5e9db5d3315b40d2918de07c2ef6fb1228125d200194ea8e8879495acf07d545[.]exe

resource
5e9db5d3315b40d2918de07c2ef6fb1228125d200194ea8e8879495acf07d545.exe
unpack001/$PLUGINSDIR/System.dll

5e9db5d3315b40d2918de07c2ef6fb1228125d200194ea8e8879495acf07d545.exe

IMPHASH 46ce5c12b293febbeb513b196aa7f843
SHA256 5e9db5d3315b40d2918de07c2ef6fb1228125d200194ea8e8879495acf07d545
MD5 4b27440dc8cb57d6b77632e6520af4c1
SHA1 f3ef3854aa7f344c46587b63c93c97d4bf63b9e5
SHA512 4149ecf5c59b89fec9e8e27a21448742955678f838ea695874d85f28dd75a28ea7fe0da9aba8bcbffa8a7f711790e3c873b79ba5131445a8e7b341fe3197430c
SSDEEP 24576:tn3ClvMI4qfv4Qv3K5ItTpT3KfSa2o1HOWfVvc:t3Cxhfv4Qv3qIzrKfz2o1uW90
TLSH
T1EA250181AA50C176D9A602B0DBEBFDF41167BC1FF8A1194B3AE1BEDA3D72160441718F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

13983

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegOpenKeyExW RegCreateKeyExW

shell32

SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW ShellExecuteExW

ole32

CoCreateInstance OleUninitialize OleInitialize IIDFromString CoTaskMemFree

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create

user32

MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW CreatePopupMenu AppendMenuW TrackPopupMenu OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW IsWindowEnabled SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CharPrevW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint CharNextA wsprintfA DispatchMessageW CreateWindowExW PeekMessageW GetSystemMetrics

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor

kernel32

RemoveDirectoryW lstrcmpiA GetTempFileNameW CreateProcessW CreateDirectoryW CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW CopyFileW WriteFile GetCurrentProcess GetModuleFileNameW GetLastError GetFileSize CreateFileW GetTickCount Sleep SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW MulDiv lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject ExitProcess

$PLUGINSDIR/System.dll

IMPHASH 509a34b3a68a773e0afb4259e68f9f82
SHA256 996645d7f16a6294babb6da83478062aed7b72318d7a51b66e90ab5d3edc51a5
MD5 6d08f0d5503bb100b8429fefaad163a6
SHA1 2a79aac2d3b715326c3dcd3c5cf2e33de3632a0a
SHA512 e259b1aff39c533e3e31cf4eb323c8eb22b2beeb5d8ce2c929de30702a6d8ab8076aeacc983d724b05d7d99a6de8c4d239bd159642c7e75fb86faef683360a1f
SSDEEP 192:cjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZr0QPi:s/Qlt7wiij/lMRv/9V4brr
TLSH
T1A9427C1297B089F2F151093819667F2A6FBEAC5C23F405A3CFE304C63D212CB9879243
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Archhypocrisy147.ini

SHA256 09760cbf5570708056d0f4c65918d7f3f5bb0635c94e335a480df65bdf362a6d
MD5 360732b4d1b4bc299990bdd85c9da00d
SHA1 4bb1ecc57fdcdceb11b9a991af5f5a61c072aa22
SHA512 f738af1ffb0db04c737a3d9c8f387ce87f49aff8c517b664f3beb69b1b1f7498d27358ae2d34e08fa4d340fb22d8bbb4314b522729b36d62288d20b91bddf071
TLSH
T1F2E0F1F0C8135D992D1B594B3E4035522F3050914C1615A4B4CE4B8F2807D32D20E815
MD5 SHA1 SHA512 TLSH

Lemur/Reformisterne231.jpg

SHA256 0be1304835d2992d4be26d7bd6317a48c46ab8206986da00d778b894f0e0280f
MD5 7315b7dbd33f41399e66177481ba2806
SHA1 6c7ff3e9fc87ac1158000a206461e18abb215ae4
SHA512 a19d9cdacadc2533e985c8e7250dee3983484e83c62f3d955c3c38873a42b184ec353baef39501e95e708083b5b77517ba73385842b5d43a38752a76b13f7dab
SSDEEP 384:iXpXNw2d740ICGLDGnlK8PjTPQl4bB1euqXP7q4WXcof:iXZNP60IjG48rY4bBkLX24ycof
TLSH
T15352D08E54162229770F8F3A209C5AB683C7FD43D847E13461C16938F668DFC72AC75A
MD5 SHA1 SHA512 SSDEEP TLSH

Lemur/Smalfilmene.jpg

SHA256 e0165490949d975241e3aa5c70b6b6ef5960953ce999ce24dbe5c5ef702629e9
MD5 f4d8a0bdd2109b2d934472dc3fe2abf5
SHA1 eadb41c6add335171aa846d7c6139b76b634d3e2
SHA512 3bfcbec8bf60314878221e0c0398d192a5534c199de963aafdf6cc60791bcf1127366ba336c3d499abb94a6df40a98f6ab751906392ba6c12cd5066b012e463e
TLSH
T1F841194E5D4653A1EFD186BA984932C3E8EC4D56BB9431782121F9F6CB10EF55084CA9
MD5 SHA1 SHA512 TLSH

Lemur/Squeakier.ini

SHA256 939ff398477c8c05cd3e0b25142003d4b8380c2d4bdb4085c2ff7ad410582ae8
MD5 63c0de02c071d550862f8ddcdb81a3f8
SHA1 74112a50a9e9676257ea15ab9ca60251a3357f35
SHA512 aca12500e405ed8102899070f63ef88c41291d362f343fc39ec86f37a0dec576e60d344320e0122114795ee14e64ff6d296c0c538de748bfdb589a517e36fb6f
TLSH
T1F3D0227C81CF422E63D7202A6041C067C040D246E00C962972480B2E408D9A8F6E837E
MD5 SHA1 SHA512 TLSH

Lemur/astrologe.ini

SHA256 f687527784a94e1eca36a1ab41a54fbc2d452867af1d6833d1e40b2f414532b3
MD5 4301672cd4cb76342e12a692c63205e8
SHA1 f719c1dad2b3cdeaa972da41da3319da06eee4c4
SHA512 f254a274e33f23600117c6b39d174975ca0b40918ffed637158b88dc74d348d2ec0ed9616e262e1280f5f8a825679670d9a6878b233947934aa35245fbcf5ad9
TLSH
T150E06A3368817378137D0F9442557D01DF054468172E44183CFCD70D444E07DB85F131
MD5 SHA1 SHA512 TLSH

Lemur/ballonprvers.ini

SHA256 ec42d664327f0b13adf109609dc9399dbeacb010fa58dfb251a48c9c6b8d82ef
MD5 304a8647396a52a1c3d1e1452203d6ba
SHA1 1d077c4b5f479174680e73e785712c643681dbd4
SHA512 06910b660d21d20cfb2f99ea0f44b9c4b331b5a40253f8106e567e4149bc3f6435f3e1a1eb9a6278f151c421097cac46336cc4d2388fa6314654b1bfe794d49d
TLSH
T1AFE0A375DC2E19741F5EAD76FC104EB24158C51AD4290448B115574D7443297E2EF75C
MD5 SHA1 SHA512 TLSH

Lemur/bldtvandsfilter.ant

SHA256 233be22b249547b3a088c1a3306d4adcf93f9292f310da920e1b8438efd9255f
MD5 f01f116c19271768e40c7b7309dc00be
SHA1 817bb791a65d10e7b3a7ccb55a04f2605a91d89e
SHA512 9187e2d0ddef5055f7248b7ccdf1e37585703aae7dbf0fe8281c8eaffadc6305ee1b4c37750359d6ee3fdd310a5bbf08602ebbff01694121b7e93ef87fb563df
SSDEEP 768:7yXWHk8TYzXsGLXR0caNXK8/rXvYHkYXgH7dTgBgS32xn0AIeJeAEkyxwjG1QKiR:M8A4
TLSH
T155C502AAA7ADFFB8D5C26F4347EE394527067B7C1AD5420164EFF03E21C01625348AA6
MD5 SHA1 SHA512 SSDEEP TLSH

Lemur/chlorofluorocarbon.txt

SHA256 9b565291d0234e9b97b3e7b45336b133f6b8fa54bb8b089b35db7a2c9bda2943
MD5 127f4912a3bec4505cd574ba7f92ace0
SHA1 b19303963d77f2255023fcac588c98af5c021a16
SHA512 e5ceb100dce13f6a2ff050bb2d0553b851f97a2f5d6ba93c53e02190589cbab8165adee7728051187886913490e71a8a4b5ace2adb2d8a79c107f0d5d3ff86ce
TLSH
T199F05C00DF24B5522D030A38BBE0591028AE86355911B19EABF6BACDB56503C97C608D
MD5 SHA1 SHA512 TLSH

Lemur/farvesprudlende.skr

SHA256 6cd184345b5455a27ff21eb7cc892dd393e491dc6feb6f8ffc0fd8bfc1af4804
MD5 d1bcb5b9ec5116974258f4520bb4c7b4
SHA1 0b64e03f1ba830185af687d88f5f4a8752eef09d
SHA512 8ebd93014aba47fe5ee2bbcb49af47b5ef938717c0a3b0d2cdf11cb9cdc39902e913c18f615bed62fd6757dd235a92cd92d36416f46f366b649326a64f91ebad
SSDEEP 3072:yZRBG6GITW1XxO32zuXVAlrGuwyCn4iffXfCZKckHK/k41nSBqn3JcUChA4tO/ws:l
TLSH
T1A36612EF7D369E68850CA7B3B28C51C80116D3F2969C4A7E373D9118B70F932699587C
MD5 SHA1 SHA512 SSDEEP TLSH

Lemur/fjerdedelen.oly

SHA256 73e502ec01b06e9bc10e734b056da42432643551dfe577a85a559c74d66e0ec4
MD5 cd73928c171010006dddafabf63100e0
SHA1 3cead603228b914c1926090440125d87dc2657aa
SHA512 3c99fac18038aab1ddd6ed7e7c0b14bb8321c2cd7226157968af4223bf587c3601b77a48dbfc1ad0058ec170d2735a847f623bfd7573b9d2d67519b74f8e122a
SSDEEP 192:1jN95puFz7EwzIS1WCpchFxu1QakaaMZdbmdbU8ZwZBckpulGa+5wW8NjmoJQX0m:tzgtSpoAKPtgY4iCuoXyH6YihYV/
TLSH
T1E96622C4E2410AB9074E50BF0E91D9438FBBAD576AC2CA7C547E6590D2CB9A1AC7933C
MD5 SHA1 SHA512 SSDEEP TLSH

Lemur/stiftsfrkeners.txt

SHA256 60401089c83e59f283e17178dd041f24a264aad794856a740886a4ec13a558a8
MD5 f77542d4e40e833a543942762f66c34c
SHA1 3fc0bf8e54300e8147b202e065ecdd83113ac25a
SHA512 c6541a5e5c6e98e513792659f113085dbb80cd4a06909cf9181e4be82bbe6a498def1f3d23cfee3b9590a24359acb9728addad8e963dc55e73ac74bca2259f6d
TLSH
T1D1E0F1A69E020528FF851135E63329822A0ED5A3092EAFDD72AD039EF8040DB40EC359
MD5 SHA1 SHA512 TLSH

Sgekommandoernes

SHA256 1107b612e7a8f2da5cfdf142f0a20aa851ac37647eb767a03f9ebae8e6baec4d
MD5 f469309eb77ddbd9fb3f37e118a6cbe5
SHA1 c5437ea0bbdb6e663d11884c9422bada6e7d0bcd
SHA512 a8e8a74e964bb01c17d6ceb6707dcb35501c2843aadad64b4b883b3e3f6db2436925883358cf58db5c1452b28ff218437f72ba4f10cab8b078e0ed03659b5873
SSDEEP 3072:SRwRywvjlv4TIbyxU7hndUUCkpWDn8+YSDo1ysajY/fOpSMh8u6:SRulAtxIhzCkpWj83SwysaBIu6
TLSH
T10EE302EBE70E2F37DCB75234E1D2810428E1D06D5B5E66CC4D110AE9D2962CEB7A4EC9
MD5 SHA1 SHA512 SSDEEP TLSH

osages/tidsprioriteringernes.txt

SHA256 c12a2171e8a16548c890ce9dfb5c410d5b1e13ef7ff49d00e2b00192f9bec4f8
MD5 a0484360a86dc99a8137f7fb04fa23a1
SHA1 330a6f899db8be2ff4c391d76c2462f9f2160ff2
SHA512 bedb644366306bdf090c73a5f0d7e5943b3206398441ae0bd7214d41d17a2000c68f05aa7935fdf82bc94d34b89a85f9e9eb18f9f8155cd8e545054721e60556
TLSH
T194012811CC30024919DD16F9FDD35E46C6D8DAD55838C15AEF71870F5010EECD166E34
MD5 SHA1 SHA512 TLSH

osages/tyfusepidemiens.edl

SHA256 c482c231a9b59089c9239a2d50d8020d642fa13201b7e622a64038bf616e4851
MD5 d9c8ff563ff82bfa916956d7ea0e9389
SHA1 e7129101f9df790c2ea9011023a2e32a4a8d4008
SHA512 3042c6668f5bf2480ae9aa076ede8c10bd06f42830273ee7c2822fc66e41f90ac1f8b120da03be18d2da62215853fba17bd97c7fac6b310a5b6aa6b17a4e6647
SSDEEP 192:Unhd3MKtTgC+JuhaQOd8B3sLLi1ejt0duphYkMQPN9W9lbtVLbEprnAp4pTUQbb2:cylmjxonyeqOFTgeAthvI6rye7
TLSH
T1715623530C436648E9B3A84D0F84E4112D48CEA7AB19EFE4EAE704E44EE3157CD65ADB
MD5 SHA1 SHA512 SSDEEP TLSH

osages/unprotestantise.ini

SHA256 ba7da9e1c75cfd159f5cba172f29bee3443cf7ff4622e68f4595a0709fcc26c3
MD5 2d4de0499b275b826aa05ad3708c1d96
SHA1 003d002d7b6686af02bd5cb0efd7e0e84b84352b
SHA512 ba0a758f03ab61592d141445c377385b759bad591acbbedb0fe37f1a2b238d3787af80754da280cf142d7ab022a6d7ecc1648190559716be1e064125ef0ffa1c
TLSH
T173F09740B1AAA62A2906BB64BBA2BD845AAD464615091039F806DF4C740E804F3A6A4C
MD5 SHA1 SHA512 TLSH

5e9db5d3315b40d2918de07c2ef6fb1228125d200194ea8e8879495acf07d545.exe

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Archhypocrisy147.ini

Lemur/Reformisterne231.jpg

Lemur/Smalfilmene.jpg

Lemur/Squeakier.ini

Lemur/astrologe.ini

Lemur/ballonprvers.ini

Lemur/bldtvandsfilter.ant

Lemur/chlorofluorocarbon.txt

Lemur/farvesprudlende.skr

Lemur/fjerdedelen.oly

Lemur/stiftsfrkeners.txt

Sgekommandoernes

osages/tidsprioriteringernes.txt

osages/tyfusepidemiens.edl

osages/unprotestantise.ini

Sharing

General

Malware Config

Signatures

File Explorer

5e9db5d3315b40d2918de07c2ef6fb1228125d200194ea8e8879495acf07d545.exe

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Archhypocrisy147.ini

Lemur/Reformisterne231.jpg

Lemur/Smalfilmene.jpg

Lemur/Squeakier.ini

Lemur/astrologe.ini

Lemur/ballonprvers.ini

Lemur/bldtvandsfilter.ant

Lemur/chlorofluorocarbon.txt

Lemur/farvesprudlende.skr

Lemur/fjerdedelen.oly

Lemur/stiftsfrkeners.txt

Sgekommandoernes

osages/tidsprioriteringernes.txt

osages/tyfusepidemiens.edl

osages/unprotestantise.ini