32dbd142accd606bedbda791b46025aa6b89241244c6592b23ed7b11b4fec3e0.zip
- SHA256 32dbd142accd606bedbda791b46025aa6b89241244c6592b23ed7b11b4fec3e0
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Trigae.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
21 signatures
150 seconds
Behavioral task
behavioral2
Sample
Trigae.exe
Resource
win11-20260130-en
windows11-21h2-x64
20 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260129-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
150 seconds
General
- Target 32dbd142accd606bedbda791b46025aa6b89241244c6592b23ed7b11b4fec3e0.zip
- Size 323KB
- Sample260407-dvm9esfy7n
- SHA256 32dbd142accd606bedbda791b46025aa6b89241244c6592b23ed7b11b4fec3e0
- MD5 2509613eb3a39a2ff06702b6e86a2e95
- SHA1 27841ef8da4551a3d7f04fb66325d38739f6d0c2
- SHA512 38c77612a0ed2d338551b0cd471847f8d3167c1475f2428368cdeec54f783ba7a2f77a8416a2f4893b47c0c8d363f97aaf194351b5cdb38605170bab72d33a75
- SSDEEP 6144:YJvHBtEDceU5VlZX9+avKkVqIHDOq6gNDdj8DP6gD2:YJvL1eU5F9+4lIup/4rD2
- TLSH T16F642335368D2F31F050B1190B67DB7EF903522E879EF02B4BD868C62B252761A7CA57
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/$PLUGINSDIR/System.dll - Untrusted Codesign Signers 1 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/Trigae.exe
File Explorer
-
32dbd142accd606bedbda791b46025aa6b89241244c6592b23ed7b11b4fec3e0.zip.zip 323KB
-
Trigae.exe.exe 424KB
-
$PLUGINSDIR/System.dll.dll 12KB
-
Alkoholiske/sagkyndigere.eft23KB
-
Hamadryads178KB
-
Hvileperioderne.ops77KB
-
Opiners147KB
-
Whiners.san13KB
-
delphically.baa8KB
-
doryphoros.sli87KB
-
headborough.yan48KB
Trigae.exe
- IMPHASH b34f154ec913d2d2c435cbd644e91687
- SHA256 32839e5fa6a7e0f95d88153b87b2234f07df06228b9f62517a1b47a737e5d1ed
- MD5 1d8341fb71f4f2301f6577aa5fa3c678
- SHA1 b45b312ffc799c40bfa278c71a46550ffae0048e
- SHA512 0744da5da13d951507971fa4b0fb18221b1cd986a8b347afa91d971cbae3df7bdc375cf7200d604f3ed00aa8cf418bc885f67528a06f2c0c3a4e7e3b8a8c6cd3
- SSDEEP 6144:x5lz/1R2mcE9J4XhEn/lb3809+aFKkVsIHDMq6gNDtj8Dx6gk:rfr9J4XI9b379+ol2Opz4Zk
- TLSH T1FF94F1037780CBA7C46487314AAF8715B736FD165BC2270B3398B7592DB3362291A79E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
fb:03:93:44:b0:02:b7:ed:be:97:2e:f8:5a:46:44:36:89:6f:f3:a2:73:7a:31:83:2f:41:c8:99:67:e1:39:67:5f:98:d8:7d:2e:58:6b:39:16:20:22:6f:8d:a8:e0:3a
Digest Algorithm
sha384
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=forvaltningsregler,OU=Stimlendes Geopolitiske\ ,O=forvaltningsregler,C=US,1.2.840.113549.1.9.1=#0c114f706665646574404269746d61702e5374
Chains
Apr 1, 2026
CN=forvaltningsregler,OU=Stimlendes Geopolitiske\ ,O=forvaltningsregler,C=US,1.2.840.113549.1.9.1=#0c114f706665646574404269746d61702e5374
PE Signature issue
Digest
24:2f:14:e5:59:04:18:f6:11:a1:48:ae:84:63:e1:c1:8a:4c:3f:b4:4c:e5:18:45:8b:08:08:a5:3e:d8:e5:20
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=forvaltningsregler,OU=Stimlendes Geopolitiske\ ,O=forvaltningsregler,C=US,1.2.840.113549.1.9.1=#0c114f706665646574404269746d61702e5374
Chains
Apr 1, 2026
CN=forvaltningsregler,OU=Stimlendes Geopolitiske\ ,O=forvaltningsregler,C=US,1.2.840.113549.1.9.1=#0c114f706665646574404269746d61702e5374
Subject
CN=forvaltningsregler,OU=Stimlendes Geopolitiske\ ,O=forvaltningsregler,C=US,1.2.840.113549.1.9.1=#0c114f706665646574404269746d61702e5374
Serial Number
07:51:a1:b8:50:97:ba:86:b1:5a:cc:b9:7f:a3:26:f8:16:e0:4f:ef
Issuer
CN=forvaltningsregler,OU=Stimlendes Geopolitiske\ ,O=forvaltningsregler,C=US,1.2.840.113549.1.9.1=#0c114f706665646574404269746d61702e5374
Revocation Status
Not revoked
Timespan
Mar 26, 2026 - Mar 26, 2027
Minor OS version
0
Major OS version
4
Entry point
13145
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
SetEnvironmentVariableW
SetFileAttributesW
Sleep
GetTickCount
GetFileSize
GetModuleFileNameW
GetCurrentProcess
CopyFileW
SetCurrentDirectoryW
GetFileAttributesW
GetWindowsDirectoryW
GetTempPathW
GetCommandLineW
GetVersion
SetErrorMode
lstrlenW
lstrcpynW
GetDiskFreeSpaceW
ExitProcess
GetShortPathNameW
CreateThread
GetLastError
CreateDirectoryW
CreateProcessW
RemoveDirectoryW
lstrcmpiA
CreateFileW
GetTempFileNameW
WriteFile
lstrcpyA
MoveFileExW
lstrcatW
GetSystemDirectoryW
GetProcAddress
GetModuleHandleA
GetExitCodeProcess
WaitForSingleObject
lstrcmpiW
MoveFileW
GetFullPathNameW
SetFileTime
SearchPathW
CompareFileTime
lstrcmpW
CloseHandle
ExpandEnvironmentStringsW
GlobalFree
GlobalLock
GlobalUnlock
GlobalAlloc
FindFirstFileW
FindNextFileW
DeleteFileW
SetFilePointer
ReadFile
FindClose
lstrlenA
MulDiv
MultiByteToWideChar
WideCharToMultiByte
GetPrivateProfileStringW
WritePrivateProfileStringW
FreeLibrary
LoadLibraryExW
GetModuleHandleW
user32
GetSystemMenu
SetClassLongW
EnableMenuItem
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongW
SetCursor
LoadCursorW
CheckDlgButton
GetMessagePos
LoadBitmapW
CallWindowProcW
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
ScreenToClient
GetWindowRect
GetDlgItem
GetSystemMetrics
SetDlgItemTextW
GetDlgItemTextW
MessageBoxIndirectW
CharPrevW
CharNextA
wsprintfA
DispatchMessageW
PeekMessageW
ReleaseDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
GetClientRect
FillRect
DrawTextW
EndDialog
RegisterClassW
SystemParametersInfoW
CreateWindowExW
GetClassInfoW
DialogBoxParamW
CharNextW
ExitWindowsEx
DestroyWindow
GetDC
SetTimer
SetWindowTextW
LoadImageW
SetForegroundWindow
ShowWindow
IsWindow
SetWindowLongW
FindWindowExW
TrackPopupMenu
AppendMenuW
CreatePopupMenu
EndPaint
CreateDialogParamW
SendMessageTimeoutW
wsprintfW
PostQuitMessage
gdi32
SelectObject
SetBkMode
CreateFontIndirectW
SetTextColor
DeleteObject
GetDeviceCaps
CreateBrushIndirect
SetBkColor
shell32
SHGetSpecialFolderLocation
ShellExecuteExW
SHGetPathFromIDListW
SHBrowseForFolderW
SHGetFileInfoW
SHFileOperationW
advapi32
AdjustTokenPrivileges
RegCreateKeyExW
RegOpenKeyExW
SetFileSecurityW
OpenProcessToken
LookupPrivilegeValueW
RegEnumValueW
RegDeleteKeyW
RegDeleteValueW
RegCloseKey
RegSetValueExW
RegQueryValueExW
RegEnumKeyW
comctl32
ImageList_Create
ImageList_AddMasked
ImageList_Destroy
ord17
ole32
OleUninitialize
OleInitialize
CoTaskMemFree
CoCreateInstance
Name
.text
Size
25KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
128KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
164KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
161KB
Virtual Size
160KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=165, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
$PLUGINSDIR/System.dll
- IMPHASH fc0224e99e736751432961db63a41b76
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
10643
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetModuleHandleW
GlobalFree
GlobalSize
lstrcpynW
lstrcpyW
GetProcAddress
WideCharToMultiByte
VirtualFree
FreeLibrary
lstrlenW
LoadLibraryW
GlobalAlloc
MultiByteToWideChar
VirtualAlloc
VirtualProtect
GetLastError
user32
wsprintfW
ole32
StringFromGUID2
CLSIDFromString
Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc
Name
.text
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
867B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
120B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1024B
Virtual Size
648B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=14, version=7299,
count=20, id=1, productName=Unmarked objects,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=4, id=48, version=9044,
count=1, id=42, version=8803,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
Alkoholiske/sagkyndigere.eft
- SHA256 ae0316af7ad6762f0533beef2c46436e10c94e1f0b69a2e9357d8760a9e4c73d
- MD5 c7e290dca9539b1ca8d45db3fe31374c
- SHA1 5cfe4eb4f7f98b6e79086304f56c495cfc33015e
- SHA512 d1bdae5e10e7c32c991c6255104f5d6e17b1c61d582e37fcddaa63c61dce64b9bdfe8b55560c0507c542f2268a63e9b041c620591a53a69cac9d64c9d46450d5
- SSDEEP 48:Xk9VM7rtZe3VHqmhbm38YN4+kXkiw2fzArBRmcnyzHYg5w:0eZe3VHqKbmzN4+viw2fzQmSq4ge
- TLSH T173B2C60360EB28DA4D9A91B981388A4A534BB98BC37A15FC67E7008B09574A374CCF27
- MD5 SHA1 SHA512 SSDEEP TLSH
Hamadryads
- SHA256 3f03887001a62002a764c69386bf5233730b64df4d0df5f76e6c9c35fa7e2f6a
- MD5 096aa764e25e752f105d34265ee5de81
- SHA1 231b28ee7d4885d0755d61bab0b16f4a63e2bba3
- SHA512 80d11a2e3090bf5ef043d5968e57df0e6aa4a9b984b32b50db5a8dee39e8c5e33d95c6547010d447e37ded084d9d23453e9c687efa47d7a51a8710e158c629f7
- SSDEEP 3072:XrnUGlm5SuGTx84Y+BOMV48dUw72/waOaWyvraqH8zJDlUPwr:Xrd45QTx8V+nV48dDn9wd89Dlz
- TLSH T1ED04E1E87A81A662CFCA1532CD050DDF78193DA5DFA4A67B12DC042FF84C0DD50AEE96
- MD5 SHA1 SHA512 SSDEEP TLSH
Hvileperioderne.ops
- SHA256 33298ac4eae7df33e0901e8eb5cf936a32553631a2ec2313fb3f6a13b3a60023
- MD5 be00c17cb0719b56b0dc5100a26b0379
- SHA1 708825bb0e7d5e02be10b90f74dd7e7fae315b36
- SHA512 9557d43ae5fe9efc4cb1bb95020eeb1ef500034a334d6b40443f2b427bc47ff061df68ec73293af0b31be9a07ebb4cdb9c9728d08638cf01a2301c962f8743a3
- SSDEEP 96:rLiqrg4PO21yChrOGqk0rUY89ESyAei8lUlqUj7W3:rLQStVAk0rURLyAeipqUj72
- TLSH T1AF737DCD76B5C558E265301AF0E0A0B23343A25ECAD64F4F6121D2063E8BEAB45C367F
- MD5 SHA1 SHA512 SSDEEP TLSH
Opiners
- SHA256 d3724b3a0c3cd05c1753c7817378496e088855eae31e7545f91d86d1a5a65109
- MD5 a25faf2f4011cafc7450219fd40f1713
- SHA1 e606154c6d5b287819459e37b359684b13996af2
- SHA512 f4e8f723b320f22b113c018c2c506883939fa6fd92ca219fdc348fa58c3f60f93629cf4286d49ff0efcfaad3b0e127165556ad47c189a6bd09a8b3d5b6dcefc4
- SSDEEP 1536:Kr48ianvMxOK54vE/Yzg3YsbMxGwE2s4B2VaEiqasrneZHAg1HFJXFOmBpZnhY:Krnhe/5UEwv8Mx22s5VaEnLeZIwru
- TLSH T189E3BF55E75A8CBADC07C638C56E71A9485930269B0FE0BD7176EC24C2972E21334BFE
- MD5 SHA1 SHA512 SSDEEP TLSH
Whiners.san
- SHA256 d2589f0f921b7b2fe5b085225b966a4a760d9f225b2be7e6c905bf93aff059b9
- MD5 2bde9cd95a636519368d942329e6c391
- SHA1 c6da05a5525b512361aeb0e023c5fd89ad03e6e6
- SHA512 2dcdf019d2dfaa2589d0701b5df53bccc11f2c7753d37033feac3ba3163d096a81d9f1378f43bf33870487229d6bdb9e47ac1155d8a336fc100484e18535672b
- SSDEEP 48:Y8VpzESBq2lbuWA5mwYjgzhlwodM6XWoG+z264tGorBeyhS:YapzDBhbaUwYMQsbntz2640ory
- TLSH T16452E2738E7C8394AA03A0C33A020E0309EA80943AFA80AB07D63001C8FE392C882023
- MD5 SHA1 SHA512 SSDEEP TLSH
delphically.baa
- SHA256 42a3d803867b950b80a8e2da06fe472779a572a403e20c9b5dfc06b67798353c
- MD5 81023b070ef49e7a51888b9719af9440
- SHA1 da2c95e4536b4ea5c9b9e19a22cdd7ce5620559f
- SHA512 55d4427bba280d2f861768ca1d679225d70652fcb79285f8bf9cc0a94b52510c2cb4f7f72fb90c973454b22ef0af9ee3a537dfec172fd56210eeb9914b32b41d
- SSDEEP 12:bpXRnaZQmULJ7NdCa4aqJa0YLMchukxlXt8Ld+NHLNosLKw+tVIm6LzC+H:tX5rmUl76HM0M5ukXqGHcw6VsXCE
- TLSH T1F10275DBF0D10E42C70DF75534A244B04F138AE009029B2C1C705D7ED0838515E78FD9
- MD5 SHA1 SHA512 SSDEEP TLSH
doryphoros.sli
- SHA256 666a551ceb3672b241762758035c753a74b583d4cfce155597dc13d6c490417d
- MD5 3c2165419503a89626aec40018bc2dae
- SHA1 1a81bd4a789f7b4ee6102f4452cd6e269b262e72
- SHA512 73e790a6cfc1d982e2c267ce5080b64968eab41023f7824afb6962bb60e2c4ba868cbe97c3e118ccc36bf5d3d3f63876de9047ceedb5aa79433fc8ab5c733d64
- SSDEEP 96:YtvAtDeKuZ01BnyHwaBsCvGaiKPuZaJ2bbzfIcoc:YtvysayHwaNvG9KPubo2
- TLSH T10E939D337DCF35281A23E416855A07F6CC794B07A0E507212372A89B0D87ED2DAE63B9
- MD5 SHA1 SHA512 SSDEEP TLSH
headborough.yan
- SHA256 2a45ec5e023cec1866271945badd15061a7f52426d00554c453db9774e9bd634
- MD5 9bea6a31edbc2095017d74e2aae2df3b
- SHA1 d2b29f9a32e16f3fac75bf0e6069274e7130b904
- SHA512 0d403a399146e8fb9c6c4993c1823b19ee679609dad5da23fd1252d4b69b44060fcc2e67d00e43461ef1a00fc2064d01873419244605d986abe47aa7d9970de6
- SSDEEP 24:K84J4MqsdtNNfT9XN0F6JDrX9x2nAyDleBN9JntRhst/EiqeYvWhzZ+FZhvrs02w:KZzNxMkD9x2nAoYZtRhkXzZQTvVwSp
- TLSH T18E237E805F850C821701D617A35BEAD20CDE79A6A22D4A57DEFE170509A64347EC31E7
- MD5 SHA1 SHA512 SSDEEP TLSH