1109118734xlsx[.]exe

resource
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll

resource
1109118734xlsx.exe

1109118734xlsx.exe

IMPHASH 9dda1a1d1f8a1d13ae0297b47046b26e
SHA256 d78beea33ff995cf0269602c7b95e498c1eec4b9be5e70c5b367a4435842db31
MD5 6aabda25e2138d1197fa327c1096ea93
SHA1 5c46a56f3b2aa3b383b431b223d2f847adcedddb
SHA512 130dd9b3b7698ca24a1efb5b5b2202c1d9566201ffe180c1d833e91a1f0b8435ffda193a8bcd80204a245b5aa8922c6d8b1aeaa03e6c5651776df8fccdc53b1e
SSDEEP 24576:Kadmu5MNkum/mthprduS9gTC5F4h0zM1ObgZuXiuG9uQ1/Wg2Uw95jcscEb67xsb:pNmyz+/tiTC5Fo0QIG9uk/2/Xjct3s
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned binary was signed by an untrusted entity.

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

PE Signature issue

Digest

11:7e:59:31:6e:68:32:d0:a3:97:31:61:79:2e:73:5b:15:9d:08:af:3b:ba:93:e4:a3:7c:2b:9d:3d:da:73:77

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Preexaminations,OU=Fiercely Fishtailing Uninvoluted\ ,O=Preexaminations,C=FR

Chains

Oct 9, 2025

Minor OS version

0

Major OS version

4

Entry point

13925

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegOpenKeyExW RegCreateKeyExW

shell32

SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW ShellExecuteExW

ole32

CoCreateInstance OleUninitialize OleInitialize IIDFromString CoTaskMemFree

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create

user32

MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW CreatePopupMenu AppendMenuW TrackPopupMenu OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW IsWindowEnabled SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CharPrevW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint CharNextA wsprintfA DispatchMessageW CreateWindowExW PeekMessageW GetSystemMetrics

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor

kernel32

RemoveDirectoryW lstrcmpiA GetTempFileNameW CreateProcessW CreateDirectoryW GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW WriteFile ExitProcess GetCurrentProcess GetModuleFileNameW GetFileSize CreateFileW GetTickCount Sleep SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW MulDiv lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject CopyFileW

$PLUGINSDIR/System.dll

IMPHASH 509a34b3a68a773e0afb4259e68f9f82
SHA256 23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6
MD5 192639861e3dc2dc5c08bb8f8c7260d5
SHA1 58d30e460609e22fa0098bc27d928b689ef9af78
SHA512 6e573d8b2ef6ed719e271fd0b2fd9cd451f61fc9a9459330108d6d7a65a0f64016303318cad787aa1d5334ba670d8f1c7c13074e1be550b4a316963ecc465cdc
SSDEEP 192:ljHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZqE0QPi:R/Qlt7wiij/lMRv/9V4bfr
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/modern-wizard.bmp

SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
MD5 SHA1 SHA512 SSDEEP

$PLUGINSDIR/nsDialogs.dll

IMPHASH 3b477381217c97b22146297f93df2a92
SHA256 89a82c4849c21dfe765052681e1fad02d2d7b13c8b5075880c52423dca72a912
MD5 b7d61f3f56abf7b7ff0d4e7da3ad783d
SHA1 15ab5219c0e77fd9652bc62ff390b8e6846c8e3e
SHA512 6467c0de680fadb8078bdaa0d560d2b228f5a22d4d8358a1c7d564c6ebceface5d377b870eaf8985fbee727001da569867554154d568e3b37f674096bbafafb8
SSDEEP 96:ooEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YMNqkzfFc:ooEvCu5e81785qHFcU0PuAw0uyyIFc
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

7527

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Skos/Exsiccating.bry

SHA256 e0beb7495c1b9dad2289639b4b0102b897b32ae7445f8713248f2a3d25bf1300
MD5 289591c7bded6c21db7bd37c9a8e73c5
SHA1 45bc908c9d24b66ec6cdd2f1ef40d0189d9d9761
SHA512 47340f1cffda973cca188c228c42eb4cd63cc6f08db146e0cc1fac63d82faf9b055b13d87b608616e31e2fb64b9a5fc97bfbee93906fc02cfff7d36f75cbd7e8
SSDEEP 1536:XFgItbDWyoOAv0s71UHceWkH2ovHyJ4RIy5SNvfAouoNmaPMYZm7kNx89M8Zcf8l:ce
MD5 SHA1 SHA512 SSDEEP

Skos/Nyetableringens.Qui

SHA256 55ed6c3f65e02aa647b06368a86acb3b498ebb2f9af9ea1b0fe00e1b9b7c1119
MD5 7a22be941120e16a8e5e011d5709f2ba
SHA1 8f57c9ae693b0811b671f285cfa9830ae0d37e02
SHA512 b107162abbc14a0c41905ab4ca2a6eabb0468250b7a5aa67e7fe866bc9a17b9ca2e0ea0811664b8f9d2a16cb4b6496bcd7813a7f38511cb513654118ee348af5
SSDEEP 768:iuZwXjmnt/3RdZuOq8Nw+sMJtORBnFFzvSEsv8tuzVhGFBAT3:ilX2t/9uqeRxFZRYcuZhG03
MD5 SHA1 SHA512 SSDEEP

Skos/Offentlighedsfaserne.txt

SHA256 acca862fbaa8a466d5f0ce227947ab4b4d81042255416f2bc88fa875aba76770
MD5 108ddaa4a2cfa1b7cf3821768c13a154
SHA1 531c2812a2cb7698072a65092f94dee12b658255
SHA512 c78e2dfe29df6fd13f9776f7ab1a6376dca184a1b98aa684ee55b35d846e20a86a7618d25274a4ea8f8223b4d66685ce7f0f488eec705761a18bc63018d2f830
MD5 SHA1 SHA512

Skos/Tipiers222.pre

SHA256 d32ad09e33d51974be96080a5d1978efefd433c0c96f7014e26d5580970d275a
MD5 d2ccc8345aba2f04b77651e38b0bbda3
SHA1 4f4258ae1f4bb69bbc08a828d6c7963f8804bd1c
SHA512 f5d967420ab9063c7f0ad297f40dd0b7f86b31ad7ca45a396e2791c34cfeda3bcce9b7bcf85eb03d6304e462c4045418e5ca297c346467c6a5a27059a2d57458
SSDEEP 6144:iBIxr8B+glnzRjqJftKFTgZwdLMILEeYo6P6ebvD1cA/kSmRcDDK1SEaHgfp92Vm:Y
MD5 SHA1 SHA512 SSDEEP

Skos/Xyrichthys.ini

SHA256 306c298a1891ae09c8e8e03bdd2a9c41b8806ebd0ab25c85b0e7130ef8cceb1b
MD5 120c2a83d55f2780b0a777c92d1ea6a9
SHA1 989406a0ceba799063e965e88ce5a98ffe0bb201
SHA512 ae26ae66ff9d32f936a154c2318effef78ae22dc36de78ad3481f0aa095e3591ca65472fe7f4cec9b0144f6b68c22eadb301e58559fba9478ef560b6706afe64
MD5 SHA1 SHA512

Skos/ajivas.txt

SHA256 9d1dd62b75ced942bec84bfd2c35bac3bd5f9c96526e2a93f49f63808e032104
MD5 e6f3a88679b6eb154a6a57ab3374c481
SHA1 b7243ea85e543bf3f7c840ffdc9d84c88d5d1ce0
SHA512 b6374d3d6d16b83480973d19d484b720eb62f6602906c6dc4115a09c21cef86e8f0737c841c1804a17d468571947ac1f3a1daa071c3cd0ff0e2dc4623550183b
MD5 SHA1 SHA512

Skos/forklende.ini

SHA256 0a9679e86832fcfbc92ea2b946da50acd0fa82d80da628d1eefb685450a40e7c
MD5 1f5b0e60cbc10637abbc523622898a46
SHA1 a85a585fda7c236ef57fed39781194fdc39882d3
SHA512 21454ae49e200d6c3f7a5a458ad3f40a6907c394398916d2cd941077976a2850fb8dab07108c46af964e6eb609ffd5ce858af0f8d8ddcdc4a8f14b4b80924d5b
MD5 SHA1 SHA512

Skos/omlssendes.pen

SHA256 0b7700298685311aeca504dfed9f0b4ea7f15dd71240c834f83067fef302e8f0
MD5 8c61e4f5dd0120276bef8de66b158757
SHA1 feb4129ce31f3e8c1c44cc36cf5dc41d22b00b87
SHA512 8a96cf0c9a2647274c536becd406438a06ea77b6d596ddb8c972a68484104fc085a43ed906e42477bca3f42bb6de6cf4cb4671a7024823800e2a285e8b33848c
SSDEEP 192:F9eRkAlO+4gDwSAw4clAvHDJZmu69PkNebQ3s:s
MD5 SHA1 SHA512 SSDEEP

Skos/tidsperiodes.rnn

SHA256 0d8c84c95c4af8437442d8c367c934ac5da8dec7bef277ebcfc1ee868b11f299
MD5 4b4455596fffdc4979608d2c1d9eac7c
SHA1 0469bce361b3bd81345cf922cca910c614866b8b
SHA512 40821d05f52efbbc4ec12ccf978e6b2f16af889d93d1a4c59085ef7ed9ef9739b67de92ae73a99c67f7caad23cb25a034d442bb751dafea836755e0a041ce9ac
SSDEEP 1536:p2AquJcHu+Pkhf1A+59xLp8yZQehOC2GP3TULRMFW2av/jLU7bZVf37WRH08V9cs:zaHZ
MD5 SHA1 SHA512 SSDEEP

simultantolkendes.Fes

SHA256 c303384fb0326d3c8bdbba143344522eaab6fe82b745ffe7ef814242793f017e
MD5 671def0257e6f9db980b9f0df13311b6
SHA1 194d8143c677b1d90f28d1810a2239ba8c4e69d7
SHA512 f537cfe1aeae2fce1dc4e7c0b05ccc693afd0f559da6c7634a5308b60fef12ec06fcee18f5f252085386ad1281c158c485e3f801a865bc4b26873b7be162f489
SSDEEP 12288:+SsMNOiXPeTlmjflkAfGaSnAoEYuMxigHfja5+G:+INOi2TojOGSnzwgU
MD5 SHA1 SHA512 SSDEEP

1109118734xlsx.exe

PE Signature issue

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/modern-wizard.bmp

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

Skos/Exsiccating.bry

Skos/Nyetableringens.Qui

Skos/Offentlighedsfaserne.txt

Skos/Tipiers222.pre

Skos/Xyrichthys.ini

Skos/ajivas.txt

Skos/forklende.ini

Skos/omlssendes.pen

Skos/tidsperiodes.rnn

simultantolkendes.Fes

Sharing

General

Malware Config

Signatures

File Explorer

1109118734xlsx.exe

PE Signature issue

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/modern-wizard.bmp

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

Skos/Exsiccating.bry

Skos/Nyetableringens.Qui

Skos/Offentlighedsfaserne.txt

Skos/Tipiers222.pre

Skos/Xyrichthys.ini

Skos/ajivas.txt

Skos/forklende.ini

Skos/omlssendes.pen

Skos/tidsperiodes.rnn

simultantolkendes.Fes