98feb7e5d2cdff3351f0bf47d2dfb7f0a3f7d0f637626a153ca6216c3a541e51[.]exe

resource
unpack001/$PLUGINSDIR/System.dll

98feb7e5d2cdff3351f0bf47d2dfb7f0a3f7d0f637626a153ca6216c3a541e51.exe

IMPHASH 573bb7b41bc641bd95c0f5eec13c233b
SHA256 98feb7e5d2cdff3351f0bf47d2dfb7f0a3f7d0f637626a153ca6216c3a541e51
MD5 1dcb58d1e0db0fe9edfa71c89f09b1d8
SHA1 e201c843b39538d0f42e3ac3490f2a0038d16493
SHA512 99560dad5c18e99b530d284fbf001d3b24082bdfc20da18b48b9db83f5958259cdfd5b9572ccf1914357f59473766472fc19c039eb38d4941bfe43dc288ad7c6
SSDEEP 12288:gTAHY+hwvIGqltvoCKCpaD5Sa7niMtZMobimoLzNK4nr0LL9sXAWhHY:gTAHY+eWb2EaGOMucLpK00Lz
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

fb:56:a5:34:c0:2f:4b:92:bc:af:1a:8a:80:f5:bf:86:1e:21:91:cc:1f:79:0b:c3:a0:58:35:b7:05:9e:fc:08

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Klubfolk,O=Klubfolk,L=Greensburg,ST=Indiana,C=US,1.2.840.113549.1.9.1=#0c134d616464657240446f6d65796b6974652e5768

Chains

May 1, 2025

Minor OS version

0

Major OS version

4

Entry point

13709

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegOpenKeyExW RegCreateKeyExW

shell32

SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW ShellExecuteExW

ole32

CoCreateInstance OleUninitialize OleInitialize IIDFromString CoTaskMemFree

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create

user32

MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW CreatePopupMenu AppendMenuW TrackPopupMenu OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW IsWindowEnabled SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CharPrevW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint CharNextA wsprintfA DispatchMessageW CreateWindowExW PeekMessageW GetSystemMetrics

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor

kernel32

lstrcmpiA CreateFileW GetTempFileNameW RemoveDirectoryW CreateProcessW CreateDirectoryW CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW WriteFile ExitProcess GetCurrentProcess GetModuleFileNameW GetLastError GetFileSize GetTickCount Sleep SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW MulDiv lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject CopyFileW

$PLUGINSDIR/System.dll

IMPHASH 509a34b3a68a773e0afb4259e68f9f82
SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Czigany/Reeksporteres.jpg

SHA256 2c2cf2b2c8e4482ca1431b813c1e6158bd248e6ecd6b21e21d8f189142dcbc49
MD5 3ec3fc7cda077a2e482ccdca7d15ce47
SHA1 82ab417578e0ff497d82fe60417a6b2268dbf26f
SHA512 82423df4f0771b3b6e2f7fb761713a355d766b9aaa2f513534a28e1837f84738119e3e41cb2ab33a0a9a4e1ddec668539a6163b777d19ba125f2bbc19b1a1c22
SSDEEP 96:RhGEKbdiLMKT6h00yWPRSnuKMXmvIYLdI6D3GEahTMcWaFZJrb+7hkzA:LGvhiLMK000L5SnQmgYxpAAr0n+Ff
MD5 SHA1 SHA512 SSDEEP

Czigany/Smreolien.txt

SHA256 3594ef22aa077eeb70f58aabf26b679c2e1fff8c5b2cf6d2979347f0d617d235
MD5 22cc5217b80a5b862c9b686055b96e24
SHA1 e67f6e38d502d25d43c847325a3bf4fb29eddda7
SHA512 cf3c4d49dfa8d73a5243c133c5b7e236b71ee28419091c7a3f785405c31f675c406cf7c3afb9857e3ab5ab92e8ad9ca8a4fae27fde7783f627f4c68424d84b7b
MD5 SHA1 SHA512

Czigany/aedicula.txt

SHA256 0178e58fd19730adf7bd8b9014f591df2936673e4f94ed951e05294d8dc9600d
MD5 57d56608bee4f8423255dc7d4d692396
SHA1 93be67f4d1b14e60d040bc7587822020670b063c
SHA512 49a1e7f1fde0a7433cf84d23f922e9ef207c38e419ed909ca3f5a753c546a91a6c820795b8642ea863efb864c33c7171dbc2fbeae629839add0abdb743173af7
MD5 SHA1 SHA512

Czigany/amaine.txt

SHA256 26d4bf837efefaf5754191229224513ed6ea740163be4b0f494c1e7350fdff89
MD5 7a31750ec6109a699286097772e70b3c
SHA1 bfa6ee2e8d7316e8b3e03589efc9482e9d9fb05f
SHA512 325eb6e04054dd3b5390d4b1d5198652f0359643bec609d35aaf42423318a62341c158e9567d49ac741b5f1f2e14425a1717ced33655f4e130e3074ae0d0ed9b
MD5 SHA1 SHA512

Forbilledlig/Unpiratically.Con

SHA256 a33f10e691b52c723cf33d5b97236eef4b5dff67cfe7823c93e3551e11fee189
MD5 a448f61e0721c8d64a7aeea7589eac9d
SHA1 d9801582286a119b218a7544538084e7f3a904fc
SHA512 c3d09acbed2e5ea9c5bfcdf288cc7db280de70876a94f59892a9ae04927f547686a1bb7f5d60e95fc2eb27d692ff7cb7764f479e490eb5a4f661a9b79a5d0635
SSDEEP 1536:VFpRM2It+1PAsqc00iLNNaEN3iXKUQBRgf+jkUvXsSQF2iz/P3pM6PasyfXW0:V/Ri+kc00iLNZiXNkvKUizH3S6isyfG0
MD5 SHA1 SHA512 SSDEEP

Kondicyklens.ini

SHA256 56bc9f09b772f036cb8be49e2364e58c4631ee80cc1f2387d00e2eb01b491ac5
MD5 00c244716ea3c3ec1ff8e36445efb76f
SHA1 eec587339d988b460c1172be49c412d6658986bc
SHA512 c8fae7f3825a6f304cba11b10c4279522dfb27f20f00474063ddc5b9f9e4bc56d3dc742343ab1cedab959381101ba7a16cb11300a6b45be81081a1cadb198302
MD5 SHA1 SHA512

Reomission/Meteorologens.frk

SHA256 8c417b657797e2ec0b57dfed7aa75057d07130e46198772cdf3c815442b04f42
MD5 2227191a40e21e7117fb3967dce25e70
SHA1 631c181bed1a9d0f1a02a44de05e4818e38d2b3e
SHA512 4f55f091635aaa54e74f6e88b02d09aa536a26ea659a2b26beabdc0cffeb1d195c4c33603678ba18698b5b21f1cbe812922177f3e2934f79001a5652d450f2a3
SSDEEP 6144:EmhR0OflBLL5Ed6rV51WgXwHfpdZt+X6PODW4LRJPRkvFkzzPRD3GYHsarGbP9BF:EmhR0OflBLL5+6rV51WgXwHfpdZt+X6d
MD5 SHA1 SHA512 SSDEEP

Reomission/Pendelen81.ini

SHA256 6ebe5fd263e08014e0f858004f4def87b879584a99a3306ce9a4f1fcda9380cf
MD5 b6c05de8d01fa6ded2464a832ae7165f
SHA1 802fe0cbec829be281a897031ecefe7d1514ec7c
SHA512 e15c07c1ecb1ee6a554b7d7cb74db5485a41f6d65acdde2772f3b6633580c0e100573e61f162e64ba10b48be2d8a0ff8e90b83e8a3d3c47738ade0548cb3d62b
MD5 SHA1 SHA512

Slgtsbgerne.San

SHA256 c7a36c0722a468f13ba117549adab3c58db88d707ccf0f8ac2fac91e1b56e21c
MD5 c3d84ef94abc323edb47a86cc95b6ddb
SHA1 706b686ba64be662a4421028bdc82da970245299
SHA512 a99eeadaef830313ffadaf629019d1e9d146e2680cf9c031805de7ea82fa3364fdb6edfbee50b62abe5d34f1128c7a2dbbf5e9c0d4629616bd160df9085b6918
SSDEEP 6144:4dRbB4njqk8gl5HivC8mNb3bRhPf8/2RQyLmf0i01+f66row6XxoPzql8oot:UpWjD9rHv8kb3bS8mf0iA3xo7ql8o6
MD5 SHA1 SHA512 SSDEEP

naadestdenes/Splitninger/fjernbetjeningsenhed.ini

SHA256 89364b6aeab2be7e12346d03f5d481a0ff8dec19aecf35c5b5c19683cfa80373
MD5 bc451849132c86abde2c92099d0906ac
SHA1 2150cbb3e3754fedbdfc3469135a03fcce0609a6
SHA512 fc15cf2a2eed1f9c29434846cc271d2050534403e47593ec3436bed38599c64f02a5626969da1958bd6dd14da47f2b2547f212179494fef4ce1884a634c82ea6
MD5 SHA1 SHA512

naadestdenes/Splitninger/haandsbredderne.spe

SHA256 a01b1e6979eda00f356c310aaed3d80b716bc5dd095302885686700ed90910da
MD5 c32ebafd108b0927e916df4e22702bdc
SHA1 0ed3cf87fd18b7895844c35657f4a10475270978
SHA512 f540b6b8bccaf26f857b3915e5a932833f281595c07174412a7ed2f2ccd06a4817d6040da918c52a4aa47ad711326d89c61853c1906bf54eba2c658fcb5c2d8e
SSDEEP 6144:XYKnwIt7YTuelk0T40FurHQg+b48maNeO6BwdHS4cQ7On/Av5:uD
MD5 SHA1 SHA512 SSDEEP

naadestdenes/Splitninger/indskydninger.ini

SHA256 88dfeadecf5d56ba8c8d5c9eede688c822db089c3025d2d2089365731e086b63
MD5 d4054a42c705a82d1ecc6531c747f07f
SHA1 061569184e7fba3fa410712e5126faaef8c071cb
SHA512 4b8541637ab10e6feb4ac0e5606d090901874b88d09f29ff3035a805c64d593d6c4fb501944ce1f3e6a42917f6f987536a296700274907ab278773d0b6c70295
MD5 SHA1 SHA512

naadestdenes/Splitninger/parallelogrammernes.ini

SHA256 9bd9e155b7f47234de23382a5598ff827bfb48757b8b71e4ed5b16a552b6723e
MD5 489b3228ea38f940e44f463ddf15d39f
SHA1 8d06cb8c63b69e63b1fbbcfc87df4f4f8c07137a
SHA512 5cca4a775bbbc12f200dce1bce71032c17bd99f596cf6a3974e2cf4dbbdb8f2261ed05dde808f1005d8111d5611247e94774fc9a74851892a2fc7b1547691d82
MD5 SHA1 SHA512

naadestdenes/Splitninger/prosophist.ini

SHA256 3d2790316f42195a1062e35f00db3704a897c1d01b5fa72ce5225291412aa5a9
MD5 fdc79e914b56b31ef736226d89bc28b5
SHA1 563446b22fed072ad821b36d59a68ba94ac82167
SHA512 1d86afb165d8a6f5a9e6124eddf379976b8045587abf47670bf6ba7f31b1e6077b94c6c25643cf5fd4a3131ddb7435be644fc204ce7e920a1c63a5b60762b1e0
MD5 SHA1 SHA512

naadestdenes/Splitninger/reenacted.ini

SHA256 be03d381d2417b1db28bc3c225c61319b81510c257b71d91e608d84f439db23a
MD5 6640f4f20d2f3746af2bb9c2919d9cb7
SHA1 cc56152503d06ecb8051a1555b7fe9c016c9723e
SHA512 978f4cffd18664153871fed88518bca88c5b94ec3dcbe822ac9bef5f0c2f0a6ee39120c16bedd60e9b80876fefccbd3c938f2a80edc06c1d5f6534ce040514c2
MD5 SHA1 SHA512

naadestdenes/Splitninger/tsebrns.txt

SHA256 45bf76c897017a587f4ef10864047e6751a367ddb342df7433fb60b68e25e79f
MD5 5867cb6d57ecc4ee5e79874b74419546
SHA1 683d9f601a0105a56464e0a41a69072215b084f9
SHA512 c387c37b5d53423e6b47c7abb3a64a4c4718f23d906120e3916fa3d5c68f478bb1f1c0ab3d00b5020e7bf3cb727253c6083d93f9b8f7776945dc3caec4bd60db
MD5 SHA1 SHA512

naadestdenes/Splitninger/ufoer.che

SHA256 b4c9c900b6906c8d0c118e2ee47fd58853de752dd0b6e4b70dd74a3b8d09e9a3
MD5 0c815fb84d0bbd22a44f835d084aceae
SHA1 6c9d8a1dedaa49288db400944e52669ab9842b81
SHA512 bd2dc42c43432e64edceb859681564283ece515abe1cb1152846efe8b58a2bd79acd7da4392eb49e7e69d8b4522834cd55fd6df7649ac693b8119f3f9fa60f9a
SSDEEP 384:EdfN4072wpWCzIEQdCgh6phfB4eeIcG7M:8407RIEQopBB4evW
MD5 SHA1 SHA512 SSDEEP

naadestdenes/Splitninger/uforglemmelige.jpg

SHA256 602be27ec9fb1bfa13c776c0ee7a59356e6d81c2d9e5ddc8909be8204756cce4
MD5 276401a5022abe1871494e17649cb181
SHA1 aab5ad9ffdc9fb8f661a659f06b610b8abfb0bd1
SHA512 92580ccc962651aef135426e37695d5fb2b16d7c5838d21a909e4ce0939cb40276b46ceb11c61e694d100a1afbf9b1dd286d2e2df29f780f12bb2fae7554e462
SSDEEP 192:LEvEXJOvbz5Z8zrcE772M4yrbkOzkTUKPRSD6J0nX:IMXJk3E/772Mf7kU8SD6JW
MD5 SHA1 SHA512 SSDEEP

naadestdenes/Splitninger/widework.txt

SHA256 15f2c153e3e9523a2803541f671443ef5787cea1f56973c59ade2ea6b2241b59
MD5 ad69351ad0056d2165b353adfddedf1f
SHA1 42fde35167aad39894954606cb0183b205847a67
SHA512 0f60f9fa455bcd695faa941a883c887fec978ed18860e8c30ae67e69810a3ee7a478b46f20d64a73881239d023db022b81879610eca5ac5032e1fd36991a73e3
MD5 SHA1 SHA512

naadestdenes/anstift.txt

SHA256 6f0747444724f164ae4a85ddefcb437f6f288c853735734bb76b5b931b936e3a
MD5 deb5d57173011a5535cc8205816e931d
SHA1 2ff5fb36b2f485793a255305e88bb5bc10eba446
SHA512 d7451a425f5d601dd5c0ebb73b796d0942a2809e22e621830945820f63361f84f26d5306a9bfca84941de73773259185170a057f3d2b9f2b4e66943dd1da6d4a
MD5 SHA1 SHA512

naadestdenes/borddans.jpg

SHA256 7d3c0fcfb9dda2cf479e22e46e5f507281cddec464c1f979fac37329e2ac9884
MD5 6458448d3f67590bf2a5d4624c97ba1d
SHA1 36719b4d188989e2134de1005650f68489e199e6
SHA512 07a13461e0e3969d512ff096f27296862735d7e7ee746a7e9509e798bbdeb80aecddd0302d96a780e10f3872e62ce37b2f393085239fa0f2453ba61072d7cc19
SSDEEP 384:dsnO72mWEj2n4S4BfY4csf8uoSfO7176WpyNsNPu4Nj:dxqmWjZIfkIob17zNPug
MD5 SHA1 SHA512 SSDEEP

98feb7e5d2cdff3351f0bf47d2dfb7f0a3f7d0f637626a153ca6216c3a541e51.exe

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Czigany/Reeksporteres.jpg

Czigany/Smreolien.txt

Czigany/aedicula.txt

Czigany/amaine.txt

Forbilledlig/Unpiratically.Con

Kondicyklens.ini

Reomission/Meteorologens.frk

Reomission/Pendelen81.ini

Slgtsbgerne.San

naadestdenes/Splitninger/fjernbetjeningsenhed.ini

naadestdenes/Splitninger/haandsbredderne.spe

naadestdenes/Splitninger/indskydninger.ini

naadestdenes/Splitninger/parallelogrammernes.ini

naadestdenes/Splitninger/prosophist.ini

naadestdenes/Splitninger/reenacted.ini

naadestdenes/Splitninger/tsebrns.txt

naadestdenes/Splitninger/ufoer.che

naadestdenes/Splitninger/uforglemmelige.jpg

naadestdenes/Splitninger/widework.txt

naadestdenes/anstift.txt

naadestdenes/borddans.jpg

Sharing

General

Malware Config

Signatures

File Explorer

98feb7e5d2cdff3351f0bf47d2dfb7f0a3f7d0f637626a153ca6216c3a541e51.exe

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Czigany/Reeksporteres.jpg

Czigany/Smreolien.txt

Czigany/aedicula.txt

Czigany/amaine.txt

Forbilledlig/Unpiratically.Con

Kondicyklens.ini

Reomission/Meteorologens.frk

Reomission/Pendelen81.ini

Slgtsbgerne.San

naadestdenes/Splitninger/fjernbetjeningsenhed.ini

naadestdenes/Splitninger/haandsbredderne.spe

naadestdenes/Splitninger/indskydninger.ini

naadestdenes/Splitninger/parallelogrammernes.ini

naadestdenes/Splitninger/prosophist.ini

naadestdenes/Splitninger/reenacted.ini

naadestdenes/Splitninger/tsebrns.txt

naadestdenes/Splitninger/ufoer.che

naadestdenes/Splitninger/uforglemmelige.jpg

naadestdenes/Splitninger/widework.txt

naadestdenes/anstift.txt

naadestdenes/borddans.jpg