PO-NEWORDER-0046[.]exe

resource
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll

resource
PO-NEWORDER-0046.exe

PO-NEWORDER-0046.exe

IMPHASH 1f23f452093b5c1ff091a2f9fb4fa3e9
SHA256 707a26e9f7bc1106f0d10386fcbe2ab0dbbfb8a697f7f206b574b2596b8f3154
MD5 4fb3dd6ba2b4c5f18c229967c24fd90f
SHA1 fcee2478a8a56d6ebd15db2497b34bac6242e3f6
SHA512 97485e1b8aa683f265576dd1f6e80d48f6cabac3ba5ad62399b7b5e90cac327357bfba738228ec64afb7f9d9defa0c925a808005dd3344c0d25615dd314377e4
SSDEEP 12288:iiMUrvBKRpqkVRh3pQvImn1Wrxb7P3C5+k0L74FMFr0FLIKvBt2c:iiMULwp/R7FyW9Py5mL77ILIIBt
TLSH
T195D4231564508613DE794F32AB289DA6FAFA9D513CA182CB33C27F0B39793120F9E715
MD5 SHA1 SHA512 SSDEEP TLSH

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

ad:cd:d5:6f:a5:54:34:01:72:1e:34:c7:81:10:c8:4f:2e:e5:8c:cc:16:65:93:42:85:76:96:10:e7:6b:8f:1e:b6:b3:dc:95:98:ee:f0:56:83:88:95:f4:b1:98:e8:2b

Digest Algorithm

sha384

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Eremitage,OU=Supplies Bulrush Gaincall\ ,O=Eremitage,C=DE,1.2.840.113549.1.9.1=#0c184d696f6372797374616c6c696e6540426568756e672e536b

Chains

Jun 2, 2026

CN=Eremitage,OU=Supplies Bulrush Gaincall\ ,O=Eremitage,C=DE,1.2.840.113549.1.9.1=#0c184d696f6372797374616c6c696e6540426568756e672e536b

Subject

CN=Eremitage,OU=Supplies Bulrush Gaincall\ ,O=Eremitage,C=DE,1.2.840.113549.1.9.1=#0c184d696f6372797374616c6c696e6540426568756e672e536b

Serial Number

54:12:03:b7:8d:7b:4d:18:02:3c:e7:4a:34:51:cf:15:26:bf:3a:73

Issuer

CN=Eremitage,OU=Supplies Bulrush Gaincall\ ,O=Eremitage,C=DE,1.2.840.113549.1.9.1=#0c184d696f6372797374616c6c696e6540426568756e672e536b

Revocation Status

Not revoked

Timespan

May 3, 2026 - May 3, 2027

Subject

CN=DigiCert SHA384 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0c:20:43:49:f9:d0:f7:59:fb:98:2d:e4:08:1b:88:7b

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

13449

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

ExitProcess SetFileAttributesW Sleep GetTickCount CreateFileW GetFileSize GetModuleFileNameW GetCurrentProcess SetCurrentDirectoryW GetFileAttributesW SetEnvironmentVariableW GetWindowsDirectoryW GetTempPathW GetCommandLineW GetVersion SetErrorMode lstrlenW lstrcpynW CopyFileW GetShortPathNameW GlobalLock CreateThread GetLastError CreateDirectoryW CreateProcessW RemoveDirectoryW lstrcmpiA GetTempFileNameW WriteFile lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject lstrcmpiW MoveFileW GetFullPathNameW SetFileTime SearchPathW CompareFileTime lstrcmpW CloseHandle ExpandEnvironmentStringsW GlobalFree GlobalUnlock GetDiskFreeSpaceW GlobalAlloc FindFirstFileW FindNextFileW DeleteFileW SetFilePointer ReadFile FindClose lstrlenA MulDiv MultiByteToWideChar WideCharToMultiByte GetPrivateProfileStringW WritePrivateProfileStringW FreeLibrary LoadLibraryExW GetModuleHandleW

user32

GetSystemMenu SetClassLongW EnableMenuItem IsWindowEnabled SetWindowPos GetSysColor GetWindowLongW SetCursor LoadCursorW CheckDlgButton GetMessagePos LoadBitmapW CallWindowProcW IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard ScreenToClient GetWindowRect GetDlgItem GetSystemMetrics SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharPrevW CharNextA wsprintfA DispatchMessageW PeekMessageW ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow GetDC SetTimer SetWindowTextW LoadImageW SetForegroundWindow ShowWindow IsWindow SetWindowLongW FindWindowExW TrackPopupMenu AppendMenuW CreatePopupMenu EndPaint CreateDialogParamW SendMessageTimeoutW wsprintfW PostQuitMessage

gdi32

SelectObject SetBkMode CreateFontIndirectW SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation ShellExecuteExW SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW

advapi32

AdjustTokenPrivileges RegCreateKeyExW RegOpenKeyExW SetFileSecurityW OpenProcessToken LookupPrivilegeValueW RegEnumValueW RegDeleteKeyW RegDeleteValueW RegCloseKey RegSetValueExW RegQueryValueExW RegEnumKeyW

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 c2f405d7402f815d0c3fadd9a50f0bbbb1bab9aa38fe347823478a2587299448
MD5 9625d5b1754bc4ff29281d415d27a0fd
SHA1 80e85afc5cccd4c0a3775edbb90595a1a59f5ce0
SHA512 dce52b640897c2e8dbfd0a1472d5377fa91fb9cf1aeff62604d014bccbe5b56af1378f173132abeb0edd18c225b9f8f5e3d3e72434aed946661e036c779f165b
SSDEEP 192:eX24sihno00Wfl97nH6BenXwWobpWBTtvShJ5omi7dJWjOlqSlS:D8QIl972eXqlWBFSt273YOlqz
TLSH
T1BD325D06235081F3E1914138846B3E175F6A15069BF58E97DFD38646BE30BE7BD79503
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10178

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsDialogs.dll

IMPHASH e2ee55bddad4241d619d6a8a38e2d869
SHA256 86c8ee210e6611383a634dcb8c60455063ddae3d7adccbeacf3adf7bf2a46676
MD5 d2e45dd852a659e11897df573832f381
SHA1 19990ee627c95b6c18d3b5c5f0ec5c24791d0af5
SHA512 93c9fa1767f3e861fe5765f2940aaba9eee6396d069c443ac6cbaccc88441b2bfc3c3af50a8044161f96bb7eb81af1bc6c1fa754d89740d0a2a8d591fef11073
SSDEEP 192:o18cSzvTyl4tgi8pPjQM0PuAg0YNyfIFtSP:8BSzm+t18pZ0WAg0RfIFg
TLSH
T1A612F793E5E420B3C6D3523F35BE2B2EC7BD5335B0512C0482738A497A6947A6E38347
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

7443

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Antiterror

SHA256 10b7d6bb6d501f034dccc720aa0bc0dd8c8457515c63e34fc082f30d2f865500
MD5 4dd5e5420f808599e47bb2dd65eea43f
SHA1 2515b6e4f32e6233d60279e74b665eb722da18af
SHA512 e3b4ba0911bfb58b1858f1435df773741f98317ec2dbef4edcf813e05453baad69a413f52fbee6437d84d15ef0111891e6825e9bddf32fd8d9b2d49638cbb82b
SSDEEP 3072:yJpXeb4Z5YgZZZZZZZZZZZZ3ECErOSjWMBmoKItAb8fBpCLgxEG0Ou6LLLLLLLLJ:welYEzLtAYpv902LLLLLLLLLLLLLLLLJ
TLSH
T13BF3E197BB3E4A1CFBC30E5442FAC61265A286665D7471F4F886EBB0C9791A03070E5F
MD5 SHA1 SHA512 SSDEEP TLSH

Ascents.tum

SHA256 75045dc21e3716ff5bfcac9bbde7930db596f3f1ba997e5b6d32e1e9b39dcd4b
MD5 39dde69d60fa31218f17433a6a9733f1
SHA1 5d994faee6e31af6f06bf91de439b5fa5a45f77e
SHA512 f2310eb4f1a329c360f4d01079911318536ff7f124ad1534195c1061afd7c9444196b8908e259fe5cb43da060a67a914efbc32d4b592be167ceec4e1f96fcb3c
SSDEEP 768:kgzjdjBFXbJKLMXX6RmDYBOEgOnV4gGDr2MN1AAafxGnXMCewBidanLdUvn7mw83:TY
TLSH
T102F51280D9E3DE41E5C46E7EEA1FE8D9989AB58B5E50E51332F81089F21E3E186EC010
MD5 SHA1 SHA512 SSDEEP TLSH

Factotum/symboliseringers.ini

SHA256 f31f13c1a6f451d9c9eb482e195dc363d429c7e3def40b389c0784ef84274e42
MD5 33b4695538c9814fe75bafb469ab8337
SHA1 4128ff21c1388afbbe5d69332406e3bf8abd873e
SHA512 4bad0c030f21fbb9f7a5b48dcc8a6fef39fb622907ca89130091077e499feb352d8ec9430a9ea1483edc2c9fb1c998cddd1f4287563ef391170a41284a0ea07d
TLSH
T10FE0C04DF7089450C9041BDFECB308827D4E41B7A902A8807DDB428EB22033C654824D
MD5 SHA1 SHA512 TLSH

Factotum/yndlingsbeskftigelsers.mrk

SHA256 1051c1a839442ade3552908d180d47b7f6d9e3fb0c9a1929f7ecc2c1cbaf2ad1
MD5 d0cc352c1b88eedc6f3d2153f2f50414
SHA1 516b71dc0d9261b2d0b918ee4f90dbea64a25ddf
SHA512 35109dc06e4500472a45ad4714c7b36be584472c17524b4b2d4f3e3dd3ad966fb0982c28e2880f9558824cdc735a62721b93cd8b9d5e70d929120a0807dd1437
SSDEEP 768:GMS/N4YvIIeSYW3Q4hu0fM2qUHSL2svVfb6fA83vVKxI5pdLij4HzRoq9Kv/7iSw:GMw8D/Rx
TLSH
T157762343ED94E0DAE7360CBC41B79EE7003E56295BA2F1834D394821315B72F9F2A359
MD5 SHA1 SHA512 SSDEEP TLSH

Nytaarstid

SHA256 32a59537f792b429f3c917a6279e5659ad45bf05ae867332f528dacf5de66de8
MD5 e0e827d56cf437db1bc55b69f81f8a59
SHA1 726802b4ccef76d9621362cf00f461c5f993c87a
SHA512 21ada8a9b66fe6b0ca28866bceb506cae6aa2743aa84806d45a56d2cf4464dab0749c24bdc27542e9557f75ec2aeb183d86471d01e5213a702133321a659c578
SSDEEP 384:UUwl3I/hDPWe2oHK3l9Fenx9G+CmmWzXOS:UUwlYZDPWe2o8Anx9fCZW71
TLSH
T18DA2B06287A19C77D907CA3CD19EB5A38D3D7021AB9FD4E920A7482CC2A57D25B343D3
MD5 SHA1 SHA512 SSDEEP TLSH

casks.jpg

SHA256 576942443027cd0f7af9cff47f95724a1839dc8e4aacf7ff0e38686b351e9b08
MD5 ba229dcfa8a46d90764e3a73c15f68ea
SHA1 22b84c2be4423a1a561f007229a392b0132b9849
SHA512 5ea5638dbfd4f87f15fef3758bfe718cc39d5161eb216261a787ef5e3459ca867d94ac6b569993c57de4dcdb58b72c1f5cacd66d9c521e3ff9c474a90c320a8a
SSDEEP 1536:VPuolECOmpE2kkyz9k5FSsEQT1o8YGqFz1Re17NZEPa4lmy:RuoGCxu2kqbcQT1gLvRe1ox
TLSH
T1F1530234864A6F39466087D0DDBF3C59F2E84C6365C4A839B73488113B80D7BA7D98BD
MD5 SHA1 SHA512 SSDEEP TLSH

PO-NEWORDER-0046.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

Antiterror

Ascents.tum

Factotum/symboliseringers.ini

Factotum/yndlingsbeskftigelsers.mrk

Nytaarstid

casks.jpg

Sharing

General

Malware Config

Signatures

File Explorer

PO-NEWORDER-0046.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

Antiterror

Ascents.tum

Factotum/symboliseringers.ini

Factotum/yndlingsbeskftigelsers.mrk

Nytaarstid

casks.jpg