af6d42988f7bae13fd1b36d
SHA1 06873c3b1b9680b8e0bf15c5b35988f1fdd507d6
SHA512 b41abe029274115bc9c5052c32144d085cccc88568b5463375136e5da79fa7a1603d721d4977fabbe17e60a99c2f042867766769f1d8762c6a800967e216efa2
SSDEEP 24:nDlZEUL6ETMgXBZMu0AVvUqgF+895KraPo1WYVK02gQByHP:DHr6ETVIu0mu9YOP2obo
TLSH
T1CCB26351EB5A20023FE5343AF02B42AE680564B5E7D6965AF003824C876078027E1BD1
MD5 SHA1 SHA512 SSDEEP TLSH

Prostration/liquidising.fag

SHA256 702e3b429f27035a4af724c5723b0f2fd5ed9de051b52eafb0349cf96f9db407
MD5 053726c6a9927d59df2c8c6c7a4dd84b
SHA1 5956a0fa2c1ebe170d164304038787a68bf5032a
SHA512 3fbb8323e1e1920a49165085744b1af0c9541e2a97bcf95564c490bf3c9fe4cc280ba76cb3a30605bb899bba5f061a30e5ae7d26b6f6f9194676a997bbc64905
SSDEEP 24:g0sBRM0vpC+MejHgXjvEaWp+vrqjvWF16Q:g0sBaKDnjHsjvEgD2vEn
TLSH
T123A2683CB3C62C6995567013100F1539783678EF37AC4D4FA731907AAD07E0C5265DB4
MD5 SHA1 SHA512 SSDEEP TLSH

Stvsugerne/regering.unr

SHA256 0411b9455ca145458ec6015c0d93be10bf7e0d70ae8cfb11dbe591bc773d2ea0
MD5 399cfe72f5e6a9920f77989f1845a6f8
SHA1 17e9f14cd27ab195da2dd357580bfb3cec4279fd
SHA512 709deb0855176597c08ec94aa306cb49df56a7c3b0dfe5f9bdb6707094ace58c33db28ff4220880da6845f395712e49b9db2e37e1b800f62b71f9eb9d5d42538
SSDEEP 12:cmJesFGq8UkJL8EeSPR2upqCl70nRSqZdpA3o0MvQUqMlTmn9Qav7iLASzIY:Ms4jU0RPKSj/ELlTm9KASZ
TLSH
T13AF2E9B7C39A50F0DA7F02F57240924385806F3CAC4B58E0E8FDDBE11824DA1E652495
MD5 SHA1 SHA512 SSDEEP TLSH

Stvsugerne/skizofreniens.reb

SHA256 2bed262404c0a892293c42c68aac597388943d9ccfd00a68400f8ab338316bf6
MD5 b3c47790d9ad1b7d05e42d0778cd14b5
SHA1 8c2a972bea0f8aac8001e0ca33c6ce0663bf0495
SHA512 18f9e27107d825469fd090f331db6b64796a0d44a67d2d7941dad2f3bb1d413d2243028d2dcc59531329a275ccd98b0288a78238d56561ac50ecbb19964c54e3
SSDEEP 48:ctHPfkIG3nSSqP5vVZjRQC+vHhLpmdKTAnvyAGX6570Ona849z:KH3ZGiSkbyC+vHlwd/NGq904a8Gz
TLSH
T161531BB76A70C879712C88FDC45126F8FDB1617244D40785FA56D9C7BA5C98D0F38294
MD5 SHA1 SHA512 SSDEEP TLSH

Stvsugerne/solurene.pas

SHA256 e2eacce354d7ea5a019d95eb965604aa14cf39429b8990bba567c2b9ba574abd
MD5 1b257b9c41a10cbff5b21812aaf81a9a
SHA1 6cbc05acece993d4fcf5b3ef29cde2d80f0296b0
SHA512 51181cf6b7648cced4ab5ce04acdd77f65f025d1cc21294729cfcf5c55fde1d9eacc2adcff75500f37e93ad7a386493d626bf28ba990659ba104a2f0114b15b4
SSDEEP 24:ohOmHiasiFipjxuHRNcx8rqQEE0r6YPvocRNg5q2XnqtW:ohXyiFUjOZeQEE0r6Yoc/yq23YW
TLSH
T199C2866439ADCD48C440A8495349729D823A6935720614CD76221EBFD4C3674F6CA091
MD5 SHA1 SHA512 SSDEEP TLSH

Stvsugerne/vikas.fre

SHA256 f5c54d4cc6c509c470373ec1fdb5a0ae745983687a6572d794635315244149e0
MD5 d133ad1bfdebc825c11b9f0da9e74ed9
SHA1 2b0a13044a41f563189bffdd6a87041d73d9db50
SHA512 1ef6533aad866a77b1485785e20a091e036cd3436ccd21f3d69dfddff8a5055d22e8d24b72bb3d29ed8fa8b8caadaf09fca4ea7781b1288846de6c5b61c56e1f
SSDEEP 48:5wixRvz3afgTGebnT6ENtVW/LeE8NdHtKDAzvZXibkkGFSeM+90Jts:5ZRxVPXoQNSgcts
TLSH
T19553EA6FB41D8AA6842D113354F0191CF58BE0B3BD05D8AF2467227327363792496026
MD5 SHA1 SHA512 SSDEEP TLSH

Yndighed

SHA256 5c4c835f2b4806bed93d5e37628676400402494b4adea9fe64ec8d7ffc766a3c
MD5 ac47e69007d0a94ce10f679fd52a4681
SHA1 38394c48d38a6fd4db0b0f328f2ef9701116c6ff
SHA512 750164e89b5a73c9fd5464fe43c5cde88eafefc981aaa871567e0c5a28457ad63a47d7e4f4b80e8dec1f3be215aeb9623e53b5535fcf52e59e39d5f7155209d1
SSDEEP 1536:y4I8ZpwKo6WvgqaVyabpbi6qFepMTYFynn2OsM8CcmqqnGLNqb0lSMXjELC2tg7:5pSgqxaBxq7TY4eM8qEqbGzo2
TLSH
T124E3BF52DB729DBBDD0B813CC09E31F64D68B0168B0FD56D6136A818C1973E367282BE
MD5 SHA1 SHA512 SSDEEP TLSH

15c7cf02ae7d2aac1a3d7eb5015d2f387ba3b820f315dc9799e7b847964dcc04.exe

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

Betndelserne246.adv

Handelsattache

Mandataries.kor

Prostration/Semidiaphanousness196.ass

Prostration/alarmklokkens.lyk

Prostration/honnrmarch.bri

Prostration/liquidising.fag

Stvsugerne/regering.unr

Stvsugerne/skizofreniens.reb

Stvsugerne/solurene.pas

Stvsugerne/vikas.fre

Yndighed

Sharing

General

Malware Config

Signatures

File Explorer

15c7cf02ae7d2aac1a3d7eb5015d2f387ba3b820f315dc9799e7b847964dcc04.exe

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

Betndelserne246.adv

Handelsattache

Mandataries.kor

Prostration/Semidiaphanousness196.ass

Prostration/alarmklokkens.lyk

Prostration/honnrmarch.bri

Prostration/liquidising.fag

Stvsugerne/regering.unr

Stvsugerne/skizofreniens.reb

Stvsugerne/solurene.pas

Stvsugerne/vikas.fre

Yndighed