01beeda976d48dc4c029032b0113fed68e00a2736cc03667c065f7bf7440eec2[.]exe

resource
01beeda976d48dc4c029032b0113fed68e00a2736cc03667c065f7bf7440eec2.exe

01beeda976d48dc4c029032b0113fed68e00a2736cc03667c065f7bf7440eec2.exe

IMPHASH e2a592076b17ef8bfb48b7e03965a3fc
SHA256 01beeda976d48dc4c029032b0113fed68e00a2736cc03667c065f7bf7440eec2
MD5 bf56c567703447c78773f3e581a004db
SHA1 80ec3b7f7b5f7e2df367dff512b508a21c682111
SHA512 b67e817ab691ab8257826b5a90fb7731801765b5e1299f1ee5235aa36065d082a04ca276c735eea0480a5e27382047b488227bd4e887a4176639cd64fd4c2f5b
SSDEEP 12288:fzA/ggggjlFZKqUVReLAu8xzRCf8CzQXX:U/ggggjHZbU5Po0CcXX
TLSH
T1D8B4D1ABEBA0C956CE3C47B4E8B392141B749C562E71CB0F178934106FB77C278A9617
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

12960

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetCurrentDirectoryW GetFileAttributesW GetFullPathNameW Sleep GetTickCount GetFileSize GetModuleFileNameW MoveFileW SetFileAttributesW GetCurrentProcess ExitProcess SetEnvironmentVariableW GetWindowsDirectoryW GetTempPathW GetCommandLineW GetVersion SetErrorMode lstrlenW WaitForSingleObject CopyFileW CompareFileTime GlobalLock CreateThread GetLastError CreateDirectoryW CreateProcessW RemoveDirectoryW lstrcmpiA CreateFileW GetTempFileNameW WriteFile lstrcpyA lstrcpyW MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GlobalFree GlobalAlloc GetShortPathNameW SearchPathW lstrcmpiW SetFileTime CloseHandle ExpandEnvironmentStringsW lstrcmpW GlobalUnlock lstrcpynW GetDiskFreeSpaceW GetExitCodeProcess FindFirstFileW FindNextFileW DeleteFileW SetFilePointer ReadFile FindClose MulDiv MultiByteToWideChar lstrlenA WideCharToMultiByte GetPrivateProfileStringW WritePrivateProfileStringW FreeLibrary LoadLibraryExW GetModuleHandleW

user32

GetSystemMenu SetClassLongW IsWindowEnabled EnableMenuItem SetWindowPos GetSysColor GetWindowLongW SetCursor LoadCursorW CheckDlgButton GetMessagePos LoadBitmapW CallWindowProcW IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard wsprintfW ScreenToClient GetWindowRect GetSystemMetrics SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharPrevW CharNextA wsprintfA DispatchMessageW PeekMessageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow LoadImageW SetTimer SetWindowTextW PostQuitMessage ShowWindow GetDlgItem IsWindow SetWindowLongW FindWindowExW TrackPopupMenu AppendMenuW CreatePopupMenu DrawTextW EndPaint CreateDialogParamW SendMessageTimeoutW SetForegroundWindow

gdi32

SelectObject SetBkMode CreateFontIndirectW SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW ShellExecuteW SHFileOperationW

advapi32

RegDeleteKeyW SetFileSecurityW OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges RegOpenKeyExW RegEnumValueW RegDeleteValueW RegCloseKey RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumKeyW

comctl32

ImageList_AddMasked ord17 ImageList_Destroy ImageList_Create

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

Butterine/Varemaerke/Garuda/Slumretppe.hor

SHA256 614bb44d24bbb3b890649867e13fb15d86e5ea73179fd44e716b10ffcaa3c7c0
MD5 3bf82f450a0dfd86f29536257623e2ad
SHA1 286877538ec1d1d41a9819596b41b0289509cb51
SHA512 8b4cad6568b4503e6e4171d22b8db89e54449bf98d28c0d4d9f207aaaf56005e3406c8160a8365037f36cc4a7e4c537455ed6632371e2104cb718ec18c13d3cb
SSDEEP 96:v48YsRVEpylVQratXvDeUeYSi80KFuwczSfTS48Bacs/OMRK2BL0Ab:v4XsRVCr0b/80KFuwNnA8OMRK2R0Ab
TLSH
T16AA18D9C5C45C034C4AAD7395C7E035242D25F882E0C3A3065A5A362B3EFFDA47389B2
MD5 SHA1 SHA512 SSDEEP TLSH

Butterine/Varemaerke/Garuda/bouillonterningens.skk

SHA256 6329afa66841b081b1479bbf17be5a6dab5863e736093da1398ccb4fd48c56ec
MD5 a5a3506d7a85c6a0834f9c3d27fce6c9
SHA1 dc5600f7ccd5caf8a924b70c2f45c1d7969f0e6b
SHA512 608b83dc77c28c663a9108b4f935e6db82d470fa0392bd30fe9f7dc94e57d1bfaa5749f8ed3e489dd138fd12a2a6cbc488699660e0bfa7f24a1bd66ddac1a1fb
TLSH
T1F311F7C2086FDC34C00421B2EF2011260371EC744AEC7FAE5845A6F6DB897A826B303A
MD5 SHA1 SHA512 TLSH

Butterine/Varemaerke/Garuda/nondeferential.txt

SHA256 8bffab9063ff62ad2be0622f70c9608fc039fcb4a4b1917081bd90adc5c36935
MD5 368d84fcacbe7199aad3fd09c7df14a7
SHA1 a5ca69a9db10aff8e8b7069b1800b8555b841c4d
SHA512 9e27dbb488e00f1690086b6c1d28e1eebfe4c1415a7a218de93baf210baa26d7d8c484273ae51d269403b844c11c37832349204faa1f7cb139585b9f7e26878e
TLSH
T16FF005146121225D4F6F45DAFDE05020F5FA030BD20441544393051BC597FD6D2EF24C
MD5 SHA1 SHA512 TLSH

Grouchy.Opl

SHA256 2d7e6c0e1bcf0f9f4db98c9cc7576cb87017f3defdff31f5c83d3eb414e56e92
MD5 16c2e56de9c7bea98d12e66613e04e83
SHA1 f69245121a7b6a309f94c4dea5d765e90200c5f2
SHA512 0c04b63973824e5f0403f99120dd250c316483fc13b689d428a979d52ebabeceeaa81751e0aed5e83a8c1aedfb11990b2a38f9b84a82d7342d93b20b49901824
SSDEEP 6144:2BujOgCh9ozuHs1toDuYwYD6+Bb8j4Z7zDMWp+RuRpb:2B289ozO4iDlo+R24ZzMr6d
TLSH
T1C764E0B1E7318653E51A18B85024DD083FD58061E2F242A9BC29E235A1DBBEF1D4DDFE
MD5 SHA1 SHA512 SSDEEP TLSH

Vitaminerne/Taksonomiske24/Trephining/Piloters/Holomorph196.mil

SHA256 3fca5795690f2d6553ca5845bf9b122051ab8b7c05896078541a14de00fb6bd7
MD5 4e679d550c231c35094fefb645f0d0b4
SHA1 26e9e728dcda9ce0a9427de64a8365ddb24090e2
SHA512 e0380be7bed7ab78208fa0694fedd3f5512bc6dda0c29c3895db4e6f814fc719dcfe933d1ec871b75fbd7b436c2c57bb0fcf9acfb64e171c01c022b36f73f4ba
TLSH
T183817E7875CF0B4DF2927ABDC4BC2954A9FF1285709D08C422877237930A475D6E6DC5
MD5 SHA1 SHA512 TLSH

Vitaminerne/Taksonomiske24/Trephining/Piloters/Recepternes.pen

SHA256 cf1db414b602f31a34655222809a3542f96a8ffcf0e43dfdbc341192f8298f71
MD5 24e44ec408c4fb8b429adb0ee5869985
SHA1 1913f35995281fec0c9f586fd73d6a2f4e64a5ca
SHA512 76b152a80b4f9537c1cd3fb6209021040946c0e7c75fe907f9b95e9f4446b2f12ef54be9721de7b13929df0e1d555db38f470d43f9142b4c1b87e74768819425
SSDEEP 1536:sHoiMTmNr5n2YDREJfm7g0ctkXRR7f8zYXJ4l:QoxOHifKciRdf8zYK
TLSH
T13C43D0A4FB6E151C85A210E45EC5817A1F588DED92A4C263D39F777E3088C9806FDAFC
MD5 SHA1 SHA512 SSDEEP TLSH

Sharing

General

Malware Config

Signatures

File Explorer