b481b6034d399f7f85877662838d4cd461a8ef5ae694b2cd44fcd9614b8842fc[.]exe

resource
unpack001/$PLUGINSDIR/System.dll

resource
b481b6034d399f7f85877662838d4cd461a8ef5ae694b2cd44fcd9614b8842fc.exe

b481b6034d399f7f85877662838d4cd461a8ef5ae694b2cd44fcd9614b8842fc.exe

IMPHASH 6e7f9a29f2c85394521a08b9f31f6275
SHA256 b481b6034d399f7f85877662838d4cd461a8ef5ae694b2cd44fcd9614b8842fc
MD5 8e584b7f95ee67a337c103260f122413
SHA1 d0e187f73008bdce2ff5a40312cb32d13ed0d69c
SHA512 91f77142be5c58f8927117eb28fd85aa9cda7d956f9b3d16a0e8267c2a873b5c4d290902973114886f8f1e0eba6a7eeb7e617ddc32efcc20381cc41bce35ca45
SSDEEP 6144:RMm4CCBM3hU/hFaslnT4gHo9ROhUvUmoJRp5na6u:RMwNRMhFaslnTrlhUcmU5at
TLSH
T1B52401046760D05BE95585B0C97BAEF81EE0AD22DEA0875B23D47F0D7939BC1DC2A329
MD5 SHA1 SHA512 SSDEEP TLSH

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

c3:92:de:81:74:01:c5:b3:77:37:1a:11:96:e1:82:e2:7d:99:5a:22:06:25:47:ea:b4:02:8f:47:1a:96:d5:c4:2e:b1:77:0f:aa:7d:67:6a:ca:a4:25:35:a7:38:24:4a

Digest Algorithm

sha384

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Myographist,OU=Productively Nonformalness\ ,O=Myographist,C=US,1.2.840.113549.1.9.1=#0c174f706b61737465646573404f7073746e696e672e48616e

Chains

Jun 25, 2026

CN=Myographist,OU=Productively Nonformalness\ ,O=Myographist,C=US,1.2.840.113549.1.9.1=#0c174f706b61737465646573404f7073746e696e672e48616e

Subject

CN=Myographist,OU=Productively Nonformalness\ ,O=Myographist,C=US,1.2.840.113549.1.9.1=#0c174f706b61737465646573404f7073746e696e672e48616e

Serial Number

3f:23:b5:cb:97:d3:9d:eb:ac:55:12:c2:79:ad:dc:11:c8:d8:47:0a

Issuer

CN=Myographist,OU=Productively Nonformalness\ ,O=Myographist,C=US,1.2.840.113549.1.9.1=#0c174f706b61737465646573404f7073746e696e672e48616e

Revocation Status

Not revoked

Timespan

Jun 13, 2026 - Jun 13, 2027

Subject

CN=DigiCert SHA384 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0c:20:43:49:f9:d0:f7:59:fb:98:2d:e4:08:1b:88:7b

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

13455

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCreateKeyExW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken SetFileSecurityW RegOpenKeyExW RegEnumValueW

shell32

SHGetSpecialFolderLocation SHFileOperationW SHBrowseForFolderW SHGetPathFromIDListW ShellExecuteExW SHGetFileInfoW

ole32

OleInitialize OleUninitialize CoCreateInstance IIDFromString CoTaskMemFree

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

GetClientRect EndPaint DrawTextW IsWindowEnabled DispatchMessageW wsprintfA CharNextA CharPrevW MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW GetSystemMetrics FillRect AppendMenuW TrackPopupMenu OpenClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetWindowLongW GetSysColor SetWindowPos PeekMessageW SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint EmptyClipboard CreatePopupMenu

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateFontIndirectW CreateBrushIndirect DeleteObject SetTextColor SelectObject

kernel32

GetExitCodeProcess WaitForSingleObject GetModuleHandleA GetProcAddress GetSystemDirectoryW lstrcatW Sleep lstrcpyA WriteFile GetTempFileNameW CreateFileW lstrcmpiA RemoveDirectoryW CreateProcessW CreateDirectoryW GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersion GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW ExitProcess CopyFileW GetCurrentProcess GetModuleFileNameW GetFileSize GetTickCount MulDiv SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW MoveFileExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 acf90ab6f4edc687e94aaf604d05e16e6cfb5e35873783b50c66f307a35c6506
MD5 6e55a6e7c3fdbd244042eb15cb1ec739
SHA1 070ea80e2192abc42f358d47b276990b5fa285a9
SHA512 2d504b74da38edc967e3859733a2a9cacd885db82f0ca69bfb66872e882707314c54238344d45945dc98bae85772aceef71a741787922d640627d3c8ae8f1c35
SSDEEP 192:MenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XBaIwL:M8+Qlt70Fj/lQRY/9VjjgL
TLSH
T1BE428D1193B089F2F590593805A67F2A6FBEAC5C27E44A63CFE345853D702DFA47A243
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10719

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Brevduernes

SHA256 b97396ec5a056e3c6ee6e0f054e705ee57f46df2785d1d9cb4fbf6820c185950
MD5 c09059ad769817ba14f5742c45bad23a
SHA1 f60060f67ffed84fa7cde940632d0dd12fde0aad
SHA512 514d01ee40a2f283b411be5ff546535cdecf3600bd22193ed90dd0216c4c2758f4e47510dd6ffd223e6d682b7e09df37a52eab5fb6bd8d827bc38916c0bb6dcc
SSDEEP 3072:bt7T7D19XzYAm2CgpIIAhgSpAdcSIR6oeHp4IUCEAn1LMUEbOmzXeVksaZ:xf7Dj15dAhgSpAd4IjzAtaIXEkso
TLSH
T197F3F166C992FFD2E284B339A16837B3F329527C2C955151AC4ADE7422CE3EC953D20D
MD5 SHA1 SHA512 SSDEEP TLSH

Gallowsmaker.per

SHA256 2dc4da53e2ef0ba94c6cdd905acbd7d3b0ee2f267c9cf77bc7408a4f93be9ebd
MD5 6229909d5792f5aaf174b90e2416fcd7
SHA1 63842027c5e11fb055caa8c8136c4445b876c767
SHA512 e338e42770c72d482fa17fa23f3ab17d8a0322beda77479574b793ddf14e4d1bcbc2395a1fbef7a73a1fd04ee3ccd87564cfdf6aad23838c7acc340f5267985a
SSDEEP 3:rfA4AGfcDhDjrrIknfbDArJnDDcfDfvffarLFD8Dr0fUffDQr2ffa6PrDfv:U4AGfcykYerfCGXnffMKffa6f
TLSH
T1059112295B03485C0D50A908705E401C4172194ADE78083060850416606128803735C4
MD5 SHA1 SHA512 SSDEEP TLSH

Laeseret/valgdato.god

SHA256 4dbe16d4641687a58f1f831a40733c0d6bf63506ca63af70ce0f479a12b64b83
MD5 50b8ba6da8fbb669757957627d205229
SHA1 7ab9f52ac993f846fe92461a48bbba4917341092
SHA512 1b224a2332109308be25eedcfe50e7cf5e474740463bc54bfae027b30d4de404887caed84764c475ee0c99ca17ad6a7124c5cccd30025bf5c5f5036d1a44ccd4
SSDEEP 48:ixZQ56dI8QxozAMz37R+uon9HX44TajbZPJyaovwMU/0xFd3ha5XBA2lTjBZ7llq:628QOT37R+uoO4TcTQWI3c5XG2blU
TLSH
T12433E8EB07E5CF895A0CCA898D4C2762269602DE5EE4527263D8D9D481988879D3D7F0
MD5 SHA1 SHA512 SSDEEP TLSH

Palmchrist

SHA256 9a9f388b3fcfd3497550de37485d303049ccecc16af3b4490a38ee7604225aa9
MD5 465454c8b060a1cb10351c5e18f63340
SHA1 96ee092e0faa9e5f4b132eb30b0d0c64f1456a39
SHA512 4f736545d183578659f26c42d3a697ee5e531bb8ddc97d7660da39e74b724237cfe744360ab087a86e471ce96caecf8bbf5593760feb8e35ccbe1d8808ccf85c
SSDEEP 384:vYYuqmQ8uda+0OOfVPgJJQqfWhPklb3et5FLVqb3vHqAPSvE:vYYurQBADHYJJQq+hkidVqbvVR
TLSH
T1AEA29E53FB164CEAC896857CE2E892C3D845B01D578BD0FCA1267804878B6E91B24DDF
MD5 SHA1 SHA512 SSDEEP TLSH

Rddikens24.sam

SHA256 eb03bf57bc7e00ab80e22abf7a4599c5c422652c2e94199451d86a393c1ce180
MD5 a5afa0b8b1dc7320df829d2f7eef5747
SHA1 af87601ad9fd7611b1583362f397ebabdf10c327
SHA512 bc48e3c0592be5a61d7d87bdea05339cd73e4b86e6a62dcc3b102562ecb9584f24292a3ee69a76f44dba2e5eb6c5d2ac2eed80cb72b80e33e31efbb1344865b2
SSDEEP 48:XxPfpXdIk6MR66xQF7YqfGUCtp8ATxBSthMBMNiNMhvyyWxbqlMCzqPz:N4kxRTbXdd4yZtPz
TLSH
T1DE93FB9E11573F903FC5C796CE46D8366F620E84C2273A005A89F3B17A093A557B5467
MD5 SHA1 SHA512 SSDEEP TLSH

Speechfulness176.sky

SHA256 31f4d4a4f38f5a841031830ceb7b161c6610e54c6fabd283647ba58021969196
MD5 bb9c062ad79336dbd754dd30964ea5be
SHA1 3d51a28699aead47a8ce9757cbc6c761e1666c65
SHA512 7dda8c14d44fc0ed9344b9cb936910be0affeb299601387cdafd262171c7499694f2a738cff7f7c73cc239b13740919f86600f1e5098251c905e00caeb19a71a
SSDEEP 48:IivLjKKNnYWawddoOdDdz1LkdCqcATNJRWCK:9vLtdMedoOdDdz1QYqcATNGCK
TLSH
T1DF030AAC232933A0A93A3E771FC94C6119A157FF476D1BCB808800FEB498C1863520D1
MD5 SHA1 SHA512 SSDEEP TLSH

Trolst.eze

SHA256 82b5997341ee5bd0f07da9181af85f9cb771b3980c2097adf00e01ebf08ef4a5
MD5 318ee2aaca3338437ba83a013a004f6c
SHA1 19aa0fed293e6cd43681c3fc5ca9e008fef79782
SHA512 7d17255f4c5ec1e6acd36c23918251020e1059cdd527571ba5fe8f0c7c1a43eb3eabde9e452a8b0909160fb6f88177c0650c115e87f472852aba10bb5d3a2c72
SSDEEP 48:PTY95MkG6XoaC2MX7gB89SkXdmKygqonuvmHM6T1zhVkRCeO:Pk95DXo72MrykpYznvmHFhVkRCeO
TLSH
T164632C61C99A4FCF590EA1309522C5050B04CF726AA0C2FEBAB095B29170CFD3F5AADD
MD5 SHA1 SHA512 SSDEEP TLSH

aerolit.mad

SHA256 bc5632828ef94586de48be37689c2b79acc243284188c7d70a260bbfd6bace1e
MD5 fd4f2c81cb4ed68a17f6b215ab8d18f4
SHA1 118e52e249bc5ae6d3bf027f3f33c5e03181e02b
SHA512 99351267019edebb84512274e4e6c576430e7a20b19c973e398a971c9ee02d67776665f438aa9b3f50ef73884499f87d86276b020aabb78d33f39403aed64178
SSDEEP 48:ymFpBUnGiKep+1ZtYfU4A0D/iAoDmgP+S2vWCcYleWO4Cnpfa1yx:9leQ1HYMW/irmN/hwaYx
TLSH
T1F603D7551F2CB0A4002D779CBB8ED2EF50D88A681D767A7BEB961BEF0191106A326611
MD5 SHA1 SHA512 SSDEEP TLSH

dijudicated.dig

SHA256 74f068aee32c42fc484d12346252087c2c9337fe0186103d21a85927b8d43897
MD5 12c154d6e90073d07f8d2859ca79ef9f
SHA1 0d22118c706f5ac1d90295e60ba725c861dafb45
SHA512 8e578abb72b0ab3f983ddbd5503ea479679c329ef80f992edefd9e4104abc8e796b1e06db39d43abd26d5e5f92176b21964aaf528bffe281dc290d262dc9b682
SSDEEP 24:CkTT2W5TUjq/EkiktC4Rk3bX6urPLc9dh6OxnaW7XB3yOyF5dzYtZKQYqNO:xWSTUjUCL3gcOl9+FiXRO
TLSH
T15F03D7743A8CA49C0FB44060C12B8CC2555BCC30F86EAD7069CF9FCDABB86D51B06966
MD5 SHA1 SHA512 SSDEEP TLSH

enkeltstaaende.mil

SHA256 941a31d8b67b85d327e5559272b9c37a46e47d8298015ad931084c3c973f4a2b
MD5 dafab4d298356032c822e3520cc2ea28
SHA1 409b99ff2dbe2da3b0278fd9d1d787c34482427c
SHA512 f868e5251c72d05ee79bab060cd7bf254dad5e29eb29110c40e8adafa9591580af09f2861d58fb9fabee6b9b163deedc3aab09d67b6e524794e45d0098821e35
SSDEEP 48:Y+G4f+CavWO1FP6GzXfojPGC35zzSP2e7Q3y4DoKwZF:Y94f+CQf1NFfoLGCJvSP2MMjVwv
TLSH
T16F33F8D2AEEE4018E0CC045BC4ACB190E690434B73A5EC95375B6C4A803F5184D9AC58
MD5 SHA1 SHA512 SSDEEP TLSH

podzol.ela

SHA256 a6074e8798ed7dcbd2b697fee987d0c75c196b34e53c6b85a744aea16238ed03
MD5 f2ebc029309f1369d6ca0bc63ea3ebac
SHA1 098e33ad100b58e711c0829b77cbd0cc7e13c4f0
SHA512 dea6ab85f58631f5f95dfb5aa902e6d008ab728835b3f5fb0725a28b9cab903e4f11175f9443228a8b79028fb80bb7e5b61db05e11241f3e34bc574f82cf8030
SSDEEP 96:nrcbLQrrjfUfldtO4/3k/MzlQWvHwDAZkVIPxtBa8TrTGQwQT8Kxnr:r7zUf9O4fm0B6/Vexna8/CQwQT8Mnr
TLSH
T157632BC076BCB7412B3AC7D3B76435F4C862128AC398A89AE08662544ACD436CE0A129
MD5 SHA1 SHA512 SSDEEP TLSH

sprjter.gal

SHA256 073a6ab62d518397224e36d2efb6a3c550cd1083ee588b452f6ed0542005af07
MD5 a55627cb17164c9ef59ea010a2bf76d2
SHA1 b57b27e476f21fa5b5241f4f88725cca339a6b2a
SHA512 268059025e6c317377abba1bacff6c3bd28f74b550a4414e943f8a0cdc30a8849ce24f38acd9f3521d048d5eec8848b3ccae2e99b6e84b1817fce3fb574a9dc8
SSDEEP 24:8jpL4u6NYgFlcbPqIqO4aYzvy/MbkbC4bZpKIxrSOd4FaOCK36LH:8V0XqgFlCUnxkuCL1ZShKj
TLSH
T10803F9CD102988CEDF9545B3D4AD334A11532B695D6A0B8BCB8DC1183004F470DBF61D
MD5 SHA1 SHA512 SSDEEP TLSH

b481b6034d399f7f85877662838d4cd461a8ef5ae694b2cd44fcd9614b8842fc.exe

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Brevduernes

Gallowsmaker.per

Laeseret/valgdato.god

Palmchrist

Rddikens24.sam

Speechfulness176.sky

Trolst.eze

aerolit.mad

dijudicated.dig

enkeltstaaende.mil

podzol.ela

sprjter.gal

Sharing

General

Malware Config

Signatures

File Explorer

b481b6034d399f7f85877662838d4cd461a8ef5ae694b2cd44fcd9614b8842fc.exe

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Brevduernes

Gallowsmaker.per

Laeseret/valgdato.god

Palmchrist

Rddikens24.sam

Speechfulness176.sky

Trolst.eze

aerolit.mad

dijudicated.dig

enkeltstaaende.mil

podzol.ela

sprjter.gal