640d4390b574d98cd36bd206a65fceec9c322b4008a915519f55a8d39265c78c[.]exe

resource
640d4390b574d98cd36bd206a65fceec9c322b4008a915519f55a8d39265c78c.exe
unpack001/$PLUGINSDIR/System.dll

640d4390b574d98cd36bd206a65fceec9c322b4008a915519f55a8d39265c78c.exe

IMPHASH b34f154ec913d2d2c435cbd644e91687
SHA256 640d4390b574d98cd36bd206a65fceec9c322b4008a915519f55a8d39265c78c
MD5 6bdec974b6a33ac38c1ec88ccd4385b4
SHA1 44b1f17c6716851075dd1a74aead174b7fcc976a
SHA512 2f76036913a6b4d03a7e50c418bd7af37069bdf8fa5998b063b52afefffde94f923a64d16bbaa0f67345656f091c226f654a2d1d65ed086cc8f5bc4d875525c8
SSDEEP 12288:vUeRVFH0VxfCsbdysP2mybjsGqaSS7lPNz:vUIBCxasRys+XXfz
TLSH
T1F7A423803130D24BEC6347B5052E2D5F67BAE5BBAA102645D7D07E993C27382A91F37B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

13199

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetEnvironmentVariableW SetFileAttributesW Sleep GetTickCount GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW SetCurrentDirectoryW GetFileAttributesW GetWindowsDirectoryW GetTempPathW GetCommandLineW GetVersion SetErrorMode lstrlenW lstrcpynW GetDiskFreeSpaceW ExitProcess GetShortPathNameW CreateThread GetLastError CreateDirectoryW CreateProcessW RemoveDirectoryW lstrcmpiA CreateFileW GetTempFileNameW WriteFile lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject lstrcmpiW MoveFileW GetFullPathNameW SetFileTime SearchPathW CompareFileTime lstrcmpW CloseHandle ExpandEnvironmentStringsW GlobalFree GlobalLock GlobalUnlock GlobalAlloc FindFirstFileW FindNextFileW DeleteFileW SetFilePointer ReadFile FindClose lstrlenA MulDiv MultiByteToWideChar WideCharToMultiByte GetPrivateProfileStringW WritePrivateProfileStringW FreeLibrary LoadLibraryExW GetModuleHandleW

user32

GetSystemMenu SetClassLongW EnableMenuItem IsWindowEnabled SetWindowPos GetSysColor GetWindowLongW SetCursor LoadCursorW CheckDlgButton GetMessagePos LoadBitmapW CallWindowProcW IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard ScreenToClient GetWindowRect GetDlgItem GetSystemMetrics SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharPrevW CharNextA wsprintfA DispatchMessageW PeekMessageW ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow GetDC SetTimer SetWindowTextW LoadImageW SetForegroundWindow ShowWindow IsWindow SetWindowLongW FindWindowExW TrackPopupMenu AppendMenuW CreatePopupMenu EndPaint CreateDialogParamW SendMessageTimeoutW wsprintfW PostQuitMessage

gdi32

SelectObject SetBkMode CreateFontIndirectW SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation ShellExecuteExW SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW

advapi32

AdjustTokenPrivileges RegCreateKeyExW RegOpenKeyExW SetFileSecurityW OpenProcessToken LookupPrivilegeValueW RegEnumValueW RegDeleteKeyW RegDeleteValueW RegCloseKey RegSetValueExW RegQueryValueExW RegEnumKeyW

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
MD5 0d7ad4f45dc6f5aa87f606d0331c6901
SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
TLSH
T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10643

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Tinworker/Aflyses/Fuldfoer.jpg

SHA256 49ea9fd31efb305f595d35f20c9fb4e5adfffe0fd708790fe8e46798e33c851c
MD5 5ffc586f3095e62678901e7b2c2b5c3b
SHA1 4c6ead14ee64a42984d585e4bca74ba77df84631
SHA512 53a72636516d830ce52a7f859d8b8f2e01e119481f94849c7b35307e3420b45209b4b65cdf192b4b7605d83d2609c65c1abb9f68c75645b9d0488ef61edaf733
TLSH
T101516C436A289281CF0079EA9C970A07D09F1BCCBE203AF85A22009A8250FF6D48864D
MD5 SHA1 SHA512 TLSH

Tinworker/Aflyses/Nonconstricted.ini

SHA256 89e749c60e56946f3a6cb29e9b33654f3a8ddf9c47441b352abcafadf80210dc
MD5 dd91f538ced552a9c4750cc12c05be5d
SHA1 616d288e911bc55e32d148da20294a2d44cd97ea
SHA512 1633cfa945a46c294ae0ec3ba5a0f9072ffe43acad449ddfcc242fb6e4d59ffb496799bcd2ed7b564ebcf6a5dcce5669793a7c68de68e8184759901e11ff9554
TLSH
T1D7E0C00CB45023D3E3CF580382F90A4155944431E620C013D9FA9305AC2D86847BB34F
MD5 SHA1 SHA512 TLSH

Tinworker/Aflyses/Sejldygtiges.tve

SHA256 d31579062335f1496efb58bf0cf5c5a2a0a1d3ebfaadb3fe9fd906af347d0f8e
MD5 dfb3f3f565e1baca3421f05c4eebcaf5
SHA1 300909b130b8aa53ad1e6d6f015458d66f0c1c3c
SHA512 0d308abc6fb117e2de5723765bd9d429edc65c827590574a85cf29cf4e5d6c1d8ba1d8da024be641ccad08df8d64603b3423e20274cdb633f4d4649ea0efaa25
SSDEEP 768:qYXURfLpuVrxR+2ujLVlS+ThTahsh/X1Pz9jjzHHNCRYrDPHZyF:qYGdkxJ+xhysRF1jpCRYfP5yF
TLSH
T1E574120877E091663E86FCACFBB6ED553833647C756ADC76A046FA36C624E08D927804
MD5 SHA1 SHA512 SSDEEP TLSH

Tinworker/Aflyses/Superciliosity.Com

SHA256 dd831498d6897ce6cc6795eadf20814fafba7ca101488c94402ae1a1c438a1e6
MD5 02d5a4c57919ffdc6cf4782cce058515
SHA1 679c330cbbf48017bb9ad9a1e357b45912328855
SHA512 1be71d225e4e2f4c3db04b8c3044b96058ecfcbdc780c16c306fb89707a98ff9caad072274132dc47d16064f200fcd869afcadb695c5a23ed9f207d787a20e11
SSDEEP 3072:hAlVdWc9dCPaeZ2LiDjlgnbUlMmXy1Rmlrei:Czn9YParu543r1RmIi
TLSH
T10ED3AF93CB654CFBC817C538C59D32A68C597015974FC4AEA13BE828C1863F667286EF
MD5 SHA1 SHA512 SSDEEP TLSH

Tinworker/Aflyses/flersprogede.ini

SHA256 c6420f67fd22b76d0daa39dabcabf376923ef1cfb6bc00421fd5b9261c65bcfb
MD5 470c268dfc1e89bf5f1e4f71cb18a2b0
SHA1 4bc21e98fd1749a9c512d92f09f4915810b226fc
SHA512 0620145e049818ea7e6548551fdfa38da7f168c57f81a0fe07775dbb0385e79efede64cf5e21aa12e2c484e918cda77b85ca208e2cbdd775da5c8fd98845a355
TLSH
T129F08DB2B930032A2E62B840FE0025F0528E86E00A00407C73BB038CB93224A2313A71
MD5 SHA1 SHA512 TLSH

Tinworker/Aflyses/furmity.txt

SHA256 d6530be498e55c95dcca48b6121d32cb3ce92565847037ae7e9996419af81f09
MD5 9fb6a5f59528ee12161d20499c6b9dbb
SHA1 512f4181b8ba684acaf545a12fbdaf385156e80f
SHA512 bc905d1224facc49446361ace9d08ed6be85599a8ca9c4ff410c345719476257d0745feb56f03b6e7c4740a9e2f9c92d1f39fa5d3b1a52a8942cce54e5b8ec7e
TLSH
T171F07EABFF0500CA1EC63AA83033914043D080024D2E1028F6AF3B0F22EDE80C28228E
MD5 SHA1 SHA512 TLSH

Tinworker/Aflyses/linearizable.beg

SHA256 5e6b13e56e99c976331ecfeca6563dc0e8036a16b5527d3342c39fa200caa725
MD5 5f6738965beefb97c0fe3d33c30079e9
SHA1 1a7d3deb266fdd8a8ff01d6abf8b6b6bc2704018
SHA512 07637391cd5abccc6e0cd11974150142f9132df48aaae29480ab510b0ee08b1cf6c6c76c3b9bd5bd2377cc4fad0dfb1af4b7a3596aac5ccc211d761ae8a0bbbd
SSDEEP 1536:cR1HUQJpmVQ9v/zVd45Kf2jtvCd5craeW+mTmLT4OmlgZo+i805y4m2IY3t6E7p/:EvcKYyLOznHSEIO0Az4+GSA5
TLSH
T15A8412D2650E0ABB9B9411ED72A6B54F8D64FC2408257A016FC0C7F18B27E9AF401B7F
MD5 SHA1 SHA512 SSDEEP TLSH

Tinworker/Aflyses/overpopulousness.ini

SHA256 6ad0c727d42fa68109e2e3e6372b536f45b0ddd2582661224df143ca4e6ff981
MD5 aa28e79e903b07c0a39b645779d69734
SHA1 1d343c557ff347a284c53c57d3563501ceb3f0c2
SHA512 880e2e5134e7a00ae8e1c9e32575584bf032be904653583015d27c87aa7663badb464685f59221b329e5c24b855facf70a14c60f03927eef79443a1cca476497
TLSH
T123E08AE597774F0C3E23518CEC641CC84C1A810A090D01F636B8130C3417334E70D7D6
MD5 SHA1 SHA512 TLSH

Tinworker/Aflyses/pjecen.ini

SHA256 30e23e9462a92ca578caafaf6e74f7ee5830c19cad51abcf5faeaecd647b38e2
MD5 93fbe345befbbdadd44c6afacdcabb22
SHA1 c6e3ac832206022023cd799a21d757ba80e27094
SHA512 1a3e3c6080730f448f541101c30a75a039f3f856d2c6e1afa9bb9d860590f91969951afe24a1928f3ed72db2b5338acfa5cc5467d6ba49cb93455e0695105494
TLSH
T1D7C0125D14636D281328691258405D59CF69A45DFF071224792637913CA1497525416C
MD5 SHA1 SHA512 TLSH

Tinworker/Aflyses/stigmat.ini

SHA256 837d4bdbc9e2bf4e4c8e326c421023bcda2412e98a0d4c510637253c6b61b573
MD5 20b897099c47d26ed4e84282c2da18c6
SHA1 5489ce282ab47ff04ab1abe89f53400dc700a32b
SHA512 66a4dced97295d3c60de0a9af748ea722ba363a73a3d14f5461dcdd83ae6b3c50adc9c4b09ee53533177d0a4f2bd4de9946aeb2a0b0dd6c24bfcdf22ca0338f5
TLSH
T19CF09E447D8975AAC94233BEDCC209245A5F170C531054AEF853472EE29497CF33B927
MD5 SHA1 SHA512 TLSH

Tinworker/Aflyses/tvredes.dob

SHA256 aadd95489c0b4b50c377514876ce6fd2c7ffba655f3db1d2d0f8369b9cc2d542
MD5 5064b07baeac34115e86066c8c05b1f6
SHA1 ba8e05461f3088cda2de308afc2328d367d48e9b
SHA512 a36647c00aa29116f7534f04a0eeab2e42ae561b2b18e59d7e49b9ca405dd69e3067481dc3e113c03111cc92547d963b74b05e5928a407ddfc25174af95bfd29
SSDEEP 384:AJ+cvyNISz6ZjEdnLPeeauEPEnlY/0ujBAnttuT:8+cvpSz2jEdnzeeauYEnlY/0umtS
TLSH
T15A03BFD2AA384CC0B691D386316ED10E5ED44E2FAD884EC13A96F68285D30BF5536F60
MD5 SHA1 SHA512 SSDEEP TLSH

Tinworker/Aflyses/unprofusely.ini

SHA256 a0ca786b5643f98b72fc1e85fab61c576915d1c997224c2046d0247313513353
MD5 caccdcb11875d229f34f69f0862b664f
SHA1 208e08d6f975c26e6daea48e99f9070ee61f31ae
SHA512 0a269c91482a08ba1db815857279334d6c74c7d4b8e0909f409960aa6a947dab3d863c02ae611cf3206b74991b4865ca751f93ba3e3918118c2b10b2ae1cc2e8
TLSH
T144F0756D857621550D5710ECDC270D0CC8A9C440A03608E2FDE8D34F179E04CF33D148
MD5 SHA1 SHA512 TLSH

Tinworker/Aflyses/viaggiatory.jpg

SHA256 7fe98cccfd029725157ec35be1a28d250f3a8629e505d15604f7df7852dc1375
MD5 2cb4559c32ed172f7d2bd71cc3d3942b
SHA1 38026448d7d1c762b2caf35d394255dc8b39340f
SHA512 8cc3fe303375c48442a6654075bb3ea0dd20399baf7aeded17f47bfd7e01c8d84bc73dd67e259785764c4aa398e0d968cea1f3c8f368d8ea63c6d32b114358b3
SSDEEP 384:/l9zBl71XsBOWxKqE7kpS2jfffOM/GSv+qwJVorMc+LtbHgxZViEzbuNgVoA+HRC:/l9Nl7lsOW5E7kp3jff2M/B+DJVorR4c
TLSH
T156A2E01E3B2857519F0ADA8F1D055F3B73DBB99DDB6438BA7C8814BEC010C7058CAA28
MD5 SHA1 SHA512 SSDEEP TLSH

Tinworker/Frontmonteret.Rec

SHA256 39247ef8e3ed3acc4041ccfc7ab910a024cd804fa6679c68af399b1ff81ccd0c
MD5 1c7aad4bb3053eeb8a7954c29faaf692
SHA1 0570e9eb938e3368e1ea5dbd71f580626f0c6f2d
SHA512 5b9ed4b91ce07b73864907b10d961cceff41e06a9425c93fc7c9dea630bcee0ecc3d98f72b426dc69274316a4d633366e0fc0700f0e19941d77b8eb666b5711a
SSDEEP 3072:UPqFR7PSWzXaJp5vvnPxW5cubPicM4/NL2yFaZ2R66DM+k46JRG8QiJZGsPcOm8o:BPS0wPx+Ac/NCy8ZuhQ4kRNQSZ6w9y
TLSH
T18914E0D092540624F2FEB760E221EEBFE4F2CE87E0676BD4E14689D62CC9852705F749
MD5 SHA1 SHA512 SSDEEP TLSH

640d4390b574d98cd36bd206a65fceec9c322b4008a915519f55a8d39265c78c.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Tinworker/Aflyses/Fuldfoer.jpg

Tinworker/Aflyses/Nonconstricted.ini

Tinworker/Aflyses/Sejldygtiges.tve

Tinworker/Aflyses/Superciliosity.Com

Tinworker/Aflyses/flersprogede.ini

Tinworker/Aflyses/furmity.txt

Tinworker/Aflyses/linearizable.beg

Tinworker/Aflyses/overpopulousness.ini

Tinworker/Aflyses/pjecen.ini

Tinworker/Aflyses/stigmat.ini

Tinworker/Aflyses/tvredes.dob

Tinworker/Aflyses/unprofusely.ini

Tinworker/Aflyses/viaggiatory.jpg

Tinworker/Frontmonteret.Rec

Sharing

General

Malware Config

Signatures

File Explorer

640d4390b574d98cd36bd206a65fceec9c322b4008a915519f55a8d39265c78c.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Tinworker/Aflyses/Fuldfoer.jpg

Tinworker/Aflyses/Nonconstricted.ini

Tinworker/Aflyses/Sejldygtiges.tve

Tinworker/Aflyses/Superciliosity.Com

Tinworker/Aflyses/flersprogede.ini

Tinworker/Aflyses/furmity.txt

Tinworker/Aflyses/linearizable.beg

Tinworker/Aflyses/overpopulousness.ini

Tinworker/Aflyses/pjecen.ini

Tinworker/Aflyses/stigmat.ini

Tinworker/Aflyses/tvredes.dob

Tinworker/Aflyses/unprofusely.ini

Tinworker/Aflyses/viaggiatory.jpg

Tinworker/Frontmonteret.Rec