9c43b920900fe218212dec879c49c6b31b17ad0cda091818acff94a062b75fb8[.]exe

resource
unpack001/$PLUGINSDIR/System.dll

resource
9c43b920900fe218212dec879c49c6b31b17ad0cda091818acff94a062b75fb8.exe

9c43b920900fe218212dec879c49c6b31b17ad0cda091818acff94a062b75fb8.exe

IMPHASH 3f91aceea750f765ef2ba5d9988e6a00
SHA256 9c43b920900fe218212dec879c49c6b31b17ad0cda091818acff94a062b75fb8
MD5 a65a4249fef77e1c648070c5adaeae14
SHA1 d75ccb8ad7b09f8f1a82ab532b796df6b1960ac4
SHA512 b4759e1b5b2a26caf58f9224e53523ad2dd61a0ee8af5bcea5992ac07f50ab3ff5dda09d5ad56b4f08fc8a95b42a526f8cf23761f69ea92d13d8a0944ca3cc17
SSDEEP 12288:AfHYAmd7zNb0lP5QyMsiwN0UoJG43s+1Pkw:GH7mrb0lBQSiwCJGiPV
TLSH
T169C4E0567FB5C416CBAA0A7CCC63BF4E95E45C7034229693EB10FA799978380FD0E216
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

fc:d4:db:a2:44:fc:4b:c3:ad:82:4d:d2:11:96:c9:ce:5f:a2:64:94:a7:f9:ca:f7:ac:58:c8:02:5a:56:5c:e6

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Earthboard Venstrehngt Yock\ ,O=Indeklimaindsatsen,L=Kingsley Green,ST=England,C=GB

Chains

Aug 21, 2024

CN=Earthboard Venstrehngt Yock\ ,O=Indeklimaindsatsen,L=Kingsley Green,ST=England,C=GB

Minor OS version

1

Major OS version

5

Entry point

14076

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCloseKey RegDeleteKeyW RegDeleteValueW RegEnumKeyW RegEnumValueW RegQueryValueExW RegSetValueExW OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueW SetFileSecurityW RegCreateKeyExW RegOpenKeyExW

shell32

ShellExecuteExW SHFileOperationW SHBrowseForFolderW SHGetPathFromIDListW SHGetFileInfoW SHGetSpecialFolderLocation

ole32

OleInitialize OleUninitialize CoTaskMemFree IIDFromString CoCreateInstance

comctl32

ord17 ImageList_Destroy ImageList_AddMasked ImageList_Create

user32

DispatchMessageW wsprintfA SystemParametersInfoW SetClassLongW GetWindowLongW GetSysColor ScreenToClient SetCursor GetWindowRect TrackPopupMenu AppendMenuW EnableMenuItem CreatePopupMenu GetSystemMenu GetSystemMetrics IsWindowEnabled EmptyClipboard SetClipboardData CloseClipboard OpenClipboard CheckDlgButton EndDialog DialogBoxParamW IsWindowVisible SetWindowPos CreateWindowExW GetClassInfoW PeekMessageW CallWindowProcW GetMessagePos CharNextW ExitWindowsEx SetWindowTextW SetTimer CreateDialogParamW DestroyWindow LoadImageW FindWindowExW SetWindowLongW InvalidateRect ReleaseDC GetDC SetForegroundWindow EnableWindow GetDlgItem ShowWindow IsWindow PostQuitMessage SendMessageTimeoutW SendMessageW wsprintfW FillRect GetClientRect EndPaint BeginPaint DrawTextW DefWindowProcW SetDlgItemTextW GetDlgItemTextW CharNextA MessageBoxIndirectW RegisterClassW CharPrevW LoadCursorW

gdi32

SetBkMode CreateBrushIndirect GetDeviceCaps SelectObject DeleteObject SetBkColor SetTextColor CreateFontIndirectW

kernel32

WriteFile GetLastError WaitForSingleObject GetExitCodeProcess GetTempFileNameW CreateFileW CreateDirectoryW WideCharToMultiByte lstrlenW lstrcpynW GlobalLock GlobalUnlock CreateThread GetDiskFreeSpaceW CopyFileW GetVersionExW GetWindowsDirectoryW ExitProcess GetCurrentProcess CreateProcessW GetTempPathW SetEnvironmentVariableW GetCommandLineW GetModuleFileNameW GetTickCount GetFileSize MultiByteToWideChar MoveFileW WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA lstrcmpiW lstrcmpW MulDiv GlobalFree GlobalAlloc LoadLibraryExW GetModuleHandleW FreeLibrary Sleep CloseHandle SetFileTime SetFilePointer SetFileAttributesW ReadFile GetShortPathNameW GetFullPathNameW GetFileAttributesW FindNextFileW FindFirstFileW FindClose DeleteFileW CompareFileTime SearchPathW SetCurrentDirectoryW ExpandEnvironmentStringsW RemoveDirectoryW GetSystemDirectoryW MoveFileExW GetModuleHandleA GetProcAddress lstrcmpiA lstrcpyA lstrcatW SetErrorMode

$PLUGINSDIR/System.dll

IMPHASH 4f33ea844b96a31c8f4690530ba63854
SHA256 f917aef484d1fbb4d723b2e2d3045cb6f5f664e61fbb3d5c577bd1c215de55d9
MD5 d6f54d2cefdf58836805796f55bfc846
SHA1 b980addc1a755b968dd5799179d3b4f1c2de9d2d
SHA512 ce67da936a93d46ef7e81abc8276787c82fd844c03630ba18afc3528c7e420c3228bfe82aeda083bb719f2d1314afae913362abd1e220cb364606519690d45db
SSDEEP 192:acA1YOTDExj7EFrYCT4E8y3hoSdtTgwF43E7QbGPXI9uIc6w79Mw:RR7SrtTv53tdtTgwF4SQbGPX36wJMw
TLSH
T16C426C496B619FF2F61A473719B37F264B3CEE1412E446DB8FD38446A8A01E721362C3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

6730

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Importunement.Ran

SHA256 5f74495b87c9feae7d0b596bde675b2050e0d4d61151415ebee8e7b33a97c625
MD5 3e98ed2df101b0f658b67bfe8a244d57
SHA1 15b40ed5574d581f5bd79fc10742ca6fa0207cf0
SHA512 de761cb09e0d8374398c9c27832d27dadb82be27cf34e51a9c4b1e56fceec56797198cd5d00367b57cfa1166bdb5b5c7f897735933590cf80b42529f84330eba
SSDEEP 3072:LSd8I71YEtLfweyWBsSt9u29mBMKXR4X+DdGon3itBToYMacF1p5wMpY:w71ftLfByW3+29m6KX6XPjToYQwMpY
TLSH
T1ED14E0E09A042DBED60BA476E614FEBCD47900C9F71A5705B125EFD0C579ED2328AB0E
MD5 SHA1 SHA512 SSDEEP TLSH

Puppen.Und

SHA256 c7c4ecc5cfa3a3876b199deae7e027f1fdb1281ed86ae5b81ebfd0aa950df396
MD5 9f2c5d8c337986a93c50a93a46687401
SHA1 fae9e20289829f4d157ceae42c05f042ce1aca6d
SHA512 1ebc251bd91148c3a773a67537cf4c7d004afbcc1b613e36a9062119ae0f5f47601f5d707d5869fd7c1e98374d595e53a9bf15877a8044f75668c976508fb190
SSDEEP 384:OLdwy3wQYQTXuRPokeSffgfrLRRojyb2LPZedb:e+y3HYQTetxf4NiPZA
TLSH
T1B2627E5293695D7BC403E238C6FF12E34DBC701B775BC8AD6121B604CA565F127322A7
MD5 SHA1 SHA512 SSDEEP TLSH

Subsistential28.bes

SHA256 5cd6d103745ed0ffff3d6ad16bbe4c08d9235bd3084f6517868de90f69b4abac
MD5 55fe891faec296296055be524ce7b55b
SHA1 b851a2ebcade032054083f4448fb3af7e245cc67
SHA512 4304b77c890c2506487fc25c1140fbddb597782f896449778da21aad5c4d3802f177eff7551e2e1d4a390234fca828dc81f5182b98a8405cc282a61d4e8f02b9
SSDEEP 768:59JcN6I2D5XmTvKVnWRCoMCm5KOsjsYll1uUN:P2K9R2/
TLSH
T10B34F1BADD02A1F7ED0F02F0DDD097B905CD48E46B1181AADE56D6DD6EB6CF000B1A86
MD5 SHA1 SHA512 SSDEEP TLSH

elevtimer.tis

SHA256 df39e6dc9982a70c25893b029ca9ca4ec6a07c95e34a5c7e25cc5a447c8638b2
MD5 8c3629f3da48e563bef055ac214070fc
SHA1 597f68cc680ae2241d9a4fe332837058c9904eb9
SHA512 fc51a5edcc3ad38693c9344021a37c920da3aba129a9da4590bd116963ee485918a47e224e18f2b4368eb5197afda20c6aad1ae2b9405d1315d89149a3ce98c3
SSDEEP 768:6WStcfXo+wJYxf5RtFN/YxYetffyXSJyR4DL8BX4m4tJX8f9+qV9qlmfPBVPCAq/:6sr0MfkKbk0
TLSH
T180A40151CDE3EB1BC2885EFA053DE858DCE2407A7D5F24E44836F319E3F15A185AE019
MD5 SHA1 SHA512 SSDEEP TLSH

nondepletory.opd

SHA256 dd762b474296bc8242209ad8c599664c70a68d2e770d1a70c478dbc33e5242aa
MD5 bea5a076d13da19f22bb7ee05c36df4a
SHA1 ecaf368d7548db3ae87fe7d5cb43639fcc4c18c2
SHA512 ce733ea5ecff4c6b8527f48fdb40cc4e5923ee514c6c8c6bbba51777302628b06d9fc6071cc15eac22a52db271c9da798603bc897c0351efd407cc3517644de6
SSDEEP 768:IU+s/LahvJdV5Lr3h1WH9RQZS4bphjxS2XJtgiwptRGiLWrfZ52kz8/5cIOBwiXE:T/Lw1cfe0
TLSH
T11C94F285A2A75D75C588D87787F9C0817721EA6D02F8ACC7D2DC8DB3E31B4AC4817791
MD5 SHA1 SHA512 SSDEEP TLSH

thrawartness.txt

SHA256 02059cca2474dc5e2faeeb71423a12582de9157ee9cb79a98300001822796ed7
MD5 1c0aba2073bbda91f030e4abaa5e4991
SHA1 4dcdf7b2fb209e75b90fc089076948a273e82319
SHA512 1edb040fada6cacdf99fe9d49ccabcd650cbb0bbb41901a651aa9623d1431fa5395661624618f6012e7151c4b0adbc7807dc4371492d3a054ab03316bc9bf660
TLSH
T189E0AB5486D22A8E46CB9A1C84402964C07AAE836C5AB29972996E81D00389ECDE2848
MD5 SHA1 SHA512 TLSH

9c43b920900fe218212dec879c49c6b31b17ad0cda091818acff94a062b75fb8.exe

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Importunement.Ran

Puppen.Und

Subsistential28.bes

elevtimer.tis

nondepletory.opd

thrawartness.txt

Sharing

General

Malware Config

Signatures

File Explorer

9c43b920900fe218212dec879c49c6b31b17ad0cda091818acff94a062b75fb8.exe

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Importunement.Ran

Puppen.Und

Subsistential28.bes

elevtimer.tis

nondepletory.opd

thrawartness.txt