ccd0a1b439fb4fc8977c48b8361c2d041e240e897d423aa7019fe6efb5410ad5[.]exe

resource
ccd0a1b439fb4fc8977c48b8361c2d041e240e897d423aa7019fe6efb5410ad5.exe
unpack001/$PLUGINSDIR/System.dll

ccd0a1b439fb4fc8977c48b8361c2d041e240e897d423aa7019fe6efb5410ad5.exe

IMPHASH e2a592076b17ef8bfb48b7e03965a3fc
SHA256 ccd0a1b439fb4fc8977c48b8361c2d041e240e897d423aa7019fe6efb5410ad5
MD5 454d4e3e306cb450d303ad19ea19ddbc
SHA1 1c5e03fff10c126f51687c2aa5378e2033047782
SHA512 bf776e757a4d89407126d117174e50f55202bb5120f628f0f1cf37260206dc2f2b9fcc91b6b69176230e5b98ae811f9efdd68f850a6c0b9a3bb080fd2bfe4b20
SSDEEP 6144:a4t6LsCB7fXyMBDmJrmUdLvm/nM/BJM0AqkPLkX4WlpmEgihaA8aVr0Sq5y9GrVm:akCBLXy8mKAS/niM/PLaoi8I0STAtEX
TLSH
T1578412023E90C59BD4754271CAA5E5F679884EF4F72E8F4F0F503FADB872A064B0925A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

13054

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetCurrentDirectoryW GetFileAttributesW GetFullPathNameW Sleep GetTickCount GetFileSize GetModuleFileNameW MoveFileW SetFileAttributesW GetCurrentProcess ExitProcess SetEnvironmentVariableW GetWindowsDirectoryW GetTempPathW GetCommandLineW GetVersion SetErrorMode lstrlenW WaitForSingleObject CopyFileW CompareFileTime GlobalLock CreateThread GetLastError CreateDirectoryW CreateProcessW RemoveDirectoryW lstrcmpiA CreateFileW GetTempFileNameW WriteFile lstrcpyA lstrcpyW MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GlobalFree GlobalAlloc GetShortPathNameW SearchPathW lstrcmpiW SetFileTime CloseHandle ExpandEnvironmentStringsW lstrcmpW GlobalUnlock lstrcpynW GetDiskFreeSpaceW GetExitCodeProcess FindFirstFileW FindNextFileW DeleteFileW SetFilePointer ReadFile FindClose MulDiv MultiByteToWideChar lstrlenA WideCharToMultiByte GetPrivateProfileStringW WritePrivateProfileStringW FreeLibrary LoadLibraryExW GetModuleHandleW

user32

GetSystemMenu SetClassLongW IsWindowEnabled EnableMenuItem SetWindowPos GetSysColor GetWindowLongW SetCursor LoadCursorW CheckDlgButton GetMessagePos LoadBitmapW CallWindowProcW IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard wsprintfW ScreenToClient GetWindowRect GetSystemMetrics SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharPrevW CharNextA wsprintfA DispatchMessageW PeekMessageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow LoadImageW SetTimer SetWindowTextW PostQuitMessage ShowWindow GetDlgItem IsWindow SetWindowLongW FindWindowExW TrackPopupMenu AppendMenuW CreatePopupMenu DrawTextW EndPaint CreateDialogParamW SendMessageTimeoutW SetForegroundWindow

gdi32

SelectObject SetBkMode CreateFontIndirectW SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW ShellExecuteW SHFileOperationW

advapi32

RegDeleteKeyW SetFileSecurityW OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges RegOpenKeyExW RegEnumValueW RegDeleteValueW RegCloseKey RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumKeyW

comctl32

ImageList_AddMasked ord17 ImageList_Destroy ImageList_Create

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb
MD5 17ed1c86bd67e78ade4712be48a7d2bd
SHA1 1cc9fe86d6d6030b4dae45ecddce5907991c01a0
SHA512 0cbed521e7d6d1f85977b3f7d3ca7ac34e1b5495b69fd8c7bfa1a846baf53b0ecd06fe1ad02a3599082ffacaf8c71a3bb4e32dec05f8e24859d736b828092cd5
SSDEEP 192:eY24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35Ol+Sl:E8QIl975eXqlWBrz7YLOl+
TLSH
T1E3325C12135081F3E4918138C86B3A276B6A15029BF98E57DFD39546BE31BE3BD7D603
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10183

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Noncorruptive/Daniela166.psy

SHA256 31e86baa33fe26cb64a41263b0f24c2a483ad0aff4c8abc2e6095abb8ace9769
MD5 db5aa155f527a0f20bbc59bef3201713
SHA1 67aa3801dfdff0c20aa9348ceb9f9843eff2f71a
SHA512 a45d1843e4d08e1f16736280e00b5e6e0f619d477511c029aa1f4cd9a19bbfc54299def8b3290c2bbfc71fb67815b585d573b3de298e2e22fff7170586964737
SSDEEP 48:tk72K8UrVRhAaHqiYyYB0OA/cDD38gwyKkGYKaXkRNy4KwlPJJl12RVV0iFxxoix:XKZrBPHqiI0NYrwynUzOwBJJlYRTXe9+
TLSH
T1AB63E90B323D7458646F4B5BB13D215C28280D57CF5396D261F4E1E84A3AE83C2E5E65
MD5 SHA1 SHA512 SSDEEP TLSH

Noncorruptive/Exorcizes

SHA256 462e21eb0f28840b89c091bf041fda02ac8ffe17e81909a830220b2336921545
MD5 b4708f17c1368674815f1cb85ebca670
SHA1 5899fdcda62fe3f1b91b480efe6cf17a41a7d477
SHA512 c8da9ed47cfef304a5a22f107fddfd3132450f9089373a568fb464b89e52563de2b711bc45a0f3e16f8cb573925a632757a2bb629026b4ac9b06878c46a4da2c
SSDEEP 3072:bKeCDdRuZv1VMc1YUtmqS+L1SMXwm8HmtwAj98Vwo3/FKFiVl8FgRop5420Kgq:8DruNVM9gNFJNwm8HmKAro30Fi7opx0I
TLSH
T18324DFD0FDFE14A3FA2A613AF488511DF57BFEC068A0A0A7368DD157031A46ED4C93A5
MD5 SHA1 SHA512 SSDEEP TLSH

Noncorruptive/Mnstrede

SHA256 5e738605da0fbf0a454cd6b66603d22108e59f5ac1abc4c97d323776acfdeb1f
MD5 1fadb8662e617c63355f1610b249c3c1
SHA1 c8e3b31355f2db1f018fdda270a731b8bb8f29cc
SHA512 185230e8b8bbca4355aae9bf1539fe47bec2541f8eb3da14ab4cbc84517c6ac6908010745ea7f9c1a8bcb5753a724aff403a5dfc1846b816f37149750b0adfbc
SSDEEP 1536:+jQDGaK3lfDBzxWscbVfRNhRJDGdoD8Sq04n2PcdRC2:+8W3FBF0bVJNhR+oDg04n1R5
TLSH
T1A9B3AF86DB56CCFFDC068538C5AD12A28D6970168B0FD4BD9139E824C2473E367387BA
MD5 SHA1 SHA512 SSDEEP TLSH

Underligeres/Margarinefabrikkers/skemalisten.hap

SHA256 439931f0aaa24d3332f84ea45d40f93b56b2948c56be92e78482a1989a491a61
MD5 2ff34998dea0aab0118e1239e551d446
SHA1 286a35bda40b16a5d53a950a66bb7ba0ccade96e
SHA512 7bc68ced725f2be444b9c13c2b7d79e2f3baf1d54f2b5ce23bbd3ebba9ffd32b0d9d5b33c5057689625cb9ceedebb8b58696a6f54b3dd01d4c8fb98f64e40fca
SSDEEP 48:LsHfVmlLsW2PyLc0p314G28TYm2dtcicddrtidRscPIiT814h2+ZKq6f/3OhE:Ls6GGGXU7trEnPIio4h2Wh6f/3GE
TLSH
T1B053F7E0A9B3012D0321A0BB26446DE1A9FE1B1223E3B2A30CEC907579D12BC8780948
MD5 SHA1 SHA512 SSDEEP TLSH

Underligeres/Margarinefabrikkers/snapsetingets.ban

SHA256 5fdca3348172651116726134565e6e46a1e82aadfc9ba57a6fa5333d7329d3b2
MD5 f7084a1fb0f96f967b4977b3fc4c6c14
SHA1 6b6a5bf85ec16aa642d412a3af631dfe41ec7559
SHA512 cfa2f6c5ad8ff247280410e1af568252beac4a28d1c68fa4f3165226edef3dfe0dd955dba10d552aed1e8be972ffa8f2d441c8581b544b4472763d37a9b70efc
SSDEEP 24:Z9ueBJpi58Z1koRYjM+wmr09nMeFGW6yeAZAJf7wgadQ:Z9zi4OjM+5r09nMeFGW6yzZAJ0ga+
TLSH
T103D2DA1083F1F2116236197D058B0E4C3BCCC40A54FE3474C5161BE65152DD8620B823
MD5 SHA1 SHA512 SSDEEP TLSH

Underligeres/affutage.sta

SHA256 6e22059433c4c4beb58c5c237e3cced842e612f959eb9798e16e8e3d1d53ff00
MD5 38f4dad87089422df42ec16bc4afa76b
SHA1 844ac0f5e026d789ee73cefdeb27f5d237dceafa
SHA512 c74c666f699db2b64752049b1e7eacebc28e1732a6368068ef689ba99bf8e77413fa2b3a42cb9a220022093f3ced99902a700ef15f6a174b8e06c2eaa92d86b1
SSDEEP 48:oIBiWqz0i6W8WV1jk13hOOCjgrgRs7eqfClJr00EpmfSSGYA:Bji6HsvEgi7eqqlJpTHA
TLSH
T189231994CC0A56CC9BFC9FD653121A9441EA9C382299380B3676C77C0E65F235307C76
MD5 SHA1 SHA512 SSDEEP TLSH

Underligeres/bioelectricity.udd

SHA256 27696bbeca252447cd36391adf04dc2b446b319a4b06b8e5a48668957d00ef05
MD5 1ae8e9847cd22cd7d60a83f7694d7e27
SHA1 9430a139e39427ebddbc89f59cd23dcdbd79d322
SHA512 63b8ff04dbc602ef4fa6cd0090303233e46446249abc98084b7930bf1fb856c8463955b6c728947e826c84362ee120151b188598e8a6eadda05775651246ec29
SSDEEP 24:acag4YmH+WIYPmiTMrOmR660rm0ujQFmuAioNhy6SBBycYqgyifiqb:xmvTINrOE0r9usVZozEF7gyo
TLSH
T15CB244CF529D62A00F02980E0F765A92E806CCF53427A52A7055401E8B1DE046DDB47D
MD5 SHA1 SHA512 SSDEEP TLSH

Underligeres/skabiosens.pho

SHA256 0f03986409fe5325ab8f446a911eab6a6091ef91f49b4b750468277881bb5939
MD5 4b91e0cea2eb292f21366a1182b70c02
SHA1 a3ee83b9ee8520a4cea9eee716c0c81c9c19cb11
SHA512 56e48931bb59837beff97c10dc6ce09e5fc59f3f6c25cf3a77d6b958b1449d65bbc78c544848055a36e411034359efaaff97c583a13a4d87da75409dc43a75ff
SSDEEP 24:iDogiI7n3qK+v/6JvM7GX+mYLveZxMw54XS7a9HHIjmFbfuiYtlnvEIBpt:so5Wn6dvyYPEyBSKHIjm1midIBT
TLSH
T1D4832B5A3255395F3505BD35A309F5336161D81C33A29CE4A2AAAD425385933B2B6E03
MD5 SHA1 SHA512 SSDEEP TLSH

ccd0a1b439fb4fc8977c48b8361c2d041e240e897d423aa7019fe6efb5410ad5.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Noncorruptive/Daniela166.psy

Noncorruptive/Exorcizes

Noncorruptive/Mnstrede

Underligeres/Margarinefabrikkers/skemalisten.hap

Underligeres/Margarinefabrikkers/snapsetingets.ban

Underligeres/affutage.sta

Underligeres/bioelectricity.udd

Underligeres/skabiosens.pho

Sharing

General

Malware Config

Signatures

File Explorer

ccd0a1b439fb4fc8977c48b8361c2d041e240e897d423aa7019fe6efb5410ad5.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Noncorruptive/Daniela166.psy

Noncorruptive/Exorcizes

Noncorruptive/Mnstrede

Underligeres/Margarinefabrikkers/skemalisten.hap

Underligeres/Margarinefabrikkers/snapsetingets.ban

Underligeres/affutage.sta

Underligeres/bioelectricity.udd

Underligeres/skabiosens.pho