Researches[.]exe | Triage™

resource
unpack001/$PLUGINSDIR/System.dll

Researches.exe

IMPHASH 17b7d61bda0f7478e36d9ce3d4170680
SHA256 6e24c014d9214bbf4f57d547a64e3b0e8655784094673d97f0cb61cf37470ec6
MD5 c52b880eb8aaeee90ceddecd2b1ff4f8
SHA1 98f0771cfcd46fea300f8b93628e3be97a657401
SHA512 5c9369b339be3d6d1ad168b5c8ab3c8b5ce8092c120c178b2b54bb6a41c78db50b5b3b601a92a6d1274d372f6345c52d0a8c66be601b09c3c0c3cc12e99910dc
SSDEEP 24576:9GF+EgVm1pvmELwhbXcS8BMTwQhBpIrR0/wrSMaA4/5r0:osVm1pvRLwhbMFKThLK0vN0
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

79:14:32:59:17:9c:25:82:88:15:43:c2:97:6f:f3:2b:b9:b2:bd:7b:e5:50:84:06:5b:55:3d:04:36:76:c5:96

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Hypnotize,OU=Uninfectiousness Languorousness\ ,O=Hypnotize,L=Dassendorf,ST=Schleswig-Holstein,C=DE,1.2.840.113549.1.9.1=#0c1c50616b6b656c697374656e4050616e696b736c61676e65732e536d61

Chains

Feb 11, 2025

PE Signature issue

Digest

6e:2c:f4:43:20:e5:1a:94:aa:2c:74:e8:fe:e8:7c:c9:18:b9:7e:64

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Hypnotize,OU=Uninfectiousness Languorousness\ ,O=Hypnotize,L=Dassendorf,ST=Schleswig-Holstein,C=DE,1.2.840.113549.1.9.1=#0c1c50616b6b656c697374656e4050616e696b736c61676e65732e536d61

Chains

Feb 11, 2025

Minor OS version

0

Major OS version

4

Entry point

13084

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathW SetFileTime CloseHandle GetShortPathNameW MoveFileW SetCurrentDirectoryW GetFileAttributesW GetLastError GetFullPathNameW CreateDirectoryW Sleep GetTickCount CreateFileW GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW ExitProcess SetEnvironmentVariableW GetWindowsDirectoryW SetFileAttributesW ExpandEnvironmentStringsW SetErrorMode LoadLibraryW lstrlenW lstrcpynW GetDiskFreeSpaceW GlobalUnlock GlobalLock CreateThread CreateProcessW RemoveDirectoryW lstrcmpiA GetTempFileNameW lstrcpyA lstrcpyW lstrcatW GetSystemDirectoryW GetVersion GetProcAddress LoadLibraryA GetModuleHandleA GetModuleHandleW lstrcmpiW lstrcmpW WaitForSingleObject GlobalFree GlobalAlloc LoadLibraryExW GetExitCodeProcess FreeLibrary WritePrivateProfileStringW GetCommandLineW GetTempPathW GetPrivateProfileStringW FindFirstFileW FindNextFileW DeleteFileW SetFilePointer MultiByteToWideChar FindClose MulDiv ReadFile WriteFile lstrlenA WideCharToMultiByte

user32

EndDialog ScreenToClient GetWindowRect RegisterClassW EnableMenuItem GetSystemMenu SetClassLongW IsWindowEnabled SetWindowPos GetSysColor GetWindowLongW SetCursor LoadCursorW CheckDlgButton GetMessagePos LoadBitmapW CallWindowProcW IsWindowVisible CloseClipboard SetClipboardData wsprintfW CreateWindowExW SystemParametersInfoW AppendMenuW CreatePopupMenu GetSystemMetrics SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharPrevW CharNextA wsprintfA DispatchMessageW PeekMessageW ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage GetDC SetWindowLongW LoadImageW SendMessageTimeoutW FindWindowExW EmptyClipboard OpenClipboard TrackPopupMenu EndPaint ShowWindow GetDlgItem IsWindow SetForegroundWindow

gdi32

SelectObject SetBkMode CreateFontIndirectW SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW ShellExecuteW SHFileOperationW

advapi32

RegCloseKey RegOpenKeyExW RegDeleteKeyW RegDeleteValueW RegEnumValueW RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumKeyW

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

CoCreateInstance CoTaskMemFree OleInitialize OleUninitialize

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 f0cd96e0b6e40f92ad1aa0efacde833bae807b92fca19bf062c1cf8acf29484b
MD5 b853d5d2361ade731e33e882707efc34
SHA1 c58b1aeabdf1cbb8334ef8797e7aceaa7a1cb6be
SHA512 8ea31d82ffa6f58dab5632fe72690d3a6db0be65aec85fc8a1f71626773c0974dcebefae17bcf67c4c56ef442545e985eea0b348ff6e4fc36740640092b08d69
SSDEEP 192:eA2HS+ihg200uWz947Wzvxu6v0MI7JOde+Ij5Z77dslFsEf:mS62Gw947ExuGDI7J8EF7KIE
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10041

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Afguderiets150.txt

SHA256 7007387b5476a98d8a424a65e192d3d9482f81a71c4a6f6a6514599b22815cbb
MD5 6e29bceb9974ee689d56f5005bb7202d
SHA1 6d5b9d63d6d719e2dfe25f4e6b297ca81e2f2fdc
SHA512 d735445b88a04b231fa39280675f140f1146b458217ddf0639917c7deeb0ff325d34fb17350cc20fc23764c58edb53346ec06caf814e496389419fa8aa0b5f49
MD5 SHA1 SHA512

Nonideological/Catadicrotic.txt

SHA256 f44be9c8ed64349d20b20078d75f0b3eab694c3d461a6a8d9e9a4a2d69b7f4d7
MD5 050c9a234ab7b30322c3effe05e023fe
SHA1 57e9c9878f84edbc84dda6bba597449682045e3f
SHA512 342c6957aad2dd2df6a0abeafab9172507424958a380fcc9653885d250e34eafafd97b7369afd99f4536fe32b1cf173f87871b0b8178fca17cb27d6e8796f806
MD5 SHA1 SHA512

Nonideological/Devoutnesses.txt

SHA256 c17b44134663e4fd3e807d38efd54ad9363529c998bdd1808972b877d9868740
MD5 1d33156eb1a1b99fb42dcfaad5f8507b
SHA1 bc3e09cc2eed6bb0e6cc18734dbd56741a69e898
SHA512 a0d564fe70ec3107a9b97d95d941d1715d3b9400a98f7b25802912fd6c9ddc0e726aebd7448d2acf092458c2d27b95e3b4d07853cf64ce78ec21dd817a765d03
MD5 SHA1 SHA512

Nonideological/Fibrocartilaginous.eut

SHA256 7b102e5df1828d5a268943c19947a74c085ffe85cd9a3cc4da915794506c5772
MD5 5b59bc89f150197449cc6ba8edfb5be2
SHA1 14f50ad3a09d0382f786da023dc041b41ceb9dea
SHA512 0372b74e4b3542a784ed8b274584f2fe6203d4f5b36896438f6405d14789bbddfd6104c27877b9885f6a42d0e6628ac45ab6689304cd93ab4df809299d27e486
SSDEEP 24576:paHSA30j7GUTTN1qfdIyGXJayR6KfVBbsMJAL5YvXYRvc6am967q2Ha5v6pHlrER:8
MD5 SHA1 SHA512 SSDEEP

Nonideological/Flugtningerne.con

SHA256 79940be88674ab93e8b4571d07ff6961a7c3186c5a264156f8e3ee43074a03fc
MD5 88649eb8e8169913a0384e0bf6c57097
SHA1 0c9510e755ad46a2ec51511d6057a54ade9fb876
SHA512 53e1161abdc7b16cbcd78d6f3222f7b3df97273847ac28415ce851d30443fd3c5683d338f469ba2808b9d15a0a6c4092473b83aecf4fe5dcd90500e5b3424938
SSDEEP 12288:yd3Q3QCvvJpDXwJqKikWvCQs2wmmZqdOZukbo2PKnO4dxpDzJ9JBtJ1u/08N4IvL:+
MD5 SHA1 SHA512 SSDEEP

Nonideological/Metricized.Byg

SHA256 6d6fb6fbf8152f41fa1dcc96d80b94022944582ec83f2463fdfdab91cf4f64ba
MD5 b7e9605ad3acac5a1ec1502a0d7d7d4a
SHA1 35cca871f79ba12c0172c537392faf09c7f67520
SHA512 baaf611a2df4359a538c70851ec5c5784a0ea0d144c56d27354c6e21d3f87c3d06502425281f9b66bb84d0ef202a8d90a651402ac767aeb0275257c04fd79e59
SSDEEP 3072:sFBfh0hRq4E1IyNO4IakStmCMm+Ta6gwzYF:sBfhfIyNO4IZSMC4TagzYF
MD5 SHA1 SHA512 SSDEEP

Nonideological/Parkgsterne.jpg

SHA256 04bbb2a1f5aa03c71fdf84159661069150ae1a748687de2e1a079af3fa46c2e9
MD5 9d1b62dd46fda6ad61ccb778ef066aaa
SHA1 bcc9d2c609f6c21373f19d0352b66940f501fdf7
SHA512 e1c76b9fa9a947adcc25f20eba39e74447487357ee724b29cbf58f61de9ffc46637b6ed8627c2427dd5961f7f01a096ff821701dd0c7637be3d7d53414fcd020
SSDEEP 96:Rh2EA0orehnK1NOHhv2qMgU0NbA9I2l26s7v7aqIJuE5X6E:L2h0QyyOHcEU0N0lds7v7aqIJFl6E
MD5 SHA1 SHA512 SSDEEP

Nonideological/Unhealthfully.fet

SHA256 d99a359f39c97d7b0cc4d1bf25db5d408102dd9c8620798ae7d13a203cf5e9dc
MD5 f94ebbf3a7c671fc942b917794cbef99
SHA1 3b758a6369077f26be0f6cd9d4850bef7b1d9360
SHA512 34e66715aa81f5dfe93638bb82b4867f3a7fc95b7c3906789e17dec4389fff56b867207246a5f1e42fe895d734fe7932a8b6629c3448465aafc8e9870f807e40
SSDEEP 3072:DU6ggwMAubnOrQTAzAU0YUfpUsQ0iqiHKGeWPKlEk7fO7Xye1AQK3AIfXnxqCp/D:U4
MD5 SHA1 SHA512 SSDEEP

Nonideological/domfldelser/vejenes.dre

SHA256 c49049bb1d44b45c17ec4314e5f51bd883519682f80f424dac4c1dae4af2ddf5
MD5 0ea793ea873153fb0a67adfd9f9451c1
SHA1 f2449bb27f6da973f48f8dbc9e0dbf7f87675f19
SHA512 46a1b9741e0d01a209d18f0df9818c727c0f4814c9643b138a354aadae7f3e0ab70eeb600c7045243312b583de230f550500106026861a1ee25eae356e674b99
SSDEEP 384:+DzGyAR9UEKIy6duRb8D9y8+uW7uJdrYtTefHy49heYmVlrseXxGVaVPcGuceLNp:kzoRBsuhf/uBhy
MD5 SHA1 SHA512 SSDEEP

Nonideological/hf.udp

SHA256 985b6b12a0b902f3eb7a050b2a6d300c286760df2c6b0bfdabd58bc4814e691e
MD5 2c97e07b2be199bf59ebc17fb69e93f9
SHA1 9842b8bfb262f98be3040f3dfd668d98edd4b705
SHA512 fd157d798d3cfff1997950467c936d3f0252619549cd35c05369ecffb6aa586a5db994c26fb108fe582bacb8335537f3117b55431d49a4f91965e6561ba0b599
SSDEEP 768:4yIQ3t0qOqAIuSwA+ulme7ikqfZBNlmMGJT:4yndASyjfFmMGJT
MD5 SHA1 SHA512 SSDEEP

Nonideological/indberegne.ini

SHA256 d2d0b4e5d2b15b838ab70cb57f619b6dff45693c1d0ba85ab3ef424f9137f263
MD5 9607a2f26574486a7800bf4604216ba4
SHA1 660407ee407de38306c2b87a08836484fef365a0
SHA512 806c04fbd565e0d825d45321963474327dee514346c720728b1afd0c496466fe5ef41f85b05a0d7bed2bdd6b86d35d6979b1d12e27de4ef800befde50ebb84be
MD5 SHA1 SHA512

Nonideological/stepmotherly.txt

SHA256 a57af19ff1a065f7b813ee1c8d356ef3c199e3a1f49bb045bdd8391c6e3f185d
MD5 a50c62b18088d107a85c8702be38a5ac
SHA1 17b0a71d87a1df657749095527dffc4dd549f793
SHA512 6935dd9d8f8fbe121a7e675a2d82c36b7369b2e661ae04866d8a916ee7b907fb04200c0d68f7f93863cf2ab77125f1c93ffb6cba38d9344d9ba9eaffa0e1596b
MD5 SHA1 SHA512

Pessaries.Sag4

SHA256 aa87af30a6040c66a2f58e4778beb365e1faad7a8539fba9238159182bb25eb2
MD5 c55465b98cda98aaf74e36a5dd55d938
SHA1 d5f55e31f540d2a32a658e96402cd559e73c55ae
SHA512 7724291684c7dd8ff7c9d38f6bd827927c5f0e9d3c5905406f34848c9629c77a5dda6d0c730c64327ca374f20d824f8f8ed0a47bfac479a6c8f4b99ced90f991
SSDEEP 6144:puENBY8qRj1bHXD/eVay2P8QADv7/0KUye:RNKPj1HT/uVo894
MD5 SHA1 SHA512 SSDEEP

Researches.exe

PE Signature issue

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Afguderiets150.txt

Nonideological/Catadicrotic.txt

Nonideological/Devoutnesses.txt

Nonideological/Fibrocartilaginous.eut

Nonideological/Flugtningerne.con

Nonideological/Metricized.Byg

Nonideological/Parkgsterne.jpg

Nonideological/Unhealthfully.fet

Nonideological/domfldelser/vejenes.dre

Nonideological/hf.udp

Nonideological/indberegne.ini

Nonideological/stepmotherly.txt

Pessaries.Sag4

Sharing

General

Malware Config

Signatures

File Explorer

Researches.exe

PE Signature issue

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Afguderiets150.txt

Nonideological/Catadicrotic.txt

Nonideological/Devoutnesses.txt

Nonideological/Fibrocartilaginous.eut

Nonideological/Flugtningerne.con

Nonideological/Metricized.Byg

Nonideological/Parkgsterne.jpg

Nonideological/Unhealthfully.fet

Nonideological/domfldelser/vejenes.dre

Nonideological/hf.udp

Nonideological/indberegne.ini

Nonideological/stepmotherly.txt

Pessaries.Sag4