_8bda7db9909e9b4e6bbb325102bae2639f622cf3d895e1b500f7a02cfd21608d[.]exe

resource
unpack001/$PLUGINSDIR/System.dll

resource
_8bda7db9909e9b4e6bbb325102bae2639f622cf3d895e1b500f7a02cfd21608d.exe

_8bda7db9909e9b4e6bbb325102bae2639f622cf3d895e1b500f7a02cfd21608d.exe

IMPHASH 46ce5c12b293febbeb513b196aa7f843
SHA256 8bda7db9909e9b4e6bbb325102bae2639f622cf3d895e1b500f7a02cfd21608d
MD5 eaccbc831b2fc77bdcd8eb19f5f3dee1
SHA1 9f70c4d1ab267ffc886ca66f1d46e51b43c393a6
SHA512 c01691f06101c3e7e1e86fc8018636e42c9dc18a0ed336244f37821d6c2c0e1c7c17b60a5306c629532e8bca56535f694a00bd53771fca164d954bbe1022667d
SSDEEP 3072:blnffjVrwUak7uVPvA5fCDlS2wpjJYrQFCIikHOlSE5i/4xhQRZKXGfJI1ok:blnhrwtVPvOKDo2wjrTikHE5vxiKXGfU
TLSH
T12B04F15532A0C863D6E206701E765AF6EABF9D511594030B6F283FAB7D335B2810F793
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

91:c4:98:fa:14:3d:ee:f7:3c:43:73:18:ab:47:8b:11:56:4f:83:f1:8a:6c:63:d9:cd:a0:00:38:30:d6:66:4c

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Mavelandede,OU=Skismatikeren Variorum Petaloidal\ ,O=Mavelandede,C=FR,1.2.840.113549.1.9.1=#0c1452756d6261656e3137334048617965642e53796e

Chains

Jun 22, 2026

CN=Mavelandede,OU=Skismatikeren Variorum Petaloidal\ ,O=Mavelandede,C=FR,1.2.840.113549.1.9.1=#0c1452756d6261656e3137334048617965642e53796e

Minor OS version

0

Major OS version

4

Entry point

13983

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegOpenKeyExW RegCreateKeyExW

shell32

SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW ShellExecuteExW

ole32

CoCreateInstance OleUninitialize OleInitialize IIDFromString CoTaskMemFree

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create

user32

MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW CreatePopupMenu AppendMenuW TrackPopupMenu OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW IsWindowEnabled SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CharPrevW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint CharNextA wsprintfA DispatchMessageW CreateWindowExW PeekMessageW GetSystemMetrics

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor

kernel32

RemoveDirectoryW lstrcmpiA GetTempFileNameW CreateProcessW CreateDirectoryW CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW CopyFileW WriteFile GetCurrentProcess GetModuleFileNameW GetLastError GetFileSize CreateFileW GetTickCount Sleep SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW MulDiv lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject ExitProcess

$PLUGINSDIR/System.dll

IMPHASH 509a34b3a68a773e0afb4259e68f9f82
SHA256 996645d7f16a6294babb6da83478062aed7b72318d7a51b66e90ab5d3edc51a5
MD5 6d08f0d5503bb100b8429fefaad163a6
SHA1 2a79aac2d3b715326c3dcd3c5cf2e33de3632a0a
SHA512 e259b1aff39c533e3e31cf4eb323c8eb22b2beeb5d8ce2c929de30702a6d8ab8076aeacc983d724b05d7d99a6de8c4d239bd159642c7e75fb86faef683360a1f
SSDEEP 192:cjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZr0QPi:s/Qlt7wiij/lMRv/9V4brr
TLSH
T1A9427C1297B089F2F151093819667F2A6FBEAC5C23F405A3CFE304C63D212CB9879243
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Lp/formspndt.unt

SHA256 3ee6c1e6f5adcceaa37bcd45821a28ce7c86d385dc5abda8009045b3afe2aba1
MD5 e105c55777e3debd9a4047345f593b27
SHA1 ce6170011f9e46a276e7853775f69563e631f254
SHA512 bc41fa1f18b6465dbf0bbde4fa2c6792811a90eb1d39f4fe75bbad4843e41561958ca6de0a732029def3d1b7d95bb103ed2631ffdc92498662daa57a1879137d
SSDEEP 24:VhBlJUK32G0p0BbdzkIFBpkfIwYvuwSjOln0aEjAXjKKftyXC7eiAAFwfo7:+9GbN53nkfMMOhvjriqAAiY
TLSH
T19713C80989673417A1B9781230F4C551C7A049EA29A480E89DB6CFB46BE526B0183C0F
MD5 SHA1 SHA512 SSDEEP TLSH

Lp/grinagtigt.his

SHA256 625521af0b4e478931a211001330911c077bc002ad4392e73edbb5ee80f769dc
MD5 4b161ae288c22dd38d22b79442b19802
SHA1 774633d0eebebe35db32f4adcb0f521a2908d56e
SHA512 b6ffe83ef6f9ae39bec9b247265ae55f8d3ea15fbcabfdfb18cbf49473e44b93c17fd79a58a7f666c8c46a8499ebab1ffac1288bce7be3a82b7cdb7c63e2d232
SSDEEP 24:CC3vTeo3m09qxC78W1qu1fcgVJy1lUCA+pRf+A64woaHdx:Cav6yve24gvglUQa9/o4H
TLSH
T1E423E7A28CDFBA26190E4A99706034505BC9134394A37C51B12795A5BA20D709212827
MD5 SHA1 SHA512 SSDEEP TLSH

Lp/ndsituationer.hrg

SHA256 304ff482da5b05c502a65457eca87b6ff9fa4b0ddc585ecc2a81a728593281bd
MD5 af6234943b3c21772c1d1c63cde300aa
SHA1 68cc7b49f4755b6cbee1fd9789ad712976ac6716
SHA512 e9e20afdced3de970e81890d805f59fa2a73c17003bec3aeebb0ce86f71fb1d4cca2eb6730cc28a92d2d0d7fdf41522620b9efe9ff66b485adada1a989448b4d
SSDEEP 48:4PD4edPTj4Q+ByLK2SDqVOBrtm8GYdElgvL+pC664FwBt8L9/v:47TjYyjI5mVYdugvLaCGSs
TLSH
T13C43D6B0C4920432832C1E0C9B62B4A99E2A9F2CAF58510903C628933AF7778117CF9A
MD5 SHA1 SHA512 SSDEEP TLSH

Lp/preparatively.ove

SHA256 5964d660fc8745c75e8b9515d851e4dfa083f03f51f395b55b70b92bae900ee2
MD5 4392b696c0325efd139f67469ac35a6b
SHA1 bb73818658eec593244220859f7732f2dd990049
SHA512 9ebf2a18ac99e7f41a2206438e79bdba83074356b0cb9b46b73b072c83811ec9ea47ac3731c2596fe835e5831b179d3cce77e0e01cb0ebf5557ec22b994f0649
SSDEEP 24:z5dqvMilZntDNSOWt+3cV3nOFtO7JEPCKN1N0IhONe:MjBMPk4O/sqN1ZhKe
TLSH
T177C2C53CBA488A604B365A7E8E133C67602283F54BB2018DCCD3D107803ABBF3325639
MD5 SHA1 SHA512 SSDEEP TLSH

Lp/swarmers.inh

SHA256 76d443cfbc0718d351a7bcd387c847ba7a0ea0e4cd3fe7a53c238a22421efcc6
MD5 4327e693d74e63e8e1365bfb36245603
SHA1 fa199e97468977168489f2abc69883bd91abcec4
SHA512 133500922f579dd6eafdb46207d76282fb08821acf5e8ca85c61e7aaa88131fce683b2beb0bc21178ab626168fefa7c0fb6ceda90791086513df1ac924199500
TLSH
T161411212B464500372481219048D100B4B90444C05690C2C010851430615B00A332114
MD5 SHA1 SHA512 TLSH

Saddeltagets226.typ

SHA256 d44279553e2df9b0e77ddeb77f51988031fd34658c6ca9f3b0286f5390b2f082
MD5 39052f11f8f3525e111438293abbe650
SHA1 073c9ba7c4006cef5fdbafb0e142fe4d97b29780
SHA512 d83e3c5c988b7818ef39494d1b6930b6a1f93219403c59b4620b6b63dcb6344840c5cf31d64ef8e76020aa2dc729c61fe80850f8170220114ca3b52e976d8af7
SSDEEP 48:KfAumkcwXRqsNxrCOi2f16HoLEHGFhufxweyT4Y:KfK09x1JdmyT4Y
TLSH
T10433A7AD5CBE95B85378576E4A6A1C49322C0411DE4EA9881824B8E7500682BB503AB3
MD5 SHA1 SHA512 SSDEEP TLSH

Scapegoating.bar

SHA256 affa537fd0755036e9669c739d694c99ee1d072434dd2c495247869018bc7b90
MD5 2073eb8b0074c7d281e520318ea34a95
SHA1 edcd02d486a88e14c814ed4b6f5d0a1a369813ac
SHA512 bcf977f84121d2072cd36a1352ddae8d2aef635174fe25faaff223ba0eb1b1cec4ec12a616ef66339dd253ac80aeb6dc1670d71dc2c591f9d0f34b21ea078b00
SSDEEP 12:QfTrRhuysTuRbuIxmbQMniQvuBulfu2DTQ:QfJhgTtJQXBonQ
TLSH
T17102E75048839CBD8AFB45C5352DE64D10D55DB2B28E43F3375553DD01355CA3D51CD5
MD5 SHA1 SHA512 SSDEEP TLSH

Youngly

SHA256 79da9fbc991e637705bac5bb6dbc3b6ae5ba90773d83c4fa36a2ca74f75f0ff0
MD5 ccd733e51800c17c0a8936507d5b67fb
SHA1 c95231776813cf6889f148b693c349518d0209ce
SHA512 fe448a47b5eda94f78bc24b5e6898b9e10816f0c42ffc03c79a447852b4d0765ef033b59c3f770ec7e0989be3dfed6b50514a4c2979fab33881107a1bace964c
SSDEEP 768:WrDuC3cPlDzwPRpqg9fyUkhKvfsk2IF6yfT:NIMlDzyqgFyUujob
TLSH
T1B1F2AF7ACB53BDF3DC1ED630C06B55A64C45B0258B2E64FDB17A2A19C54B2E28730277
MD5 SHA1 SHA512 SSDEEP TLSH

coequalness.bil

SHA256 280d229745e9bc3a80d1c5d6ea86167fb3f78ce37ed9f0b5ad26165a85ebfe8e
MD5 957ce108769622e6a825051e6f391aa5
SHA1 416b8bc6e078461ad14b793336393aa4862c8dae
SHA512 edcdd5f3f285d7a5c6a50aec5f0c009f7ac37e2901abd1a0040ec192b13013321b3a2c28a1ef27b700af5f29670dc9c17df5d310d27a863cb623974c5e0a1949
SSDEEP 6:y1hYHj2jRnlhRYtj9hhm2YhBThrmXPLQhSbthhykhJ:wqj2XRYtj9jm2YRr826hvJ
TLSH
T1ABC180545054B47A7048FB80FD0AE66549417B46258750E118DF3C3CF572571CE4C866
MD5 SHA1 SHA512 SSDEEP TLSH

dataskrm.bio

SHA256 a0332d36644105e5a2e4e6054a42e4cca324cfa234633c4b869522be35a7c5d0
MD5 c33bc833c9f863156f71c42035ce7bd9
SHA1 fbbc4a01e28e10a8df27917b29492a098161bd8d
SHA512 5ce3c62dafcd0febd333d2e4ebcc3ad80d54883571be1613c5f2a1b02a5eb6f33ce7acdc83588a31d685321526d95256f0315f60a426e4181516274b694dc334
SSDEEP 6:JUIPUINrYGNEINNBYJUYNNsvScIU3hNiGNIrIBrUD/:J3lrYGjvwxi6BU3XiGuruQ
TLSH
T109B11206B43F1A35694DB7C4915C1CB3304569ED1C9461454543490A0CA99A4DCF2528
MD5 SHA1 SHA512 SSDEEP TLSH

detoneringers.syg

SHA256 90b4964e775b1179ee11b90c9c3063f8ef13109ba893ea1a899d602d2519986f
MD5 2d0d6e61a05ae394e6889618ccde2453
SHA1 b9d96c38eee73ff27b351198cdf3ea76e2c5e359
SHA512 e224d414f5142e6412e86c5454440087a3ed381543928f313c4c6f60105f4bab533e1bec6ae9263a07685eaf6a7a0706a1c98bf6c43c22996788c481c4399830
SSDEEP 24:m0zqMX8slz6fr7QiZOHt9pQ9ncltAHsGqE2PXyUH195T:m0OMX7l+Dci0FQVcTMsnz195
TLSH
T18B13B777521ED0DD40439D19FD2093984233903D8DAC1E74E30C59A42BB1BF189193B0
MD5 SHA1 SHA512 SSDEEP TLSH

hemmeligstemple

SHA256 ccbfc42bd474a5d8b7822d6a2226afac915371a875e428a306861f23656d497d
MD5 5a5668bf4d0d05c4ddc196120d2335b1
SHA1 0b46e4e394cb2d5518148ac03c52741de5ca2a50
SHA512 caf08dd275dfc4dcb3315d9bf2adbfefe1435c80f0be2085f4ffc2fd4cae23987ad8f3f5001919bf8fd96fea933d38d85a9748c05496929f7a06669ff6b2ae18
SSDEEP 3072:7BCcNPkO0GIX8uHRUqguF5AFn8BJQQQQQQQQQQQgKO0B2O4fJ8Lt9OZ3:74ctkO0GIX8uHaqgjmBI2fJ87w3
TLSH
T133C3C0DBBF01749CCA16D932E131590B1A4B9080796F8D353601BA81AD436E987FFEDE
MD5 SHA1 SHA512 SSDEEP TLSH

_8bda7db9909e9b4e6bbb325102bae2639f622cf3d895e1b500f7a02cfd21608d.exe

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Lp/formspndt.unt

Lp/grinagtigt.his

Lp/ndsituationer.hrg

Lp/preparatively.ove

Lp/swarmers.inh

Saddeltagets226.typ

Scapegoating.bar

Youngly

coequalness.bil

dataskrm.bio

detoneringers.syg

hemmeligstemple

Sharing

General

Malware Config

Signatures

File Explorer

_8bda7db9909e9b4e6bbb325102bae2639f622cf3d895e1b500f7a02cfd21608d.exe

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Lp/formspndt.unt

Lp/grinagtigt.his

Lp/ndsituationer.hrg

Lp/preparatively.ove

Lp/swarmers.inh

Saddeltagets226.typ

Scapegoating.bar

Youngly

coequalness.bil

dataskrm.bio

detoneringers.syg

hemmeligstemple