scan[.]exe | Triage™

resource
unpack001/$PLUGINSDIR/System.dll

resource
scan.exe

scan.exe

IMPHASH b34f154ec913d2d2c435cbd644e91687
SHA256 aa1105659d2cba649744a8fab29478af596927dd6bd8da12db3d8a5bf2d3a15a
MD5 52ee9a8245eff62190f6b54a4aa7e35b
SHA1 686cd7b7b7b4ac0d3724fb5f3179976778f258cc
SHA512 ec64f2236e91bec9e656da59f493aaa9588a999e8bb55094c1bf7ff157b082b83678975708fd7999072eb729f54017392e8d94376a79fb44739251d0cf29221c
SSDEEP 6144:J5lz/Zgm8JjEt/X9DXICgdmc0pjLRKHMdBcljglISNQkcXiV5q0kYDpKSWo43OVb:zFo8/XxICqrkLRKHmmmBNIYlKSWxp2
TLSH
T18AA4F152EA8191C2DC38A970CC5784791667DD3898E40F4B3B5CB33E68B72425C2E7BE
MD5 SHA1 SHA512 SSDEEP TLSH

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

7a:e6:d7:46:af:5e:40:dd:87:54:58:22:be:90:dd:e8:40:14:44:2f:1b:f8:65:a0:9b:38:63:f2:9c:2d:2b:a9:40:29:1a:f2:7f:06:f6:2b:34:39:80:90:fe:e2:39:70

Digest Algorithm

sha384

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Funktionernes,OU=Cashing dreadfully\ ,O=Funktionernes,C=DE,1.2.840.113549.1.9.1=#0c13476f7468697465404b756c6c6572736b2e416e

Chains

May 20, 2026

CN=Funktionernes,OU=Cashing dreadfully\ ,O=Funktionernes,C=DE,1.2.840.113549.1.9.1=#0c13476f7468697465404b756c6c6572736b2e416e

PE Signature issue

Digest

f1:9c:d3:a5:ea:a1:f1:02:0d:b6:ef:08:01:df:45:0a:12:ac:42:8b:8b:84:52:82:ac:45:e0:7c:c6:88:42:3a

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Funktionernes,OU=Cashing dreadfully\ ,O=Funktionernes,C=DE,1.2.840.113549.1.9.1=#0c13476f7468697465404b756c6c6572736b2e416e

Chains

May 20, 2026

CN=Funktionernes,OU=Cashing dreadfully\ ,O=Funktionernes,C=DE,1.2.840.113549.1.9.1=#0c13476f7468697465404b756c6c6572736b2e416e

Minor OS version

0

Major OS version

4

Entry point

13145

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetEnvironmentVariableW SetFileAttributesW Sleep GetTickCount GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW SetCurrentDirectoryW GetFileAttributesW GetWindowsDirectoryW GetTempPathW GetCommandLineW GetVersion SetErrorMode lstrlenW lstrcpynW GetDiskFreeSpaceW ExitProcess GetShortPathNameW CreateThread GetLastError CreateDirectoryW CreateProcessW RemoveDirectoryW lstrcmpiA CreateFileW GetTempFileNameW WriteFile lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject lstrcmpiW MoveFileW GetFullPathNameW SetFileTime SearchPathW CompareFileTime lstrcmpW CloseHandle ExpandEnvironmentStringsW GlobalFree GlobalLock GlobalUnlock GlobalAlloc FindFirstFileW FindNextFileW DeleteFileW SetFilePointer ReadFile FindClose lstrlenA MulDiv MultiByteToWideChar WideCharToMultiByte GetPrivateProfileStringW WritePrivateProfileStringW FreeLibrary LoadLibraryExW GetModuleHandleW

user32

GetSystemMenu SetClassLongW EnableMenuItem IsWindowEnabled SetWindowPos GetSysColor GetWindowLongW SetCursor LoadCursorW CheckDlgButton GetMessagePos LoadBitmapW CallWindowProcW IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard ScreenToClient GetWindowRect GetDlgItem GetSystemMetrics SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharPrevW CharNextA wsprintfA DispatchMessageW PeekMessageW ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow GetDC SetTimer SetWindowTextW LoadImageW SetForegroundWindow ShowWindow IsWindow SetWindowLongW FindWindowExW TrackPopupMenu AppendMenuW CreatePopupMenu EndPaint CreateDialogParamW SendMessageTimeoutW wsprintfW PostQuitMessage

gdi32

SelectObject SetBkMode CreateFontIndirectW SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation ShellExecuteExW SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW

advapi32

AdjustTokenPrivileges RegCreateKeyExW RegOpenKeyExW SetFileSecurityW OpenProcessToken LookupPrivilegeValueW RegEnumValueW RegDeleteKeyW RegDeleteValueW RegCloseKey RegSetValueExW RegQueryValueExW RegEnumKeyW

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
MD5 0d7ad4f45dc6f5aa87f606d0331c6901
SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
TLSH
T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10643

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Saves/konsekvenserne.vov

SHA256 1741d27cc0302398064b62a819fcbb057888ee454311f4c2c172c94c8003185d
MD5 d66d07a9d1de21e9808b3efd56d3fbb8
SHA1 0d9e82fc572576d31ebca235728c71a3a692db64
SHA512 cefdf5e297c24ccaf57b1f222b0a92b3066ffc96963e27230999e62c81c3e01f0302fb17389922414222c3c2dc42f92220f41c3ea6fec4bbb04787b9a5561584
SSDEEP 96:SKgyznAwvGI9/C12Z2RmUce0tsAfPODzyPqx:DXzAwTq12wKe0itzX
TLSH
T10F633BCBBDC38D38F70FAEA2DB983126414D0365AA201478005CB2BB5AD48A22037FF1
MD5 SHA1 SHA512 SSDEEP TLSH

Saves/nicka.whi

SHA256 372f572c092c196831b2e26904466778abcc86a8fe9cd297ce85d83200791e9a
MD5 c42838670ca60e4c9e26f16e902ec787
SHA1 57892bdc85083fdee049500e99ffb9610e602d61
SHA512 0f6bc28e3a4070a03c8582a832a72fe7b03042226c445a37a649a334b88dbc8c50fd85941440d27476851c0423fe5594767de2695f90e844c3fc22c706a5b192
SSDEEP 24:rFNB8FXgegemY+DY8sg0pvsSiEJc06PlcaTcketMw/YCX:RNG7gDY+lX2sEOfPlfTHMT/BX
TLSH
T1F8E275A7B2045183CDD5DE1BA6403D25C819C471CECF2DFDB4F4A12B63B01CA5B10123
MD5 SHA1 SHA512 SSDEEP TLSH

Saves/sphaerococcaceous.exp

SHA256 eedaeb4e249d48dc536e68c339f53c48a3a6c204892d6fa0551049adc71011ed
MD5 e388dd68db31591fa89db6b1b18286e1
SHA1 6aae00d16a607cb0e9e730081c6c8052cecda693
SHA512 8d9e0ce0b48f568b9afca55c1a6d95f812e71b7cc3cd49f2c132866d36418a81a929f22c314be6936f708a195d510c186e4ef5f15b1abf1afbb8dff0f9eb56f2
SSDEEP 24:cwR4t2tJeKYokwrCUPI2gz5U0AJQ8oIwpDsRJB:cOC2f9YokwrCUGNUExlgB
TLSH
T17C8220521D808939B820229C229320D99409F4300FE38931FC065D2BAEE746D140985A
MD5 SHA1 SHA512 SSDEEP TLSH

Schmelzes

SHA256 6f6a5c1fb518f6980536f23f358823f249789171a96c40a87594d90163057c92
MD5 816f44996f042e4c1f7d9561f4d20b27
SHA1 8fc6f406418e49f31b6802db439a3adee6c40d3e
SHA512 abd835ed34cb0e0a0a5d663c524c4cdcd2a05afc3e7242deb142704d94bc643837ceba0e10c3429136e7d332e3e4ba7e0c1d6848a23edd42445382cb656da7fd
SSDEEP 3072:0UP5x6uutHl9qL8gYf4gVqRLGyob5wIHcJXdrd/lgfOaMDiTF:0Q5cuu1H4tLtobRHGNd9aMWTF
TLSH
T170F3AF95C76A8CBADD06C538C46EA1FA4D5870169B4FE0FEB179E814C1472E323247BE
MD5 SHA1 SHA512 SSDEEP TLSH

Sveskestens

SHA256 5ca460697266fe4c212f87e59d912780d73cab2e415ddb4141626f2bb6dd24ae
MD5 fdd2c9c0fe0bd9714fa636d78a619844
SHA1 550d07aba2c8f7b47b61ac7802afc5051e31e92a
SHA512 e42ce1d441f9e7e013af95f5bc85258a4a628fd5da9943dcd661b9dd8cacad0e3c9447ae323c799e7d345114beaf912e6050e9bd876a80c40bfd170f38156ea0
SSDEEP 3072:I6ZqNihnPv8Z2jk6TepHVKXigGy6SJkeAjg6tZtuJmQ1Y7aE9PaVFwG:I6t8WkxHV1yJTW9TtuJmQ1UaQPaVSG
TLSH
T1A824CEEE9AD3BC26FEA9183CF53F632C6A3CBDC50962F037412568435564E1571E2913
MD5 SHA1 SHA512 SSDEEP TLSH

Undervisningsministeriernes244.bet

SHA256 e8c4f3e0394c0a9767240f211e47c397b1883ca83b2a3f1350fd33828477ff04
MD5 f32ddf7eb9e5c1be9f9f5666aeaaf94a
SHA1 422c236fcb453a4dffc8ad1b454e52a794401ebc
SHA512 799bc15390095b474d5f94753939993dadb37ad34f0f205935224625781b0f5df0039a6a129615bea509e9aeb24f2d099e7884f92863d5c7e61a48d3e7a2a1f1
SSDEEP 48:cGlfX+/K68j/2A44CgjYWeQ5R5kxbTh6VNmktikFf2iL:cGx68j/r44heQ5HqThuNkgfj
TLSH
T1A56319219E0D8FD84A3D08110D8986209629CBBADF4709D1C34F1C8E2902AF0FA4B57E
MD5 SHA1 SHA512 SSDEEP TLSH

scan.exe

PE Signature issue

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Saves/konsekvenserne.vov

Saves/nicka.whi

Saves/sphaerococcaceous.exp

Schmelzes

Sveskestens

Undervisningsministeriernes244.bet

Sharing

General

Malware Config

Signatures

File Explorer

scan.exe

PE Signature issue

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Saves/konsekvenserne.vov

Saves/nicka.whi

Saves/sphaerococcaceous.exp

Schmelzes

Sveskestens

Undervisningsministeriernes244.bet