rDEC_SOA[.]exe | Triage™

resource
unpack001/$PLUGINSDIR/System.dll

resource
rDEC_SOA.exe

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

rDEC_SOA.exe

IMPHASH ea4e67a31ace1a72683a99b80cf37830
SHA256 9fe4d4fa0652fe7d37175a5e866dd0ec2f446c9b1d92ca6eb88dfdaf04984a99
MD5 06f5ce2724a8b7857d3b284ac8503438
SHA1 3d769e8d3aba579f5a08b6e85685abaae8569113
SHA512 c65514adc33dc1c06fbeb90d024d651f2d0601f116752df2be7d1ad0a3dd51ea0c6b45736e39f535fa16cd381ed6e898096ad15fc96d649183f4ea6ac133f0c0
SSDEEP 6144:fPX8uRui+eVkVStrMDC72//eJthO8roUpONv2oV7qqM5pu4bwF8UmQK3V8RoLfK:X8AkVQrxzwqJU4olkWF8w20afK
TLSH
T14484F1193A43D497D9091E74EA76C9F249727C26EC8C024F72F5FF2EB9B92610E0E149
MD5 SHA1 SHA512 SSDEEP TLSH

Untrusted Codesign Signers

Codesigned binary was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

11:a4:f8:9e:8d:a3:44:f8:c1:2b:17:c4:04:44:93:64:f4:95:b8:f7:7c:17:fe:e1:cf:21:29:20:9a:bf:87:e3:cd:44:5d:0c:42:27:e8:74:e6:29:46:bd:ee:05:f7:13

Digest Algorithm

sha384

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Udpining,OU=Sejlsportens Amtsplejehjem\ ,O=Udpining,C=GB,1.2.840.113549.1.9.1=#0c1c44616e69656c73656e4052756d666172747363656e747265742e5479

Chains

Jan 18, 2026

Minor OS version

0

Major OS version

4

Entry point

13409

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCreateKeyExA RegEnumKeyA RegQueryValueExA RegSetValueExA RegCloseKey RegDeleteValueA RegDeleteKeyA AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken SetFileSecurityA RegOpenKeyExA RegEnumValueA

shell32

SHGetFileInfoA SHFileOperationA SHGetPathFromIDListA ShellExecuteExA SHGetSpecialFolderLocation SHBrowseForFolderA

ole32

IIDFromString OleInitialize OleUninitialize CoCreateInstance CoTaskMemFree

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

SetClipboardData CharPrevA CallWindowProcA PeekMessageA DispatchMessageA MessageBoxIndirectA GetDlgItemTextA SetDlgItemTextA GetSystemMetrics CreatePopupMenu AppendMenuA TrackPopupMenu FillRect EmptyClipboard LoadCursorA GetMessagePos CheckDlgButton GetSysColor SetCursor GetWindowLongA SetClassLongA SetWindowPos IsWindowEnabled GetWindowRect GetSystemMenu EnableMenuItem RegisterClassA ScreenToClient EndDialog GetClassInfoA SystemParametersInfoA CreateWindowExA ExitWindowsEx DialogBoxParamA CharNextA SetTimer DestroyWindow CreateDialogParamA SetForegroundWindow SetWindowTextA PostQuitMessage SendMessageTimeoutA ShowWindow wsprintfA GetDlgItem FindWindowExA IsWindow GetDC SetWindowLongA LoadImageA InvalidateRect ReleaseDC EnableWindow BeginPaint SendMessageA DefWindowProcA DrawTextA GetClientRect EndPaint IsWindowVisible CloseClipboard OpenClipboard

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateFontIndirectA CreateBrushIndirect DeleteObject SetTextColor SelectObject

kernel32

GetExitCodeProcess WaitForSingleObject GetProcAddress GetSystemDirectoryA WideCharToMultiByte MoveFileExA GetTempFileNameA RemoveDirectoryA WriteFile CreateDirectoryA GetLastError CreateProcessA GlobalLock GlobalUnlock CreateThread lstrcpynA SetErrorMode GetDiskFreeSpaceA lstrlenA GetCommandLineA GetVersion GetWindowsDirectoryA SetEnvironmentVariableA GetTempPathA CopyFileA GetCurrentProcess ExitProcess GetModuleFileNameA GetFileSize ReadFile GetTickCount Sleep CreateFileA GetFileAttributesA SetCurrentDirectoryA SetFileAttributesA GetFullPathNameA GetShortPathNameA MoveFileA CompareFileTime SetFileTime SearchPathA lstrcmpiA lstrcmpA CloseHandle GlobalFree GlobalAlloc ExpandEnvironmentStringsA LoadLibraryExA FreeLibrary lstrcpyA lstrcatA FindClose MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA SetFilePointer GetModuleHandleA FindNextFileA FindFirstFileA DeleteFileA MulDiv

$PLUGINSDIR/System.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 6fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e
MD5 fccff8cb7a1067e23fd2e2b63971a8e1
SHA1 30e2a9e137c1223a78a0f7b0bf96a1c361976d91
SHA512 f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c
SSDEEP 192:xPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4v:g7VpNo8gmOyRsVc4
TLSH
T116326D5503504AF3E996863C00263B7FAF796A2095F14D53CFA394C0FE2E5C9AD38352
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10529

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Farvemestrene59.ban

SHA256 9ab6f2eb1bcefc8a42fc0a95a498faa217c1d5dfd4d31c5ea427d3d8d40bd91d
MD5 6a0c8d3f88183838e54f650ecd282bb4
SHA1 199603547ec9c6763927440b05855cd2a822d5f7
SHA512 e9d9115138dc84c01deb06c74db33b103525a3f55885b2851fb4ff46603c394fc6ee1956f56b2592575ec4b04713c6ad4c50d8c5b87810941c4a22472de72907
SSDEEP 12:uCYXAfufwwfIYIA5ubcpAaNQi4gQ60sQ0exHRfhq:VTswwgDoMwYxx0
TLSH
T19D02D43DF17064E8009DA53D68C4AA2D13C00E9BFC5921C61D9374D5D06515D1712D6F
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Nudities.Smr

SHA256 0e5a369408807f4cba1ba447ea65209254142fab58721ed8d0f7226b9bceb268
MD5 1c1b3ee22c3d2a80fc2b838297fd9b51
SHA1 014b7f4fff4a88824af9b7693be68b75b1ad6864
SHA512 647f4f6f9c5c8d6b4077d12415c00af45ff6ea6efcb069a79ca3436e109f5ebaf4c126a65ae109aa74d57c2c8b6c45972a81d177b00faadce3d653ae56356457
SSDEEP 6144:eF0ABeO5mvIXbmtolq+dn0zIUKBPIm2oOqWAIR/85m+A7Gb:eF0Aqvt7a0z0BqJ18g+B
TLSH
T12054023B637C4A66CF291E7D08753C1C5ECA8A9F604C06651BD39CC5E987AC838A53F6
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Preacness/Laminar/elektrolytiske.ude

SHA256 f6c719dfa946a7057895fd27e3d0a8450b82f40b75d6917fc177449c93e53b2a
MD5 59c414f66d33aeb151c6503fca8d62f1
SHA1 710e0ccb8be8e51e8c90be02089810c108cd3de5
SHA512 b9a9d920f034a9be40dc7bf2d3c8128b4879e37cea66772bb2f0cd77ef4a2f3a6de2de54f07683740a40a0597e49436a68fdd34dacc50e044a8e3e0b84ae3a49
TLSH
T14B712B2A7821CEA4E07AF4A4704A54D9A8235278CC42E61C5C0C4E3743DFDE5504023E
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

Preacness/Laminar/gifteknive.rag

SHA256 4f1580b72d4a2449e5434a331f2347d17882b45bab5dfb7167d0bb6791242852
MD5 00923384782bdd8e018564fb94a028fb
SHA1 daa29f13c410626835ef589fb6924346ff6fba36
SHA512 496d989ab8aaa23ea0856d4d0961a8a8db3e0d53cb1b63adaf806727eab8e4346b94beddc9e6c4c6e864b89f079d4ac69889b057f7f9a5640153df4ec1ff368c
TLSH
T1B86195FCA773C75741DF4CD41B45A09874D1400A5974214D15AE8D084743C982C714FD
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

Preacness/Laminar/glatfret.bat

SHA256 beef71952ddbaab878ed1c5db37c380a2bd8c65f48ce161cb7edef635ebd1e9f
MD5 4fa2e35e82e0e5c0c27cd80d1801096c
SHA1 2d30055a0e6a9e5eabd1b7697bfcd80b6133df5e
SHA512 5b37e9f5cd5df3ed9658021fe6bba6fe2daac24fa213e2068ffea6f8cad29d7033d9e76810b91fdba524b60cb173ce9e88c8624c5d52027add41514a9d0e4e47
SSDEEP 6:BIiMS24bgv6Wvio8gOuBe4c+DGmdVxpSxsHCsu1SyRHxpae8wCoNmOWKvQTj6uJ:WL4KPibgOuBLcKHVx6E+pahZoNmpD+uJ
TLSH
T1FC02208EE81EEFA9B4C5C8EE184D31204FB2714516A18A226854E0B0714E8679B82199
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Preacness/Laminar/hovedstillingens.ads

SHA256 044f3bd631de4ddd3aa6bcc8023d55346a82ecace67d79b82f5fae83f1dc2fba
MD5 9b0d061b46a021660da02c86878d2bb5
SHA1 033d2b738f41f27106e481b49faba54ca765c96a
SHA512 553519fbc1bff202344fe72d2ac0c3e4662b2dd2a7d665315440504c198b9afd877e58b7fec7a4e18d60ad202424d86bfc567785d562ddbd3a8e1d61bcf87c72
SSDEEP 24:fUvls3iCndORc4//nXHe9UkgsZIxE+LdBiz:fUvQiCndOfHXH6Uk4CWQ
TLSH
T10D0254DBCFB1592B0781F8058904893F22340EF145948C102379012DE2DBCC8C674E38
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Preacness/Laminar/positionsangivelserne.bag

SHA256 cbfd0aeca5b740820d931dfca9ae6dd2e9f09a4f371d5522a3ce89cbe09a1f38
MD5 9976f1470729dbe7b1b429f80f0fc462
SHA1 322dff0ae441b9f959eb756ec74401d1366f30cc
SHA512 594efdf3e51c7708c5dd3a7f39d2adeae491e30cecbd2b47024fb306bea89d5f00bc885d90366ceace4b847e2c7b419511dff69df2bfbf65c81166a205a3c6b3
SSDEEP 12:cXmawyXmcIQctetStCqO6tmWXa04XkCQyutB8wKXKtUKXmm2tkaXQ2X+twX:cVZ0eoCq97aT8tL8wKeUK2TppOa
TLSH
T119B12B57DCE58017DB12953C05F5835CAA69019F6190E95588A6261946C7786E80F298
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Preacness/Rillock.cla

SHA256 9dbc13a94a3202fda471f9e1e92bd8b49f36dd7d7fabb01fcaa34016aa8a3d21
MD5 ef932ff0fccb9ae22f0af4757f9b2d7e
SHA1 abe47c131324a7efad60a0cfaa33a94ee2ce0eff
SHA512 85a70ef578132b45fc52e7131b2faae8f45920195897609f911fa3631c37223219074a1fa42074e88b29384f00cd3ad2fb1dc9419fc9789ef9c55b5af2b97171
SSDEEP 12:4aQkrV1IEyvKTx6rKY8rsXYsEJ9sQB1DNN:LQkrrIHhuY8Ag9sQX7
TLSH
T1C9B1C04A52152C1135180666F50D570F2834D64D40848E316321D17D726AD120ECE750
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Preacness/Thereof.sco

SHA256 58d7c43dae0108ea1c6a28d8b7c2f479b9d46ea3d15a8c5cae193ded186dfbd2
MD5 c077dbf09dcd20d903ba2195b9afc5a6
SHA1 d74b6a41ac488347d12af534282cfd614e7d47cb
SHA512 fe6c7b7931792e857fa72a55f57b5ffd6cf3b8e19fa0c5b6288a31224154d27eb834a1ee9813e1d5ab8e4cf0b0f067731a93acaf87f0bfb4493951c5e89e45b2
SSDEEP 384:R+QmOrAnauCvc16dhG3Pmn/Vw2Rt8z0y00QiVpISSqIGyZD50lXotdw3:R+QmQAjQh1n/Vwc1ypnILA1Yk
TLSH
T1F3A29E12CB1E8CBDD502C73CC9AF35A64D492006AE8EDC4EE1799915C1E36E277A1B78
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Preacness/bridgeport.wit

SHA256 c6f3efd11899f0476283658880401a89f78dc500ba49427d2ea27f78998d2b08
MD5 1d7db00aeb8b207e397c45bb67efe3b2
SHA1 3e7411d1f8dbc92ed1a11a88deef16a97b44e0f2
SHA512 e00986024b1b6243834c273f32648ca20cfb78a7c357b0848697775115713d8c8efcebe6c80e288a334615f045b96d02ca3351260f9b9edbfdf54312934dd05d
TLSH
T1715122A0C4623230AC861F160024A0800A00E8900AF855483F0085D01C54F99AFE2B13
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

rDEC_SOA.exe

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Farvemestrene59.ban

Nudities.Smr

Preacness/Laminar/elektrolytiske.ude

Preacness/Laminar/gifteknive.rag

Preacness/Laminar/glatfret.bat

Preacness/Laminar/hovedstillingens.ads

Preacness/Laminar/positionsangivelserne.bag

Preacness/Rillock.cla

Preacness/Thereof.sco

Preacness/bridgeport.wit

Sharing

General

Malware Config

Signatures

File Explorer

rDEC_SOA.exe

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Farvemestrene59.ban

Nudities.Smr

Preacness/Laminar/elektrolytiske.ude

Preacness/Laminar/gifteknive.rag

Preacness/Laminar/glatfret.bat

Preacness/Laminar/hovedstillingens.ads

Preacness/Laminar/positionsangivelserne.bag

Preacness/Rillock.cla

Preacness/Thereof.sco

Preacness/bridgeport.wit