545c9b0499ec2a2e5503d72d76954ed020e63a290895cb3fcd4f382a2496b31a
- SHA256 545c9b0499ec2a2e5503d72d76954ed020e63a290895cb3fcd4f382a2496b31a
Password
infected
Static task
static1
Behavioral task
behavioral1
Sample
3137663df90055b5c2dd92ff91ed1a0edc6965dbd50f83578643c727b36b060b.exe
Resource
win7-20240221-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
3137663df90055b5c2dd92ff91ed1a0edc6965dbd50f83578643c727b36b060b.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral3
Sample
Borteskamoteringers/Fridtjof.ps1
Resource
win7-20240221-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral4
Sample
Borteskamoteringers/Fridtjof.ps1
Resource
win10v2004-20240412-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 545c9b0499ec2a2e5503d72d76954ed020e63a290895cb3fcd4f382a2496b31a
- Size 571KB
- Sample240417-p4dxwsfh94
- SHA256 545c9b0499ec2a2e5503d72d76954ed020e63a290895cb3fcd4f382a2496b31a
- MD5 aa719668b1165ed961dc33231b856688
- SHA1 122c259fe1c5a9082f8691357c36b18a639d0431
- SHA512 aad2592f065e3f02ba9bf85dbc080b05b364524166dfa2cebc68de9d753d51db713f7630c8132bcf32c4240916068893cec727102f32d6789329b0b07d9f8bd7
- SSDEEP 12288:tFamtIAtNGMoQabmnknqhTv/U09s/vYbtqDUfasiO76H3M4Ef/x4G58:7ptI+NGMo9mnWqtceAeqDAC3le/xq
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
File Explorer
-
545c9b0499ec2a2e5503d72d76954ed020e63a290895cb3fcd4f382a2496b31a.zip 571KB
-
3137663df90055b5c2dd92ff91ed1a0edc6965dbd50f83578643c727b36b060b.exe.exe 652KB
-
Borteskamoteringers/Behandlingsmaal.sac333KB
-
Borteskamoteringers/Fridtjof.Bea.ps1 58KB
-
Borteskamoteringers/Kliniklokalernes.sun392KB
-
Borteskamoteringers/Menneskekrligste.Stt350KB
-
ugerningernes/Srrettighedernes/Beskresaks/Potatory.rea269KB
-
ugerningernes/Srrettighedernes/Beskresaks/teda.txt577B
3137663df90055b5c2dd92ff91ed1a0edc6965dbd50f83578643c727b36b060b.exe
- IMPHASH f4639a0b3116c2cfc71144b88a929cfd
- SHA256 3137663df90055b5c2dd92ff91ed1a0edc6965dbd50f83578643c727b36b060b
- MD5 7971d20d1b569b51e56f37fc734a1c81
- SHA1 3c1a1fa66cd9890c8e0021853d39ab7b3aefc5c7
- SHA512 6efbec26eebfcaeed965a46ab22f4870fc6fa93d09818c7cf03782f34c8a768b4defa5b9b1f347ef41798df82c725a3f5a402793d977e6d791fe5b857d36c6a4
- SSDEEP 12288:nXRAvufNFTr7L/R90rJ2RPBY+K9Yc65vpNpqwDwmuu6TNxFu+i:nXRyUNJr7L30N2RJXKz65vprPqu6hxF+
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
50:76:a9:eb:2d:f4:48:b2:7d:2c:de:66:43:4e:ea:10:0b:a5:06:e2:ac:bd:aa:61:67:29:71:f0:9b:c3:b0:19
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Pleasureful,OU=Thinnesses Mellemteknikeren\ ,O=Pleasureful,L=Saint-Auvent,ST=Nouvelle-Aquitaine,C=FR,1.2.840.113549.1.9.1=#0c1e5469647366756c677431313240556e736e6f62626973686e6573732e6172
Chains
Apr 2, 2024
Subject
CN=Pleasureful,OU=Thinnesses Mellemteknikeren\ ,O=Pleasureful,L=Saint-Auvent,ST=Nouvelle-Aquitaine,C=FR,1.2.840.113549.1.9.1=#0c1e5469647366756c677431313240556e736e6f62626973686e6573732e6172
Serial Number
5f:71:85:75:3b:1e:77:05:8b:f3:7d:4d:5d:26:8d:ea:da:5a:85:06
Issuer
CN=Pleasureful,OU=Thinnesses Mellemteknikeren\ ,O=Pleasureful,L=Saint-Auvent,ST=Nouvelle-Aquitaine,C=FR,1.2.840.113549.1.9.1=#0c1e5469647366756c677431313240556e736e6f62626973686e6573732e6172
Timespan
Oct 17, 2023 - Oct 16, 2026
Subject
CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Issuer
CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 12, 2016 - Jan 11, 2031
Subject
CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Issuer
CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 23, 2017 - Mar 22, 2029
Minor OS version
0
Major OS version
4
Entry point
13564
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
advapi32
RegEnumValueW
RegEnumKeyW
RegQueryValueExW
RegSetValueExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
RegOpenKeyExW
RegCreateKeyExW
shell32
SHGetPathFromIDListW
SHBrowseForFolderW
SHGetFileInfoW
SHFileOperationW
ShellExecuteExW
ole32
CoCreateInstance
OleUninitialize
OleInitialize
IIDFromString
CoTaskMemFree
comctl32
ImageList_Destroy
ord17
ImageList_AddMasked
ImageList_Create
user32
MessageBoxIndirectW
GetDlgItemTextW
SetDlgItemTextW
CreatePopupMenu
AppendMenuW
TrackPopupMenu
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
IsWindowVisible
CallWindowProcW
GetMessagePos
CheckDlgButton
LoadCursorW
SetCursor
GetSysColor
SetWindowPos
GetWindowLongW
IsWindowEnabled
SetClassLongW
GetSystemMenu
EnableMenuItem
GetWindowRect
ScreenToClient
EndDialog
RegisterClassW
SystemParametersInfoW
CharPrevW
GetClassInfoW
DialogBoxParamW
CharNextW
ExitWindowsEx
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
FindWindowExW
IsWindow
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
ReleaseDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
GetClientRect
FillRect
DrawTextW
EndPaint
CharNextA
wsprintfA
DispatchMessageW
CreateWindowExW
PeekMessageW
GetSystemMetrics
gdi32
GetDeviceCaps
SetBkColor
SelectObject
DeleteObject
CreateBrushIndirect
CreateFontIndirectW
SetBkMode
SetTextColor
kernel32
lstrcmpiA
CreateFileW
GetTempFileNameW
RemoveDirectoryW
CreateProcessW
CreateDirectoryW
GetLastError
CreateThread
GlobalLock
GlobalUnlock
GetDiskFreeSpaceW
WideCharToMultiByte
lstrcpynW
lstrlenW
SetErrorMode
GetVersionExW
GetCommandLineW
GetTempPathW
GetWindowsDirectoryW
WriteFile
CopyFileW
ExitProcess
GetCurrentProcess
GetModuleFileNameW
GetFileSize
GetTickCount
Sleep
SetFileAttributesW
GetFileAttributesW
SetCurrentDirectoryW
MoveFileW
GetFullPathNameW
GetShortPathNameW
SearchPathW
CompareFileTime
SetFileTime
CloseHandle
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalFree
GlobalAlloc
GetModuleHandleW
LoadLibraryExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
lstrlenA
MultiByteToWideChar
ReadFile
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW
MulDiv
lstrcpyA
MoveFileExW
lstrcatW
GetSystemDirectoryW
GetProcAddress
GetModuleHandleA
GetExitCodeProcess
WaitForSingleObject
SetEnvironmentVariableW
Name
.text
Size
25KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
126KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
224KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
186KB
Virtual Size
186KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=163, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
Borteskamoteringers/Behandlingsmaal.sac
- SHA256 ded32062860db523c6436b432f22ee503f7706dccd75ba2825a4470d58c1412d
- MD5 f8c0fee8de3e2f93e8ea22388a77bb09
- SHA1 9bba5c653a1a83a35eb65cbca505c659c59662b5
- SHA512 2fcd5eb3bbc0bd881fc4c8e271b233851a2c1b39f8e6db7cd937005c1a1d0ac2f8c1219cbfaead1f70d13d3a7e1c8acb79297ad9efa8f3289591a022eb34338b
- SSDEEP 768:YYv2jfcXjveUx72Yj7X5I7TO8Cr6qgLE89h3R71p6qRfOU0Ane1k9M/qlvFNLxI:B5jnc3
- MD5 SHA1 SHA512 SSDEEP
Borteskamoteringers/Fridtjof.Bea
- SHA256 4fc178d7b0c912917422d5259e796c28f38a765bc3f56fa14df7480b49a0f2f2
- MD5 b747bba9cd5ec658f83a8f004b9ddc9b
- SHA1 eb25e589a4de7af6afd91ccaf9c12f30aaf3c67a
- SHA512 7e115a0e8cc9b16cd7eeafc6aa6635815763384ab543bb92308c197af849a49e9109f775652151617dc094862313109830091f5d203f582a887595b81b875d9e
- SSDEEP 1536:ft7VcOuMK0tpHzCNB2PPEcs2WlyRRpAbeKbKCU:f7QgJzMB2kcs2qHbeKuCU
- MD5 SHA1 SHA512 SSDEEP
Borteskamoteringers/Kliniklokalernes.sun
- SHA256 92cc335f5aaa5f481ed32b10f95853a4d478be368f9feddc20f6b7731923d066
- MD5 21d2ebdf40706ec8fc35650094126a9a
- SHA1 53519ec395f2e3fc49d97216fb54a9a0088a851f
- SHA512 b648c3934055358cb18dce32a8459e5475b82c8eac011528e7da4c4d1573d680672d275cfb78e6da26fb40ff72dfb31dd94c91611874d1a79e255b1b074abe4d
- SSDEEP 768:uPDccdaFpHi7QWY7vVTnSy0DwPh3PY0YVcf0aVr+LBgaP1mbQZk2hD+FyqYhyNBR:kTOnd1NOBp9
- MD5 SHA1 SHA512 SSDEEP
Borteskamoteringers/Menneskekrligste.Stt
- SHA256 cec934596d590684641da052fa5d39b119c7b668c28925e196213d4258ac75b0
- MD5 5a078e54f0d5d5d90111e92881a45f0b
- SHA1 96c2419b4e1f9609e11bab95c051780d5a812a3d
- SHA512 d6b893adddd088f8c03389a31d10c6b87c0f67f1620739c02821e2f51d4b785abb512fc1e550ba08b653569069d37e62c1f8a54a55845d2b346f9eebb061f569
- SSDEEP 6144:3fG/BvQDkD2ElSvsoTcwJgXgDpfI0krlYzNm0PTNUsGEtnr152XGVuq:PG/G4D2PsozgQDpf32G8fEtnfJVuq
- MD5 SHA1 SHA512 SSDEEP
ugerningernes/Srrettighedernes/Beskresaks/Potatory.rea
- SHA256 05d0f6c869793ef28ee232a704382092e71fa20b9b1a33d39de36c374967f903
- MD5 b140848a979aa1806772dab19a298710
- SHA1 7a7107a4839f01c3aa087212763e93ecd7904a21
- SHA512 a3cae2ce90c61b08143c47774dbe8eca90fbf748f986ca5f0ecbf140f29c57ea50093d12af65b0d565755d4a50f8202edc8fa8a828481c85791e30854c5aef9e
- SSDEEP 768:50QftKJWNEsYKIleNCcQySVfmGhwwFp7L9jRspT56:zhO7Q
- MD5 SHA1 SHA512 SSDEEP
ugerningernes/Srrettighedernes/Beskresaks/teda.txt
- SHA256 420647e422b79e2daed389a252880cc5f8685a1a04c5ab6537c2712818284cbd
- MD5 5da9127f07e748b0da6767b10c087270
- SHA1 b3dd5a50677e6cc6c9923fdbe4fb4d3a1fd21707
- SHA512 0f6161b9f14c0633992593a4f0e86de3da3b56f975af1a25a59d6790ed590a934256807787967265968e299b1c32af8bc0a2ec2ca200713678028fc960049446
- MD5 SHA1 SHA512