b24d9b4fe10dec89c3585169731a20a070b4646e7e0c72bdaa550bc5969b306c[.]exe

resource
b24d9b4fe10dec89c3585169731a20a070b4646e7e0c72bdaa550bc5969b306c.exe
unpack001/$PLUGINSDIR/System.dll

b24d9b4fe10dec89c3585169731a20a070b4646e7e0c72bdaa550bc5969b306c.exe

IMPHASH 56a78d55f3f7af51443e58e0ce2fb5f6
SHA256 b24d9b4fe10dec89c3585169731a20a070b4646e7e0c72bdaa550bc5969b306c
MD5 27a6a80adc174c46a9babcad794da0b9
SHA1 d8c8be746f58d0f07ad0a22bfa391af6075a5557
SHA512 ad4ee0714f5d51797b7bf0fefb6a8a0b20cc18a5bfa9dd76b22627b5c1cc76fd424994c499561527451b5aee1c2f4358f8197977c2286b5194daf7d200cdcd1d
SSDEEP 6144:ZbE/HUttFJRHSDqGIgQCWejB/fb/ALWjft4XbF6zs3d7R36E5kFKdND0SE:ZbRtFJRuqCWmVoyjftC4Md7B6ckiD7E
TLSH
T19394F120759DE4A2FCD1643B6836C2775BB8BC2E7E646E433AD07B2F39720D5901A742
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

13613

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCreateKeyExW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken SetFileSecurityW RegOpenKeyExW RegEnumValueW

shell32

SHGetSpecialFolderLocation SHFileOperationW SHBrowseForFolderW SHGetPathFromIDListW ShellExecuteExW SHGetFileInfoW

ole32

OleInitialize OleUninitialize CoCreateInstance IIDFromString CoTaskMemFree

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

GetClientRect EndPaint DrawTextW IsWindowEnabled DispatchMessageW wsprintfA CharNextA CharPrevW MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW GetSystemMetrics FillRect AppendMenuW TrackPopupMenu OpenClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW PeekMessageW SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint EmptyClipboard CreatePopupMenu

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateFontIndirectW CreateBrushIndirect DeleteObject SetTextColor SelectObject

kernel32

GetExitCodeProcess WaitForSingleObject GetModuleHandleA GetProcAddress GetSystemDirectoryW lstrcatW Sleep lstrcpyA WriteFile GetTempFileNameW CreateFileW lstrcmpiA RemoveDirectoryW CreateProcessW CreateDirectoryW GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW CopyFileW ExitProcess GetCurrentProcess GetModuleFileNameW GetFileSize GetTickCount MulDiv SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW MoveFileExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
MD5 cff85c549d536f651d4fb8387f1976f2
SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
TLSH
T126426B129BB089F2F591583814667F2A6FBE9C5D27F50563CFE304D63D212CB983A283
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Confederal.str

SHA256 7a65015b99b5d08d2ebabf527512c6b3cb2b713d8d8c4ed4b8e92c8cb5328507
MD5 ad131a1b3adede26f70caef88848ab43
SHA1 59099f063c5d8f8c954dabfa16a0d32a9d0352ac
SHA512 c6a9364bf95d2873bf576b10d0d86c153aecba2fa712abde49028554efd95c34a8c50763198a7f76d414b3abb084822323cc49e269929366196637cdd0126f27
SSDEEP 384:9eGUH9qEsO9qIgyJFUqbWXJCM9pO/24UotQ+O8ndI4r9Pcst1Jxw:4Tqri0r30fQ+vnq4Ltjxw
TLSH
T1AC54BF38F24190A8050E39F7F1BFCCE7A19BEBE4C782129D71824B7E596C4D980258C1
MD5 SHA1 SHA512 SSDEEP TLSH

Reluctance

SHA256 a9b5ed5c066a4e1cf9309d8bc28846b6e149de565a001e78bf19d275e876aee7
MD5 26ea0f9a140c53326175fff5db9135e0
SHA1 f3ad9181e12bb29b0c35447260aea0869c0f65f9
SHA512 43eff083f4d321aeac8ae2c24fb874112aabd3d81bb4b580b642d98a94f54244b4e57b760419b846c28b3dfce47590da77353b909830a0f482522665ed48f061
SSDEEP 1536:ySSPw2St8Xwh8k/9l+7A3EWoG+8Ndd4TTzsrzEjHtwNvvHAS589ecIZ0DaVKDTf7:CC8XylioCG+vTTzsvEjNOvIm2DaVG
TLSH
T176D3B056DB558CFACC02C538D47E62A6882D70119B4F60BEB176A824C1872E36734BBF
MD5 SHA1 SHA512 SSDEEP TLSH

Versicule

SHA256 81a010b49f000c662e4763c9fcc4a8eb4d820b7400daea30661a88f7d9bdba2e
MD5 f9756b9bb061331dc3e7580aa738cf48
SHA1 c3c4293126c8aa22c44251eebfe88e4cbdeb4b61
SHA512 c43e02dab71eb41830ca3cb093f872038faa8572be62975cc1d0e24b84a3f6f46957172c804bf0239451a25442152116c688b931f1f712488e57935153031677
SSDEEP 3072:IiuTFPJO9L9WttbKfDtNDvf+qTVylhAG2z2m5fERMe4qTC9:IuL9yB2DtND+qTVYqzOKqa
TLSH
T1BCB3E101EBA0BCF1E927933CCF6973D49A4AB111C5FE5B91434A786A108E07946787BF
MD5 SHA1 SHA512 SSDEEP TLSH

bravurnumre.iot

SHA256 35960a7e121f569486dbf1cd21e9601061bc8c616cca79240cdbf6b6b1df055e
MD5 8fa1bfbc6abbdde2c47a452a39ba97a2
SHA1 335e664b6852a1ed2faf352c47c320e06612f053
SHA512 cb7ef6cd72d00a1906902a61443e8a710fdf033e75c6f0365aebfeaa6ce919ba687019e9f70d65fc1c7420d08e8be7f3b4eee3aea126f066564b9b317eedb539
SSDEEP 384:vrfVS7Y9YoK3+4CMZHNUuIGmDEM9u9ubDDU+w/sPUFtqvXJI/ihT+tH:vr+M14CMZtUuIGOu8DDU+zsFQv66N+tH
TLSH
T13764BF33E3DDF7384C3719ABA72858CA07C018B8948246307615E75DE6EB54BC81A1FE
MD5 SHA1 SHA512 SSDEEP TLSH

ddsknnes.cat

SHA256 d9d8dbaaedbfa7f7f89b2ede2d36b4b471151a09aeda8a1ee764faa921274e4b
MD5 6ad2db3f7de281f7d0f2f4e64df0a9ac
SHA1 a23b3a38323ebeb85a38fdef505fad94afdcde59
SHA512 633e3a0390c75ea05f196a8a4cc8f3daeb88f9583a66437b63975e2f4ee60fa4039f8399bab9b2352729780cf3b73182ded7542ff48001befb4330d99d1fea33
SSDEEP 1536:hSbi/9dh3NppIB/JOpMD19oHE+kBh8s59YlvmZ87I48WLh2riZlO46Wvwfh8:ht/Th3N3IBBOQFpBSKIf2riZlO46hW
TLSH
T16EE4F16CB5823A970ED16DDE23C95FCC7B124019A8AD739C327D62D1A19FE01B6C1F94
MD5 SHA1 SHA512 SSDEEP TLSH

hombres.var

SHA256 865cc6ba92135ba55793539c945189cadcde72ad20c969e36d9c8f50f28c5efa
MD5 8e662e568c4edc6c851341534906112c
SHA1 89c575bf2e875b8d18b2f5c486b6ca4fe9df0eff
SHA512 7b782340adb89f376aed6ff5b9860bf3c90763045030b3b098a45535ea1b05b7fa810b93ffd75e3450f8dd615120f8a30d83611a94caad605644330777bca520
SSDEEP 192:VLhTaG7Qu477Bt8kSsYI4MAQNKpAuD4j+T7pHtmNXeTX6k/RuHiehUsoN5AFP:rTaG7QLBWknP4bQNRuD4aVj/ne6+FP
TLSH
T1B574BF4B9DE2118807790EA6372DABF6CF83E6E0DDEF608411ACB45E58614DE14174C6
MD5 SHA1 SHA512 SSDEEP TLSH