iceland[.]exe | Triage™

resource
iceland.exe

resource
unpack001/$PLUGINSDIR/nsExec.dll

iceland.exe

IMPHASH 32f3282581436269b3a75b6675fe3e08
SHA256 6d610fbcef50c501f7dd4b042022496092199cb36dea9de9abd9ae84ee74d03e
MD5 525345947fe0a6eacce48afeaae1a495
SHA1 e417df4b5ace3b2652dacb376009157731260b59
SHA512 99f8ef3df75dbdc1f3c8978d18845973380332c25214ed5fa21bfeb8a6495fa198d81453072025f42752f1b754a8da00d4b6253549065579ead9c3c2e6a60823
SSDEEP 24576:BNlGKuT2b9UOqBOAP4KfNoLplXboKGNFiY6g/cNao1D1RtE1E0gDYNptfcB6T4Lk:5GzjwGiplrt+iRhNZD1Ry3/EBZLNdIf3
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

bb:f0:c7:45:47:d0:f9:7a:72:35:a6:37:69:c6:0f:52:80:89:24:48:01:fc:1d:c2:b8:cc:52:87:6b:2d:af:20

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=493 590 202 00047,CN=CPUID,O=CPUID,ST=Nord,C=FR,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024652

Chains

Jul 3, 2025

SERIALNUMBER=493 590 202 00047,CN=CPUID,O=CPUID,ST=Nord,C=FR,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024652

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Serial Number

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

SERIALNUMBER=493 590 202 00047,CN=CPUID,O=CPUID,ST=Nord,C=FR,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024652

Serial Number

a6:5d:6f:19:1c:7d:2d:22:5c:59:da:6d:93:13:7a:70

Issuer

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 5, 2025 - Jun 4, 2028

Subject

CN=Sectigo Public Time Stamping Signer R36,O=Sectigo Limited,ST=West Yorkshire,C=GB

Serial Number

a4:29:3b:6e:1e:dd:d7:a7:34:08:87:ad:7a:4e:b7:24

Issuer

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 27, 2025 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Serial Number

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 22, 2021 - Jan 18, 2038

Minor OS version

0

Major OS version

5

Entry point

14819

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetFileTime CompareFileTime SearchPathW GetShortPathNameW GetFullPathNameW MoveFileW SetCurrentDirectoryW GetFileAttributesW GetLastError CreateDirectoryW SetFileAttributesW Sleep GetTickCount CreateFileW GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW ExitProcess GetWindowsDirectoryW GetTempPathW GetCommandLineW SetErrorMode CloseHandle lstrlenW lstrcpynW GetDiskFreeSpaceW GlobalUnlock GlobalLock CreateThread LoadLibraryW CreateProcessW lstrcmpiA GetTempFileNameW lstrcatW GetProcAddress LoadLibraryA GetModuleHandleA OpenProcess lstrcpyW GetVersionExW GetSystemDirectoryW GetVersion lstrcpyA RemoveDirectoryW lstrcmpA lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalAlloc WaitForSingleObject GetExitCodeProcess GlobalFree GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW WideCharToMultiByte lstrlenA MulDiv WriteFile ReadFile MultiByteToWideChar SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW lstrcpynA

user32

GetAsyncKeyState IsDlgButtonChecked ScreenToClient GetMessagePos CallWindowProcW IsWindowVisible LoadBitmapW CloseClipboard SetClipboardData EmptyClipboard OpenClipboard TrackPopupMenu GetWindowRect AppendMenuW CreatePopupMenu GetSystemMetrics EndDialog EnableMenuItem GetSystemMenu SetClassLongW IsWindowEnabled SetWindowPos DialogBoxParamW CheckDlgButton CreateWindowExW SystemParametersInfoW RegisterClassW SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharNextA CharUpperW CharPrevW wvsprintfW DispatchMessageW PeekMessageW wsprintfA DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW LoadCursorW SetCursor GetWindowLongW GetSysColor CharNextW GetClassInfoW ExitWindowsEx IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint FindWindowExW

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor SelectObject

shell32

SHBrowseForFolderW SHGetPathFromIDListW SHGetFileInfoW ShellExecuteW SHFileOperationW SHGetSpecialFolderLocation

advapi32

RegEnumKeyW RegOpenKeyExW RegCloseKey RegDeleteKeyW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumValueW

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

Name

.text

Size

28KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

415KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ndata

Size

Virtual Size

596KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PLUGINSDIR/nsExec.dll

IMPHASH 8700d0ebbb41c81ea52718af1ab70a93
SHA256 8165c7aef7de3d3e0549776535bedc380ad9be7bb85e60ad6436f71528d092af
MD5 08e9796ca20c5fc5076e3ac05fb5709a
SHA1 07971d52dcbaa1054060073571ced046347177f7
SHA512 02618317d6ab0302324aae4d3c5fca56b21e68c899e211cfa9412cf73820a1f931e56753c904fd7e510c638b4463aedbfe9536790279e096ea0387b67013e0c4
SSDEEP 96:/Uspq2y5jOEEQrhySvUgfj74/vvrTBzfYZA4YF3Telac1nIq/2:/erjOELhySv5f2vvBjiAflaB1nIq
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$TEMP/Cambridge.hopp

SHA256 548db251ff9b85aee3cbc3d7e7ecb959fb4fbf451b22e883cc88ad472e7d2088
MD5 cb0d1ffb31902a464123034caf4f8d98
SHA1 a10ce0ab8e9cd254723c58a607550316123a0f4b
SHA512 7915a6caedaf6b5430628c5c2f4aa3006e99db873e956e7e6727e644b2c2ea7747cfff003375dfaf99db8013f55ffeeef91b5665d8a19cbc18b1ab84362c5db8
SSDEEP 12288:AZ/REsuV3EzEsB1ExK4H2on/4/9I0jEyZgo0e0x:eIEzpyPzn/4/n/m7eY
MD5 SHA1 SHA512 SSDEEP

Briefs

SHA256 d1f57bb9efb5d2e746cbbbb16b5e3b8d0849aa18b2a925abca4cba8db9760f1f
MD5 7b3f2ce8d5529a5a1cb6d7be24d87b13
SHA1 c96c589a0b4fa831dc4c39239fd7b8218bfd757a
SHA512 4472e55a7eeb9606c2f2a5cbf88bd42b2d228e1141c762eb7cd1fc2460869b343b0c6828964e7a6d279b01ab4d74df00086acc87596b70926e9b661fa27a9998
SSDEEP 3072:3xCSVYvlhx6vA3MD8jjJ8lghHzJi2ubSW4wC2Q:3ZUlhxb8AV8lghTM2uK
MD5 SHA1 SHA512 SSDEEP

Butter

SHA256 49d336fd41162156c67018923b962dec7a3757bfe5e0278fbd89fd5f7cb20455
MD5 7c3ed2382c6079451a099724e0b2c714
SHA1 a942de0fc0c6138684fd93e3ce9a4f3d60ceb016
SHA512 89313f31344a78d92751aa38142678622b079f510fba888bda7c2a8fd2702e8a1bfab73fbb80adaa792909bf1ee002f4a4236ddfa5b9943d2d397848a35e845c
SSDEEP 1536:Qh63EYrDWyu0uZo2+9Br+DATG62rt4dP+iX7DjfvSSuyxiQ:Qh6DWy4ZNor+D62rqd2iXbvSS7iQ
MD5 SHA1 SHA512 SSDEEP

Guards

SHA256 1fc28889ab1019b1e48d6933601b1599e6bb99e6510a9102609c7cb67316776b
MD5 91640eb4b89fa74da48b41d3f3c7c13f
SHA1 3987d4c66b05727c46cd66f3688e8a48741bb53c
SHA512 fadb18b5144630764c779a43d8377dc7c49285ba87d18ab7ec4108547c44c2643e9a9a6df7bed992808f444244e116f5a4f6d667b49e0037cfbabb851e7dfc45
SSDEEP 1536:NrZlYR+68cNk3smxUsb1yAwsc8MxqVbD61HOyU/CX2CdXibOT0EdQGQ9EtSijtNO:tYR+HUDXOXT/CfXib+tSijpcv
MD5 SHA1 SHA512 SSDEEP

Kilometers

SHA256 fafdc06c47ea76a2ffbe5b2e6d6f8619e0b9740ac87dcd2435529c737840cdda
MD5 b2477d6641ee0a1b493b175853acb4b3
SHA1 fcb22fd52aa3bb0007ad6065ba1be5be4934e4c6
SHA512 07df891d58089ec08d986c076ce17b6927d38f41351331e455874cb58df82801e0970f76eddc1002ab0af0095746163ab4a1755e5a462aebacaf25a4a015e6ff
SSDEEP 1536:LqX25G5ClCQEiV2XaRodwTVCJ9XonOM4O7tiC9jC0O2i94rqWJNm4Ql0/YUdzPrw:LqXQGYlawwBonasL9jC0O2iSW4QlXUxM
MD5 SHA1 SHA512 SSDEEP

Mint

SHA256 cfe8c4b4016ae611f457916597b956ddbaba598e21f54724f6dc8c22960bc043
MD5 d55206083d043c1c2744e7ef57c2ed8f
SHA1 25bb603c3ae92bda63a907b7af6ad77c27fe6841
SHA512 01bd3f68b1fb3fd0007b380b7eacd2727efb67d52f7b4df51157208f4e071f9e1af504cf5e24eb8f3036a53af0d7b5b1fe2d1ecc2bcee5d9de44f8f978961a13
SSDEEP 1536:t0YwYwTkNJ3Rpref3ghV1SKOxqNdunCMfpfpJKgG:yeVzOqD1IGuTpMgG
MD5 SHA1 SHA512 SSDEEP

Ordinance

SHA256 669b6d6fd05572f0f6b9986d721702fa2b08b84c8e47667545237e0c635c16d6
MD5 f074309b50925874c045f70cb05c3932
SHA1 613233cb7a30b9476fa1b70e23bd4a2d6c36108e
SHA512 28dabaebd79a9b3ff4a3eb372ad4320ed744ffa22776d12a6ba8db433b03f397b19ce09cf0a0ad9a7649097f93674922e086bd7afea3f13bd2223577777bf5a9
SSDEEP 1536:zu0HkjrkBGCGuNkMoKFHWKbAAnPC2U1Ld/f/Yyiy2ozCt+JQ+Hcnka+EYO:exRuNkdKF0vYNyet+JQ+HcnkLO
MD5 SHA1 SHA512 SSDEEP

Possibility

SHA256 4e0ba678658aea2a4a9a06de58b6182dcf8249e64e94469814336a34c727f91f
MD5 22e47f7dc4998504ec534f5ceb299978
SHA1 bb8779569a21388fd25f16a66c9df3b06a5ffc2c
SHA512 4eb0b8b79a2b34d44b3bbe58179719342e36a44dca2cbfae3ebc29497d8d1399dc0da9e98de2f62528853fa3e78dc55e60a7ecdaa659daf0deb9a2c2bfde8e18
MD5 SHA1 SHA512

Pride

SHA256 65ddb7eef46fa60c43e6ec2b2f58144b438be5bf721356086b99daffb6194d4c
MD5 8775982f323488b93297d11cd4ea1547
SHA1 0f873a649774af66af668b9a82c60b9c5ee26dbc
SHA512 39a75601ac792abcadeebbaf1deb0970d8b46be46f834e97d7570f7a5dafaacf65496a878fd4a0d3738700ba7152d3654b9be223b6f0bf4f29fedddbac09d80e
SSDEEP 768:KM4INduPbOU7aI4kWD9vmCupxhSaAwu+2c/mex/SV:KMBNIWPuwaAwu+1Pm
MD5 SHA1 SHA512 SSDEEP

Reject

SHA256 333f2cfd4813f89a12108bb281660995344be824acd973ec7d7cb5b8540cc032
MD5 d46bb17a8666ae67bf33d15724cc4e23
SHA1 2c29cc75307b0cf995e5fa68d81afaa4f09ac14c
SHA512 e6b8a6d9315cf456db2535937b316ae5cccea1709d10e5e05a0976471150b60ff045182f0bfcc7f14db1f95d744add1f246da2d8122fa093b24a4d416be99d3b
SSDEEP 1536:m48918JsdVCsESNvmtpAi6JvAeInT3VCLIsLS8ZIjOrOJ0ou3GerIUhj18Ehs5t:9MFXD5ypAXoegz8StjOrOJGGMBwr
MD5 SHA1 SHA512 SSDEEP

Unlock

SHA256 bf320de3dd87aae6ae3f5aa4d0605dcbfaf06f67a477351b2165b7fe5553a7cb
MD5 f8c58eaabeb60b4abbe2dd78b8ce9310
SHA1 1268787d684a1bdf408ca296056b43a3695bb10f
SHA512 9513d78f4272c4fd508ff062870d1f5546ab63e89b6a9bf98415406ebd8586b85d42bcf2eb83821b689a73643c1301ac4b50524b18685e29bf9dd06e47cb588d
SSDEEP 1536:TL3KZ09kOJKnCIj4BZKaTb1nXu4uuVGHj1vtKsevk+goJqvtmgMbFuz08QukU:/3I09JwCIj4BPb1XuE/gc0Ag0Fuz08XP
MD5 SHA1 SHA512 SSDEEP

Victorian

SHA256 e39f3aad1bd70745d79b16d18bc39ac686f566e768165d4675fede9ed90a15df
MD5 a951836af45f6ad5e146923736f8fabb
SHA1 5c0c108244eac59c923a5330c0679c24c762bbfa
SHA512 0892e2abc8428628aab11a33d2bd1098dc30eaf2e9589f48ac8edde9fcc3fe15838a3eabe84e3300db1c756271e80a02086dfe299985e60d65ea438048d0ba29
SSDEEP 1536:DPdkdux84SbL8R571Nf0xe5c/IwDXX/44Y:fYbwR5Exe2/RTX/45
MD5 SHA1 SHA512 SSDEEP

Wed

SHA256 64aa7652940f6391a3b62a6dbcfa5daff60d4020aaae6abe83f8bc913c477379
MD5 6fdfd59a62f0141e5793a1e480b98352
SHA1 2c8ac1a95ac34bd9ede83f66ebadba40c4f327f8
SHA512 c201c7b622c4c5d4154b14327fc9c9a6145d86c52c73c6d7242f5530eabc5cd1bdd53b0c7ed159ba107d7d61199600ce3a90f548bae6be8efaa2805e9490cf2c
SSDEEP 1536:sJaGloaj6bs8jcd/TcI3s+uXkrfhrRj3:gam6OzmkrJrRj
MD5 SHA1 SHA512 SSDEEP

$TEMP/Colonial.hopp

SHA256 87cc3cebdddca1015522dd9516e9b8d74867a59895de4d893b034762a47a9dfa
MD5 454112f57f302cf6c8688c34ccbe6fd0
SHA1 29ed7b9f76d6c3b8a0473e110d6146bfff2f72d1
SHA512 6a98bdedbe05c3d44ebee78bc9ee8bb16e439d99aa54b832d9f0bb10a9f3103d4d8c0546f842fe1966cf561659f3629c0e3f1691ed019dec5fccb9a57de5e3b4
SSDEEP 384:O5creKuqBGiz1LBjqhRgLHjG1dM/XqP5taZTXubEM:6QLBGiz1LBOjgLaAXG6TXubz
MD5 SHA1 SHA512 SSDEEP

$TEMP/Deck.hopp

SHA256 ee2d0ccefcd694daabf1a6fcadedb932549d0ef5d610714ebea5f3154572b526
MD5 541e2e83dcf9a99d199e741e37ba4e4a
SHA1 fec21dad20a85f66b67e64b6e05611488f762ba9
SHA512 3c3042c7d651b3cdb2a1443b8ec4d1ac28cb87fcb42d628f87948ec0b0ea93c878aefa2ca241c0f7e9210fc1524dd0edfff9c49e8a880a63505b2403598e8125
SSDEEP 1536:1LFV0zkF3MLLotQk5rze3lqep9tH6AxngcalwJIxFpo+rE1Zx9PagprsiaT:1Ucht9Je3lqepjRngbw52kZTCgBspT
MD5 SHA1 SHA512 SSDEEP

$TEMP/Exhibits.hopp

SHA256 bb429a6cd4736df13f5b14e03b8d605775588d00962dee709c9ff7466a888762
MD5 0d43f172dd4453397e3e2b4de6140f6f
SHA1 4b3a35ff576f817b5297e6bad970a5e98a4fb117
SHA512 27bc541d207712cf0600a154b628eb7539ddc5560f521b62a2a293d4d146b223a4c5031c1d657d8b5fd775674f92de2c211c71b49ac17af2e1e99fe894b919e0
SSDEEP 6144:PCQoeGIRQjCOl9yPLCh4kuBG7sKHP4yCTW+l4+7Nc+SOjc:qQGIijCi9CLCGBG7sKHP/KWT+pc+SOjc
MD5 SHA1 SHA512 SSDEEP

$TEMP/Md.hopp

SHA256 abcce5b1492b33089a1d84057bda0ccfd2d31a276d353ca5aeee937b70f96c12
MD5 806cb269788d65706f61197590555988
SHA1 0e23eb47960007d3d33d5d8e536878ea67cc4d61
SHA512 886e2f7c5b0b80ac6fd87e67651a63bb7b64bb96acad104962d997503075ab13fa25c5f8913542bf4579d53abc9d4a89e46ce2afc765116d3c030744b1c90fd4
SSDEEP 6144:FB8x0epPQqAeHJf7D/NrFuk+8bg/at6dTHA0mM1fC:FB8GD9oJf7DFrFu98bgPTgO1K
MD5 SHA1 SHA512 SSDEEP

$TEMP/Reached.hopp

SHA256 d46ece3faeb7fe7414563e4c889b2658686fbc97a65545e79764b1d7499cc21c
MD5 92e56d125ed14c86ef116ece2dce59ca
SHA1 5a64f5f28e8cd15929f932d2b67b467f7d7ef62d
SHA512 1392a305f9d9c38acf71e0db54c0f0718294b74365b438407392c2dc6ffcdce4137407a8b957d647985ccb0b5f82c75c0a5ec89d731878933573c920075c8591
SSDEEP 3072:goETroD6conp+bPBRsltB54XHoNBEXtYRq17oQJ+UCGETKN9k/O/i+j:PETchyuPBRywoNBqtYRq17vJB9ETKN9T
MD5 SHA1 SHA512 SSDEEP

$TEMP/Stories.hopp

SHA256 71c790829874add13f9c2cd5ca62a378941b7f2768d76bb09cc7511514399bf2
MD5 6817f20968fdf496ab6cb6da76a5da08
SHA1 664880b5bd89babd80151746f08cdb561a0826b4
SHA512 f096f4e5c50f9104d3490a5562369067645c8476729a90cba1e89190e90c0e5d4073d42def279fb5806b0c38cf1b2c809157e3cd167f135a3d6eec7560da53c2
SSDEEP 6144:LykMxzngqQU3mwW/S5NK2jbcqCps5qyhRO7fQRVX:L/07gN0mJOIUbcY5Xhg7a9
MD5 SHA1 SHA512 SSDEEP

iceland.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/nsExec.dll

kernel32

user32

advapi32

generic

$TEMP/Cambridge.hopp

Briefs

Butter

Guards

Kilometers

Mint

Ordinance

Possibility

Pride

Reject

Unlock

Victorian

Wed

$TEMP/Colonial.hopp

$TEMP/Deck.hopp

$TEMP/Exhibits.hopp

$TEMP/Md.hopp

$TEMP/Reached.hopp

$TEMP/Stories.hopp

Sharing

General

Malware Config

Signatures

File Explorer

iceland.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/nsExec.dll

kernel32

user32

advapi32

generic

$TEMP/Cambridge.hopp

Briefs

Butter

Guards

Kilometers

Mint

Ordinance

Possibility

Pride

Reject

Unlock

Victorian

Wed

$TEMP/Colonial.hopp

$TEMP/Deck.hopp

$TEMP/Exhibits.hopp

$TEMP/Md.hopp

$TEMP/Reached.hopp

$TEMP/Stories.hopp