Overview

overview

10

Static

static

3

img2026010...DF.exe

windows10-2004-x64

10

img2026010...DF.exe

windows11-21h2-x64

10

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows11-21h2-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target
    img20260107_10522882_PDF.exe
  • Size 712KB
  • Sample260112-j47bjsay4b
  • SHA256 fa191e9b3dacae45a036c5e3891cef5bea41bafbc3edf621747bc52a5cee8f63
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
installer

Malware Config

Signatures

  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

  • Untrusted Codesign Signers 1 IoCs

    Codesigned binary was signed by an untrusted entity.

  • NSIS installer 2 IoCs
    installer

File Explorer

  • img20260107_10522882_PDF.exe
    .exe 712KB
  • $PLUGINSDIR/System.dll
    .dll 11KB
  • Dykkermaskernes213.Cat
    267KB
  • Smuttenes/Anfre.Han
    61KB
  • Smuttenes/Bilindustrier27.spa
    771KB
  • Smuttenes/Ferskvandene177.dkk
    651KB
  • Smuttenes/Halvfemsaarigt/Nonsecret/Bibliofiludgavens/ulicon.nyt
    28KB
  • Smuttenes/Halvfemsaarigt/Nonsecret/Bibliofiludgavens/vagtparadens.ini
    519B
  • Smuttenes/Halvfemsaarigt/Nonsecret/Bibliofiludgavens/worryingly.fas
    275KB
  • Smuttenes/Halvfemsaarigt/Nonsecret/reversplr.jpg
    .jpg 35KB
  • Smuttenes/Halvfemsaarigt/Nonsecret/selvudfoldelserne.hol
    224KB
  • Smuttenes/Halvfemsaarigt/Nonsecret/slur.tum
    870KB
  • Smuttenes/Halvfemsaarigt/Nonsecret/terete.pon
    743KB
  • Smuttenes/Halvfemsaarigt/arsenic.txt
    456B
  • Smuttenes/Halvfemsaarigt/azines.ini
    334B
  • Smuttenes/Halvfemsaarigt/befrumple.ove
    610KB
  • Smuttenes/Halvfemsaarigt/bradepandens.sem
    73KB
  • Smuttenes/Halvfemsaarigt/deklasserer.sug
    583KB
  • Smuttenes/Halvfemsaarigt/fanatic.txt
    381B
  • Smuttenes/Halvfemsaarigt/forstudien.ven
    281KB
  • Smuttenes/Halvfemsaarigt/holdene.dag
    785KB
  • Smuttenes/Halvfemsaarigt/indkbere.enh
    72KB
  • Smuttenes/Halvfemsaarigt/insulinize.txt
    381B
  • Smuttenes/Halvfemsaarigt/isoagglutinogen.cha
    235KB
  • Smuttenes/Halvfemsaarigt/journalize.chr
    704KB
  • Smuttenes/Halvfemsaarigt/prefectly.omd
    198KB
  • Smuttenes/Hyperrealise16.uta
    471KB
  • Smuttenes/Item.arc
    348KB
  • Smuttenes/Letfordrveligt69.unq
    219KB
  • Smuttenes/Photosets.ten
    684KB
  • Smuttenes/Unaturlighederne215.col
    35KB
  • Smuttenes/Unfixedness.kan
    165KB
  • Smuttenes/aarsskrift.sam
    805KB
  • Smuttenes/alberttype.jpg
    .jpg 26KB
  • Smuttenes/anmas.ufo
    376KB
  • Smuttenes/anopisthograph.pan
    224KB

img20260107_10522882_PDF.exe

  • IMPHASH b78ecf47c0a3e24a6f4af114e2d1f5de
  • SHA256 fa191e9b3dacae45a036c5e3891cef5bea41bafbc3edf621747bc52a5cee8f63
  • MD5 SHA1 SHA512 SSDEEP TLSH
windows:4windowsx86arch:x86

  • Untrusted Codesign Signers

    Codesigned binary was signed by an untrusted entity.

  • NSIS installer

    installer

PE Signature issue

Digest
e4:cb:42:c1:89:b5:37:a3:65:c2:22:a6:7a:f2:b3:51:43:1b:bd:03:f4:87:ae:a3:d6:bb:63:d2:bb:ab:6d:fb:f1:7c:05:05:09:21:8e:22:68:92:39:7c:b8:4f:6a:1d
Digest Algorithm
sha384
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Drummy,OU=Finters Artens rugbyens\ ,O=Drummy,C=GB
Chains

Jan 8, 2026

PE Signature issue

Digest
f4:e8:24:6d:e6:e2:43:88:88:88:b2:3c:94:4d:45:09:20:ee:7c:1c:52:4d:78:a4:55:9b:a5:55:57:bc:a2:dc
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Drummy,OU=Finters Artens rugbyens\ ,O=Drummy,C=GB
Chains

Jan 8, 2026

Minor OS version
0
Major OS version
4
Entry point
12707
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE
PDB paths