AWB No_9G8858, AWB No_9B009177, HAWB No_ 9G88559[.]exe

resource
unpack001/$PLUGINSDIR/System.dll

resource
AWB No_9G8858, AWB No_9B009177, HAWB No_ 9G88559.exe

AWB No_9G8858, AWB No_9B009177, HAWB No_ 9G88559.exe

IMPHASH b34f154ec913d2d2c435cbd644e91687
SHA256 b20a621d134dc2725fc2390d02310b63b0fdbdca1000a1f45233257ff3f0709c
MD5 5cb96f0c017f854237211bda81de0709
SHA1 eb7ca1b54ae544033bbd909bfcc4d886a7678adc
SHA512 0f1ce778f6832fca39e61c6414b6905d757967cb15a2260bb48bc98d86d5d3a4f2dd6bd71d30048b16ffd62b77d906431a36c08c115c7838fa7659e818d74293
SSDEEP 6144:KQ606x/yo7PJkPt8JfZeP53E1e4t4wG3QN2bmxwPC5fLsewO:wrJkPt8JfZsSe4RkD2wPyfx
TLSH
T1A944CF613BD4D806DAB6C572D2B3FD39E673DD290A324A02A7F57F6C3836650581B30A
MD5 SHA1 SHA512 SSDEEP TLSH

Untrusted Codesign Signers

Codesigned binary was signed by an untrusted entity.

PE Signature issue

Digest

de:0e:e6:d5:42:49:7d:0d:17:97:6a:25:b7:c4:06:c0:1d:bb:23:51:a4:b8:84:9a:32:ca:fc:66:79:7f:a6:a6:0b:84:37:eb:30:33:78:1e:a8:f6:9d:5a:40:3f:7c:87:bb:e3:19:9d:9d:eb:50:08:28:49:2f:fd:f1:f4:f5:78

Digest Algorithm

sha512

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Macromere,OU=Differere Charmingest Eveline\ ,O=Macromere,C=FR,1.2.840.113549.1.9.1=#0c1b506f6c796d796f7369746973405a6f6f7468656369616c2e4c7973

Chains

Feb 16, 2026

Minor OS version

0

Major OS version

4

Entry point

13171

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetEnvironmentVariableW SetFileAttributesW Sleep GetTickCount GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW SetCurrentDirectoryW GetFileAttributesW GetWindowsDirectoryW GetTempPathW GetCommandLineW GetVersion SetErrorMode lstrlenW lstrcpynW GetDiskFreeSpaceW ExitProcess GetShortPathNameW CreateThread GetLastError CreateDirectoryW CreateProcessW RemoveDirectoryW lstrcmpiA CreateFileW GetTempFileNameW WriteFile lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject lstrcmpiW MoveFileW GetFullPathNameW SetFileTime SearchPathW CompareFileTime lstrcmpW CloseHandle ExpandEnvironmentStringsW GlobalFree GlobalLock GlobalUnlock GlobalAlloc FindFirstFileW FindNextFileW DeleteFileW SetFilePointer ReadFile FindClose lstrlenA MulDiv MultiByteToWideChar WideCharToMultiByte GetPrivateProfileStringW WritePrivateProfileStringW FreeLibrary LoadLibraryExW GetModuleHandleW

user32

GetSystemMenu SetClassLongW EnableMenuItem IsWindowEnabled SetWindowPos GetSysColor GetWindowLongW SetCursor LoadCursorW CheckDlgButton GetMessagePos LoadBitmapW CallWindowProcW IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard ScreenToClient GetWindowRect GetDlgItem GetSystemMetrics SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharPrevW CharNextA wsprintfA DispatchMessageW PeekMessageW ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow GetDC SetTimer SetWindowTextW LoadImageW SetForegroundWindow ShowWindow IsWindow SetWindowLongW FindWindowExW TrackPopupMenu AppendMenuW CreatePopupMenu EndPaint CreateDialogParamW SendMessageTimeoutW wsprintfW PostQuitMessage

gdi32

SelectObject SetBkMode CreateFontIndirectW SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation ShellExecuteExW SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW

advapi32

AdjustTokenPrivileges RegCreateKeyExW RegOpenKeyExW SetFileSecurityW OpenProcessToken LookupPrivilegeValueW RegEnumValueW RegDeleteKeyW RegDeleteValueW RegCloseKey RegSetValueExW RegQueryValueExW RegEnumKeyW

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 c2f405d7402f815d0c3fadd9a50f0bbbb1bab9aa38fe347823478a2587299448
MD5 9625d5b1754bc4ff29281d415d27a0fd
SHA1 80e85afc5cccd4c0a3775edbb90595a1a59f5ce0
SHA512 dce52b640897c2e8dbfd0a1472d5377fa91fb9cf1aeff62604d014bccbe5b56af1378f173132abeb0edd18c225b9f8f5e3d3e72434aed946661e036c779f165b
SSDEEP 192:eX24sihno00Wfl97nH6BenXwWobpWBTtvShJ5omi7dJWjOlqSlS:D8QIl972eXqlWBFSt273YOlqz
TLSH
T1BD325D06235081F3E1914138846B3E175F6A15069BF58E97DFD38646BE30BE7BD79503
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10178

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Formynderiske.lab

SHA256 b49de118400205b63bf8a9736651d4b23e19a77456e1959412d42b9770f8f5ff
MD5 d10255ffa1cedc73c9d341afb443e807
SHA1 9b418dd8453f3b8171b59d16aeab5fa2e4d374d1
SHA512 d66a762213a0dfe3f7fff9cfa8a5bfdf5de98610fe4435f79cd6a9edb02d5301cf94e674b08276f2242320816d22d5ffd93575b8c1c11141598371fd6e35d581
SSDEEP 96:K0hldAK4tNJi/EujlFTe6cUaoc8BaNNMzBa6oq/D90Hm:VhDAK4tNuco5MgzY6oqhH
TLSH
T17723B75B852CCCCF0E2D7FC83C1154BBAF808A104EA85B07FB0612FD0101B9615798E6
MD5 SHA1 SHA512 SSDEEP TLSH

Slusekamrets.Emp

SHA256 9283cb522bf757f53f463138e9b82acae559ebab71e816928cf2e38d4d77e414
MD5 b73fdf95e5578fd487b19ced8f2600b5
SHA1 9e035496f669329d981b9bf133fa2e4c9c4756e0
SHA512 3a459a18c2d6e3b42482691f156d43560db00ef4ced4d1f99fc17d6b137df8d3da72f8d0c9398560923497b3115de38c82d546d661b42115d9b76aeb8e9201a9
SSDEEP 384:++n75r3wFrQJCpJbca6lYD3gEKQ+Wu4/hNs32OnmDxkoVImabOrYysw1J3ce+N0o:ZlLwFUKJbL6yjKYs32gOx1ImmwzbSDJ
TLSH
T1DDE29F01D767CCFBCC168738C4EB689A5C58A0224B1FE4BFA036A815C09B6D363755BE
MD5 SHA1 SHA512 SSDEEP TLSH

calliopsis.Fin

SHA256 1e45c1f41dd8fc005b239e76bf038f0b338d73ce7130b0083fb5ea18881cb5d8
MD5 62ee1b4f83a4a6790c4220af89e56326
SHA1 ca13b2438d4e6984ef20c199fb9a20c6c1199386
SHA512 99b85416b9fb734ac447521e01f454e1c04843bd6129b660bb8290d9678d28a24e217d2477d3543b23d939f5f5acfcf0c34dac2c2d4281b8997215202c82d340
SSDEEP 3072:OyX/nTpCRUXugI9B3Bokp01JK6jwAMHnTUZcjoV58:OO/TsU+gIy6d0ZM
TLSH
T1CCD3C0C1297D08B6C69DA27380E1DCBA3A793E56CB3A817C1021F4F7B071B90756657E
MD5 SHA1 SHA512 SSDEEP TLSH

decalcifies.asy

SHA256 fc71a81cf58e8b7e06ce38be67f97626a9fad9dfb31053a202cd6da02da96354
MD5 43a9f903244e51dd33184cf86dda3ade
SHA1 6f190c2dffc7d794a6d2227a4aea4cbbcbb3bf96
SHA512 c2c85f4a58c942bd90825c0f5350142ef1281db002bf10679dfb6cbdaafcf9633140a49ec03a609c4fcc97493d8b28c1670d56a579559b552f86d1179d18d62f
SSDEEP 96:zQfgansRZdN6ySFdjSkgwjh9wzI+zOAHUAW8L/nNmUM:k6F8RFdjSkgwjzwk+zBHUAWQmUM
TLSH
T12C733C92E31501C6CC716D7E726DA44CB8D3AAFED0CB9D90285F5DC8391247CD1045A0
MD5 SHA1 SHA512 SSDEEP TLSH

ocreae.som

SHA256 ce058037ad34ef9c6cf77649ea556773f0e592044d7eeb81ec2d3acc0262f693
MD5 122c47e60b19083fb32bbd821a50dec6
SHA1 fa1a1c3b82f96669128b4e5756e4eea5141b8c25
SHA512 7df3271d7427511816b933387bf099ee9e3815f95b00a88ff5f004fb5f4bf3f8ee43edf75167f087987b217c3ea206bd3499642cecc8ce6f6c6b96f7ffa3bd64
SSDEEP 12:E+JA0HqsTJ081MewfKmg3UJvqH3JweI4L4sowJq+6LSz0H:hAsVJ08Mewu3YvSyeI4HoEq+wcM
TLSH
T1CC7247649DD01D0D80E436DDF4D6D52467C326245C3B55261606D7FF3E396427D6060F
MD5 SHA1 SHA512 SSDEEP TLSH

udringninger.kla

SHA256 ea6f354fe88a0e2433e1600c891f0e0dbde951e1ea23e9e2015cbe41be1e2b60
MD5 5f6c68ba6703fc6664c0853f4b91927c
SHA1 f2bd98ba5b3ccbc691065df6ddb5e3d54f601eaa
SHA512 739616588010b473581a4f9bd13f1497e87b196663e2db27673b89c79e89ac05311420e751026eedea43e5bd3ea6c81cba7a1f93047924acd1044f1f5b807e98
SSDEEP 24:J1+PTq9RKMv58Z+62rpexCCaSXjg6DFxIQc5faXUStnyOlJh:JQiB8Z7/xCCfjg6ESXUSt5f
TLSH
T1EBA2622D0F5BD1582C36819045D875EC25318BF80E212644A25970C48F09741D1088B2
MD5 SHA1 SHA512 SSDEEP TLSH

AWB No_9G8858, AWB No_9B009177, HAWB No_ 9G88559.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Formynderiske.lab

Slusekamrets.Emp

calliopsis.Fin

decalcifies.asy

ocreae.som

udringninger.kla

Sharing

General

Malware Config

Signatures

File Explorer

AWB No_9G8858, AWB No_9B009177, HAWB No_ 9G88559.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Formynderiske.lab

Slusekamrets.Emp

calliopsis.Fin

decalcifies.asy

ocreae.som

udringninger.kla