92b4d4fcf62df03ff908adc43c39189ccd71ba78c7e61916985a80815d4ec18b[.]exe

resource
92b4d4fcf62df03ff908adc43c39189ccd71ba78c7e61916985a80815d4ec18b.exe
unpack001/$PLUGINSDIR/System.dll

92b4d4fcf62df03ff908adc43c39189ccd71ba78c7e61916985a80815d4ec18b.exe

IMPHASH b34f154ec913d2d2c435cbd644e91687
SHA256 92b4d4fcf62df03ff908adc43c39189ccd71ba78c7e61916985a80815d4ec18b
MD5 9a5ef62a2495c56d93187644f4e22fa1
SHA1 2789785b618d651138b6f797b1f0b36f7abce850
SHA512 fec7f81bf7dc3a412ce9ce7cbc1439f7e4a7722a6a20aeed7bd7167d5bf390491ab714d12aefa84cb43f2c63742dcec41a51505b7bac5b064dfe680804406230
SSDEEP 3072:yWJ4TJIR1Djt+ul45dkDaJOdo7Xq2/Vg7wIRESO90DxfoduYniDVPwSTSeMgN1r7:ymGIhxAkDYOdoXmMWmO72AkgN1xF
TLSH
T17F441210A714C157F1A357303C299DBE1FDEF8140064BD076795AE2EBE726C29A0FB69
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

13199

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetEnvironmentVariableW SetFileAttributesW Sleep GetTickCount GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW SetCurrentDirectoryW GetFileAttributesW GetWindowsDirectoryW GetTempPathW GetCommandLineW GetVersion SetErrorMode lstrlenW lstrcpynW GetDiskFreeSpaceW ExitProcess GetShortPathNameW CreateThread GetLastError CreateDirectoryW CreateProcessW RemoveDirectoryW lstrcmpiA CreateFileW GetTempFileNameW WriteFile lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject lstrcmpiW MoveFileW GetFullPathNameW SetFileTime SearchPathW CompareFileTime lstrcmpW CloseHandle ExpandEnvironmentStringsW GlobalFree GlobalLock GlobalUnlock GlobalAlloc FindFirstFileW FindNextFileW DeleteFileW SetFilePointer ReadFile FindClose lstrlenA MulDiv MultiByteToWideChar WideCharToMultiByte GetPrivateProfileStringW WritePrivateProfileStringW FreeLibrary LoadLibraryExW GetModuleHandleW

user32

GetSystemMenu SetClassLongW EnableMenuItem IsWindowEnabled SetWindowPos GetSysColor GetWindowLongW SetCursor LoadCursorW CheckDlgButton GetMessagePos LoadBitmapW CallWindowProcW IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard ScreenToClient GetWindowRect GetDlgItem GetSystemMetrics SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharPrevW CharNextA wsprintfA DispatchMessageW PeekMessageW ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow GetDC SetTimer SetWindowTextW LoadImageW SetForegroundWindow ShowWindow IsWindow SetWindowLongW FindWindowExW TrackPopupMenu AppendMenuW CreatePopupMenu EndPaint CreateDialogParamW SendMessageTimeoutW wsprintfW PostQuitMessage

gdi32

SelectObject SetBkMode CreateFontIndirectW SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation ShellExecuteExW SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW

advapi32

AdjustTokenPrivileges RegCreateKeyExW RegOpenKeyExW SetFileSecurityW OpenProcessToken LookupPrivilegeValueW RegEnumValueW RegDeleteKeyW RegDeleteValueW RegCloseKey RegSetValueExW RegQueryValueExW RegEnumKeyW

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
MD5 0d7ad4f45dc6f5aa87f606d0331c6901
SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
TLSH
T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10643

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Aflednes

SHA256 2edf9e839e9ab5f99ae2e126a44e07a65946660c55973f69d1b3dd3288fd78c5
MD5 dd35f8286e59708feeca310f6680ce44
SHA1 12679c27f493e13064b6d15aa7da44c5dfa51957
SHA512 f6422117cce00081c62ea08d150458f81e436253a533e2728f1c3f3d622eac43fc9177fb9b974f2fd307ee03b57f89d43eb8f72b8ef92e342cee6cdc28098c9a
SSDEEP 6144:ECYlD7Qbxy2/S3oGo0ZVhRIZLFBLjHN3k:oNQbxyVoGouVhCBj3k
TLSH
T12324F152A89CFAEBCD6223B75C2930125E743C227F8A70430B4E6E54D9FA51B6347372
MD5 SHA1 SHA512 SSDEEP TLSH

Interfacet/Ufremkommeligt/srvers.amt

SHA256 5d8453263f4a76840afcffcb056aec71e556cdd9f0d632787fdd216854e6bcc0
MD5 fc6d6301b9d873f72f9f1b73ee51c025
SHA1 29d31261acb8d0ff1950166c3b0d12bad1fc0bb5
SHA512 6068e99952ac9d07c6031688c4ed623e70a6625ce10a3aa3b5b01cb4b6025f8f8a651da25be95c2c1dcebb1948194c54f74b869830dbb39ddbe1005fd4ebfdc0
SSDEEP 48:UGrsthaZX5XQzQhsupGVhw25AwvNxRPguUlwEsQDMLaNUv14nR:UGrQS5XQUhsuqT51zPguUSEsQmcUt4nR
TLSH
T1CC03D7C6BD7F5865469B723E11468C4059BBE53838F730733028C6B0D5413041450D6D
MD5 SHA1 SHA512 SSDEEP TLSH

Interfacet/Ufremkommeligt/ssterkages.gra

SHA256 07666192eb92d1249bf2da795517e187788ea0da902ffeb6528b7c7c7792b9bc
MD5 00d267d5b46cae17846fd3b8617e0428
SHA1 575f4fac2e944328ecada13514d4820fa8ff77c9
SHA512 0ab1b99bcbddfac96f87658b9f3b08c13e2c5575a4d5fec4f653a6a104e9b31259286e4bd6df86712155b749e59c6c4a7698ab8df16f3fc85b931f0f1d911d38
SSDEEP 24:NXx80mqzbX/i0OYYeswEiKKoE5dA0T78Dx09P/t1XW/6D5etx+Cv:NhCqzbqRYY6Ei2E560ngS9jXs648Cv
TLSH
T1EEF2B282B9A6B187CF00C0498A0AF82C3599A7842CBF8CC8CD62E60E16A3F692116030
MD5 SHA1 SHA512 SSDEEP TLSH

Interfacet/misjudgment.ali

SHA256 1d3a5085dcf0d501a81cc9f794011fc0069771e3a0b9dc7cae38a55a4799f611
MD5 01b93d633ca12f916fdead76ae395b9e
SHA1 af74ed748856fdd0521ebf3cd9df48bce35cc9a2
SHA512 e8ec3290019ba2efaad7eae6f5fb170c8ea6cf704f8be3532a1d9d9adbfc27fc9ac0cff19254ce5c4168c90501fa6133f62f600c263ea187c50b12d342803d9a
SSDEEP 3:pH281JMSH4AeHHwJpvJshpJJzJMJnJGJpKJQHH2HrJInHcrJS2JrJI7Jn8HJHDJV:08gSH3p1MYM8NPAMn
TLSH
T1318180B4565EAB9217F92B52504E752A440A11814125912496A0701246D4B715B58804
MD5 SHA1 SHA512 SSDEEP TLSH

Interfacet/sallowish.dar

SHA256 8340c5698ac49ef8e6fae9c0963338fb465edabdccdf50465659c1876e9848ed
MD5 7dd1515d33e426782a6605390ba8ca0d
SHA1 33f272e93fa3caf2e2f5e97d2d29463773fc38fa
SHA512 8cccee894f9dacbe2c56d96b7b1b52f67b837b62028c66bb0f8c139004716a74d055aa909410290e30c924d3446809314393da44e210b51e993e3264db0ea5dc
SSDEEP 96:usSsub7T/fpWRMQ6S2q8LG/v3OUalxg5NIWJslERzmL8:unsu3T3pWYST86/v+bl8QW5mo
TLSH
T1987329200118585F13B50B2E58835ADCAEAC3D76ABCB7FD82FB0A357F6DA051C68154A
MD5 SHA1 SHA512 SSDEEP TLSH

flerier.ate

SHA256 984601d4fe28c5e939b21c6b536c2ac6d1ea4e679804d9ec5b54145b93ec71b4
MD5 58c9f10f015569cf6bb5134a1a87e0dd
SHA1 773b05c1cc7ed65e5ee03553e93d059dc8d17ee7
SHA512 eee0ce0f20354966b8be0fce3d43b9ea3a9a61fdb33d46552957a8fd5c84986045f032a2a361ef21dbe9890e76d4657e62afde708e3e09d372e18cd9f3efb3ac
SSDEEP 48:Jwr/1/0yQt4XeBomyBCPMKayoQCL5d1Ya+fR0CJrVa+sioj3O2wS4tT8g96qMgL:Jg/g4QK/EoQO1Inna+sioq2wbJ96M
TLSH
T10A03B72945818F32BA61BD35EA4A5D1D1AAE5002C50EF52CAE538FB36546A702FC322D
MD5 SHA1 SHA512 SSDEEP TLSH

kontrakttillgget.bon

SHA256 f541c40bbce4a9eb45509bd520fb2a37e91d45d68f34cf09a54aa582d43ea4c7
MD5 4f7fc9abe900b1c61246084f958308e3
SHA1 4324de921e22dc421cc4270c581e02bf2a7ea47f
SHA512 508636646e2532380c2029db9d9aaab30b706cdedc679bec39e3600754feddad226730d2f5f7530763af9170925e2e5643e0570d477375db4928d8ba03e5c2aa
SSDEEP 48:PzVMRGV8UONCnljLW3b3MGLtlGSCQODh8KkXBXdX0nuaGT:LVMRGVTlHFsGTtLIR+GT
TLSH
T1BE430C465FC17F27185C238D1EC4384E650F8896155738298FE4F1CF60155A4849B315
MD5 SHA1 SHA512 SSDEEP TLSH

92b4d4fcf62df03ff908adc43c39189ccd71ba78c7e61916985a80815d4ec18b.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Aflednes

Interfacet/Ufremkommeligt/srvers.amt

Interfacet/Ufremkommeligt/ssterkages.gra

Interfacet/misjudgment.ali

Interfacet/sallowish.dar

flerier.ate

kontrakttillgget.bon

Sharing

General

Malware Config

Signatures

File Explorer

92b4d4fcf62df03ff908adc43c39189ccd71ba78c7e61916985a80815d4ec18b.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Aflednes

Interfacet/Ufremkommeligt/srvers.amt

Interfacet/Ufremkommeligt/ssterkages.gra

Interfacet/misjudgment.ali

Interfacet/sallowish.dar

flerier.ate

kontrakttillgget.bon