195bc09ff1b365c0dd470aeaa1bc86f989c09e424fffbdfdeb0bcb2331385b28[.]exe

resource
unpack001/$PLUGINSDIR/System.dll

resource
195bc09ff1b365c0dd470aeaa1bc86f989c09e424fffbdfdeb0bcb2331385b28.exe

195bc09ff1b365c0dd470aeaa1bc86f989c09e424fffbdfdeb0bcb2331385b28.exe

IMPHASH 4ea4df5d94204fc550be1874e1b77ea7
SHA256 195bc09ff1b365c0dd470aeaa1bc86f989c09e424fffbdfdeb0bcb2331385b28
MD5 0fb22642c0c3cb88ec40a1f387d35b4a
SHA1 2d8b55e21c75731dbf5269976e915b041674eb66
SHA512 1706406d2a8dfb23bea12a9769f37762083c9826f038de90d8244f36a70977a7624dcd08fbea4f5643a165ebd93e4917eeab7d6696b2b417d4876c21dff46038
SSDEEP 6144:/wq3NpQ3wDIywUF5ykHERIe6MyhdVgWfMnfYyumOk6mgcbpiOgizVaSuQ2/z/fw:/zcae65hmnumOkrDpupQ2bo
TLSH
T135C4BFA0F611D9EBD5A709BA8CBBC4302167AD1E86D1111F32ADB62825B335211DFF0F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned binary was signed by an untrusted entity.

PE Signature issue

Digest

a1:a5:9d:12:77:9e:44:28:1b:52:e3:4c:03:e8:a5:de:8c:90:d4:27:3c:fd:01:b7:62:c1:99:68:b1:49:f1:a7

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Allowedly,OU=Buggjorde Earthnut\ ,O=Allowedly,C=GB,1.2.840.113549.1.9.1=#0c1b437572766974616c3138334053636f706f7068696c6961632e4b79

Chains

Mar 2, 2026

PE Signature issue

Digest

e5:4d:ec:df:7d:0a:be:30:ca:a9:a4:eb:38:26:a5:9b:35:84:d8:b5

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Allowedly,OU=Buggjorde Earthnut\ ,O=Allowedly,C=GB,1.2.840.113549.1.9.1=#0c1b437572766974616c3138334053636f706f7068696c6961632e4b79

Chains

Mar 2, 2026

Minor OS version

0

Major OS version

4

Entry point

13386

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetCurrentDirectoryW GetFileAttributesW GetFullPathNameW Sleep GetTickCount CreateFileW GetFileSize MoveFileW SetFileAttributesW GetModuleFileNameW CopyFileW ExitProcess SetEnvironmentVariableW GetWindowsDirectoryW GetTempPathW GetCommandLineW GetVersion SetErrorMode WaitForSingleObject GetCurrentProcess CompareFileTime GlobalUnlock GlobalLock CreateThread GetLastError CreateDirectoryW CreateProcessW RemoveDirectoryW lstrcmpiA GetTempFileNameW WriteFile lstrcpyA lstrcpyW MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GlobalFree GlobalAlloc GetShortPathNameW SearchPathW lstrcmpiW SetFileTime CloseHandle ExpandEnvironmentStringsW lstrcmpW GetDiskFreeSpaceW lstrlenW lstrcpynW GetExitCodeProcess FindFirstFileW FindNextFileW DeleteFileW SetFilePointer ReadFile FindClose MulDiv MultiByteToWideChar lstrlenA WideCharToMultiByte GetPrivateProfileStringW WritePrivateProfileStringW FreeLibrary LoadLibraryExW GetModuleHandleW

user32

GetSystemMenu SetClassLongW IsWindowEnabled EnableMenuItem SetWindowPos GetSysColor GetWindowLongW SetCursor LoadCursorW CheckDlgButton GetMessagePos LoadBitmapW CallWindowProcW IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard wsprintfW ScreenToClient GetWindowRect GetSystemMetrics SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharPrevW CharNextA wsprintfA DispatchMessageW PeekMessageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow LoadImageW SetTimer SetWindowTextW PostQuitMessage ShowWindow GetDlgItem IsWindow SetWindowLongW FindWindowExW TrackPopupMenu AppendMenuW CreatePopupMenu DrawTextW EndPaint CreateDialogParamW SendMessageTimeoutW SetForegroundWindow

gdi32

SelectObject SetBkMode CreateFontIndirectW SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW ShellExecuteW SHFileOperationW

advapi32

RegDeleteKeyW SetFileSecurityW OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges RegOpenKeyExW RegEnumValueW RegDeleteValueW RegCloseKey RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumKeyW

comctl32

ImageList_AddMasked ord17 ImageList_Destroy ImageList_Create

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb
MD5 17ed1c86bd67e78ade4712be48a7d2bd
SHA1 1cc9fe86d6d6030b4dae45ecddce5907991c01a0
SHA512 0cbed521e7d6d1f85977b3f7d3ca7ac34e1b5495b69fd8c7bfa1a846baf53b0ecd06fe1ad02a3599082ffacaf8c71a3bb4e32dec05f8e24859d736b828092cd5
SSDEEP 192:eY24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35Ol+Sl:E8QIl975eXqlWBrz7YLOl+
TLSH
T1E3325C12135081F3E4918138C86B3A276B6A15029BF98E57DFD39546BE31BE3BD7D603
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10183

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Florescent.Hel

SHA256 f460d5a3ff6ac952c7c04b430c295a6c34ca1fd4b2bee34bf0b8c5fb7b7afbb5
MD5 c6cdb391088e3c5a11e523db948c3f8d
SHA1 8d562913bcb35ef02c2a8b00b669ae114ce0bb88
SHA512 03cb2a37f9ea4fb257cb8dc51534b41254a849ff1f8a8585136185ed1637305e73ddf29a21316e32dca8732e1681be4e73d137ef98da83b5ecd4a931d680cca1
SSDEEP 3072:ek1NJu/UqiEz0yVCUTJda40g/zrxnpZXunXxH82vjUdNFovZXfXg5uY:z1zJENCSJdp1lTkXd82jUdNFovZXHY
TLSH
T11C14DF75FAC1E16DD3A2593ACEE200EEDE102C14BE49A27B073B7511E3352BD15C86A7
MD5 SHA1 SHA512 SSDEEP TLSH

Nonassimilable.Dub

SHA256 37cf4fb679a3c1432cfb8a016fc70d13de8111d4d29216faba433615dfaee0df
MD5 29f3fc7232103ff5ba0f1598b92ba6fd
SHA1 44cac97a0b5856365d8ff55d2d590bbf9b175c59
SHA512 4d86c680507c4c102ff3ff30b819e2fc56586831eb5e5809ec4f1d0219c3912ab378ff47eb2a92b95a890b0935a77b2cd005710e901a17f6e99bd760fcd9f66a
SSDEEP 3072:/mzHYjOd2Sp49cXmH4TXt6ljrxZWswbiiFTBAuX:+zHY6d299ATd6ljrxZnwblFTquX
TLSH
T101944C5075C98AE0F61A5984EA78FFB211733973AFCA1CD22324F5004BBE9513A4DA5F
MD5 SHA1 SHA512 SSDEEP TLSH

Southeastwards/leathered.ord

SHA256 139dbcd70572199d6bb6a9d80b7d5c35b93a1ede7d421199302b41a4b64eed49
MD5 13d332274fc70f8505f99fde54e4a405
SHA1 a47ab77b5b95436c389f007c100ec680e2b9fd2b
SHA512 3219304755f4ae82586d01796addfc8da9bae88d36c6c6343cd47290de72ba3b4270cf91daf0966b1aecc5eec8f3e647aec41c5b2b77b66cbe61bab164ce8cff
SSDEEP 6:MjDMmN9eJNFTi6GYNNgVNNsBtqNQ9BLNNeNvNN/lNNu5INN9:MB9eJjT2amVTsBt8uTAVRg5KD
TLSH
T1CB322BA02670A272223D1935184D91FE603580F542B6E2D5F9D967B364FD9C50350217
MD5 SHA1 SHA512 SSDEEP TLSH

Southeastwards/salsdren.exi

SHA256 b0b6a8c82bcb3f8cd7ea4bfdce7efb21ab993875eb966c414399bbdec1b9c452
MD5 ab6b40575bc484a69a875fc6dad595cf
SHA1 c2949e7d86bfe0accd5c90bb3f244fb459ed18a4
SHA512 5ffd7a4e58697f7e190ebaba2680de81c556549b9a68da75363f09d6e64e7601a5ca59ce64d860bf75112fb78756571fd76e95314323ad1e5559203a1625907c
SSDEEP 96:+e1EO0mqkvEajnEW/sqffsIzGzdAdQYrJSHyelgYF:71RRZEajnEufEMQ6Q+3YF
TLSH
T1CB333A520A6F042429955FE9B6A010B1E0B23F708913C820CF14A0F273E3E47E5F9153
MD5 SHA1 SHA512 SSDEEP TLSH

Southeastwards/substraternes.stl

SHA256 da81fa93f2554d6554e1bbfed54eecb99f0a81bbe90055c28e053ac13d1523f4
MD5 57b168efadc562e38e664d40d7ab3747
SHA1 f50eb2150df4cd5cd6dcbe881ec0f342f9149e64
SHA512 3a816bc8ddf8ca9d0a62ce1b5c43f90025533f6834967a186ab45dade1f90a60dfbc0fcfb9060c9dfc0801dd02b0b72882054e43108b881f9928e02004117a9a
SSDEEP 3:fXrDrDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDR:YiDxdpJuSrQEFkuDxTUJXw3
TLSH
T1D5A12B72C7C28E29A70D9E0D0CC62014289D9C3BD9682165CF1C5DE239C074E81CDC8D
MD5 SHA1 SHA512 SSDEEP TLSH

advarselskampagne.scu

SHA256 aa40795cb2fb7bead670014c140bd61429e2ab737f1d1dc9b00b1a002e0ba3de
MD5 7dea897c8eb3c9a8359eb374d724ab4e
SHA1 19e8a7002dd91f2206ac5dd2f52beacc92f1951f
SHA512 53c77ad0d6eddff2f12366c35d9e2c00cf078ea88bc9cdbb1dec624e24cc85a029ed1027322b794692a19e314632eb1afc50cb9720b0e4f58f19ac4641a5ad14
SSDEEP 24:2wOQNfzbsLB3aTqc6HHn569OyWcZ+s3qM4OOgCNzzc2+oZgr:OQN8LB3ZSXaPZgC5P+Dr
TLSH
T127430AACFABF61CD5BC019622C8732DB552E967AD4A101C51C2C49088CEFE65B241FED
MD5 SHA1 SHA512 SSDEEP TLSH

195bc09ff1b365c0dd470aeaa1bc86f989c09e424fffbdfdeb0bcb2331385b28.exe

PE Signature issue

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Florescent.Hel

Nonassimilable.Dub

Southeastwards/leathered.ord

Southeastwards/salsdren.exi

Southeastwards/substraternes.stl

advarselskampagne.scu

Sharing

General

Malware Config

Signatures

File Explorer

195bc09ff1b365c0dd470aeaa1bc86f989c09e424fffbdfdeb0bcb2331385b28.exe

PE Signature issue

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Florescent.Hel

Nonassimilable.Dub

Southeastwards/leathered.ord

Southeastwards/salsdren.exi

Southeastwards/substraternes.stl

advarselskampagne.scu