d4bb9d06e50d0009f7380cea2a2c44bafe0b2419b5d1ed69f852135c72e0f20f[.]exe

resource
d4bb9d06e50d0009f7380cea2a2c44bafe0b2419b5d1ed69f852135c72e0f20f.exe

d4bb9d06e50d0009f7380cea2a2c44bafe0b2419b5d1ed69f852135c72e0f20f.exe

IMPHASH e2a592076b17ef8bfb48b7e03965a3fc
SHA256 d4bb9d06e50d0009f7380cea2a2c44bafe0b2419b5d1ed69f852135c72e0f20f
MD5 b2b3330b04e516ce58a49e0811409ce8
SHA1 45129b589acc9c08e94ab1c968ba2c97de7502ef
SHA512 7b218b75ab0d6b200e2fdda81f741994dadc59878d2072f62c3bc7893e50c66a85cd35ec225c7801cd68c9aa1ce8cd873a157ececa3d786719ad40e347090d7a
SSDEEP 12288:DqOf+kKF2VI/6ZVVKaGDdQiPiy5VbL6Jk5xaQc4jcWm9AqaMl:8kK0I2VqDnPiy5lQSMQcScWzAl
TLSH
T1B4E4F1E6D04AE493DA5E0630E9738DF242226C15C3E1316F92753F7BB93BD81990729B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

12906

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetCurrentDirectoryW GetFileAttributesW GetFullPathNameW Sleep GetTickCount GetFileSize GetModuleFileNameW MoveFileW SetFileAttributesW GetCurrentProcess ExitProcess SetEnvironmentVariableW GetWindowsDirectoryW GetTempPathW GetCommandLineW GetVersion SetErrorMode lstrlenW WaitForSingleObject CopyFileW CompareFileTime GlobalLock CreateThread GetLastError CreateDirectoryW CreateProcessW RemoveDirectoryW lstrcmpiA CreateFileW GetTempFileNameW WriteFile lstrcpyA lstrcpyW MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GlobalFree GlobalAlloc GetShortPathNameW SearchPathW lstrcmpiW SetFileTime CloseHandle ExpandEnvironmentStringsW lstrcmpW GlobalUnlock lstrcpynW GetDiskFreeSpaceW GetExitCodeProcess FindFirstFileW FindNextFileW DeleteFileW SetFilePointer ReadFile FindClose MulDiv MultiByteToWideChar lstrlenA WideCharToMultiByte GetPrivateProfileStringW WritePrivateProfileStringW FreeLibrary LoadLibraryExW GetModuleHandleW

user32

GetSystemMenu SetClassLongW IsWindowEnabled EnableMenuItem SetWindowPos GetSysColor GetWindowLongW SetCursor LoadCursorW CheckDlgButton GetMessagePos LoadBitmapW CallWindowProcW IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard wsprintfW ScreenToClient GetWindowRect GetSystemMetrics SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharPrevW CharNextA wsprintfA DispatchMessageW PeekMessageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow LoadImageW SetTimer SetWindowTextW PostQuitMessage ShowWindow GetDlgItem IsWindow SetWindowLongW FindWindowExW TrackPopupMenu AppendMenuW CreatePopupMenu DrawTextW EndPaint CreateDialogParamW SendMessageTimeoutW SetForegroundWindow

gdi32

SelectObject SetBkMode CreateFontIndirectW SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW ShellExecuteW SHFileOperationW

advapi32

RegDeleteKeyW SetFileSecurityW OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges RegOpenKeyExW RegEnumValueW RegDeleteValueW RegCloseKey RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumKeyW

comctl32

ImageList_AddMasked ord17 ImageList_Destroy ImageList_Create

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

Inflames.txt

SHA256 6c61267a19d43ef5b8c7fc44b4409c31e972c7e3c483e332212dc0267e34c5ca
MD5 9b04e30317fafd81aa11fd536d9c7595
SHA1 77706c2be0944f851619bf2c4fa8ff741f1de007
SHA512 3a0c1de4846fa5faffd13d3205acff16ce827466c0ee272c8c08407b391fdcde54d85f6dd7b1df36fb19d84a7e714dcbfe74df864839becfb0dcb1e4f4c0336a
TLSH
T15EE0A3365B5F0435570A4B7488364B758717901CD5340059FE4DD778D0071EA757F55F
MD5 SHA1 SHA512 TLSH

Kamikken.Reg

SHA256 0daa1a50fbaebad6122fad13cc681dad7321548567ed0043855749ed0a346160
MD5 b4e78054032fcd39fc39e6b9d9762903
SHA1 543c2cd28281ea5a245afae080ffa82b8511558e
SHA512 805e0ade9fff7022ebab785ff314a03dd82aa6a64605494bc846aa71748d70424b376f3f05d09de27ee1ce86f9c8fd7699b3dfe971b9036eacd42ca368ca2278
SSDEEP 6144:ehE16l4AexMtOQJEOv+gJY1wQc9ILWSvJooPO7FIYTbLzNYjl4y2Db32skc:e216+gtOQVwxvfO7FHTbLhYB4dH2i
TLSH
T157A4F13D574F3B0CE8B6CE3557486A4A3175987B43E2F26ABB97C8634B910758C093C4
MD5 SHA1 SHA512 SSDEEP TLSH

Litteraturhenvisningernes.ini

SHA256 c814c07b76a498dfa76aea203c09abb22c074ea44f13ee3f932ae07de63efb9d
MD5 76ff9026a500f41e3b075e4f5f7075a4
SHA1 5ec8e7ca4280246f804b0e65b8b40b7a69f13a47
SHA512 b834add5f94eff059688919793480e3d6e2416ca29a2075be7c931507b66f7d33f3bc38e207085fc9adef124479ce85a38d6be33437716810a6b48c815f447d1
TLSH
T19CF00E609C47085B970B5B9CA8439E06CCDEAB048F244A30E335134F386509DB3E5361
MD5 SHA1 SHA512 TLSH

Lovprisningerne.ini

SHA256 01d7b59ce4b8faa84dbce3ab94a85cd3d6345d44faa26873d68fa039b5a7c462
MD5 ab691d16853d7d9a6e46655a71e186f9
SHA1 cd234140a20455376ffa4f45f5a0b06ce82054f3
SHA512 9a8f3a8b771608fe2ed27e4e7dcfdfb1a3ee2910747e9815808be4e960c751ad5d88e1e34728887f7f9157911a19697302eef235ffeb59a4b855350c222a6f8a
TLSH
T192E02D42FCBC323818091DC4C00B7C43D37CF2D437247B6ECFEA420E884982481B0086
MD5 SHA1 SHA512 TLSH

Nonmannite/fusionsaaret.txt

SHA256 5cec08c0e21fb21bc0c5a80883ce4796c8a933402f7c5b16c5a954915354a9f4
MD5 b5a8ff917e057ae30c81f73d78bce6d3
SHA1 df6cb5d121f58297a416c8905fb829e602fba374
SHA512 0e4dc3df3cca76a994968d9f8500723aaaaccf53739c818d1102840d1addc1e55109804ab4a905191b0071269f6b2f412d393381b19ad1a42b3c62b589ef77d1
TLSH
T192E0F113B8042C1C9A43F39D09E215A784CEDC1B5AAC5480D402592213574F491ACB4F
MD5 SHA1 SHA512 TLSH

Nonmannite/litholabe.mil

SHA256 399cc914631789f3a9f894008acca363e1e678c95282d1b546f2cb066cf3c2e3
MD5 f86f7596f8cf8adaef194ddf9ee0bf7e
SHA1 2116b1cd9ef714c7d2e81940a6512cd53888c78b
SHA512 37ceee066bb7eb04f4b9ecd5f3c9d08c971ea6e26f5867382cead8b1f079967d7e9d4ccb5aaf1380218c2c02aa51daae2e3f9e18118b181daebf919c7175b25b
SSDEEP 768:gVfXgncRdK8JvvvYcdPH9U5ySBE3kPwZqiVjE8x:mzI+cweM
TLSH
T11653D001E6EA7DA5A9C10F48753510BD0B6886D81B22633F3EFB01FC543664A49973A9
MD5 SHA1 SHA512 SSDEEP TLSH

Nonmannite/profanest.jpg

SHA256 500c154b946ae67b058b56e69d18967e172839c709672ba8d195b5d55c97979c
MD5 9e8fefea50cac00bc651b8c7736e6490
SHA1 9979f3b4ac6aa2660e773e510c9cd9bb853c7a5e
SHA512 b2beca13872440d46b925984a339d305237ad768f86ad83320a0b7af79b44fdd6704e2ba7c8826ded3b8970e33127a30ebeec46a679eb844b38cc2c7973fe742
SSDEEP 768:CA0ZvWk3QZNWzRmVAZKn0G6fHgOXpYob04cKF7DsBG:CAKvWk3QZNW0VZ0lHf5Yob04cmcBG
TLSH
T1A6C2E0BE46D7C02123C0F7891A1350F39B0B09D16B823F7945392679B4DADF4B8BD215
MD5 SHA1 SHA512 SSDEEP TLSH

Nonmannite/retroreception.txt

SHA256 f388c6d4a8c0ddc036ebd0d759216097941e376ca0292ecb32ef516fd83b2176
MD5 70e9ffd9a5c6a760f37f7ad4f191db47
SHA1 960d5f623984f1329dd8b38516445e001e5ce507
SHA512 15929b0df32ecf16fa0f7628c4b1917dde32eb85a9861e52bbdce55978b221917a6ab67dcf4d75c86d211cfe8909a04f82829a77b7ae56e23bff57163cc7d28e
TLSH
T197C02B3CE583A8B74F41B3E595106C4330798A22CC2D001E38C2034D4CA6EE1A38C09C
MD5 SHA1 SHA512 TLSH

Nonmannite/shepherdling.jpg

SHA256 5aaa5f5f22b8903099de6a5a115d1bc39c791b4330d94026708d557519df38ca
MD5 edc90185d3542b8f5a51d0781102be9f
SHA1 867dd5ce67abb9cf4b64965409c384919654f5c6
SHA512 7ea28958d8fecebdb6066c21ac0c058721c22fbbe0a47f2c7fe00c4246149cc9ba5c03434a39ad5f2c3180f6a8438ca3de6083e2519d3b7aa0b08e0736ffd199
SSDEEP 384:recSpcz8ggYM8Kfj7VxFFILiWTKpiM+aXiUNghb:rqMJOjBnFGiWTKpiM+auN
TLSH
T1CE62CFAF460A964BCF3F95B25A024A7BB75079A3349423B692305929C350EF03A876D7
MD5 SHA1 SHA512 SSDEEP TLSH

Nonmannite/sognefogeden.txt

SHA256 95a4d3620a948f334cd323d5c7eae6cea3767527f21d93613b1e3c91d7763ce1
MD5 aac47111cda7b9fa4f64893a29b84240
SHA1 2c1271026612a1e072598518287960156aa33446
SHA512 3e9b8515ba3551dab6e652ebd12d54afcd2f039c6ac951131cdb876540abef69101c8bfad2c33189d2f9b242dbf81136c1c7898770d3bd43d59e9a255c9b5016
TLSH
T1D8F0DC99C8AA15884E471534BE410D0093AB877581116D14F2971AAFC2927AE923D7CC
MD5 SHA1 SHA512 TLSH

Nonmannite/takkelets.txt

SHA256 8fb85fce9b6ad4cba38e874eaea8cbbccbc170686c96095eefae6b655509d6c7
MD5 79289bd97cceaf87b350bbbf3e737f34
SHA1 40c58ab0ecb4280507923be308b9d535f817c5ea
SHA512 386aac55b7112231be5eab8de1a56fce4af11ff83f39596630e1145a812c17f5f0c6707ae490f67c4db8b754e9670ed808ddae5ea8344bcdc23ddb949b54b8a1
TLSH
T1BBD02B4888730D1C5B9BD7D5F4C04A4AC4A1580C4532DA627098AB17701C09DC0BB32D
MD5 SHA1 SHA512 TLSH

Nonmannite/viggas.ini

SHA256 83b43b06392a9b4ded2095605079a3f6ac89d7e4cc2baa4d347cbd20a94bac8d
MD5 b74b2119839cab4a7124714a90d03116
SHA1 66560fff7e5f9413e10de38094f825d96202b046
SHA512 e687fbc1b9fdf359092ff9b9f648af3130ed2e4234c94ffb31e60ecd79349cc4fc2892097b29dee1ff7ee56125addb294991ae84cde609c7a128b17c84962558
TLSH
T142E02B85EFC8581A0C6B66D2FDA2A5A24001D028CA031031C0CA969BB002C8823BA4A3
MD5 SHA1 SHA512 TLSH

Nonmannite/wormfishes.txt

SHA256 1a62aeca07e41f75852c1379aade6657780b7422f62ffa2c0ffe0d4565a1bf98
MD5 206a49fa3dc22630bc81fe9463165a4e
SHA1 d8cd950ad3b2efcc70790ae936f4d310a635e2fb
SHA512 2b78d19c2396654e029cf49e11014e674ad6f3673fb19ff6994be76530d0087db254f1ff2c266580477dd7e162317b4bb70e1f12b4866662c3545f6d53244176
TLSH
T1AED0A7540A12494C2A5313C6E28041EB5E91809452124915B44652556E850BDF7DA724
MD5 SHA1 SHA512 TLSH

Sumer.Rdt

SHA256 067c2e4bd0f3eff9d4ccf1944244e4511798ef2debe9be5c603c149112867752
MD5 d91fc0a488adcdbed97fbfedfbfe9a5a
SHA1 1bc328445c2ebcf899c3e925fe9e7e339b7e1c34
SHA512 806993dbd43e36de48754d388babd9fa3b7547831a268d737a55375f6fc57bacfc06973477f718336a6206d4edbcd43ad44b35f415bda6f5343a623c78075dab
SSDEEP 1536:fxVUI9h4agqsocXN6mKvTxTuTvj66AQYbIHz5:fxz9mB/owNQbxT0pGIN
TLSH
T1AD43E109CB5A3914C5C1329DF75147A73A20487CC37A817AB5AFA6B930C884A57FDFD8
MD5 SHA1 SHA512 SSDEEP TLSH

Totem/Mops.jpg

SHA256 b561c54780a779d93d481d170bf5462bb06f61606f583be41ec08bcbacd0a7ae
MD5 36e53aa1c6f9863edf80a38bcd3336bf
SHA1 534c0df9098f7d7b453b15719600a0a7af3154ce
SHA512 7ddb0b273191f9bb14b837a9e9df3309e4486da17c184db27f968d767c1094becd9208fc1a227c4191cc7883353279724269f2c71a4f3a47a46460f2d9738708
SSDEEP 768:yXhbc3kL1NdKRnno8V/F8dK3D5sSHHfHLAJ74YJPPvzU:yXhQkLDwVLVNDdEJ7xzU
TLSH
T1ABD2F17283140E32BF4742BAAE626965D097024824A7E57C4F6540FE5B43EFDA4D8F1E
MD5 SHA1 SHA512 SSDEEP TLSH

Totem/bertolt.ove

SHA256 750634f6c253586f495d72e2a478fbe97f54e09f41cc2adc5409cc1a415e3534
MD5 3d5163f2139c572bf2448f39fc50b506
SHA1 c95af1d8be7ed6463ca284cfb6bdb1720f2e88bd
SHA512 093459228c4c6c26291ce0a5821663157b75789e279be998df726afc8255d524d51a09e7c7c3383ce73b6ee61fc435327776a5e279cab670d66d5180d2445e1b
SSDEEP 768:Yeno8JrTJY2I5fgLqvuBJXGnH1NQ9Ojsh4:YenoIrTJY2ISLqvWJXGnH1EOjsO
TLSH
T12193F19208023D3B77B26849477A25C87C87DE0B6240F3679479BE0412EC2797ADFC99
MD5 SHA1 SHA512 SSDEEP TLSH

klns/efterabelse.jpg

SHA256 b5e33e88578eacbc14b6d0d159c586fb7d8c3d6f8239e459ba30e60fd802e396
MD5 e206cfaaa92124a154415f353b35ceb8
SHA1 ab76630c816b38b869f751fa16382bf4bb6214e9
SHA512 f8befcca8bea13668f466ebcf5000d22d54b1ea4603d90dcf1e110cf4e71188e2f9f68a52945cc937b12d42dccd75ffe318ebcfb05882283b192fde72c6f668f
SSDEEP 768:7kjnqR43TvTnNErbP5zfTdmDFKYkpMnqKTYRJMtDpv:7kjqRETbkbP5zfTMloAyJM1pv
TLSH
T1A5F2F17F9B98539E0F02BB577B87D71242C141D2AB648AB185CCDB11A3F3CB187D8826
MD5 SHA1 SHA512 SSDEEP TLSH

klns/follows.cha

SHA256 b1d8d6c8cda18bed15dbb883f85271d6ea675f30a3214f5652290e9a30a7ad00
MD5 87f00ddebb94f7fb8c720d1f8ddcbd28
SHA1 3901b34d160b233dff2858a45775d0543d3fed8a
SHA512 2a838588a094a672a0922eea9776c3c3b237978c2d77159e3677b8693f19062d2be77fc290cc960c63cd174eb1d6745505672965994f1878a0eae011451053ff
SSDEEP 384:5sbNZADsseSCZMlUnat/MfVcGR5ugB/kxobBQ5H5u2Ka8VuyLPYAIKd6lqA0tQHN:56No0Fk6+H56ZbqK8lI69Hw5JcTEK
TLSH
T1FD93E1C79F3E595BBC95DA76124100E0C5EBB78B6B078065B224D80966392060F7DEDE
MD5 SHA1 SHA512 SSDEEP TLSH

klns/fossillike.txt

SHA256 04c2a4d0037c1fd69b3e61bf5ab28d621c0c1078db9dff2d7a217bddb651c5cf
MD5 1030923330d7d75cf92b9a72a644a08c
SHA1 2405f0b84519b8128be64f4e45b9f51a676e942b
SHA512 caa2cf39d9177bc1651d321aa31c3f31d32c7d6f5572ba708ffc32b62b1d185a683d6ed43657008890d669343d95275ae71a86863c61a63c97de95720874965e
TLSH
T15DF0DC90DE562BE45E6908DB2F832B4FE4AD6D2219371CA8A0031B98637018D853E33C
MD5 SHA1 SHA512 TLSH

Sharing

General

Malware Config

Signatures

File Explorer