c8e7a02f038692b718562729a122e39e64cad6f27d0396bbf157cfbcc90ba7d7[.]exe

resource
unpack001/$PLUGINSDIR/System.dll

resource
c8e7a02f038692b718562729a122e39e64cad6f27d0396bbf157cfbcc90ba7d7.exe

c8e7a02f038692b718562729a122e39e64cad6f27d0396bbf157cfbcc90ba7d7.exe

IMPHASH 24f4223e271413c25abad52fd456a9bc
SHA256 c8e7a02f038692b718562729a122e39e64cad6f27d0396bbf157cfbcc90ba7d7
MD5 5334c648166d1514acb15a411d8439e3
SHA1 80ad97dfb8364243d33e964f54bcd77ce867f4a2
SHA512 ec852aeaf887934db263c86d29fec9fae3f07cbbd8ffd98a339b0ddd48e1a38badac8732128860737a8701f48da3b6007433cabaae946b33f0c49e09f0295be8
SSDEEP 12288:HDd6lbK2Hmxe+WQ4nWjvGRto/6Td9ObzQqdT75+6upqgwSkIHrbSZ9Kv03:HDmmsm3WQGQsto/ed9Obkuf5VuMRIHP2
TLSH
T17EE4230F9A30C54FCD209A3EA8BB5F723BDE5E479575231B37027A9DB166102F918361
MD5 SHA1 SHA512 SSDEEP TLSH

Untrusted Codesign Signers

Codesigned binary was signed by an untrusted entity.

PE Signature issue

Digest

0b:f4:bd:3f:91:90:97:bb:5e:0d:6e:a8:e9:86:6b:36:4c:52:8e:9d:b4:b5:21:2d:13:8e:d2:8e:dd:19:76:ff:53:3b:66:27:05:5a:d9:33:18:1a:97:44:2d:1b:61:3e

Digest Algorithm

sha384

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Aplacophora,OU=Monotropaceous Grusspredning\ ,O=Aplacophora,C=FR,1.2.840.113549.1.9.1=#0c264f70746167656c736573666f7268616e646c696e67657240556e617363656e6465642e53746f

Chains

Mar 2, 2026

PE Signature issue

Digest

9a:8b:0f:52:60:66:28:75:de:7a:98:3a:fe:1a:16:d0:61:ed:09:7e:45:3e:6a:49:89:14:57:2f:7d:d2:4f:8c

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Aplacophora,OU=Monotropaceous Grusspredning\ ,O=Aplacophora,C=FR,1.2.840.113549.1.9.1=#0c264f70746167656c736573666f7268616e646c696e67657240556e617363656e6465642e53746f

Chains

Mar 2, 2026

Minor OS version

0

Major OS version

4

Entry point

13581

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

ExitProcess SetFileAttributesW Sleep GetTickCount CreateFileW GetFileSize GetModuleFileNameW GetCurrentProcess SetCurrentDirectoryW GetFileAttributesW SetEnvironmentVariableW GetWindowsDirectoryW GetTempPathW GetCommandLineW GetVersion SetErrorMode lstrlenW lstrcpynW CopyFileW MoveFileW GlobalLock CreateThread GetLastError CreateDirectoryW CreateProcessW RemoveDirectoryW lstrcmpiA GetTempFileNameW WriteFile lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject lstrcmpiW lstrcmpW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle ExpandEnvironmentStringsW GlobalFree GlobalUnlock GetDiskFreeSpaceW GlobalAlloc DeleteFileW FindFirstFileW FindNextFileW FindClose SetFilePointer ReadFile MulDiv lstrlenA WideCharToMultiByte MultiByteToWideChar WritePrivateProfileStringW FreeLibrary GetPrivateProfileStringW GetModuleHandleW LoadLibraryExW

user32

GetWindowRect GetSystemMenu SetClassLongW IsWindowEnabled SetWindowPos GetSysColor GetWindowLongW SetCursor LoadCursorW CheckDlgButton GetMessagePos CallWindowProcW IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard TrackPopupMenu ScreenToClient EnableMenuItem GetDlgItem SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharPrevW CharNextA wsprintfA DispatchMessageW PeekMessageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect SystemParametersInfoW EndDialog RegisterClassW DialogBoxParamW CreateWindowExW GetClassInfoW DestroyWindow CharNextW ExitWindowsEx SetWindowTextW LoadImageW SetTimer ShowWindow PostQuitMessage wsprintfW SetWindowLongW FindWindowExW IsWindow CreatePopupMenu AppendMenuW GetSystemMetrics DrawTextW EndPaint CreateDialogParamW SendMessageTimeoutW SetForegroundWindow

gdi32

SelectObject SetTextColor SetBkMode CreateFontIndirectW CreateBrushIndirect DeleteObject GetDeviceCaps SetBkColor

shell32

ShellExecuteExW SHGetPathFromIDListW SHGetSpecialFolderLocation SHGetFileInfoW SHFileOperationW SHBrowseForFolderW

advapi32

AdjustTokenPrivileges RegCreateKeyExW RegOpenKeyExW SetFileSecurityW OpenProcessToken LookupPrivilegeValueW RegEnumValueW RegDeleteKeyW RegDeleteValueW RegCloseKey RegSetValueExW RegQueryValueExW RegEnumKeyW

comctl32

ImageList_Create ImageList_AddMasked ord17 ImageList_Destroy

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 6950991102462d84fdc0e3b0ae30c95af8c192f77ce3d78e8d54e6b22f7c09ba
MD5 8cf2ac271d7679b1d68eefc1ae0c5618
SHA1 7cc1caaa747ee16dc894a600a4256f64fa65a9b8
SHA512 ce828fb9ecd7655cc4c974f78f209d3326ba71ced60171a45a437fc3fff3bd0d69a0997adaca29265c7b5419bdea2b17f8cc8ceae1b8ce6b22b7ed9120bb5ad3
SSDEEP 192:BenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XB9IwL:B8+Qlt70Fj/lQRY/9VjjlL
TLSH
T121427D1193B089F2F590593805A67F2A6FBEAC6C27E44963CFE345853D702DFA47A243
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10719

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Danicas.ini

SHA256 1ac957af827d2f0f408487cde74af656dfa12dc406287d6e963e86fef11b82b3
MD5 43660b648fe08a2698399f1f3763a9c2
SHA1 f2b964890fb69a07695daa79ef36d68d8eb0cb18
SHA512 dd564804c279e0ef5b76fe3b0b57eea5b516d903de26f011424ad34b2a3b5c877e2955a64b1c3d8e5ba540970107b35ef6f25d2a2c504592f29c5ce79553fd8b
TLSH
T184D0222CD923025363C9B31A9C60DC884F288081EA42CA82B096A30C848822C880F77D
MD5 SHA1 SHA512 TLSH

Paintrix/Averterede151.ini

SHA256 a31b3c11e4e692ab3edd6f5b09cbaf2cdd003caa25b7c5747a81c6257986f552
MD5 c1ae2a4633c4f7d0d7375476df7c2ada
SHA1 79e8333c3e721610ba2dd89361099f5b3ab9ccdd
SHA512 d916a679ddbd128fe02a5b4a30c76d9fe90dbab33766cf30f44da62e98a00a6d6a6dadcafd77fdd6a2a6db2747e4be1702403338f794cca7f3dd94f03742fbf3
TLSH
T1A4F07510D2654358182B5B1FCCF3A855EDD9C71D4A3041E263D1D712501280CF3381E3
MD5 SHA1 SHA512 TLSH

Paintrix/Birge.The

SHA256 8a4cd99a07231d0e8f1e34ab1d2db6d816762970d2e6bc12754cda9435fd3dac
MD5 ec7c92379fa2d3570bab13e85ff81a25
SHA1 6c174ae8ac1be10af436364a40f4e0c50d13cc7d
SHA512 a3141add601bcbf52ec28e04fe8b9c1636d03a8055bd77d61b1d3d6b008457ad81ae0dd886075e7f7b3cf94224ff008c7fdea472d585ddcd7d5442610477f909
SSDEEP 3072:U+f3yqV+flb999JyGquNuymONn7wtSQygcJyOe8g/DlCpzggoB:U83ralNgymON7wtSQVfPlQ2
TLSH
T17124E011F123DD72F057CCB8C45CAEFDED6B3E6A0B4811BF4A068523EBE995A46589C0
MD5 SHA1 SHA512 SSDEEP TLSH

Paintrix/Smeltes.Hab

SHA256 e8f69a5d6a7d17ef1b14ffcf1323b9127d6b196dbecdf014e1e9a7f1dddef607
MD5 47f60b070b66453011dc146748b0b8d4
SHA1 d1ba0e4d2918a25366eeb09a6634bdbb752b3f9e
SHA512 b1988e29b8b2525711d3bc3b1876106e08480735e54ad9f424cb2b086f60f4ca60fd1f6f695e502c648c516a7abe310840358ca4c65d78104fa5321cc5612fad
SSDEEP 1536:18te32A+8OWdJXbwXn8ll/1xns/JIU4lUTIz5ufbDCZOTUp+/h/uodZw7R8jdfUA:HXXXbpF1ds/HSUsz0fbDNpTKCJroDy
TLSH
T12DC3B052D766CCFACC078538D4AE619A4978A0125B0FD4FEA136E819C1D72E25334BEF
MD5 SHA1 SHA512 SSDEEP TLSH

Perspiratory37.bif

SHA256 b7741e347cfe5d03776750f2e27326971c9939a2eaa0673907e82d68de53bf5c
MD5 9c25a57ef4b20d705e427ab130c0b977
SHA1 ad8eef67757bc2cde006924c9e1e644cbc4dd27f
SHA512 f50580e88b7c456eff00e19cfdfc3268fe4550a7f5249553864102687a8a9b2ec1a647db8b3308a6f5d57d5a48607a7f5735e95d2cba714ad15144849bb08182
SSDEEP 1536:CTHjy7H1/LN7SOCCUq3mEls+9L0JgFd3frMonR4N6PjZHlZlBNuimDAT4ezBe9qj:HzL
TLSH
T17AB5124C87A6D96FA3D84687F0E45F58E246B9E8E9E005CDBD5B987C276D130DE06320
MD5 SHA1 SHA512 SSDEEP TLSH

Praktikanternes/dermatosclerosis.jpg

SHA256 d88a67aa13b305e89dd262c42d93b526c61edc9141dfde5849447743ddacdb9f
MD5 103bb7000ddb79ed6ddf99b8d030c65d
SHA1 10293d1ff087904b78863dc2d21fb5c676bce7ee
SHA512 5f3c7940f3a4faf7256d93185c4b9ceebd1df58362c7a941df806a0c71db71d0326a3503d270347aeb23060c38a13de1ecb6e91b1684edb2944c35a6520d9186
SSDEEP 3072:MYhuzny+GRSeiH0ohYNKa9g8QsBX/yFo++7gXFBl7pw:MQuDhegQKb8XBX/y6yXjw
TLSH
T1D4E312A7519E0DDD89157E5D20E21D01E7F8A06F4FBBC5ECD5C2C602C26BBBA801978A
MD5 SHA1 SHA512 SSDEEP TLSH

Praktikanternes/gyllepumpens.jpg

SHA256 f25d84bfdf0accc57cafd8cce012e4c4adf32031853ac7c04bb6989ce391eed1
MD5 176e9b77611c519d3893c4bb13142ec6
SHA1 b00113eac91c0adfcf91a3bb69ff9240e7a9ecd1
SHA512 4635cf72cab84bc03bfd33fb096b776988ed7db4a6b782a42d1bf0243d582a9c83c7f9e72eda005c04333f4c3b64e2ad6fe17e7f1641347a521064fc7d008809
SSDEEP 384:gbaW7uahkPAVKByZLjcVfO7LCMJ1ojwM4I1sManK45xgf4l53zpPprctW/:gba1aKY7YILlTgj+fnJIfGBpRrctc
TLSH
T188B2E0A4DB6F3DA8FB8A4A58100A6E24D498888A31445CF01799F4C942DFEFE4B01B39
MD5 SHA1 SHA512 SSDEEP TLSH

Praktikanternes/modernise.txt

SHA256 9ce3f86b06a02ce12772c81b5894cd7c271c789d016583c78ce3c966e15ca1de
MD5 2f72a4c62aa006df71104df416f86688
SHA1 8e09ce223fafec4f31043141cafac4e46d3b8a36
SHA512 b976800f022ab402acc9f54aa8496f8873f7c07ab7db79a92da6a5a00c6a3b76e49d2000a5a2daacf5b04801fba1e2968aab3824fe4301bfe427df3287fd3e1b
TLSH
T19DF0DCB26690E460ED837665BDE432E0827D0C086C594110F7CA64984080339483B82B
MD5 SHA1 SHA512 TLSH

Praktikanternes/nonspeculatively.ini

SHA256 1b3117dc52928ea278b7b786192518935857da80247871211e46edaff7fe1803
MD5 ac4c94ad0e420dc7c66a1953cbb0ce3b
SHA1 6976a23e566a87b7f805abe2492e180c85c2b21f
SHA512 a4c25016c04527de40b27bca21f7c5fd65d930a351ce6d6dbb7c06008cb95b453822b4abf6f2f92d6d5d6d327acc3c3d4fb49c35feb36cf83ee138172ef5e664
TLSH
T108F00211C76091EB0D211786E862078515766357021DE87A62F62ABDD32029C42B265F
MD5 SHA1 SHA512 TLSH

Praktikanternes/raahedens.txt

SHA256 bf3ac16a68b7887388e6896bea10ffa7c5c0c71ecf6ee4cb385f965b91c141d5
MD5 98fbcd6fa1b9c316af382ec94ff3b978
SHA1 776b8793907b35aff86ce2766dedc58e5b5c1d60
SHA512 cec26a02e8028f1bb479be6172fc6d480cd7c2f43047904a4d42ebbbda7210d69f1cdab79941d5cf7f1d72754897075c45f245b66ee2bc88f29b89a4429999e4
TLSH
T1CCF06205EB448218589B872E20C33409CF460E25AB08A127D05EB30FE24F0BCCA66192
MD5 SHA1 SHA512 TLSH

Praktikanternes/whispery.ini

SHA256 1e825ebd4db1729c0cbd08a717b47fac223baa9fa6149d2648d36627b0d1aff9
MD5 8a34f67eb765fa272cb54bd4e30bfb79
SHA1 c48d93076c5d765f22c96d6f5a5c08a4a8ee08ec
SHA512 6aa10e379d9825b8217a7b111ba3f87b449d1e6099c5831368acbbf2b1a7d71f42d0165aaf1d0c15ec51613518bcfa9b1eefb688e3a0f26b30e2e71f7f2ac590
TLSH
T14E018619EE287C0D0C8B639AB243B9631DAC84018817462076C14B9DA0364CCE7AB02C
MD5 SHA1 SHA512 TLSH

Pullimutterne.txt

SHA256 03374e0150cdddae0cc0f29f4ebfd9f5d139c6468a4b57cdc408cecc00f2f233
MD5 760a695f4623bac48056322d0a2dcdf4
SHA1 9e209c9378a8da97f0fce4acd1d348b04324fb67
SHA512 5a826a209de75d80aa491c5dcf9aae631d0bee78944131611286607599c33bbf970dcfea596759056bef55b816719a9628b54521dcfe4d84de2e454fa346c047
TLSH
T1DAE0618F8424555E99520EA04C555973258179FA02553169F010A616074397CE7AF55C
MD5 SHA1 SHA512 TLSH

Takujui/arren.ini

SHA256 d78e942495470be4ca14d961f3e201fcfc2d4fc104f89c82342cbea256f3e978
MD5 ceb67dd666a38ee1edfb52455f806ff3
SHA1 b3ea8ee7557d74fb2f8299aa4161be359d6edcf4
SHA512 221bfcfc073dfc08b988f4a2b2e4243d62ff90db7270ccfed431ffcab1fc583079341f81a8d87ef8ddaa0fe6f3589dccd21b357837a21dc75725817a5cf764d2
TLSH
T1320141C0E912B89F199E844EDADB5E48C01D4026F12146E894A91E3D539528CD37EBAA
MD5 SHA1 SHA512 TLSH

Takujui/astomatal.txt

SHA256 5981d1c7eb1a10627971d943997344c223c84cc35f87e0ee069b166ac7b640a5
MD5 1b8e9f530967b92f1cacf979ef88a2ab
SHA1 47b264da7c26f735a4d5b119719c65e860ef5708
SHA512 b979e2a38a8cfaaf0da05b69ce9d7f584109ec7ee72d56499cd2e8e390940644a8477bb2cfe94944e93fa8ca902c3918737b66a31bab6c92b440f2f878f985f4
TLSH
T19FE0F170DA2A9066830EE903794124EA4C341A4691640961438A4214724220ECFDC66C
MD5 SHA1 SHA512 TLSH

Takujui/bespotter.afs

SHA256 98e92023ee78342f943a2d4b31663ab1ceb2e12f02a49d06e07ec8f472975ef0
MD5 65e38353429fde794377f43d55b02be5
SHA1 25603be13bb0ecf84978d77951df1cbebc17ef78
SHA512 9a5f850776cc8e7756d787ad3dd9ae3d49761b6b98a824add8b38321095d9b230f5b1d6f6db404a8f71d6c4697b936a3849552765862a067d83fa8360fbf0c30
SSDEEP 384:DTINmPw6sY8EnIA3cwCnsBn9jQP1qxLZ07rW53C6o1r19/Dijz0iWwrYYOrtakUU:gTL
TLSH
T1E0B502BBE9C89A29B1756DCA4EC500154ACEB979A7701AD30E5700ED6501EC98CF94CF
MD5 SHA1 SHA512 SSDEEP TLSH

Takujui/campaigned.ini

SHA256 d0ea456e4dce1fbb226808ad438fd17f617d2f3aa530e19a1ad6983f851028a0
MD5 201becaf2053977847ad5c7f6f611c6a
SHA1 f152f5825664d579f00cf5f52f061187acbf5736
SHA512 dfa957e2c5b487e7a0acc1a9bd9d45ac790cbed40d29595a9df8f0df8e37c93542e936db6a0ac6f19ee3416507ba65524bc4ac7eb09fb7017da739564b5c441c
TLSH
T10BF041128A541458CD170155AF7E242A0379073C710D028CAEA8564C940F4BCCA2D245
MD5 SHA1 SHA512 TLSH

Takujui/cassine.non

SHA256 98f41201e287d07e1ab64614bd24ae21a920312418455c5024c5628f69cf6a06
MD5 f960e22742e96a10a2c09574570d7767
SHA1 e1a6e558045e0118ce05e710198262cdc879e77f
SHA512 357b2833b8cf4a95cd4f88b4b1419ab5a17a59b2f24663015dcb2318727865d4259b830bf6a2af0c121edaed56ef4ad2fe40a95b237aa154181395e812968c4b
SSDEEP 768:WBDFESpjehNxnr4im+9C4s6seqB6mI6YGrmW04waMvbfp1GYlzTDpZ/rglQ14E3S:2xEm
TLSH
T153A5F24F037DA0FEFDB1E9BD3A6C756062BC75C289C903848132316EE5D2618DA5A48F
MD5 SHA1 SHA512 SSDEEP TLSH

Takujui/counterweighing.jpg

SHA256 720177291c71f036c7c8dbca446db4365b5325fe7f2950e8ff5304338754db0b
MD5 cff0edc7451c842dbf083920b33bbff7
SHA1 34e878f72f85294d87b937b6b22053693cf45d0a
SHA512 453f1d9915411c4487b870c72b3bdc3e48a380430149ef55b5024e45d0e10396b5df0ee9423c5ea48cd0e126e5a16f57b68ee41607403f76863bf9a144d1a654
SSDEEP 768:NK/yA6iusaM+esai+EXcb/HVe2yhqEllmsO5u1gFOM01sFl:NK6Lzeg+EXczzywEllmswuQR0Wl
TLSH
T121D2E1FB499E42C49B5A2FE66828346CC2B69C414B152F7F4041E2758E67CF1DE8D2A3
MD5 SHA1 SHA512 SSDEEP TLSH

c8e7a02f038692b718562729a122e39e64cad6f27d0396bbf157cfbcc90ba7d7.exe

PE Signature issue

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Danicas.ini

Paintrix/Averterede151.ini

Paintrix/Birge.The

Paintrix/Smeltes.Hab

Perspiratory37.bif

Praktikanternes/dermatosclerosis.jpg

Praktikanternes/gyllepumpens.jpg

Praktikanternes/modernise.txt

Praktikanternes/nonspeculatively.ini

Praktikanternes/raahedens.txt

Praktikanternes/whispery.ini

Pullimutterne.txt

Takujui/arren.ini

Takujui/astomatal.txt

Takujui/bespotter.afs

Takujui/campaigned.ini

Takujui/cassine.non

Takujui/counterweighing.jpg

Sharing

General

Malware Config

Signatures

File Explorer

c8e7a02f038692b718562729a122e39e64cad6f27d0396bbf157cfbcc90ba7d7.exe

PE Signature issue

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Danicas.ini

Paintrix/Averterede151.ini

Paintrix/Birge.The

Paintrix/Smeltes.Hab

Perspiratory37.bif

Praktikanternes/dermatosclerosis.jpg

Praktikanternes/gyllepumpens.jpg

Praktikanternes/modernise.txt

Praktikanternes/nonspeculatively.ini

Praktikanternes/raahedens.txt

Praktikanternes/whispery.ini

Pullimutterne.txt

Takujui/arren.ini

Takujui/astomatal.txt

Takujui/bespotter.afs

Takujui/campaigned.ini

Takujui/cassine.non

Takujui/counterweighing.jpg