37aa05adb1f5408e886287c8b1ea074315a42ece0d47cbfe6678c26b6c396deb[.]exe

resource
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll

resource
37aa05adb1f5408e886287c8b1ea074315a42ece0d47cbfe6678c26b6c396deb.exe

37aa05adb1f5408e886287c8b1ea074315a42ece0d47cbfe6678c26b6c396deb.exe

IMPHASH 7eae418c7423834ffc3d79b4300bd6fb
SHA256 37aa05adb1f5408e886287c8b1ea074315a42ece0d47cbfe6678c26b6c396deb
MD5 eceaa017d7c45b81dbfe192b71de63ed
SHA1 d6ddeb437483e8e4efe73bb6d6aca345b351406c
SHA512 220d1bb0866bcd596bae096daeb7fa57a2bc7b2cfd686336ad06617669369a9f17bc552039be8fe8c72847d1fa847a4fdaeabb7c7db8a5045d52cb569b27d781
SSDEEP 6144:dNDlOLZLClTgEN/HqnXYPXBNSBsiGAgynWxGiQBhTqwwM8Lt:dk8TgEN/HOExESAhkjg+wwM8R
TLSH
T19394E147EB1BA820C24544B3D8F589FAE7709D62A556047E3382FF1E98365CF8E1827D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned binary was signed by an untrusted entity.

PE Signature issue

Digest

ed:75:33:49:a9:27:e9:ab:6a:6a:47:99:50:51:63:fa:f8:38:be:ee:90:95:c8:6e:4b:c7:73:fd:9f:66:8f:43

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=procedaar,OU=Korsikaneres Flysch Tremblement\ ,O=procedaar,C=GB,1.2.840.113549.1.9.1=#0c1e556e6465727669736e696e67737472696e4043686172636f616c792e5261

Chains

Mar 2, 2026

PE Signature issue

Digest

5b:db:c0:c0:e3:98:f6:c8:ec:61:15:2e:75:62:fa:d0:ab:9e:a5:0e

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=procedaar,OU=Korsikaneres Flysch Tremblement\ ,O=procedaar,C=GB,1.2.840.113549.1.9.1=#0c1e556e6465727669736e696e67737472696e4043686172636f616c792e5261

Chains

Mar 2, 2026

Minor OS version

0

Major OS version

4

Entry point

13252

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetEnvironmentVariableW SetFileAttributesW Sleep GetTickCount GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW SetCurrentDirectoryW GetFileAttributesW GetWindowsDirectoryW GetTempPathW GetCommandLineW GetVersion SetErrorMode lstrlenW lstrcpynW GetDiskFreeSpaceW ExitProcess MoveFileW CreateThread GetLastError CreateDirectoryW CreateProcessW RemoveDirectoryW lstrcmpiA CreateFileW GetTempFileNameW WriteFile lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject lstrcmpiW lstrcmpW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle ExpandEnvironmentStringsW GlobalFree GlobalLock GlobalUnlock GlobalAlloc DeleteFileW FindFirstFileW FindNextFileW FindClose SetFilePointer ReadFile MulDiv lstrlenA WideCharToMultiByte MultiByteToWideChar WritePrivateProfileStringW FreeLibrary GetPrivateProfileStringW GetModuleHandleW LoadLibraryExW

user32

GetWindowRect GetSystemMenu SetClassLongW IsWindowEnabled SetWindowPos GetSysColor GetWindowLongW SetCursor LoadCursorW CheckDlgButton GetMessagePos CallWindowProcW IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard TrackPopupMenu ScreenToClient EnableMenuItem GetDlgItem SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharPrevW CharNextA wsprintfA DispatchMessageW PeekMessageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect SystemParametersInfoW EndDialog RegisterClassW DialogBoxParamW CreateWindowExW GetClassInfoW DestroyWindow CharNextW ExitWindowsEx SetWindowTextW LoadImageW SetTimer ShowWindow PostQuitMessage wsprintfW SetWindowLongW FindWindowExW IsWindow CreatePopupMenu AppendMenuW GetSystemMetrics DrawTextW EndPaint CreateDialogParamW SendMessageTimeoutW SetForegroundWindow

gdi32

SelectObject SetTextColor SetBkMode CreateFontIndirectW CreateBrushIndirect DeleteObject GetDeviceCaps SetBkColor

shell32

ShellExecuteExW SHGetPathFromIDListW SHGetSpecialFolderLocation SHGetFileInfoW SHFileOperationW SHBrowseForFolderW

advapi32

AdjustTokenPrivileges RegCreateKeyExW RegOpenKeyExW SetFileSecurityW OpenProcessToken LookupPrivilegeValueW RegEnumValueW RegDeleteKeyW RegDeleteValueW RegCloseKey RegSetValueExW RegQueryValueExW RegEnumKeyW

comctl32

ImageList_Create ImageList_AddMasked ord17 ImageList_Destroy

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 6950991102462d84fdc0e3b0ae30c95af8c192f77ce3d78e8d54e6b22f7c09ba
MD5 8cf2ac271d7679b1d68eefc1ae0c5618
SHA1 7cc1caaa747ee16dc894a600a4256f64fa65a9b8
SHA512 ce828fb9ecd7655cc4c974f78f209d3326ba71ced60171a45a437fc3fff3bd0d69a0997adaca29265c7b5419bdea2b17f8cc8ceae1b8ce6b22b7ed9120bb5ad3
SSDEEP 192:BenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XB9IwL:B8+Qlt70Fj/lQRY/9VjjlL
TLSH
T121427D1193B089F2F590593805A67F2A6FBEAC6C27E44963CFE345853D702DFA47A243
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10719

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsDialogs.dll

IMPHASH 6b5c4f7d679059f68f1269aad3a5cecd
SHA256 c5ba017732597a82f695b084d1aa7fe3b356168cc66105b9392a9c5b06be5188
MD5 ec9640b70e07141febbe2cd4cc42510f
SHA1 64a5e4b90e5fe62aa40e7ac9e16342ed066f0306
SHA512 47605b217313c7fe6ce3e9a65da156a2fba8d91e4ed23731d3c5e432dd048ff5c8f9ae8bb85a6a39e1eac4e1b6a22862aa72d3b1b1c8255858997cdd4db5d1fe
SSDEEP 192:oRsHeylO012En8pqHtcE0PuAgkOyPIFc:sATI0d8pUP0WAgkBPIFc
TLSH
T156120992E6A450B3C5E6133F35AA2B2DCBBD5325B0922C0083738E4979795B66E38347
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

7527

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Firser74/Kaptajnernes.Vor90

SHA256 771c89080ffdf9f950d989b26ba3d3639832947b3e8f609c828b7f0b7df3de52
MD5 565ad328cd1318bb40974fef3c74689d
SHA1 f5e1ee8a01ae7eb9d94b6d4076f516487ed311d8
SHA512 3f83e533435791d2dcecf47e2473960c6b655ad1c5eec373ffb0e601764b17bcad6876107d753fc4e56b6aac7ac14a8a18f7e3ba44ff4b30264ebb430ca39f31
SSDEEP 768:+rrYRGBWDDq+EWihk+ue4AEMxpQkmAIzNA7pH6umuQkmcpHOTj:+nuGZ+khkPehVxpQkHIxEJ5m
TLSH
T15A33BF47EBB54CBBCD07C538C85E226A4D98F012AB0ED46EB275B694C1C65F323346A6
MD5 SHA1 SHA512 SSDEEP TLSH

Firser74/Vintervej/komtesserne.spi

SHA256 ead8ec216bffa8e6dad4378b17762556c1143721e1634b691673d6a2961bb260
MD5 09ca2f46302ab0e15095e045c422125c
SHA1 83cb0d8c245c986102ee06bc0745709575ea5423
SHA512 e881d3407118af9964043c4dea04006763c1ac0d129417d6dfd209ac5574a83b7c14424c0be6e6d124fc5e860e2de1a7bfc767a0a1e1af2dc16f991cfbdde10b
SSDEEP 48:anoWPxCMbI7UVI7YTrj87jFynz8zCF852km7CeojyoYo06RLBGRW:a3PeGI7YmFLewk7SzVcW
TLSH
T18E731DD96D3C6467A0C80CC1DEFCD441117D401547BC59771369AB6B37B73A970859F0
MD5 SHA1 SHA512 SSDEEP TLSH

Firser74/Vintervej/maskiners.bio

SHA256 d9a4561be80ea7a84d1c90f41c8885d350894504e7f2a81e578cf015bf0910eb
MD5 ee709e93990582519e2b73d96f90bc64
SHA1 e26ae2577f9848a56f05f375b9169039bef86b91
SHA512 4f3e4daba8d6141eea2e45326de7ff29e734dca9b0bccf295ab4625b76665dcfae82057cedb656a4ea7bd5f4e122960d4fb3d16c3315b099afa5a49797cc3b97
SSDEEP 48:s7h8phRx2BQsf5g6pNW6aVW57/cYOVbOFda7PwWlDlxyjb33hs1nPx/YVzPyFCGd:s98PjvG5g64V8/5cBIBmnPZY16Fhx8C
TLSH
T1C68339BAF74949A3AC2012A2C0264F18FD90E3731FD8FE208EA314625954DC78A18688
MD5 SHA1 SHA512 SSDEEP TLSH

Firser74/Vintervej/tilbagebetalingers.dim

SHA256 901ef3f7cd46ee3f36c562a1919ed35627639d206335f8f655b9becb5d1a2989
MD5 88bfa4d3b6df4579d5364f6766330f73
SHA1 c1a5271330f9ae566b676a744fb592ade93e3a5b
SHA512 0b6616c55bf7a44f0b1d99c58a0388ce71398df19f2b64f9941ab2bd60878e4e3757f01a4b5a0560808cd0d4cb6d8d3a6ff781415cf3cf73432544aceeb3c600
SSDEEP 3:hmyhJhhsyOxhhJhey7CkdyZky/dhJhVhXhBhhLyhXyvyhKkV2yPyWgIky/khCyhv:mGxhxvyhSI7rhkgyhh07l4ye27R9Yb
TLSH
T153B12B968DFC1281456361298007509640F82A34B784C0C5DD8F438CEB02F81B931A23
MD5 SHA1 SHA512 SSDEEP TLSH

Pegepinds.Gen

SHA256 b6b920e76e26945921955f88713f2ef1a8866bbc3eb75a4c0fb6d14fc8f5b2f4
MD5 fcf58756529ac0d511ecc57cfa79b698
SHA1 7667ec84479690bdcc13fc1f630134c8e108a71c
SHA512 49ee19251edc7b020edaf5b3c1d235db9c18922a0f6b91aabec070a382ee07245c2c7ac4203c32c45b9a2283f42abd1bbf95167b46d2b5f7804f287a491c9293
SSDEEP 6144:RqrW69S2aMODnGTuO8e2xKlYo8807mc9uRli43xO3tJJM:IrWs7aM8GTuhbKlY9ycS92y
TLSH
T1A854E140A9B6905E50814E92DADF6338CF40EC42A9BD6FC7C92275CC1E3DD6F4ABB158
MD5 SHA1 SHA512 SSDEEP TLSH

asbjrn.gal

SHA256 c3938b59195a1f986b2bffee6d0df4a2debfd54e0136d4bb27dabc83b98445de
MD5 8ec0ffb38f8423f6cfa7fd1918fa9b4c
SHA1 f6a263afb1afa20691a7b86408d49e81ab049719
SHA512 c231345ae1cedae85a1fcc3dbae7053c2455b44e6f62627252508b915ea0f04b4c1d38976db849ecc7d378dc707259fcc74113694466979ee3e2f9cc7e6d69af
SSDEEP 96:oLGMmIicLPkRitVSAe5f7r5KRIBkE6vx0H2CbqEqvBOPRGmm:gvi+PkRP57rdAeaEYBcRGmm
TLSH
T1CD83FCB5B5CF2C2902C0DC3BDEA50E7CB0E915859878EAD46EA8EF5C757889F134099C
MD5 SHA1 SHA512 SSDEEP TLSH

37aa05adb1f5408e886287c8b1ea074315a42ece0d47cbfe6678c26b6c396deb.exe

PE Signature issue

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

Firser74/Kaptajnernes.Vor90

Firser74/Vintervej/komtesserne.spi

Firser74/Vintervej/maskiners.bio

Firser74/Vintervej/tilbagebetalingers.dim

Pegepinds.Gen

asbjrn.gal

Sharing

General

Malware Config

Signatures

File Explorer

37aa05adb1f5408e886287c8b1ea074315a42ece0d47cbfe6678c26b6c396deb.exe

PE Signature issue

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

Firser74/Kaptajnernes.Vor90

Firser74/Vintervej/komtesserne.spi

Firser74/Vintervej/maskiners.bio

Firser74/Vintervej/tilbagebetalingers.dim

Pegepinds.Gen

asbjrn.gal