P0_#1037596[.]exe | Triage™

resource
unpack001/$PLUGINSDIR/System.dll

resource
P0_#1037596.exe

P0_#1037596.exe

IMPHASH 9dda1a1d1f8a1d13ae0297b47046b26e
SHA256 63f3a9264a8afae81e4cb56f5ade6ce4a8d9f7c20a6a977d07346d6aa769878f
MD5 5bd9119dc59d21c67c67faf81f6ec8c2
SHA1 1afc5ff23b6806bea8b83335dc802403147b30b5
SHA512 f4a5f14a7299af770cc489f3765c7caec54c32b5779b65db1db68749204f0392f2c035104a306487f5e54c6a0742dd1847aec46919d5997757de4118cb3886b8
SSDEEP 24576:SPdYZ6c4GLEmbWtr3YFyuZ+eB1SOSHxzdU3ja7tkU:+YkXmbWLeBUJ5Uk
TLSH
T13E252326B2A1D53BECB61532C8569EF637566D32D651062F5330FEDF3C33852823A628
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

1c:ce:99:77:5f:eb:59:54:5f:72:28:59:2e:3b:55:c0:a3:6d:cc:41:ae:b3:0a:f7:05:8f:a4:31:be:22:e2:bf

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Iridiocyte,OU=groundwater abnormities\ ,O=Iridiocyte,L=Orviston,ST=Pennsylvania,C=US,1.2.840.113549.1.9.1=#0c23486f7665647374696c6c696e6765724053746174736d616e64736b756e73742e737574

Chains

May 20, 2026

CN=Iridiocyte,OU=groundwater abnormities\ ,O=Iridiocyte,L=Orviston,ST=Pennsylvania,C=US,1.2.840.113549.1.9.1=#0c23486f7665647374696c6c696e6765724053746174736d616e64736b756e73742e737574

PE Signature issue

Digest

bc:9b:a3:77:83:db:1b:ef:b7:7b:b0:f8:8b:33:af:6b:25:65:0e:d8

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Iridiocyte,OU=groundwater abnormities\ ,O=Iridiocyte,L=Orviston,ST=Pennsylvania,C=US,1.2.840.113549.1.9.1=#0c23486f7665647374696c6c696e6765724053746174736d616e64736b756e73742e737574

Chains

May 20, 2026

CN=Iridiocyte,OU=groundwater abnormities\ ,O=Iridiocyte,L=Orviston,ST=Pennsylvania,C=US,1.2.840.113549.1.9.1=#0c23486f7665647374696c6c696e6765724053746174736d616e64736b756e73742e737574

Minor OS version

0

Major OS version

4

Entry point

13893

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegOpenKeyExW RegCreateKeyExW

shell32

SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW ShellExecuteExW

ole32

CoCreateInstance OleUninitialize OleInitialize IIDFromString CoTaskMemFree

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create

user32

MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW CreatePopupMenu AppendMenuW TrackPopupMenu OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW IsWindowEnabled SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CharPrevW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint CharNextA wsprintfA DispatchMessageW CreateWindowExW PeekMessageW GetSystemMetrics

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor

kernel32

RemoveDirectoryW lstrcmpiA GetTempFileNameW CreateProcessW CreateDirectoryW GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW WriteFile ExitProcess GetCurrentProcess GetModuleFileNameW GetFileSize CreateFileW GetTickCount Sleep SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW MulDiv lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject CopyFileW

$PLUGINSDIR/System.dll

IMPHASH 509a34b3a68a773e0afb4259e68f9f82
SHA256 9111099efe9d5c9b391dc132b2faf0a3851a760d4106d5368e30ac744eb42706
MD5 4add245d4ba34b04f213409bfe504c07
SHA1 ef756d6581d70e87d58cc4982e3f4d18e0ea5b09
SHA512 1bd260cabe5ea3cefbbc675162f30092ab157893510f45a1b571489e03ebb2903c55f64f89812754d3fe03c8f10012b8078d1261a7e73ac1f87c82f714bce03d
SSDEEP 192:VjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZv0QPi:B/Qlt7wiij/lMRv/9V4bvr
TLSH
T188426C1297B089F2F551493419667F2A6FBEAC5D27F405A3CFE304C63D212DBA879243
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Abonneringernes.agt

SHA256 31c8dceefad675239824866bed0d490ebf2d81c4627ac3370880b96d0100922d
MD5 135ba54dc5459e8fc707bec3cb090390
SHA1 685cf3184a1edfa064a979e19d25e6f984727d64
SHA512 1cb7fe1840e8b65c5f1ce200697784eabfd895757c8f8d37bba5cc54529107eaa127a650bb6f8d86688224d9fec770e33560ceec032412b5b3a4915a2a346144
SSDEEP 1536:2VVktQd85AbFEYWJoAu2x5+fyclYWQXITtvc9/Tjsh6m44:e
TLSH
T112C4E10F47FEE68C4A5AF3B12698B45DF443B5C7840BCEE352AA161C52BC319A41447E
MD5 SHA1 SHA512 SSDEEP TLSH

Anosmias.rab

SHA256 8e257287253c3a58c9865b8499af28b5919e94b7c6e7a0dd4a72541840aa54fe
MD5 06df47f8087f18cabc46d49f2195a80b
SHA1 aa183d54baf5eed7564181661dd5498ac54c2e37
SHA512 385f5a0538220ce8d2d33b50bc7cd0b37594c7b63726884fe0c6be4213cbe7612f1b918dd944039709addd4dbb86e60cfd6b5702a1f22eae90b7a082b5b6d83a
SSDEEP 1536:Vp2N5VWfrgntDlSVXSVOgwS6R2JgEO+5QAevEJoJ/AUK88QV4kw9rMhQq7/kf5Ls:Ky2u1
TLSH
T14C1612751FCDE458A494B910E9881393D84C1A8FA937C5B76C486F51EB3AB01CF2EF89
MD5 SHA1 SHA512 SSDEEP TLSH

Czarevitch.sli

SHA256 1cc772b8d0af3d52a3ae5cc18ca1bbc68fe3466e53061b64812d2a992bdab8c6
MD5 f251fa7b83e337eb4286ff17923a60e1
SHA1 053654ba55c480ea3a7eb617fdc14738788391ba
SHA512 129636f9b1bf722f2c7e8758d3d26c7cd313e073c11b57a81f6a2f32bf835ed4457c4b9a67c7e562d0a2ef0b25d731f2706c983ddfa51922a2040616b82f1129
SSDEEP 1536:c4PsTxhNQwMicV8hVmNVIfyihBEOp28MnVARMzc9CJOOOd3abc9N9f0zXNL4MdIX:Sf
TLSH
T1EF061234B25D5DC09A9A177A144A8A1304C9DA370A8D323B600EE394DEF45DFBB37D9E
MD5 SHA1 SHA512 SSDEEP TLSH

Feriers/banners.ini

SHA256 8521ad0b0b3b5aff163bd83ac5e9a2a965d0119622b13bf700ea0c306006498e
MD5 5bdacd8a013d3231811a8587c9682122
SHA1 d386edab6c989748906fc92ea20d727df3f642a0
SHA512 ddc865d6399ae4397e7c55ab3f2247e09e0094b0676ec68d3c813cef9f30d1e06a1eeae4317b79069921b94a5b19ec8b18fc1036d45aca2ad1cbf4297640a327
TLSH
T126310AE4DEA221E8DFBA13D77CC92E2086BD95218642183D71DF072C36410AEC3FE624
MD5 SHA1 SHA512 TLSH

Feriers/impertinensen.ini

SHA256 15fbe255fca5247517c00e3625c16f7cb7fc1fd5086375e1a9326fc3eac57fb0
MD5 25a26855f0f8141088e2ced44850fd5b
SHA1 5c5758b226c35d4a45e838a3743ad256c1309233
SHA512 4f7d0a63151ff4823c5ea143aed00b65cae6d7ae4066fbe96fe89fcf1390c3e370802cf8ebafd91bf668311c523332091b43e2347036ea4595e7f09fd8fbac01
TLSH
T1C85109A8DC5724944E9A03CA3C81292086FE95254913453E759F071C75864DDC3FE718
MD5 SHA1 SHA512 TLSH

Feriers/lrlingekontrakt.ini

SHA256 c797e017e141a55efb7e2b796c5a67ae22503c834e3703d2c0da52b7a1787fea
MD5 60fe75eb82b230009ce5f54e3ead24bf
SHA1 4d8a05513c300e7c7bea9cb8e443175ec72ea6be
SHA512 a143b1efe150e69d30a21e08fc484cc43c8974168b593f66252d42c9597db62ef46e51ee81121b99c15b5c6b2e430844227554ff5e6ec19c7d487fc016fbc481
TLSH
T1F35108A8DC5765E84D9B13DA3C922A2046AED1254903453EB5DF0BAC75829ECC3FEB1C
MD5 SHA1 SHA512 TLSH

Feriers/pseudoculturally.con

SHA256 e8a3d6683166ba4a5351431a7e010b3fc21313f5958de705c195dfe634fb6da8
MD5 5e4e0ee3d40b1e8f3b780f92a63f8689
SHA1 73915b57f444133b81c7eafa1c9aaf74391dc52b
SHA512 f7e7463df283fdc97a2a25eb560128d9317e55bb1d5a6caa18df0ed2c7259d77a7ef35ec232499f702606499096e9df013ded92bbce85b5898379bf8089bac65
SSDEEP 1536:oS0jBnh7qW9W/IAa3sEEDhxPKLhc5HgVg6GUC+JKEbGXshInhwclz73MwgBqpFrE:Y
TLSH
T14475F25CB09FB76FA6066AFE1B11C703DF52D643385C214BA54291C065F07AFB2D8639
MD5 SHA1 SHA512 SSDEEP TLSH

Pertinente.Huc

SHA256 d53cb3b7cf2100cbd44e5552e72732d3ec711c494a2c42bca6c24c23f2d54bd1
MD5 79e32e404eded8d72cdcc80d062bc60d
SHA1 055cafa05236045aa965bc8fecc81ebe92b79de2
SHA512 26238e81ef9e86549fe3ff9933f7bd85470fcd2730c495a0c83e2a2e8365991a0e9a8c57b09830fd863ca1c3189e371a9dbe5c80d01f09e2a46c74b18bb10a8a
SSDEEP 6144:oix3HWP/QWVlMJVdJqzsjTrw+q6L9jzJUNJVzTqOBk9kwVA0clYDicPwNf8z:oiZHK4ilMJdqzkvw+J5nOFw4GlwNA
TLSH
T1479412FAE66D575AC598093CD86E0D7D902ABCEEB1991BBF835F402313D90C5B72420E
MD5 SHA1 SHA512 SSDEEP TLSH

Venstreaflednings/torrefies.ini

SHA256 8289a77204b34bbd8ac4dc18a9cac4e2c4b37a46d904453b66afad5d58b2e860
MD5 50e49a4a301b6ca6676ad3561e5b0344
SHA1 67ac9ec37217c5a8abb9fdf8870af562ef0a4248
SHA512 6d8d5b3fb6141384e57102b7c8aa7ec5817fb4e262da4b4fe599fa561d21d77a0c7ecb3e4079c3db88115aab892e9efe49d8df2d285af39a04f08840f936c67d
TLSH
T18AE0F160ED1303E565AC0187786C3C206CBE0B744CB1390970BD03D416450CED7DA1E8
MD5 SHA1 SHA512 TLSH

Venstreaflednings/tovningens.ber

SHA256 c36e8428521e5f6edc508421ee0e8138ec3284183cec4f0b6038227f35ed8716
MD5 1999744654c5d02aba595db08288969a
SHA1 97b03170e6fdc1fd7f065ada26687051c49fa4a4
SHA512 c61a1b4c143bcac27f68abe2f6e41fd1ea70d7ea4ddd46858d1e89bd1522d6db57e1458adcc6595d5d14112b63217034e714de30d861ede15f762ded503c9816
SSDEEP 1536:fV699Ac+q8MV64FlENSWQ1Oy3i23rsG4FzsuZi8FVi+Op4uyVtjGOhIU0uslasYE:LoFKK
TLSH
T18E36135AAC3CB61DAE0D92C1952630FFCEE3CA47C61C6E53437AE49864F96237ED0065
MD5 SHA1 SHA512 SSDEEP TLSH

P0_#1037596.exe

PE Signature issue

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Abonneringernes.agt

Anosmias.rab

Czarevitch.sli

Feriers/banners.ini

Feriers/impertinensen.ini

Feriers/lrlingekontrakt.ini

Feriers/pseudoculturally.con

Pertinente.Huc

Venstreaflednings/torrefies.ini

Venstreaflednings/tovningens.ber

Sharing

General

Malware Config

Signatures

File Explorer

P0_#1037596.exe

PE Signature issue

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Abonneringernes.agt

Anosmias.rab

Czarevitch.sli

Feriers/banners.ini

Feriers/impertinensen.ini

Feriers/lrlingekontrakt.ini

Feriers/pseudoculturally.con

Pertinente.Huc

Venstreaflednings/torrefies.ini

Venstreaflednings/tovningens.ber