d0e312a985c2ef7d0482ab9d588de2c19de50217113d477f87b6c11dc0fa6d82[.]exe

resource
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll

resource
d0e312a985c2ef7d0482ab9d588de2c19de50217113d477f87b6c11dc0fa6d82.exe

d0e312a985c2ef7d0482ab9d588de2c19de50217113d477f87b6c11dc0fa6d82.exe

IMPHASH c05041e01f84e1ccca9c4451f3b6a383
SHA256 d0e312a985c2ef7d0482ab9d588de2c19de50217113d477f87b6c11dc0fa6d82
MD5 36f426e8795e75bd29b7209418214b83
SHA1 7eeb6f846c97a788b01e829e050a4e2f6a0e1a97
SHA512 59bd410c3a89fe0ee978347c4e4a55fd9c4714383cdac80cf1abedd11154dd44119f3bb50bbe471e70d6b32453fe2bdd23b3607c241502e0bc87413d7c6ccbfc
SSDEEP 6144:rgORajLOfFhInrUqnmozjKLGfF06AqNps63WvsiU8gt3BzSIMKlqf:rg/LOMUQ7jKOAqN2Vbut3BGIMKcf
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned binary was signed by an untrusted entity.

PE Signature issue

Digest

30:4d:f2:2c:ef:fc:ef:21:cd:74:fc:f3:ca:ab:13:ec:e9:a5:90:fe:8b:d4:3a:0c:da:ac:a3:bd:4a:68:9f:8f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Cellstoffers,OU=krediterede Espino cyclosporales\ ,O=Cellstoffers,L=Cefn Hengoed,ST=Wales,C=GB

Chains

Oct 9, 2025

PE Signature issue

Digest

d0:56:e9:0f:3a:be:4b:40:e6:93:90:f9:22:8b:5b:91:72:74:cb:87

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Cellstoffers,OU=krediterede Espino cyclosporales\ ,O=Cellstoffers,L=Cefn Hengoed,ST=Wales,C=GB

Chains

Oct 9, 2025

Minor OS version

0

Major OS version

4

Entry point

13784

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCreateKeyExW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken SetFileSecurityW RegOpenKeyExW RegEnumValueW

shell32

SHGetSpecialFolderLocation SHFileOperationW SHBrowseForFolderW SHGetPathFromIDListW ShellExecuteExW SHGetFileInfoW

ole32

OleInitialize OleUninitialize CoCreateInstance IIDFromString CoTaskMemFree

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

GetClientRect EndPaint DrawTextW IsWindowEnabled DispatchMessageW wsprintfA CharNextA CharPrevW MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW GetSystemMetrics FillRect AppendMenuW TrackPopupMenu OpenClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetWindowLongW GetSysColor SetWindowPos PeekMessageW SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint EmptyClipboard CreatePopupMenu

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateFontIndirectW CreateBrushIndirect DeleteObject SetTextColor SelectObject

kernel32

GetExitCodeProcess WaitForSingleObject GetModuleHandleA GetProcAddress GetSystemDirectoryW lstrcatW Sleep lstrcpyA WriteFile GetTempFileNameW lstrcmpiA RemoveDirectoryW CreateProcessW CreateDirectoryW GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersion GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW ExitProcess CopyFileW GetCurrentProcess GetModuleFileNameW GetFileSize CreateFileW GetTickCount MulDiv SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW MoveFileExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 7a9ddee34562cd3703f1502b5c70e99cd5bba15de2b6845a3555033d7f6cb2a5
MD5 564bb0373067e1785cba7e4c24aab4bf
SHA1 7c9416a01d821b10b2eef97b80899d24014d6fc1
SHA512 22c61a323cb9293d7ec5c7e7e60674d0e2f7b29d55be25eb3c128ea2cd7440a1400cee17c43896b996278007c0d247f331a9b8964e3a40a0eb1404a9596c4472
SSDEEP 192:nenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XBDIwL:n8+Qlt70Fj/lQRY/9VjjfL
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10719

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsDialogs.dll

IMPHASH 6b5c4f7d679059f68f1269aad3a5cecd
SHA256 6bf9cccd8a600f4d442efe201e8c07b49605ba35f49a4b3ab22fa2641748e156
MD5 48f3e7860e1de2b4e63ec744a5e9582a
SHA1 420c64d802a637c75a53efc8f748e1aede3d6dc6
SHA512 28716ddea580eeb23d93d1ff6ea0cf79a725e13c8f8a17ec9dfacb1fe29c7981ad84c03aed05663adc52365d63d19ec2f366762d1c685e3a9d93037570c3c583
SSDEEP 96:oFsvUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YuNqkzfS:oFsvWyNO81b8pCHFcM0PuAgkOywIFc
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

7527

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Radiographs.ret

SHA256 e855607db7f98ae0ed64c05750becf90a900817fd77e89a8550e068ff522eee8
MD5 a6892daaf62f9e389e0914672d89e169
SHA1 86f49f7beb6eeb79c2703664a76bf414c9eb7df4
SHA512 e150d7d5678e373ced9fbd3057aa77bbaa4d6e8b79982165719c805b607f58f25e030588c935dca7fe3de8e81b22f501d820a02e2eb3468c4e85f4ea9e229558
SSDEEP 6144:QEqiEmrvcHViUp5goyxvGr/OYoO3zHu5S2Sj7IZ7X1F7xs92bnhC5PB1QOUA:QjDmrvcHcUp5+xvGr/OQ3zO5621xbcvj
MD5 SHA1 SHA512 SSDEEP

Toadlikeness.Pic

SHA256 87227d6c3b127a54876101c23621fe7b68630b14c862947bfab907046d813578
MD5 3b076223b94f6170a4a3f5e0ba301e3e
SHA1 b5bd5a47456940a58fab5c651e197df5e127f441
SHA512 62cc4f1faee32e99616fafd724f933de8db28c8d47fc61f10393972a6ac44bfeab6e1620152c4c8ec7b27ab2f84ba684c438798861585395c7457984b48ab689
SSDEEP 1536:Fy3Hy7gYrAkWiF2zTU66LuBy16uNLSwkYwSgReIfoL0lrYS:FOSMLRzXs31kY50dV
MD5 SHA1 SHA512 SSDEEP

comings.sit

SHA256 90c79acd45693c343c88b09069bb525ad0cdf925cae5a41477a5c3948b3cdf1f
MD5 3fe0200f2436888fd7870b9029b0bde8
SHA1 b502751390d74c512b87c4022c7776598502f2eb
SHA512 663ba3f5d37cb2ae847f649e4938d61656f307379c7ffcfb24fd3f5e8b1860c542ff13fcacca42de0cddd437ef3ed774a46caffbcc03b32804d3bdbd220c962a
SSDEEP 48:ehTipCrszIc5Il4u8bqZQEWQgtOj8eRKu3c9jvWL4/i:FvIgDhjPQgURKuMOc/i
MD5 SHA1 SHA512 SSDEEP

ensilation.sal

SHA256 abbe89887877e0623b16fed09fc9ef79579c1bcbaf89ed4d1d4c328280f324e1
MD5 aa48a94af9ec6004ace3770619373bef
SHA1 116ca04a35508fdebcdb4c9ab1b0f415eefc48bf
SHA512 a9c610360fa90ee1ee34c7e25427fda1ae0db64b039ebf530c1d067607182cbddb9d54785fd5f86a934304e31a35e7441b53b07ef62658ad7f9e49bb41395d8e
SSDEEP 12:uQA8q4iuIp8D2YY2WLdLwLYzNrGR8l28WoEvSSofZLCOmG8of:u9Zj9Hd0LQNNl2N1gdDcof
MD5 SHA1 SHA512 SSDEEP

d0e312a985c2ef7d0482ab9d588de2c19de50217113d477f87b6c11dc0fa6d82.exe

PE Signature issue

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

Radiographs.ret

Toadlikeness.Pic

comings.sit

ensilation.sal

Sharing

General

Malware Config

Signatures

File Explorer

d0e312a985c2ef7d0482ab9d588de2c19de50217113d477f87b6c11dc0fa6d82.exe

PE Signature issue

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

Radiographs.ret

Toadlikeness.Pic

comings.sit

ensilation.sal