fd2ed2817b36ad04fda64c952b1a38e9a4cee86a247d0a7e9dfea5bab81b2e82[.]exe

fd2ed2817b36ad04fda64c952b1a38e9a4cee86a247d0a7e9dfea5bab81b2e82.exe

IMPHASH 4ea4df5d94204fc550be1874e1b77ea7
SHA256 fd2ed2817b36ad04fda64c952b1a38e9a4cee86a247d0a7e9dfea5bab81b2e82
MD5 397c71ddf48527dc363407c2dc6382fd
SHA1 8d309abbd3842e15778dad790e3bb36371060eab
SHA512 a5b4bf00e115c99a2433ebf7f91ea7fc12e6c5a6f06d049d89b9027b29bba769ec51d3ace6a1671595d685db7e74e458cb75e39fe8c1abb9533ae19d0c308a46
SSDEEP 12288:jgSUrka1W50Dt/RtlieB6TxOL0w83/ImkT4bdxrVZ4PBiFeAUVABi+ksSj:hfaQ50DljNNow83gkbTBSYUK/ksSj
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

da:ef:2c:e0:c0:6e:a2:6f:a9:4b:a7:76:4c:8e:e1:9d:c9:3c:3a:85:42:f4:1f:fc:65:f1:5b:8a:e7:50:d6:95

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Forestille,OU=Somalierne malapropoism jinrickshaw\ ,O=Forestille,L=Dürrenhofe,ST=Brandenburg,C=DE,1.2.840.113549.1.9.1=#0c1f4265686167656c797374656e73404f706d726b736f6d6865646572732e5661

Chains

Jun 10, 2024

Minor OS version

0

Major OS version

4

Entry point

13238

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetCurrentDirectoryW GetFileAttributesW GetFullPathNameW Sleep GetTickCount CreateFileW GetFileSize MoveFileW SetFileAttributesW GetModuleFileNameW CopyFileW ExitProcess SetEnvironmentVariableW GetWindowsDirectoryW GetTempPathW GetCommandLineW GetVersion SetErrorMode WaitForSingleObject GetCurrentProcess CompareFileTime GlobalUnlock GlobalLock CreateThread GetLastError CreateDirectoryW CreateProcessW RemoveDirectoryW lstrcmpiA GetTempFileNameW WriteFile lstrcpyA lstrcpyW MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GlobalFree GlobalAlloc GetShortPathNameW SearchPathW lstrcmpiW SetFileTime CloseHandle ExpandEnvironmentStringsW lstrcmpW GetDiskFreeSpaceW lstrlenW lstrcpynW GetExitCodeProcess FindFirstFileW FindNextFileW DeleteFileW SetFilePointer ReadFile FindClose MulDiv MultiByteToWideChar lstrlenA WideCharToMultiByte GetPrivateProfileStringW WritePrivateProfileStringW FreeLibrary LoadLibraryExW GetModuleHandleW

user32

GetSystemMenu SetClassLongW IsWindowEnabled EnableMenuItem SetWindowPos GetSysColor GetWindowLongW SetCursor LoadCursorW CheckDlgButton GetMessagePos LoadBitmapW CallWindowProcW IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard wsprintfW ScreenToClient GetWindowRect GetSystemMetrics SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharPrevW CharNextA wsprintfA DispatchMessageW PeekMessageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow LoadImageW SetTimer SetWindowTextW PostQuitMessage ShowWindow GetDlgItem IsWindow SetWindowLongW FindWindowExW TrackPopupMenu AppendMenuW CreatePopupMenu DrawTextW EndPaint CreateDialogParamW SendMessageTimeoutW SetForegroundWindow

gdi32

SelectObject SetBkMode CreateFontIndirectW SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW ShellExecuteW SHFileOperationW

advapi32

RegDeleteKeyW SetFileSecurityW OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges RegOpenKeyExW RegEnumValueW RegDeleteValueW RegCloseKey RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumKeyW

comctl32

ImageList_AddMasked ord17 ImageList_Destroy ImageList_Create

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

Insider/Befrdendes65.txt

SHA256 0cf4bb0bf1c3e0ae6482e23e1848afc714e8b954dc992eb19ef679348f02b84e
MD5 ccde3fc943fdcfb029d3525cce095db3
SHA1 547dad168a0cc862946085dc455be414451d5c53
SHA512 cee02406bc4be98b6a1842e0f9964ef5586b0fa0946e91e545d293b48cf4e6b3163ff79ae7fc67c94fcaf6eab9314d2eafbd2f95fdc3cdb8a86364ee5ad01ca6
MD5 SHA1 SHA512

Insider/Pigout.Smr

SHA256 9c121e08561368b3fabba2fef46f73a398fd27b54ae7a9b511d1e782cd50dfef
MD5 5b666f06cc1e9de33f4f56e415241506
SHA1 8253f4854a516d91f9ac7189d108cfe2822f5a2b
SHA512 e2f444a080037474a69ecdff6545638a0a173a3e7230046f4e0a3b659511516806d13c406267d570d7b2006d7e9efbb91b8fbc02996d9ee31ffa801b5e7027f9
SSDEEP 1536:InmEOiVlvTGr2dnogkp49haaVcHrMfxFJAbUg:Ih5dnoI9haEjdLg
MD5 SHA1 SHA512 SSDEEP

Insider/dyreavlens.imp

SHA256 731be3247d08d24adc88d60d8f22282d6588c054ed4cc40029699ea6fc052565
MD5 58adb7cdd32ec55687f843af63111ed7
SHA1 79183f55bc66b64b11ca4145a16bd82d436c9bfb
SHA512 f5700c8b59da855c768c66f573bd354bde40aaf771cb8fc7299be892aed1031775cf5bd117b1739b3e9e983a24f48732e7fe28feecbcc6e2db42026b63eb63bf
SSDEEP 768:PPscZpdvpcCsBLRbV/UN5pA4j/SKVijdD4rcYmRjnwoL4YGpazYNU+QDDPumTcCF:7keMUS0Eunf7kTFiOLWtM
MD5 SHA1 SHA512 SSDEEP

Insider/intarsiate.mek

SHA256 5559dd25f25927ea495b4a4e5cc1f297fc5e97a090c1b668a5cd9755a8f00273
MD5 01e1f30356c56ab894e00f810155ccc9
SHA1 0035fdcc37357f1e34045ac3387b7584477750ea
SHA512 5954e94b3698e290cc69f6dc111fb57e5a54b3c417dce29997b0388c5344c88978891362e20e143401573f46cce6d561c6c4cdbaab20105f5ddaa5bb80089cba
SSDEEP 768:TbtEww/5Xa3ILTP3xcxDDQEspiRC0T1coB5xS+ySp6tqMoTjOc26YxugGM78IV0R:AhERl2P1ZQQtPUzKA/
MD5 SHA1 SHA512 SSDEEP

Insider/laris.apo

SHA256 48316282ea994f9d92a13e908068e620539f6937c5cdd7bfb849e996bf3fea62
MD5 4082ae64bc3139c761d5902ac0c0eaf3
SHA1 76027d38b21873c9da8c0762432d3c8c9ccd754e
SHA512 51ba31623b87c9c541576adc4ac9684553a6b8d06f2a84c2f2608d6f1050403920a4f96b9a9cf6bb0808bf307dd825e290f3dc7c382b7082367a7054cb5f204c
SSDEEP 768:Pe2bKzwzel5Awqpqs2Rf5MOGmZ8LJzD8pCz8Lml4Rj1zKaNtmI38NAxZ22AeVfR2:/c+opySNYtMGq8zCd
MD5 SHA1 SHA512 SSDEEP

Trilogier.rea

SHA256 7d6c274ad802ad0f166f4cd6bf1a72e289d55900481105029c8146265e969b29
MD5 f96b7a4776a6d23f3a50da5897f86911
SHA1 839f9621509a37133fedf3465944999a5c88b8bf
SHA512 7f6befad553bcd030d48b5cade86c26394f3ae306abef0bf6f34eca72756947f85d1983874c993a237bfdc585b41d7bd73e8147cc2084c631df157226229580e
SSDEEP 6144:piCS0I+5OYEZ9KyFH72H27XIV31a7CVN6k5CYiloIs+aaVdcHca:pSFo09BZ6HM4ZgW2OCD1sPc2Hj
MD5 SHA1 SHA512 SSDEEP

Sharing

General

Malware Config

Signatures

File Explorer