d546ccfe65927247618f5db67dfcd6791d705034bb7bf4dc592f5042b09ee04b[.]exe

resource
d546ccfe65927247618f5db67dfcd6791d705034bb7bf4dc592f5042b09ee04b.exe

d546ccfe65927247618f5db67dfcd6791d705034bb7bf4dc592f5042b09ee04b.exe

IMPHASH e2a592076b17ef8bfb48b7e03965a3fc
SHA256 d546ccfe65927247618f5db67dfcd6791d705034bb7bf4dc592f5042b09ee04b
MD5 219e65811a15ce9c2834b8a64533c8a3
SHA1 67da017fce36074d73f3bd3bee70b7afb6464ddd
SHA512 4e1de87d848300ae3d74e2aeca626cd148f0f592fdaa37333fe380314b1d645ed4a220ab80dbb2d8c594fd2e0765e17dd8c91e85e4e5a200b0f28b8d75ca7d32
SSDEEP 12288:UqKLCF0DpBqDTgmqZFY/lEQJPDRD/z9GlYtCqGOunBxJcsTF/VQ9o:lUKDIY/GAdDFCrJFFdQ9o
TLSH
T1381512253A93D897CA7A0A30EA63D9F65A727D21DC10422B73F5FFFE38B1391510A149
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

12906

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetCurrentDirectoryW GetFileAttributesW GetFullPathNameW Sleep GetTickCount GetFileSize GetModuleFileNameW MoveFileW SetFileAttributesW GetCurrentProcess ExitProcess SetEnvironmentVariableW GetWindowsDirectoryW GetTempPathW GetCommandLineW GetVersion SetErrorMode lstrlenW WaitForSingleObject CopyFileW CompareFileTime GlobalLock CreateThread GetLastError CreateDirectoryW CreateProcessW RemoveDirectoryW lstrcmpiA CreateFileW GetTempFileNameW WriteFile lstrcpyA lstrcpyW MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GlobalFree GlobalAlloc GetShortPathNameW SearchPathW lstrcmpiW SetFileTime CloseHandle ExpandEnvironmentStringsW lstrcmpW GlobalUnlock lstrcpynW GetDiskFreeSpaceW GetExitCodeProcess FindFirstFileW FindNextFileW DeleteFileW SetFilePointer ReadFile FindClose MulDiv MultiByteToWideChar lstrlenA WideCharToMultiByte GetPrivateProfileStringW WritePrivateProfileStringW FreeLibrary LoadLibraryExW GetModuleHandleW

user32

GetSystemMenu SetClassLongW IsWindowEnabled EnableMenuItem SetWindowPos GetSysColor GetWindowLongW SetCursor LoadCursorW CheckDlgButton GetMessagePos LoadBitmapW CallWindowProcW IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard wsprintfW ScreenToClient GetWindowRect GetSystemMetrics SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharPrevW CharNextA wsprintfA DispatchMessageW PeekMessageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow LoadImageW SetTimer SetWindowTextW PostQuitMessage ShowWindow GetDlgItem IsWindow SetWindowLongW FindWindowExW TrackPopupMenu AppendMenuW CreatePopupMenu DrawTextW EndPaint CreateDialogParamW SendMessageTimeoutW SetForegroundWindow

gdi32

SelectObject SetBkMode CreateFontIndirectW SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW ShellExecuteW SHFileOperationW

advapi32

RegDeleteKeyW SetFileSecurityW OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges RegOpenKeyExW RegEnumValueW RegDeleteValueW RegCloseKey RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumKeyW

comctl32

ImageList_AddMasked ord17 ImageList_Destroy ImageList_Create

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

Auxiliaries.Tsn

SHA256 d479e3e3850cb9a13288b13c5bdea86f4b5aec08d556ffffd2843d3a2eb4b194
MD5 eabe941f1b6e93eed317f7c406d31619
SHA1 88d219fc32b5099da4682d2730139e3c04b44163
SHA512 53ba3fbec82cb05dc919cc0da10e848d4fc054f5f5d47b6dd1a603c3a74ea088d86e8735707f3280a749fd101981f067560a1da96d5e3b6e4d37b1c6778794b3
SSDEEP 6144:SjxNtSWeYootIGTPNYWSOQfYOXflKOr83HK5gHYxvHZUrm466jEOVOM5o:SNNE3u1EbXflKOwZaBUrmAwKOM5o
TLSH
T1BF64024B26E9D6CDD0A2943502BA087268FC36BA1D171375D6960ABD25FEF80331DDF2
MD5 SHA1 SHA512 SSDEEP TLSH

Biddet/Nettoomstningernes175.amp

SHA256 6188cf0ecd1129a3bdfbbe8739078470cd3774acf4c0ffe26e142b42bc8b70f0
MD5 352c1e7026dd93973f06bd75049d0f36
SHA1 bf87cb22f61f39b2b397a8c180fa1a3eaceb56b0
SHA512 b82d1fc7dc2233a49e68ba00bddd19ad45b1335b8ed33a67c9ef0b70127f79b76959142c9796cc6cff612dbec129c9e7f967365147c58dbc88e0af8a374b890c
SSDEEP 6144:sfMx6IUNnrZQEVOJCaN8kO0qyc9O1BDdCbgvawhFsbR1C4my7b+pOIeFoqP8f4FZ:Un
TLSH
T1685402DBD413CFEBB665059E4D04E6811C0CCDE8B60E5BE24908773031297DBEAD8ADA
MD5 SHA1 SHA512 SSDEEP TLSH

Biddet/Radiussens.jpg

SHA256 c9915a7eca0242e66467f1d809b50ddd7d4287637f7c381c95ff9b105a46c029
MD5 d23605a52a01a12102f695de8a7a384d
SHA1 ed172d8264d301069b48e0c91537c1e2267f2e4e
SHA512 3e09e210877a67ed86cd79aa856d38943ba62ab1691d5fec539ea39a4e35dbaeb97cd8fb9d33dd7fcfce9a60feafb717bebf79dc9d939ff2fecca274ae5d51f4
SSDEEP 768:8B/OuFpXd+Njd+NAxRBZhm1bmpOqPJBfRMx9PI6L6x5Ek:8B/rHN2jd+NAZWbmpOI7fSxtdGX
TLSH
T19003F2FE75714FBF570E2A7167AE136E68860A2F970C86BC0B90D7A89215C31439781F
MD5 SHA1 SHA512 SSDEEP TLSH

Biddet/eskamoter.txt

SHA256 546e371e1ed2e764358ac163474dce8ad1afe41dcc6b31948c35bf70b629953c
MD5 9d184df283ae1814e8a32e8dd5ed88c4
SHA1 596d83cc5255fc79c3e9ec5a4852dbc29cffa5ac
SHA512 7bf7325f4e4f7afcfd4d7499a24d5204b8667f6c70d646c338011965b14ce5c977b4031aad4d12bf93afd78fb032abdde13532573642991a00c1a51f838fcd72
TLSH
T1CEF00E46EBA8200FAC2F390DEB0018E3C7AA4E828C70A16BA00C931DB440DCEF37D524
MD5 SHA1 SHA512 TLSH

Biddet/haandvarm.syn

SHA256 d5b5d5f21469c696a37db8cb5cc217e33b66e56652fdc3c8acbd5c8dfc75f2b7
MD5 0d3a95cda29cb95afd3e82fc6b3fd10b
SHA1 d90b2c846d1e9de450e9577c681335ce0633751e
SHA512 e819d321f16ea81080df8048981d8e329255be2a859cbcc7147811d6f551cdb1511ea5eedab5532d011a08efe0287b1126881fdab2e31b10f8b0091161da4672
SSDEEP 384:RoywoNxQQaXZ0lym1u5luRgGgiZzpGkB25FGDtz3mGBUrrtbwr:RMyuQaXCI5fiZzpGmdBHBatsr
TLSH
T165E2AF3424C724F73E15EEACD5BCD9938DB84CA905DD83AC1210DEA663AF8C35D54863
MD5 SHA1 SHA512 SSDEEP TLSH

Biddet/hulkortsoperatr.txt

SHA256 674a62f09f7ce7d7578450ccf46f1b3bd0407098dc9cbee3e7d18755f3987b85
MD5 6fdee6ff230399bf3b9d1a672945c47c
SHA1 36c2570b2cb7e1cd7180c7b276c58f38f5c66ad5
SHA512 4da2fd596e511bdd1396ecd3f72a8716110908a8802897b6b1970056695855356aa61e7b1cb3c29c6d512c8f43bc4422599a71643faa74f74a81d3c0d044a1a8
TLSH
T129F0C0445D187CAF153303DAEAD52F9AE65D00600B26584760961E0E8683ADCF3BF49A
MD5 SHA1 SHA512 TLSH

Biddet/hypotensive.jpg

SHA256 79fee096be11a2097160e5cbdacf9bf2d268b38966cfaf22af1dbffc7457e7a1
MD5 6fa3a44454d103c606cf0347598f3869
SHA1 16abee4ca68dd183d84636f66beaf62d7a6dee7f
SHA512 d6a60e5b42a1be3dcd9854c9d26dd0e6bea8aef30f8a6abde5c7e82af42959c0447f09493ec0fe1d4314d6899994229f03940d879cd5ab1b091eb906cd5d0e3b
SSDEEP 1536:O53+2Hv8TiD3zzwvjfKK/ItFs0pfaBHVuA:A3+uvzjzzwmntFs0JA17
TLSH
T14D5302B6E68CAF1BAF3BD374797D0E0157CCF678CAADD1352BAD40B72086B612254804
MD5 SHA1 SHA512 SSDEEP TLSH

Biddet/moleskin.txt

SHA256 a5fbfeb7835443f85aabffe70053fb4360e378a09ba1967cedbf531d21edafcf
MD5 5c3260a31057da5e8ee54ecf36531f46
SHA1 697769e77c95aae0aa42602fb7fe82855043d640
SHA512 51d2be8a64971522c0a7925f2671fc359130b9b3b7dfbe846916d3051699196703e4bc5492728d9e4be0308ad46db0a1f20dd02869e9eff881b0b3f5a24899a9
TLSH
T130E0C0F2C06A566987D75FBA3DE048549336504465068D783017BA9EBF01CA0D3FDB4A
MD5 SHA1 SHA512 TLSH

Biddet/mongoe.txt

SHA256 4fecc40c8f896c7cb50bb834e6d32189c301aac1ef34696d4b5c3e6da0496dd0
MD5 fe5c4d4637ec2b95b4ec05448c51888b
SHA1 bcf75fae7ab196c0bc124ee1dc3295439859c2d8
SHA512 fc00d339ad18b0b76c67ded56877f79c4ec8ea4b9cf9c2ab352e8cffdd1af722ae1cdfce599d0fc8f7b94dd74f34463da1b49ba951c8a35817ea6d8844fadc12
TLSH
T18FB0125454CF120A012310004D7C6947DF94C644B3B0440CBC73759B1905CF945B6929
MD5 SHA1 SHA512 TLSH

Biddet/mortensaftenens.ini

SHA256 7f3f5d17416513abfe47d4c3ade0196cdacee0623a6fed7e1a896e08895b20fa
MD5 39ba5628c764057ecdda7ec7a8a4ff3c
SHA1 7639e1e7bed15629726a7c036a7d7bd7b2f2e515
SHA512 fcfc8b42c2710766a2c13dcdcd477395906935246dc335e95426ef7eee8922feb8fa0b7c6c59b50f8eb5a5ef3c6354b604900b947fdba947193362f66c227f5d
TLSH
T107E068FE9503C1801B86570E1A942CB257AA0823D72AB080BAA757885136AAC94B131D
MD5 SHA1 SHA512 TLSH

Biddet/phoria.txt

SHA256 7c98d007ef41ed7f2a8c2af884596fca449653c9a403b481a0d553a90b1a01b0
MD5 e46f54f146006aeb42dc432be27368ec
SHA1 113a91aa9508c51ffb0dcd84f97999de1e38afbb
SHA512 f78b975ec22c0a5468d65e51054b6b8003e6005194f39ab7390f0190bdc679ad17602f0659382d934dfde3a67a3e91544abf5b19a7f07e76b75c123707793ba8
TLSH
T1F7E0AB568D2326008A5896DC9CE27A5348CC5218E1324942B2912309A091869B19D92C
MD5 SHA1 SHA512 TLSH

Biddet/rvehalens.txt

SHA256 a2c81d87b2f5605ee8c7ae80d12dfb3b539a9622043943f5c6017124e359a513
MD5 d68c4b85c89891d0bdecd244a5b7894d
SHA1 e77714bd228c2b4c28722c47d1b81f0f62fd73ef
SHA512 a5841c8c230250014be4162327643f6dde0463c41038b1e1806c470d5f683add5e3fbff6c8e365f23554f2ba71d0731892ae60d073abdc80d1158458af184962
TLSH
T1A6F0209C97F0754706440A4BFBF23EF00828144E076DAAB37357D60F644822C927A27E
MD5 SHA1 SHA512 TLSH

Biddet/stiftamtmanden.txt

SHA256 44d5697fa8bf5764b7db68b0a99415e96fd55bb22e00e13ba41cfa3420e5de1a
MD5 02bc6f53257b3eca23aea859dccffaa7
SHA1 8ad09df1b8d5d8399225e272c4e383132ffc01f7
SHA512 6699a1ca9efd8d3e89f3d7db1a694d531985af6395d8aa9a989fca63551b9431bd0867b9483fbf5764249babce5133cb0e7f5904fde2beb35bb80b5e27842b7f
TLSH
T1DFE0C27F8EE2214A0A5457887D622D92248D5AF6D068A3A6396C9B29A46221CC18A82D
MD5 SHA1 SHA512 TLSH

Biddet/supersulfurized.txt

SHA256 3b257b67310c3fb34547089670697310a05a6d9a70ac8f7360623a91fabb0653
MD5 ad57fcd27c3bb6fa34664b1edc8092a6
SHA1 1513fe443dfa0cfd92eb48a94a59763ddc70d20c
SHA512 c349d8d1970c89dce74ed56fcf560ab0c0728a7ae65a9d14f281299fb769fb1a43f5a522799cc270c53c096ec904efbaaf52d219bc0a3d6b7b27f448e05f3d23
TLSH
T19EF0C904EB023F1AFAAB71C23E5B249A621881119A1B84E5289B234C92132D8A5A8286
MD5 SHA1 SHA512 TLSH

Brasswork/Armless.jpg

SHA256 9c581dff1e58fa60f0db5b151e7caf186c9b37fb8db18d4ad0ea6c1714c89459
MD5 e7f15f24a51e2337715da818ad02f3d4
SHA1 4260494b73d3db09f4bdc73f53733bf0c453b3ce
SHA512 2e9a19e0d7691a29a7901057860b3ceb751f622e5a4dde93ad63f4e4a4b26ff6567592500a1772fe41f924074de810ecf36a6c40c1bd282c92670b107282e20b
SSDEEP 3072:WVle/fRMWikRCGdFHTK2ruONzlO/xV/tHEwJ35/9q:mA/z9CCFHgTx6
TLSH
T100B3127B2EF878464655CF2ED8420E2989F3B111C65517EE4BE0C1A50D8CCB0D6EEE8B
MD5 SHA1 SHA512 SSDEEP TLSH

Brasswork/Camphene75.jpg

SHA256 5b49c74408918c27cb557c159d1dee55de1197d8cc2bb9f23158bcdd85738567
MD5 7d2683fdae9a8a796d80015d6aaed1d4
SHA1 57e0f8dec0fef0569e47ad5d05f8fc3cade1a04c
SHA512 d057c4c313271620ff6484972eed81cc80ca7358ee9b8f39f37bfb8079b9c4d14a980b1fffc467a0e043618f5c2684e0b410086abd9f8a3b98dbba156288b8d5
TLSH
T156412B5552067110A7DE19BA5A604AE7728FE8C37F49AA397817363DD001CF4640644C
MD5 SHA1 SHA512 TLSH

Brasswork/Makropakkers184.txt

SHA256 db575cdc08342653132cea5c8e09aa20953b633554fd9439184ea14266d8bfa9
MD5 14afe9842a9ff3bcca00fa0b3fa307bc
SHA1 41a34ae977fe443b980fca382d74b0ff7c11feb9
SHA512 ab959a37ede149fd19e2efc9f06e338e6a1346f80938abd908505172b2d7f8cc98f96248b73159c8831014a66fba91df560f4e69d1311869cbc6cc7ce1b7fc70
TLSH
T1A0F026F0DA030CD87F4745C44C129A42456AD000F6155001748F130F37C3A18D36BB5E
MD5 SHA1 SHA512 TLSH

Brasswork/striber.Tun

SHA256 93daa99dcce7c5d16d6cc5fd5dc089bb3514c31d91360b9420ea8f2a6b064de3
MD5 d53128176c8f51aeca0de57060d7fcbb
SHA1 75eb827cfd676dbfd63494ee978bc45ff93d7b42
SHA512 0c10aa90d621119dd19786272cc00b90d162b2a011e24475fe04f36771486b0a9ea5e44105e2fe63e938aba515b8b1577d7d8c7531bd2a705537d069af904002
SSDEEP 1536:mTH9+C3olk8su5rqS8xcg6FoJN3gmNAArVCUaItv:mTH9+Z68drqSC/TAArVCUJ
TLSH
T17733D0D89F741F5C160026ACA90A4A3657688F7DD5A9C1F1CE7F127B10C51EA20BCFAD
MD5 SHA1 SHA512 SSDEEP TLSH

Hondled/udrjest.ost

SHA256 95243e3d31d589ad47e7283d5a409afeceb597f78508daee311446533a8af31f
MD5 765bc066d88db9ada317f8768325693c
SHA1 a180f3a8a76c5fc55200fcd4ea7b594395e04129
SHA512 6e9d675e9e71e884a45e6718b085bfbac1544cf2a749ecfb30ad30f6570e76fcf08d019730d893ff073ae4769b07af35516afa262ef2f8806743a6f95d4f1958
SSDEEP 1536:MIpPzpNiFq0IttuDgEw5VHHn3Sqjaep/S685dOVfprUaVYSxOI+uFqEM4Rwn8o64:zNi1hKVXrVm38QcLs
TLSH
T17584121FFF6ADEA8AF656C5CB994139C957B6222E8FC080011C91D4581F6BDEF89D20C
MD5 SHA1 SHA512 SSDEEP TLSH

Hondled/varicosed.jpg

SHA256 fe9b2975b431871e94ae928eaeff15604f9d03dbb3b37893a49261320e3080bb
MD5 edb044cf98ed500e069f8ac04ca6e671
SHA1 24fdff241832b9fc3f68778b1259ce5d5c7c0bce
SHA512 d7c74ee4da6c11fa5c731c47f17d7821fabba92753a4de4554229caded780f168cef868f3cb30c8fb91bf2c25ddc2c95e28ee27b77fb8803efa76cae303ec6c8
SSDEEP 1536:1YC9gAsSnz/IZ2yWMK0P88ukx+6iGIeG55AGvc2/023EMcyBpTja5oQS1E6:39xfz/MndVGZeGAGvc2MJyT0nb6
TLSH
T12F7302E83D5216A74D73B325B16262B398617F236C1193B3E217C391E1DA8BBB5334A4
MD5 SHA1 SHA512 SSDEEP TLSH

Sharing

General

Malware Config

Signatures

File Explorer