258292744-055928-sanlccjavap0003-9563[.]exe

resource
unpack001/$PLUGINSDIR/LangDLL.dll
unpack001/$PLUGINSDIR/System.dll

258292744-055928-sanlccjavap0003-9563.exe

IMPHASH 1f23f452093b5c1ff091a2f9fb4fa3e9
SHA256 63d207b04e2c262db67b0bd741361abc22dd6b3fe5a95a2dc59a234fc67d0c7d
MD5 089ee90218a2a85374f7248cf2089025
SHA1 b382df0b83eef5639101466114b4208274ac629e
SHA512 bf0ad26be5c4df5c5add3d1742924738a1eae1c13f06dccb44375d2348dc9ddd021bdf2a6be12f118d19088159a17bf67f452a5a53b102a2df24f2285907705b
SSDEEP 12288:OU0TtRM31sMFXNxqem1hA914hlarhM84gl:ObAFsMJ/m1i9Ch0Vv
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

69:84:c7:45:b0:7a:39:16:70:fc:b7:b9:2c:85:e5:0f:99:40:b4:16:3a:29:52:d6:7f:5f:d3:40:7d:f3:27:91

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Opgravede,L=Dalton,ST=Minnesota,C=US,1.2.840.113549.1.9.1=#0c1248616c76626c6f6473404a656666732e4b6f

Chains

Jul 1, 2025

PE Signature issue

Digest

3a:81:9e:ae:fd:8b:56:0a:e4:c3:5a:36:14:39:01:36:e2:d9:58:b4

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Opgravede,L=Dalton,ST=Minnesota,C=US,1.2.840.113549.1.9.1=#0c1248616c76626c6f6473404a656666732e4b6f

Chains

Jul 1, 2025

Minor OS version

0

Major OS version

4

Entry point

13449

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

ExitProcess SetFileAttributesW Sleep GetTickCount CreateFileW GetFileSize GetModuleFileNameW GetCurrentProcess SetCurrentDirectoryW GetFileAttributesW SetEnvironmentVariableW GetWindowsDirectoryW GetTempPathW GetCommandLineW GetVersion SetErrorMode lstrlenW lstrcpynW CopyFileW GetShortPathNameW GlobalLock CreateThread GetLastError CreateDirectoryW CreateProcessW RemoveDirectoryW lstrcmpiA GetTempFileNameW WriteFile lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject lstrcmpiW MoveFileW GetFullPathNameW SetFileTime SearchPathW CompareFileTime lstrcmpW CloseHandle ExpandEnvironmentStringsW GlobalFree GlobalUnlock GetDiskFreeSpaceW GlobalAlloc FindFirstFileW FindNextFileW DeleteFileW SetFilePointer ReadFile FindClose lstrlenA MulDiv MultiByteToWideChar WideCharToMultiByte GetPrivateProfileStringW WritePrivateProfileStringW FreeLibrary LoadLibraryExW GetModuleHandleW

user32

GetSystemMenu SetClassLongW EnableMenuItem IsWindowEnabled SetWindowPos GetSysColor GetWindowLongW SetCursor LoadCursorW CheckDlgButton GetMessagePos LoadBitmapW CallWindowProcW IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard ScreenToClient GetWindowRect GetDlgItem GetSystemMetrics SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharPrevW CharNextA wsprintfA DispatchMessageW PeekMessageW ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow GetDC SetTimer SetWindowTextW LoadImageW SetForegroundWindow ShowWindow IsWindow SetWindowLongW FindWindowExW TrackPopupMenu AppendMenuW CreatePopupMenu EndPaint CreateDialogParamW SendMessageTimeoutW wsprintfW PostQuitMessage

gdi32

SelectObject SetBkMode CreateFontIndirectW SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation ShellExecuteExW SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW

advapi32

AdjustTokenPrivileges RegCreateKeyExW RegOpenKeyExW SetFileSecurityW OpenProcessToken LookupPrivilegeValueW RegEnumValueW RegDeleteKeyW RegDeleteValueW RegCloseKey RegSetValueExW RegQueryValueExW RegEnumKeyW

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/LangDLL.dll

IMPHASH 3e8d18bb71c7ebbda2ddc2a4bb03547b
SHA256 5bee24fef5c0f643adc7ee02ccb6e80a72a4eb30d9d326023ac03f0ffbc4e624
MD5 376c1b784a3cca9d10ba4ca5d8cb55d2
SHA1 ad12f8ebab5b4b58eb7d5368469e82e2442b089f
SHA512 6f02f0d878c228de114dee6b0df85152745b43893a252b2e9c309ba943ea56ab1ee678e42d9b0a89162e2bda627d396c2933c02e1c42d0169ac6e05ff3af4bbb
SSDEEP 48:S46+/pTKYKxbWsptIpBtWZ0iV8jAWiAJCvxft2O2B8mzofjLl:zfuPbOBtWZBV8jAWiAJCdv2CmmL
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5439

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 f004c568d305cd95edbd704166fcd2849d395b595dff814bcc2012693527ac37
MD5 8b3830b9dbf87f84ddd3b26645fed3a0
SHA1 223bef1f19e644a610a0877d01eadc9e28299509
SHA512 d13cfd98db5ca8dc9c15723eee0e7454975078a776bce26247228be4603a0217e166058ebadc68090afe988862b7514cb8cb84de13b3de35737412a6f0a8ac03
SSDEEP 192:ex24sihno00Wfl97nH6BenXwWobpWBTtvShJ5omi7dJWjOlESlS:h8QIl972eXqlWBFSt273YOlEz
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10178

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Amatrteatrenes.txt

SHA256 d18adb319afbd1e10fc512dbe40a9714c18bcb5066740bfe74e6a8a0bf075e92
MD5 430d31510a0c044074db5d89381323a2
SHA1 ac0813bb550d3446df99ee0f21ce39aa53ea14db
SHA512 3f5f2b63de7334e7585c3ee62768f6dd5c9be391347797ec702e8b357e576e8cc61b42b1dd7e39363eaf9ad5ac5950f169c2b3ee868c5f508d4365ae48293913
MD5 SHA1 SHA512

Disputerende228.jpg

SHA256 e58268cf9d3fe8aae5d7243aa2a3ea5e3a5360c2e3dcd6e595d55028cc26d09d
MD5 26a5acb0fc6ee908566e33dffcf1e1d5
SHA1 4d2c132150428cc0458e5f45c1c30b4f9aef0df5
SHA512 4fb53e341d9950cc48e4e5860102b277672c5eca8535723c4de95876f22f5a0188b870610d5701efd5b7884736287d81ab4d6c44f262c4c67a80b3dea3b5eae0
SSDEEP 384:SATzGxlbxFi0CP29FNcEO4kkMFLT80fC7/K0pl/2cYnzgFvK2kxyDDGHJN5h4hMK:SGzel9TNu4WFLT7f0i0L/hrDqFh4Kmz
MD5 SHA1 SHA512 SSDEEP

Halloa.Tnd

SHA256 976f6dde4fb01bd24b3eb21c25d7d9bf3e18881bcad7cf84fbd319d060414ed8
MD5 bf603e787d17f248727fd2703911b3ad
SHA1 d9d6a54d97bf181796b1972ea3cd9a1da30c0731
SHA512 d18c918dc93eaced0d69221c1c4a334a896f04d6ca605a5428480d330852150cc549f60ba7e23da728412a218604e290e8d79ab4f7daae4c18140f64d74a7700
SSDEEP 6144:3VKg2PVUtly18BiZ6VKdT1t3uu4AfImRSACrlsqugY+znGtQK:3VpkDbcVyH+u4AQmRGugBLwX
MD5 SHA1 SHA512 SSDEEP

Industrialiserings/Filens126.txt

SHA256 142e02c53adbd37fcac286bbd3677c6a9a3554ed707c9a735561f044b75c3ffc
MD5 4f36a9982a65c6ddfdd323d7e4cf0965
SHA1 c868a8e3947fe079dc65904a2ffc5ce76a3cabad
SHA512 83f432d4a43531b6f2090e30c5be22a9b61c473409e86032faaae94626f66a8b1eccc173aa77bd9bd5cd3413e655a27ce216dfee540cca208e44a4a20ad6e744
MD5 SHA1 SHA512

Industrialiserings/Opsttelsen.dep

SHA256 775be64315630cd217bba9f6f3c40cca3784ac7265d050258aafdd0f4f71677e
MD5 982d87b0555a1ed06ade93f161293fbc
SHA1 3dcb873f1b5535219ddb2b81487b0078a57beb6b
SHA512 ec1875f716a0868bbad3740134d916bb25a9fb22bb6cf600a9b48c7ef226446a6335e8d82af47050eed2b6c7eb3169a99712837a3ec2a2693d1ca9f1a0c12382
SSDEEP 96:dXRI6L3/6xykJMmIVGjVC2UEj8u1GYnNA1lXfs71UEypIus2OZi+oor7iRk0hl85:SnLPkw7OhWpIlhZvI
MD5 SHA1 SHA512 SSDEEP

Industrialiserings/Recommencement.txt

SHA256 b27b3a4a23013f36a29dd29b0fcde814bb3ff256dbf9974a37a70a9d86555d49
MD5 22cde6a47773c761b278b720cd8aa0cc
SHA1 70f430697de066dd535e6fa9f9be350bb0b85cae
SHA512 0e75fa0f43e9a625e0e312d8cf0b0c1121a57dc094a2901ffc8538f3766e70c62da624904712ae4350b16dab643be98a987e61d02efb1c09c904c45c9c14c6d6
MD5 SHA1 SHA512

Industrialiserings/Trafikulykke66.txt

SHA256 a9d91d29b294238d7333891e9ac480620391b11797d6891d895a51379df807d3
MD5 cf4ac9a53d15a5a0daa5a391b69830e8
SHA1 307dc62ff3bd111a321ed511e37518ba17e9c2a2
SHA512 b02537a0e1ec614e97328925b8145b5282db2cb0ea1e2a00df3022652b624e592a0984a0eb4dfedab9f3dc3e85427af58a1baa36c1ad4fb9ca3ea578adafca3d
MD5 SHA1 SHA512

Industrialiserings/Velocity13.jpg

SHA256 155378607581f93b8980da13c47f3dcabd52e86436bc537f69636bcfefd8b943
MD5 fed09c43591b3476fee8bb84873cf4ba
SHA1 968fd6ab8c4630363d33aed63a80763c987eea97
SHA512 f5987ed7fa6e938f880cf8493b161871092dc56dd23526849959414c14a71ccb6af83feb869f04fd67e241a05fb97a19fe85cecad5502dc423d64ac529af877b
SSDEEP 768:7aAkW0Mg4/xmqN/6ONaiF4KKDtfuMBG0oN4reNdqLamX:7/kGmqN/3ciqK8tWMBG0oCrnamX
MD5 SHA1 SHA512 SSDEEP

Industrialiserings/Workable.txt

SHA256 0e546b938d801038ec930bf8f2ac999ec9b659802d5b6b428ab80a1a56183be5
MD5 208123a16b2cbd254dddcf43986d104c
SHA1 82f4a8c0d224edb9a6749c0db0a59e6f1796360f
SHA512 4a36fbd9d13daee6f869804a76ecf1e1d3af4f49496e5c280ef3ab921072246ed40c124efda10f31bc6bf95cf06b58a8666a2d6621fa88bd19675dd07cded0fb
MD5 SHA1 SHA512

Industrialiserings/auktionere.jpg

SHA256 cb58eaba7dbbd905f9920d6e03fb1b1e363ffd603676245d315a3b68b5d57c4a
MD5 cfb5723e78deffd44dd38c4edcf6efc7
SHA1 707c744ebb27aadc2c8aafa804d7fc36824ea864
SHA512 9bf2d4f1c1e841ee26cdcf324431394a29cd4ed3e80abe59f8dafcb668028f64f7407ff0430b6e8e6f7b96abeeefb98c9d873e03514c204643d63a3181ac6f30
SSDEEP 768:qYhxo3xnunx86PRa0TLeav0VjURhK5AcTf1:qYhyZ8a0Tya8Vge5Aef1
MD5 SHA1 SHA512 SSDEEP

Industrialiserings/bathukolpic.pan

SHA256 88f012ea2a3bb09588e1d29e27f757eff0cf5deccaf4c6780cb41004d44b3e96
MD5 645b807d6d52d0a3f46791836e8034e9
SHA1 b582a8f21f790f755db2ba30ddadd136d6ed4e51
SHA512 53d624939e2acb8c14c5c27064e36f00a7d3f32e0add888e61d6c92d415895ef4f0608f836afb8cb0b170593235085427d47348b0ff28a0ef9e2abfb68ccc306
SSDEEP 24:BqtHasaDOUwIX/GPBSQoylWXW+oDEPqxYa/n:B0lSOUwIXOZSQsRPih/n
MD5 SHA1 SHA512 SSDEEP

Industrialiserings/bllehattens.ini

SHA256 fddd0c234a943955f2b7bbc0f5aeeb63004d5bf667afca395ef2f7683469fd4d
MD5 caef8d69ee1afbb0722af012daeedf77
SHA1 02bc8ea5cbbae6a939cd47e365cb4dbdbe04d1b6
SHA512 c01cf4f92186b371442afae7c65e692931922633c1d8288da0e70c0d9b3420c7f0dd67c025a65853ce08a693e30f032a1377ea97a44d852d81cc03295c448cbe
MD5 SHA1 SHA512

Industrialiserings/braknsens.txt

SHA256 85faf9127b7cf4fc757f4dc24ec8eec0b9232c5649096db81845084a20d0c007
MD5 087040c20403080adaf2d94e4db9c536
SHA1 753da7158f75ad59472f9232a092da1f62dc89dc
SHA512 1ddb894dd15f89599cca6146458ade32abd927ba728a7d59a4c781745c07b334b35da3e0479432c3f65b34e493bd478670dd01589bdb878a7012d1e2ea53e344
MD5 SHA1 SHA512

Industrialiserings/brankende.cab

SHA256 2341bf27aec98ad04d939a0db43bb01434764a82355fd0e843fcae1000ee6a0e
MD5 5b9d8c36ab5621a6b92da088221a2f05
SHA1 0376b4205fbf9c0e208f30f5beb54594a668ea4b
SHA512 01fc71e2bb40feb864b0681f5f64685cc1e39d453c0bb450e6eaef7e3f999a00386a2d7d92f73989e03ce3a697e8c0ddc84658646d8294bb40304c1926470e89
SSDEEP 192:pm4yzkbqD3muSnGDDiqV96obJ/64WNYMB:ArkbqD3mbnGDDBV96obJ/LWiMB
MD5 SHA1 SHA512 SSDEEP

Industrialiserings/conjugated.ini

SHA256 d3e0706bc009002b431fb2f4958d0138dada942105217a3ccb07849ef3a15076
MD5 6f6e1cfe501a269a288155792cb5ca42
SHA1 872e2625f38579c91b1f55d7660abb9064555274
SHA512 ac804785ac6bd7107c37e500740bbcf6ad829a921d6c98a184517c29e1b5fb8a20b4caf34b0e992580a04ed9d03c040fcd6f633eec9329f6d392c1de13c3cf60
MD5 SHA1 SHA512

Industrialiserings/distancering.txt

SHA256 651adfa7f0050f99dcfc35ca14ac2de19a7c2090106ab17e89090ccd979b29d1
MD5 34af6a9c678c8dd0a5f4b3678547dce5
SHA1 603e649680c49e6ef4502cfee82d2e8b6294f782
SHA512 4378831ccbb3df8391b389ab400d2a2935f1c734acc06527ca05254f631f049e920e920273aa7ad18f140b856e698e9e1e01fe571fc7d7007a9cc2365f425a99
MD5 SHA1 SHA512

Industrialiserings/draabningers.ini

SHA256 f7f57dbc86e30ba326fd60d821025fc1bb5034043ef8ccc13e5166a018ce6a04
MD5 f2300c887f204d3e0150610a2d726f6b
SHA1 9f759744ec3a5195ffe28a5f31a4adf8240e6c26
SHA512 1afe94bad62e76c8d85e2c937f0c2572a465548e7a2eaf04431b0ead2a2b88ed6c65db96d0feac7f9be37f0decb0d58b5ae3a987901b4c61705db99758cd2b46
MD5 SHA1 SHA512

Industrialiserings/julianist.jpg

SHA256 c0f13b343bb135e6b8726e54a00159101ff83140d721da7b4c7dbc543906215c
MD5 e7fbaf5422b2d8eaa99968ee73b9c084
SHA1 20f282aaa4da5ab4c793cc04561c5e4950feeceb
SHA512 32664af1fae596ad5d1349afaac8cf7b7e785d1569a30d8bb9e64e24b7b7fe8473c4b779f04f5fc1bd0df71dc5a9e37846015126611d40da47856ef0c982faa7
SSDEEP 192:Ld5Gnh1qVp3zdzulYycCb3yJf1ptUnXex:55Gh1qVBzkl0CLyxtUXex
MD5 SHA1 SHA512 SSDEEP

Industrialiserings/lovbefalede.kas

SHA256 ac5521ea6d9032812dea117b384eec21c79b72457e609739f21ba200b660df20
MD5 383caf700111547dee23b497e9a41ee5
SHA1 bbe87e803d71bbbdf3956967a04006468ec3a4dd
SHA512 0bcc152cf53ad9e49aa53558e33cb4a93733dfaa96eb9d4e3c784503845f8dbfcae90b9a8dca79fa8be0b545d0eca3ca41f7a8636a1ce30b1f6209862022e66e
SSDEEP 384:wTwA9C6522MUPnDzPTCIwlml5YM27AuqsnHJkClia:O9C65xfPTdwlM5DQACnpkClR
MD5 SHA1 SHA512 SSDEEP

Industrialiserings/trykknapbetjeningen.ini

SHA256 cef56059b5658b49c44a765a9238ad8d74c3672dcd29d22bf922ce7e940fa239
MD5 be6cefba897737e60cf8a3417392ccd0
SHA1 e2071718f83b16c18f2c5728f391ac0aada97173
SHA512 f3e68dffa6c5e1f1ad5d803c2da3aa8d746ce7be772b81ee450331001f0f230d48c4ec04646eeea8390aa1f9b302c6f222d2f3f78be1c088860e9696c3f1af43
MD5 SHA1 SHA512

Proctotrypid.Por

SHA256 0d517319e2a03644a07b3d75b001799a13dc76594eb2bf382023643bc25b840f
MD5 14593e653463705c92fec9de1aaa33f1
SHA1 3ae3c30c954bf4369c0f01def8d44da54fbd3b8d
SHA512 c051bbb5a28f5d733cf231cebe35c7dc0145549fb01d9978b321e66adf4aea8411d56798b60242aaf036c836e8c2be69176bfe2d48758c910d941a45e30cd881
SSDEEP 1536:BOgUKfbYtmY1ftB1ZKrcM6YnFFcdZ7fZA8nZG1T2im07nat5DW1:EiqF5oiboow
MD5 SHA1 SHA512 SSDEEP

Sharing

General

Malware Config

Signatures

File Explorer

258292744-055928-sanlccjavap0003-9563.exe

PE Signature issue

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/LangDLL.dll

kernel32

user32

gdi32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Amatrteatrenes.txt

Disputerende228.jpg

Halloa.Tnd

Industrialiserings/Filens126.txt

Industrialiserings/Opsttelsen.dep

Industrialiserings/Recommencement.txt

Industrialiserings/Trafikulykke66.txt

Industrialiserings/Velocity13.jpg

Industrialiserings/Workable.txt

Industrialiserings/auktionere.jpg

Industrialiserings/bathukolpic.pan

Industrialiserings/bllehattens.ini

Industrialiserings/braknsens.txt

Industrialiserings/brankende.cab

Industrialiserings/conjugated.ini

Industrialiserings/distancering.txt

Industrialiserings/draabningers.ini

Industrialiserings/julianist.jpg

Industrialiserings/lovbefalede.kas

Industrialiserings/trykknapbetjeningen.ini

Proctotrypid.Por