4d1b8646c493d3fed46745143f84d655331efb35a908297c86efcdc90fe7cecd[.]exe

resource
4d1b8646c493d3fed46745143f84d655331efb35a908297c86efcdc90fe7cecd.exe
unpack001/$PLUGINSDIR/System.dll

4d1b8646c493d3fed46745143f84d655331efb35a908297c86efcdc90fe7cecd.exe

IMPHASH 573bb7b41bc641bd95c0f5eec13c233b
SHA256 4d1b8646c493d3fed46745143f84d655331efb35a908297c86efcdc90fe7cecd
MD5 edb0ab2d9b2ab905e32a0eecc2c279b7
SHA1 b98fb072a62ba04f18bca7578912bf191ba170c0
SHA512 fcc64bb016bc88c490d87d54fb1fa6c8d3b01f2da745f3fb6a2cc593cf20b5b01ee77c821ffecf68b18b147d90f1b5371b87b8e7f8ea1b190b230ff150119aa7
SSDEEP 12288:j+RnUnoE12lM1yk7s4uKkxiaC8o03g32u2HNYQTUJ9Ag0RavExvwDY7ANuGFQBC5:j+IoE16Mj7s9oqg3aHNHmAlljEAGuBC5
TLSH
T116F423387180542BC07047B99D377FBA929FDB25A660551743407E3EBCF1EEA882B1E9
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

13655

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegOpenKeyExW RegCreateKeyExW

shell32

SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW ShellExecuteExW

ole32

CoCreateInstance OleUninitialize OleInitialize IIDFromString CoTaskMemFree

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create

user32

MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW CreatePopupMenu AppendMenuW TrackPopupMenu OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW IsWindowEnabled SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CharPrevW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint CharNextA wsprintfA DispatchMessageW CreateWindowExW PeekMessageW GetSystemMetrics

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor

kernel32

lstrcmpiA CreateFileW GetTempFileNameW RemoveDirectoryW CreateProcessW CreateDirectoryW CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW WriteFile ExitProcess GetCurrentProcess GetModuleFileNameW GetLastError GetFileSize GetTickCount Sleep SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW MulDiv lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject CopyFileW

$PLUGINSDIR/System.dll

IMPHASH 509a34b3a68a773e0afb4259e68f9f82
SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
TLSH
T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Bookmakeriernes146.txt

SHA256 fafd41b045ac99c8c3cdf0801c4097700a0ed80dfe398577bf4eb3069035e66e
MD5 5f9b272c5783dde6a0a4947ff3883478
SHA1 aa9a39e16650e0d58dcadd4a07e02525ad068f7b
SHA512 c849793eb56403803ceb6ad56531573f951a4c14783d044791e2acc53b5800b3ddd43fc5a03192e1110b489f42fdf5a53bd675850621c6369b2ee6155243be73
TLSH
T1BEE0231CC85B1F6D0F0E1D6D4BC9B19DC85A0240CC98DAF077ED379C62003BC9844298
MD5 SHA1 SHA512 TLSH

Statsborgerret

SHA256 01cb6cfd6caf090a9b885a3b92997a4e3ce6b2a4e53c0845186921805405cea6
MD5 56dd31528e126482f52584ffd48aef2b
SHA1 ca1ac51941cf84b77ee429d1036d08e1666e84ef
SHA512 e9c7bc33e32e3c673266cbda2ae798d86d8d0ebe280ba68fddf94e93e216567362562dce7e62ffecdbb45e40132497ee8e1d326f83c17722af727edea1187325
SSDEEP 3072:VJX5Urku6bTmy+F+gII6cjGZW4d1CLV4cO9Pe/4ctWLFQWcx4cugCHmJCNQSakiw:VVykRT+EgII6tZW4dIZicte9gJRacl3u
TLSH
T19314F13692FE5D06CD1A6A264657544E524B4F4FA0DBF205ADEDF83A11B3BEE80F4803
MD5 SHA1 SHA512 SSDEEP TLSH

Tarbox/Galactoma

SHA256 00a84634780d4eb5835ef0e864c17d50e5228e697fc9fe8c69736e5087fd5c82
MD5 c7cbc1fa75b9e394d13b9d8154f27289
SHA1 ce35a76a7a1c158d9dcde5c4cbd414dd0e0e8c64
SHA512 4b41e0addafa100933a408b582a94ac19f22c3e0852e9f8164e989510d0b1800c76bbbf47c76e646576836f82452850b893d4ded6023266aef5d1f1d1e7a0ad5
SSDEEP 768:pDAcKc1bb3BIjnoueF25ymh2xewfaEwqGR946ubikXrd64wd+ACa:Bq2bNySmGfFwPmWkXx6td++
TLSH
T17353AF96D7928DF6CC01CB3CD4BEA0955D99B026DB0F987D52369820C18B2F3A37467E
MD5 SHA1 SHA512 SSDEEP TLSH

Tarbox/Hvalpene.ini

SHA256 6bbd73337ed51d84dbcc2f90e4e320ebf8e1b8502e303a39092eb2c573da0865
MD5 c26e1baee18c67284bba947d61df0d03
SHA1 771795cb831ba35e118569d364da51143cb213dd
SHA512 689dd6e37be5cd77ed40a3beaca39790af0e22ff9a84053184207900c1a52439ddd209322d00690243bea7c0556445e291915126dddd7e86e7c272667d5a5e02
TLSH
T17EF0261085B33BA44D5643456CA908D74CBF223F525CBD94C7043C5E020E12C433D3EE
MD5 SHA1 SHA512 TLSH

Tarbox/Schematiser182.jpg

SHA256 134a566426cf74c266a62a6ec85a059425e134ce91d1fea5aebd51bcfc69bb6b
MD5 086b45ee79c38f6aaece483b1cd3b53c
SHA1 406248689a8d6b9b725f4cb711dbc0699e9a07d3
SHA512 b28e776e7838e556d9a3ad978ece7d36be5c70460579d5968d49216de119d7ba563ba629ba40eba3769319ea66ee4f2ea2a51726a459d3201d72e4df8af4d115
SSDEEP 1536:Mumgk8q7+l4WPbwVtDlkRXIEYw7ZcKk/6dE3js2MlD:ob+KWPbwDlUJ7ZC6dUjmD
TLSH
T19E33027753446089272982C31CE91BF2C503FF5CABAF51AD0F6608ED3A71DB9C099978
MD5 SHA1 SHA512 SSDEEP TLSH

Tarbox/Schlegel/digekrone.act

SHA256 dfe47178003c47fa6973485c325f5055abd18881f8dc1d70f45c306643a41b79
MD5 76e79252a9c0f87a51849de09cb0ea10
SHA1 8985cca4eaffa0f067dc243bf2f529e0eb6c6e97
SHA512 072a3ce46df9623354c2f2db15a89f82b30d49c2730d49352cac7bca48c7851bf32ca7d9f57d0efc37f610391bf8d145bd4c2cf01b965f6dc29e9476245b7c6e
SSDEEP 1536:9zt1MiHeF+/YO90UghqRGO/UZ/YPeQaDPogwDH/+IqE4n+h1fQz+CTgpX+LDe6fz:CSsBrD
TLSH
T14A4612088E0A538FD7788554E239A9DF3C7145B9A500C43BCDABF6F7B295B9C8E58423
MD5 SHA1 SHA512 SSDEEP TLSH

Tarbox/Schlegel/dulmede.txt

SHA256 1f2ca878747c292c7ea4b93999d3066a478e07e7d97940cbe39d7f31a2d8b7ed
MD5 aee61dee8c038730bd0ec0f495b1db02
SHA1 ff8e9c21175f09dae8ddf61f03ec323966134125
SHA512 d55797a02a1d8e55e4a0236f0696108810ec840b97661a83c1520cb9bc69fc31cd6ab818f10eb04ba9ad0338d680dd4bcbcd9404defd90325b2df9e1392aa148
TLSH
T138D02B7ED5C30219DB0B196F8D0E7C961B69DA40D111EA4DF34D63247A6E128D9B88CF
MD5 SHA1 SHA512 TLSH

Tarbox/Schlegel/dundynes.ini

SHA256 34911407e69ee1acc6dc12e8debc4bf2defb029909ba8b143005edb433a3ce68
MD5 0125d36de1dcc1b6964f989e7f0c5608
SHA1 361770252363608c39f898586b2de2ba831a965e
SHA512 8610edff2c82bb16e50779156aed4dfdc25904215dcdcedfe5a4467b3a0029c7eac685dc3e528d8f595241b869bb7db63ea343de22f19d41da9688688e066bc2
TLSH
T10BF0EB029B9C222ED45367BCAD9431D88B1CA61F4E201753E6E9A20C7717B28E76905D
MD5 SHA1 SHA512 TLSH

Tarbox/Schlegel/floppets.ini

SHA256 50a82de942220858d9a197bf57764728a5e644aff63f505faabac26c95d94b3f
MD5 822746fcb3308edaffcfeaff0e843be9
SHA1 d22e6ba54e33213de77fd3f8c9ba9c4138c01bb5
SHA512 e9d25a58c7efa12e0b2e56cf3510f72c4dcbfe64e5ff8208b243e3935c84ccb7b43ff25e5ab847781cd375ac71304464be467428faa8670b45028d0cab7da153
TLSH
T198F054C050215788B737CF9CBD384401911FC3123228617F3E9D235D23E3918A2A9E1C
MD5 SHA1 SHA512 TLSH

Tarbox/Schlegel/mediaevalist.ini

SHA256 e2bbc0d9c3d94ffc4c899335f7a8d1ad98938cfd37b83521d6210bb12d395b02
MD5 c3189f29c0821c9b4567679eca7687dc
SHA1 0c1d75b11c56aec16205fa1cf3e2428ead68bc9c
SHA512 ca2ccfdd23c6713a5f5970bc77b34d6c2a8e6b749ef2b93b296a990c1c81aa8dbc184a31272e88008b9cffc4cb4b9834d71486821e84d4649691c543a77f3d9e
TLSH
T1E9F02870F46135C2795F43011CE0E843D664431C4134C80291AA7B99853F9EDE1BEB08
MD5 SHA1 SHA512 TLSH

Tarbox/Schlegel/pornografiskes.txt

SHA256 df95f702009980716ce770b2b543654448c416a88d561b29e913da94c795b47e
MD5 2c748cde4e530c07c2165e297836f43f
SHA1 a0d0e8a1ed51d39854cbb9287e154d0226e1ee37
SHA512 a5bba1380229fea49e53dcee26d5543a3d56b0a4e133cb752de40f96a2d8f53d733e033030d46cad166f1747588927118a3baee650d3b0c8ac47455c4c2f83f8
TLSH
T125E0C0944A3483208D29320FB457D493D8FE9588592E5090F88A5349B8028188337474
MD5 SHA1 SHA512 TLSH

Tarbox/Schlegel/stokkemetoden.ang

SHA256 27c0a07474012c38a24690d6d16d3561c1912e35df1ea5c248ebf5f70b15de61
MD5 b76dfa0a307a326e254a465eb1d60d94
SHA1 5f88b07015221790d7862ea198bdb539ce313f54
SHA512 2285ac76c366366c17ab3c4935b37e38cd1ed66eccc6c3ec56bc383a5fb469305e1f6b300ef16304274c87a9df50c075f56f3645709dbd016bd5e45b311a12d8
SSDEEP 384:qyiJCKCcyzgzE4YhLCMo1c2W1mdEFArD41Li3Zd:Ps1CcsD4Yts1c2xBamd
TLSH
T1E68623B41384691D244280AF49FF2BBA72F6FD289F630F679210334EF079574AE9B654
MD5 SHA1 SHA512 SSDEEP TLSH

Tarbox/Schlegel/unwatchfulness.jpg

SHA256 9e55843e0386185d31949fdc4371ee20ed2efe79be428761d2e203fc882bb3c8
MD5 c0e29017423d31111601c8ffaaff8cb8
SHA1 f259128c5070388814aa14308539d5ed4b0e6d56
SHA512 45bad0677c1e80412a83420d4f9b8caaae1605f3240e794c0b0acad3fac7dff3f4022c4f0668a16c98af22f89f996a672c2f046d5171f2a0a0ee711617b71f5a
SSDEEP 768:sLssxqT3+TuAQjmjfoKKYPTc0iAKLLzfWn+a33eEFzsnoCeOY0:sLdpiAQ6jAgPAjAsfKnneE9s3
TLSH
T185F2F17C12C90C49293965767D9BF01A79DADF2434182A304122DF2F6E7187E31F18AE
MD5 SHA1 SHA512 SSDEEP TLSH

Tarbox/Tryksans.txt

SHA256 4bb0a98749d4c72a7d9b6cf1e45822217fc7064cdc585404cf49f3aaf185b8c0
MD5 34a74b1a13a86b82fd846b7899b18756
SHA1 04e0f42add61779a027e6e46d8bbbfc2c1682ea7
SHA512 b6c334adde7891632e4a5135eca64690137b3cff07d47e9c88a670253648a8e76f1b837d035e2cff1c38775af16d25829a5ce301872ed48ea8d1a3932f3b2988
TLSH
T1640123606C67410B14079B05F9E556460372E5A46E2246A1FACC232E7E2609CF77B68F
MD5 SHA1 SHA512 TLSH

Tarbox/Underkue.txt

SHA256 7846ddc942963a2fdd2a91ad336cf655460d458b3d10f3c18cd1c82d7d2e0a5d
MD5 d4b59335162e9daecb30d8552353ecb9
SHA1 5083ed6fe08d1f20039a82c414708f374f4caa9f
SHA512 9f417f48a4357d07806c9d11cbef2a4dc627f4be22439ebb9f4b65bbb52a0d1e43f7e28797a43ebc3ac42435a4f51015534e3cb2be61282590574b153b6bdf48
TLSH
T134012386C9841757793737DB78B11C5A44AD47354B43C232BE9C118B04DB554D27C70C
MD5 SHA1 SHA512 TLSH

Tarbox/adoptivpiger.ini

SHA256 526d90a7bcf1f1e26294748a3534761677422f5b7dde1197ec9742bab42457f9
MD5 71570e50497b465295594118429e2ed4
SHA1 4f2fbc68e2a79231cb094d834784b7f57309c569
SHA512 17d3d96d036c6c8ffebde56605dafe000e3cdb83d0d57a289459a4bc93f0b51351c4909ade310545e07d5fbf7e74c8e664ef5d9a2fe5d4c2bf9b219bade00105
TLSH
T100011080CC6819AAC40A3341EF80207652AD667941909DC2AF35134F847295CC3FEACA
MD5 SHA1 SHA512 TLSH

4d1b8646c493d3fed46745143f84d655331efb35a908297c86efcdc90fe7cecd.exe

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Bookmakeriernes146.txt

Statsborgerret

Tarbox/Galactoma

Tarbox/Hvalpene.ini

Tarbox/Schematiser182.jpg

Tarbox/Schlegel/digekrone.act

Tarbox/Schlegel/dulmede.txt

Tarbox/Schlegel/dundynes.ini

Tarbox/Schlegel/floppets.ini

Tarbox/Schlegel/mediaevalist.ini

Tarbox/Schlegel/pornografiskes.txt

Tarbox/Schlegel/stokkemetoden.ang

Tarbox/Schlegel/unwatchfulness.jpg

Tarbox/Tryksans.txt

Tarbox/Underkue.txt

Tarbox/adoptivpiger.ini

Sharing

General

Malware Config

Signatures

File Explorer

4d1b8646c493d3fed46745143f84d655331efb35a908297c86efcdc90fe7cecd.exe

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Bookmakeriernes146.txt

Statsborgerret

Tarbox/Galactoma

Tarbox/Hvalpene.ini

Tarbox/Schematiser182.jpg

Tarbox/Schlegel/digekrone.act

Tarbox/Schlegel/dulmede.txt

Tarbox/Schlegel/dundynes.ini

Tarbox/Schlegel/floppets.ini

Tarbox/Schlegel/mediaevalist.ini

Tarbox/Schlegel/pornografiskes.txt

Tarbox/Schlegel/stokkemetoden.ang

Tarbox/Schlegel/unwatchfulness.jpg

Tarbox/Tryksans.txt

Tarbox/Underkue.txt

Tarbox/adoptivpiger.ini