3cc80c52c15d1a5da944d8bd2eedc33e602f94ff3e8a59679b0f2d19a2cb6925[.]exe

resource
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll

resource
3cc80c52c15d1a5da944d8bd2eedc33e602f94ff3e8a59679b0f2d19a2cb6925.exe

3cc80c52c15d1a5da944d8bd2eedc33e602f94ff3e8a59679b0f2d19a2cb6925.exe

IMPHASH 7ed0d71376e55d58ab36dc7d3ffda898
SHA256 3cc80c52c15d1a5da944d8bd2eedc33e602f94ff3e8a59679b0f2d19a2cb6925
MD5 e685e6f33cf4ca3aed82f3b10105ec83
SHA1 dd2150c9db3e773fc0e59fd4617577541d1cef71
SHA512 d3f8869c0f3154b5399b7442190ed885c52fe1c9360f0942300a69b1337d815e718706d8927fe4fa8cf328c3ed5f4dd59f10d29ef29f16fc991ffc8c58a7c527
SSDEEP 24576:5BSEjWm/SkPCyUOFMySAy3eQ5Ricod/10zfWed3NkHAU/m:bSEhXlNCeQfG/16fF3Em
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned binary was signed by an untrusted entity.

PE Signature issue

Digest

c5:c4:25:aa:d6:f2:2d:dd:33:b6:f7:d8:15:e9:56:75:29:8d:71:5b:51:a1:42:a1:6b:85:b0:02:65:cd:a2:dd

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=genforeningers,OU=Deltidslandmnd Decafs\ ,O=genforeningers,L=Saint-Maximin,ST=Auvergne-Rhône-Alpes,C=FR

Chains

Sep 18, 2025

Minor OS version

0

Major OS version

4

Entry point

12799

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathW SetFileTime CloseHandle GetShortPathNameW MoveFileW SetCurrentDirectoryW GetFileAttributesW GetLastError GetFullPathNameW CreateDirectoryW Sleep GetTickCount GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW ExitProcess SetEnvironmentVariableW GetWindowsDirectoryW GetTempPathW SetFileAttributesW ExpandEnvironmentStringsW LoadLibraryW lstrlenW lstrcpynW GetDiskFreeSpaceW GlobalUnlock GlobalLock CreateThread CreateProcessW RemoveDirectoryW lstrcmpiA CreateFileW GetTempFileNameW lstrcpyA lstrcpyW lstrcatW GetSystemDirectoryW GetVersion GetProcAddress LoadLibraryA GetModuleHandleA GetModuleHandleW lstrcmpiW lstrcmpW WaitForSingleObject GlobalFree GlobalAlloc LoadLibraryExW GetExitCodeProcess FreeLibrary WritePrivateProfileStringW SetErrorMode GetCommandLineW GetPrivateProfileStringW FindFirstFileW FindNextFileW DeleteFileW SetFilePointer ReadFile FindClose MulDiv MultiByteToWideChar WriteFile lstrlenA WideCharToMultiByte

user32

EndDialog ScreenToClient GetWindowRect RegisterClassW EnableMenuItem GetSystemMenu SetClassLongW IsWindowEnabled SetWindowPos GetSysColor GetWindowLongW SetCursor LoadCursorW CheckDlgButton GetMessagePos LoadBitmapW CallWindowProcW IsWindowVisible CloseClipboard SetClipboardData wsprintfW CreateWindowExW SystemParametersInfoW AppendMenuW CreatePopupMenu GetSystemMetrics SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharPrevW CharNextA wsprintfA DispatchMessageW PeekMessageW ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage GetDC SetWindowLongW LoadImageW SendMessageTimeoutW FindWindowExW EmptyClipboard OpenClipboard TrackPopupMenu EndPaint ShowWindow GetDlgItem IsWindow SetForegroundWindow

gdi32

SelectObject SetBkMode CreateFontIndirectW SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW ShellExecuteW SHFileOperationW

advapi32

RegCloseKey RegOpenKeyExW RegDeleteKeyW RegDeleteValueW RegEnumValueW RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumKeyW

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

CoCreateInstance CoTaskMemFree OleInitialize OleUninitialize

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 df5ae79fa558dc7af244ec6e53939563b966e7dbd8867e114e928678dbd56e5d
MD5 ca332bb753b0775d5e806e236ddcec55
SHA1 f35ef76592f20850baef2ebbd3c9a2cfb5ad8d8f
SHA512 2de0956a1ad58ad7086e427e89b819089f2a7f1e4133ed2a0a736adc0614e8588ebe2d97f1b59ab8886d662aeb40e0b4838c6a65fbfc652253e3a45664a03a00
SSDEEP 192:eo24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35Ol6Sl:k8QIl975eXqlWBrz7YLOl6
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10183

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsDialogs.dll

IMPHASH e2ee55bddad4241d619d6a8a38e2d869
SHA256 a7c5516478ab02b5d6c1684b3c2b31ee03331712bcd9f9a8ef8309d2b72c8ec4
MD5 904d8313031ac05e2bac3dd329828833
SHA1 6c8322f76e5c38bc24b0bcc057a510c92ec40b43
SHA512 9d524ebc965f224e1a16f537f71df0963c586fd548cb9a901f8afb1951416dd656d5493cc5e304157dfa6d70d69bcd4c5a5b140fceb3736548e71fe7086b6de8
SSDEEP 192:oR8cxzvTyl4tgi8pPjQM0PuAg0YNyAUIFtSP:IBxzm+t18pZ0WAg0RzIFg
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

7443

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Datofunktion.Hng

SHA256 336be9dbe2f5d40b6348407d5256ee431835f830f19f533e32fbc98fb2026e6b
MD5 80edebc818a55afb9083c7aca1718736
SHA1 88d9d7d9c902887748326654134b7d7410362820
SHA512 70f693e0afb6746ebe5d98d096178e9fc6e5b29dab4a7c39b8a56b7dc9d9853ae601dca7433bbfcb16836be989095c68284b3109abb93e61f1a4cdcc8f546674
SSDEEP 6144:FYg86/c5s+VlKPW2WmfH9xg9DIPA+lvLyNbqt/Sv2hmRyRwFSWeEOW58:FzcK+P2W2WmP9xuEA+lbRSv+Uy2ctEjS
MD5 SHA1 SHA512 SSDEEP

Duksedrengenes3.udu

SHA256 0fc8220d501b6a80717716c95d485c8dfecd51e55dab325e02908aea0b46ab41
MD5 d17eae069f6b2b8174ac163be881d742
SHA1 210ebb1b4154be03936c6784d279aebec900d8b7
SHA512 c6d650c68bb3cd27ed0c90b03b3d983608b5420ac8079a7dcac68ae203f46c2b790c603b228d52f493cf01210eb80bf36fe37d6803bd1df9ddc0b8b81f3acd57
SSDEEP 1536:Lj+GU9B45Kmtze3ye/QeMCSBow1RUzdwNotozswO1vUrw3B99Pjs+NIChICZR8Sk:Dr
MD5 SHA1 SHA512 SSDEEP

Extemporizers.sap

SHA256 fbec6d61109d30bc15b97ddff5d010359b75eaf2ae5b7ddf47621f234e9d8ea0
MD5 b8c569e0320585f773f039072d55b1ec
SHA1 c0dcb3cb293829e9dfbc5f28bff467968f0428e3
SHA512 612a232a234e0079d728119a15cac4beece4b4ff0a0d5f873bc73f84892ce5ee9418aaa577f3124f49e59613157aaa2adf54f7c789bf05781489be36a597d134
SSDEEP 384:HFdGuUACpZKrC8oX8k2K3A6AYA3umPQRLye3GDnpek90eHmFj0l1tySGkTJ+LzvJ:WXjq6WM4qOcqE
MD5 SHA1 SHA512 SSDEEP

Konterer.Uds

SHA256 26754641b4dc327f5c5aabb22bd898a3eca1cd65160d90e1570cd2b1a9de45bf
MD5 b2f85e85680c20cd60375118c67d705a
SHA1 a90a85f3cbee6d7a33ea92367d5aca5e326c4fd8
SHA512 b6302a4b34e604fdeaeb2cb7bff5012b8c19a42a5c77ee2abcb2c2a32bf8cfe289eb95bb783a02659077d8f3a68badf9023c0f74816d67ae6851d8d2127cba95
SSDEEP 1536:8fkzBUSsGUA6/JbyCd9jBLlls24ezfGztYbGcwrxZaI8e3ERCUe3v89mANQ:+kzD7
MD5 SHA1 SHA512 SSDEEP

Ramningerne/Oppendes.txt

SHA256 d58559201c000345f2a0f9710516913ff32882c185d642fa3f5a95f97abc7430
MD5 d492e9bd07501a21d3d665cbd5ba7430
SHA1 dd5b0439cbfffe62287b8f843edc5ff2da4db0a2
SHA512 19b0017a60b2aee9400f54bfd6b8de13a754efb6f39c873f24127008cf60de7d6de14ace7806aee39aa20cd266bf28aee4674c06e63c2aff165fd0667ade4868
MD5 SHA1 SHA512

Ramningerne/Repatrierer100.ini

SHA256 cd718f4abc9b4a72c27305808251c65c08b651e447ea0e1c782f73f958f5859f
MD5 2c9cbb65a6a37acae7414c9d74059f8e
SHA1 ee5de735dca278538502a538fa8ed9458cdbf168
SHA512 846c018366fbbb0edacde1d2a5f304bd38d191c9ae8d05afe0387951307f42b6968cd16171769788c564a4c0b064bdaad380e2456e4b8d39b9e8539017d2a914
MD5 SHA1 SHA512

Ramningerne/Scanted/tronstoles.txt

SHA256 af0c40a5470556e307f14e3354a7796ccca6df4673c6e5c995f8a4d685359fc1
MD5 84da1d70ed83602a7e8839f0cec0c5af
SHA1 eff911aff51daac2b8c6945bc58cc9a543247cd4
SHA512 a5c3eca5818d1c559526417ab8e9ef4bacf2df888081d84216444f2a9cfa791b9417aedd13811b7a496917022f08a215b8c704ce3bf3e5b5045b92ffad2ceb8c
MD5 SHA1 SHA512

Ramningerne/Scanted/vissedes.txt

SHA256 d493899d3c5e7c479e8b94e56215d9b4785de6e24f0c367f25ecd362e8595197
MD5 20f88315054d6428624476c68e35cc3a
SHA1 dc7cfea25886f74c281c0aafcfac46897e9a10a3
SHA512 df3c892d56e10cbd63537b65ab1c871f09e3cda89030415cf405736983deb2cd90b9f603a911c8f5cf5d5e63721f9d74687b952e8a2483290c3dfe68d73172e0
MD5 SHA1 SHA512

Ramningerne/Senarii108.ini

SHA256 8791299b0f15efe621471f61148637a947d5d3af45467a969f547137ce831048
MD5 53cec73afaf1de6fac4aa09e2e6cc030
SHA1 423893280afcfa0315f6024045e51a9a26bf29de
SHA512 2c2121686e64d270a84df0997d40048cbb534ef162ef56aabe3c9ffa1e9ce427569e0aa87dbc4d74a84711a9b515091423c1018f628588121749461899ac6913
MD5 SHA1 SHA512

Ramningerne/Silvae.lkk

SHA256 53994328eff9deac515d5ebc7e675974b2cb732e866d289934448836c8aebcaf
MD5 6139d538d103632b2ced271606e1b272
SHA1 cedc4ddcd65f63f8066e59fff3e164819b81fa2e
SHA512 7f4b6557343954430afbd358f2b78effe0e078ebb215adfea5b56080c2bc61940f9391dcd1bdc0a98479acb62032d1de5511f0aa9c958f4de557be52f69d63c4
SSDEEP 24576:t4nINs+waWHDSOK8d4qWxhB8KNK25fQnw/OMiZsQQx8/iDATXXAbeUhOfILG85ue:h
MD5 SHA1 SHA512 SSDEEP

Ramningerne/Topviewenes.txt

SHA256 74a0ad6fedb9397bd4a8d416cc8e21331ca76afa96fdb7366c58bfa288a2391c
MD5 345ec52376def72663b58d3f63f70e9c
SHA1 ac2ee6ec1b72019e9cd77d161efe5596f62d90eb
SHA512 36f5c3f82e811b6b62e1fe16ac01ecb1cdc0ad6d79fbae4f0a6eb1564a3c5da3eaaf42a61183c0a03b624354b88200f33a791d186283e01a1790476af1d48632
MD5 SHA1 SHA512

Ramningerne/Unmasks.hep

SHA256 ccf92eed58dff84d5adffb9c725a14679abc1107ad7ca4a78ff61a499a81cb31
MD5 786eb377e60ccd3c8e16698274043752
SHA1 39301bf08fba8e58dead5fabf834b3bae070a4aa
SHA512 7bc2755a2eaef4cfe1e4da75968643d4c81e98722b633f6bfaafe6bf550dc85131591333de2e04131c15295cb247e3548e4b8a949d27419c2c2048c991712fc2
SSDEEP 1536:t6o8+7FrltSj3TDzytR+YTWgTop72nIo02e0nePP4MY8OwdBPJbC049qbaRUygia:z+5gg
MD5 SHA1 SHA512 SSDEEP

Ramningerne/Unsedulous.txt

SHA256 fdab672ae0b35be83c91a7345b64484bec7d0e5574449c724ce4899266d1c23e
MD5 0bf4a316689e374b51a414bc450db171
SHA1 ed76456d8374f0423075e987bbce5bef69f366a6
SHA512 c82dc1211574b6f79f8c037ec1eb248698ad0c68306fe50efc7c8142dd63ae1f1da9e9da2070fd0e2c90bb3f7ab7b6d083ba80ac18f564f40e62ca5daa188a2e
MD5 SHA1 SHA512

Ramningerne/Winnock.ini

SHA256 60c2fb94be5a9a187dcc07477da1075a6ad05bc06b9797be4447ecd72c837f65
MD5 f25bb3fbbbbf31517cd448a0c98ad51a
SHA1 436a27d170cac7cc4ef130c519826c0b58b3c4eb
SHA512 3f39ee4f693a5ee73b5c6b10f625e7b733945ff5354e0bf935d7459f3b75e829b46c20c4bc22a80136f2a669c24b6ef4580f6586bfe353a110da3403bf2a009b
MD5 SHA1 SHA512

Ramningerne/acrisy.ini

SHA256 aaca7fc3149bba52c3416b4e5c17b4fd8f52e640c0ed26b6735d52155cb8962e
MD5 4c5425c4719bc05a56fbe1637cf6dda2
SHA1 08e6147ab3d6ebe19f145db280664f4209991c3c
SHA512 9e11fc93d4675cae5c0e2656b6bddfc49a2f2546cccc736a6538e50ec91277651f1a533058e98f209fb659f4b5191f52e8cdd1b08d58a81e744889fe1bf969ef
MD5 SHA1 SHA512

Ramningerne/anderkendte.jpg

SHA256 c676ac2fe21d0b9c9a9a679f55bd8643451a2da7bfd2d39b92b80e595cad8a9a
MD5 cc0183ffab9c0ee8159e9cc5c619fa16
SHA1 aacc56d8b2cebb1b4824ce77e8ec48e29c9a4728
SHA512 7b233674828df4af43edc4fd63507b4b8431d50ac59a284fcfe1ee3bea8677add09d1a51411784dd0b610bf247736e0af602b7286ed732652ce7d704708bd2cf
SSDEEP 768:qGzWWqGR7zk2aQwiDjwyeIwa6QLaPxmeObgAE8/s+JiEY0Uj9jbWDc1xvfkZQA:qGzZhypPiDj9eIIQLmvObg2E+Mt0UJj4
MD5 SHA1 SHA512 SSDEEP

Ramningerne/billedsyntesen.ini

SHA256 4ff5a523e26ea0786c7632213bac15d303a6f2ad3fa144f21d62fceb59cfd387
MD5 972f52be976ef4609794c3241e308d1f
SHA1 339cf3ef1a86b442069f8da4c07f4003598936af
SHA512 552a4cc9843962b8c0948863710f28e1da658344009fb946d25d3aa34d4eb9f7f325908d20ef3549b3f68f68993e13d9e4bbe8d8129ce6cc4842894947ab71ed
MD5 SHA1 SHA512

Ramningerne/bouche.txt

SHA256 e59d21ddc6e0983c43ba231c947f3eea22a9796966734c5ab60a1cec8b63c57a
MD5 0ac00902bebd6ed62c026aa34863673c
SHA1 bc08826e8253b41b4ceabfabf5a03631fdbc3c9a
SHA512 fda929b013658642ad42ad65eada26d0aef4855e945de2bacd2d28b972593dbebe4f7ad83ee58b5c9944ec6842d8f58b54e115350499cf981d220d28a29f7eb7
MD5 SHA1 SHA512

Ramningerne/kompendiematerialers.jpg

SHA256 79eb4128288a66c4057e1238c56ce587846b5960d25df955fe2668d999a9abee
MD5 682c132f5f1ad2a945bebca5dd9f0d3d
SHA1 57b3962dddc0cee543e074bd4468cd879bd8f86e
SHA512 d97c921b6d97f8a24dc51a7ee9e3e538627fc0ba335fe319d84eba339bf8dd2e45a66a78f870e44ff690b75f2f62b41260997b2a2d32e906edbabf1cb47531f4
SSDEEP 1536:nWnWL3x6l9t+g8Ya/CxAivk0hxQfRBIDdELAYvL3X3DHi:WnWL3x6B+gbaKxhNfQD4AXzHi
MD5 SHA1 SHA512 SSDEEP

Ramningerne/optagevogns.ini

SHA256 1dc5d31c9b5aefa660c1ac508dce9131dd2253f1e49c8568d2dc8a3d491db7f6
MD5 6b56d6042292c77551bde2b8cc0a178a
SHA1 11f8935aaefc75304c2b4f87e6b391ee9c920fae
SHA512 3a3a290f22d3ac78e66b9bda66a2509cd70e68c4bb278c3b2230662d59e437c8a4cea49cf563c51f57a05b73f3c821f92ba4eb5341c203d2b02b3d4f4bc112d9
MD5 SHA1 SHA512

Ramningerne/rygeannoncens.jpg

SHA256 590179fd63cfeaa709ad046768a67776d57ba0422b2b7ffa8f0358215b49c7ea
MD5 deb04b1a35a59bd3f424f994724894eb
SHA1 e1aa6e0906f3a33476c28c28551ec49587dc9a10
SHA512 55e6af80d56fa1095ce7ae111ddee25abcaea1717009ef208e6011ffb3db9ae6811076e21d91111adbf0d4f98b6d4a40a43944ac28c2b708240496c4d6f65474
MD5 SHA1 SHA512

Ramningerne/saftes.ini

SHA256 bbbdaf166bf71ad67f8b9e0ba72b85f1916d034e38e49545de8feab26d2b747e
MD5 c51e4d3f30fea18a62d48946420836d7
SHA1 45e3b9c585cef587e6658a1c6076a969469aa628
SHA512 858e7b5dbc577dde753c7b6e8d48bb1fce7d37ea70c2da12ac847cd9860611ea89d3e8dd9d3d0be64ab8796de05b3b3fd072782dc114a4deb6a43230b80675e8
MD5 SHA1 SHA512

Sharing

General

Malware Config

Signatures

File Explorer

3cc80c52c15d1a5da944d8bd2eedc33e602f94ff3e8a59679b0f2d19a2cb6925.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

Datofunktion.Hng

Duksedrengenes3.udu

Extemporizers.sap

Konterer.Uds

Ramningerne/Oppendes.txt

Ramningerne/Repatrierer100.ini

Ramningerne/Scanted/tronstoles.txt

Ramningerne/Scanted/vissedes.txt

Ramningerne/Senarii108.ini

Ramningerne/Silvae.lkk

Ramningerne/Topviewenes.txt

Ramningerne/Unmasks.hep

Ramningerne/Unsedulous.txt

Ramningerne/Winnock.ini

Ramningerne/acrisy.ini

Ramningerne/anderkendte.jpg

Ramningerne/billedsyntesen.ini

Ramningerne/bouche.txt

Ramningerne/kompendiematerialers.jpg

Ramningerne/optagevogns.ini

Ramningerne/rygeannoncens.jpg

Ramningerne/saftes.ini