INV09876545678HLK[.]bat[.]exe

resource
INV09876545678HLK.bat.exe
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll

INV09876545678HLK.bat.exe

IMPHASH 9be4f90f50c714bc00cc8beb2e137299
SHA256 6fd06127cd5573a4f884e3c7a4425f56c1e277109bc86ceabcf57b524afd0075
MD5 a67659e909fb0f8caedd7cddcdfae640
SHA1 6c52353efc6174037879ed5096cb79f475fe4693
SHA512 0dfa4a716c2731752e0543f5dddd2a18f63d176efa7cb4f27befb9e0cf514100df6485358890bbebc9f0b1dc03f8e2d4226ff3ba10b77054d36fd68413155dbd
SSDEEP 12288:arZbgKl9ykCxeIckh1WPSETCiv4l+DNZRozLHqSPVAeL+2enZ:amKXykCxeJPS0C84sqzLKYGeL+2enZ
TLSH
T10CD4E161BA9190E0C5B55A72E92BD53725367C2A1630911F2338BF3B3FFD683C939A05
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

17331

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegCloseKey RegCreateKeyExW RegDeleteKeyExW RegDeleteValueW RegEnumKeyW RegEnumValueW RegOpenKeyExW RegQueryValueExW RegSetValueExW

comctl32

ImageList_AddMasked ImageList_Create ImageList_Destroy InitCommonControls

gdi32

CreateBrushIndirect CreateFontIndirectW DeleteObject GetDeviceCaps SelectObject SetBkColor SetBkMode SetTextColor

kernel32

CloseHandle CompareFileTime CopyFileW CreateDirectoryW CreateFileW CreateProcessW CreateThread DeleteFileW ExitProcess ExpandEnvironmentStringsW FindClose FindFirstFileW FindNextFileW FreeLibrary GetCommandLineW GetCurrentProcess GetDiskFreeSpaceExW GetExitCodeProcess GetFileAttributesW GetFileSize GetFullPathNameW GetLastError GetLocalTime GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetPrivateProfileStringW GetProcAddress GetShortPathNameW GetSystemDirectoryW GetTempFileNameW GetTempPathW GetTickCount GetUserDefaultUILanguage GetVersionExW GetWindowsDirectoryW GlobalAlloc GlobalFree GlobalLock GlobalUnlock LoadLibraryExW MoveFileExW MoveFileW MulDiv MultiByteToWideChar ReadFile RemoveDirectoryW SearchPathW SetCurrentDirectoryW SetEnvironmentVariableW SetErrorMode SetFileAttributesW SetFilePointer SetFileTime Sleep WaitForSingleObject WideCharToMultiByte WriteFile WritePrivateProfileStringW lstrcatW lstrcmpW lstrcmpiA lstrcmpiW lstrcpynW lstrlenA lstrlenW

ole32

CoCreateInstance CoTaskMemFree OleInitialize OleUninitialize

shell32

SHBrowseForFolderW SHCLSIDFromString SHFileOperationW SHGetFileInfoW SHGetPathFromIDListW ShellExecuteExW

user32

AppendMenuW BeginPaint CallWindowProcW CharNextA CharNextW CharPrevW CheckDlgButton CloseClipboard CreateDialogParamW CreatePopupMenu CreateWindowExW DefWindowProcW DestroyWindow DialogBoxParamW DispatchMessageW DrawTextW EmptyClipboard EnableMenuItem EnableWindow EndDialog EndPaint ExitWindowsEx FillRect FindWindowExW GetAsyncKeyState GetClassInfoW GetClientRect GetDC GetDlgItem GetDlgItemTextW GetMessagePos GetSysColor GetSystemMenu GetSystemMetrics GetWindowLongPtrW GetWindowRect InvalidateRect IsDlgButtonChecked IsWindow IsWindowEnabled IsWindowVisible LoadCursorW LoadImageW MessageBoxIndirectW OpenClipboard PeekMessageW PostQuitMessage RegisterClassW ReleaseDC ScreenToClient SendMessageTimeoutW SendMessageW SetClassLongPtrW SetClipboardData SetCursor SetDlgItemTextW SetForegroundWindow SetTimer SetWindowLongPtrW SetWindowPos SetWindowTextW ShowWindow SystemParametersInfoW TrackPopupMenu wsprintfW wvsprintfW

Name

.text

Size

36KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

368B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

35KB

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

284KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ndata

Size

512B

Virtual Size

680KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

163KB

Virtual Size

162KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

$PLUGINSDIR/System.dll

IMPHASH cf8eee620b3371ff06e99c34f39ea84c
SHA256 a0b9b62ce33d198090426c733e0e36f987555c22a4bc04d677b7496f4e1ed072
MD5 231194c7009a5600bbe7686a8bc7fa8d
SHA1 a601c15e38d443db6bd3fd1104ab990d8087745b
SHA512 2ba22e3cc130df82819b777ef5ffbe0aa8a9280b04ad3fa3e4f670c5e9bc6b2ad641e8de1ac95bb318045334cd32225f0c8387e7d5493e3d7d4d30070c4bac2c
SSDEEP 384:XZ2pfUx9eVLwDKO9XYD/isN7lCEjgwMU/ktKi+R45Duwomq8pqdDvHY1Q:Xr96YIrx7lC7vU/kaG9uLmCdb
TLSH
T10CB24C07F38398BFC50BC17186EF5772AA32BE211B616F6F1220F5756E24E90871DA14
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

12726

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

Name

.text

Size

14KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

112B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

1024B

Virtual Size

916B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

384B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

179B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

88B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PLUGINSDIR/nsDialogs.dll

IMPHASH 2a21171b63c0ee0261cd54df366503d2
SHA256 15a231cd94e7ff68b0ff40dda59b21b29c639d971f90b02ce0b16455e6ce6569
MD5 3dc4acdef4e8be2be4325fe8df77885b
SHA1 96daa70ca4337504eb8d098c1b736ccaf599df02
SHA512 e607b08eb315837628a665bb823a9531c115425053f0c62bc7d6b323803712c8560bedacf60310e70cdf48b9c5aac94e7bb39146b49dcac425dc43c8d3665b3b
SSDEEP 192:3ZWhF6MuqMgfdPvg/YWkNLiY8vSKXS6Hn5gIIblaks8NHAHXEdeqe4KFz0:pWh4MFv1w/YWCLXASKi6nAlHJAl4KW
TLSH
T16B52191B7B42962ACD0AE374D9EF573322F3B4551538370E0629DB49FFE1660DA39288
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

8501

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

Name

.text

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1024B

Virtual Size

576B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

1024B

Virtual Size

552B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

444B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

363B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

144B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Droslende/Chaccon

SHA256 f08b4f7156a3939987eb7c3ec350c0b05617c184c2edd30122fc774ac50b9b60
MD5 16da681473012b7539c61c0e24373bd5
SHA1 a00b30d82da4a1e37dbbaf1ea3cb0cea54a581ea
SHA512 55791cfd340cb31e6206e8bef5be40a8aa2cb134aa9992029086b94c30ac0d64dbfa37c06a23a0c34355ad151b2cf58ff0415ccc569f22a205d2f4ea73f29dbb
SSDEEP 12288:1DehhhhhhhhhhhhhhhhhhhhfhPgT9j+X4NfOXKTMTrd6bKta:QhhhhhhhhhhhhhhhhhhhhFgRSXIoTTJ8
TLSH
T15294AEDD9E050C13D6AFC9398D9E5B18AD15BCFA292AB67D08364767E0D20FFA4C2131
MD5 SHA1 SHA512 SSDEEP TLSH

Rackety/Fluoridernes

SHA256 9d7d33af93937fdabfa7b58d6ad5f0b1b8f6d8797d8e84e17a8446ba722bae8d
MD5 9d7795e7770916755102e784fe89f156
SHA1 a3c4be3b4ac47a43f3fec3b9280f65249818750c
SHA512 092aa43001a27cc7c2d5aadd980968cca47f81eebc4dc86adf8545e3ae9f498c197a1a599f280686c17604340911f445ecf28885b8551dfb2d61046fac73cd13
SSDEEP 768:DyWpIYr7L86RNE99bPc0Xl8uxoYyTqG7En9fRTU8mkrn6m0zTjtdt8MGotEEEEEu:GFCX8YiyHeUkrn6w4
TLSH
T1F4D28E5071CD8AE0F6195988AA78FFB201333973EFDA1DD22324F5014ABE5513A4DA6F
MD5 SHA1 SHA512 SSDEEP TLSH

Rackety/Terminalsekvenser145.bra

SHA256 73d7eec73f643efd436b1b676a8c80dcf46f62d8fd7f451cac5f60689f759206
MD5 bb9179b8e73f4ae26eb0e9bcc97177e0
SHA1 ac9f64441e4efe32fa8c10fe5b7dd687ea54d4d1
SHA512 d69dd2ff7e2b5b6f80aa1f8f3987876fa4fe9afb1e0f7463a9819d425fc4327620534eb27b0477de811e45bf75d2eede9461e49d9e3b13f61c66f9c3803a69f0
SSDEEP 48:4DJd6SQvjmZXMtmSGFCtSUXVyMf76CZ82S9BtMxO1Yr0+JQRC/n:aJBYbtQQLXVy/92S9BCwCdGRCf
TLSH
T1AA03176E460C974B5BD26683D0AAB200254CDFEF6F0436EE2484E003EFDE3D1C822CA0
MD5 SHA1 SHA512 SSDEEP TLSH

Rackety/aikos.udl

SHA256 3994b0936da4aa9589a993e59a2892054948229426b99271ab5bb0cefb196957
MD5 94537c198c8d158ff871d73334ef4ad1
SHA1 14d163e684297979041c71e24fae02b0459615a3
SHA512 016c97d3410985adf90e7a345b922f9e5fcc497665f3a4176843f3abf8fcbfadf5415e7d42a246b97b6b11b661fa6dbfb7629be9c51072713f0b72a2091af733
SSDEEP 48:duTyrgcDQ+AoG0hiZVAlOgaEH7Xzr1kyP/fbs64tL:CyrxhzhH7jrmX64tL
TLSH
T16E433ACE2641EA16A8B54CCAB2E803956C40CB34D4730901F9A54866786B324253BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Rackety/informationerne.sta

SHA256 526da643748c3e2d15e312ad963bf6b1b31815f78e20fd26f9007be18b0f84de
MD5 cdd4e0a0765d4ab741315334cbb6a927
SHA1 0ca5eaca4c769c6008d8ba20b9bbbadb00ccad7e
SHA512 c0b7ce1da9c3df4cd9415d3f904b4f51a81dd317bc6db293f32e773d45b0784a86e50c4ea6ecb0e6fd37814cf41c116909a2dae16b7ee9a0131183f3926d1563
SSDEEP 96:0P48ePZ4yFh9A7jcDtbULSubd+mzrs2Wat0JqnCQ:4kbXZJJQ
TLSH
T1F053199B902F3296BC0E0672EB7A994E6126C382475C5AF3E8F70A8A115060FEB30650
MD5 SHA1 SHA512 SSDEEP TLSH