cd34135861112338b55e8cf1dc3239e5b0ec290810bcbc1e3b411bc6366a816b[.]exe

resource
unpack001/$PLUGINSDIR/System.dll

resource
cd34135861112338b55e8cf1dc3239e5b0ec290810bcbc1e3b411bc6366a816b.exe

cd34135861112338b55e8cf1dc3239e5b0ec290810bcbc1e3b411bc6366a816b.exe

IMPHASH 573bb7b41bc641bd95c0f5eec13c233b
SHA256 cd34135861112338b55e8cf1dc3239e5b0ec290810bcbc1e3b411bc6366a816b
MD5 dc132f1b51f74dba47c32366c035a630
SHA1 18a1c20eca02f9ab169e1d1870c84dd8dce75cbc
SHA512 34d534be9287483fcb1f9899cc7ac8a591ca2fbd641733b5582114b4c3e934c1d09e9426d6f5a8b6982267919063050c15d82f262e46d68fdd5faf403033b1de
SSDEEP 12288:MTABJahivBwjzZBC83TSY1wdG+yskU83AeFnKf9sM5D4FIATG31Ywoz:MTABJaYBw5IaTtudGCMAeFnO+I/Hoz
TLSH
T1AFD42202BD10C532E9F143726DBA9AE91E5A2D141EA0239F33943B0E7F73693778A715
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

bc:d1:36:a5:2f:33:61:0e:d3:77:e3:af:9b:c6:d7:08:3c:86:59:3c:c8:a1:21:e4:97:d4:b0:77:d0:2c:62:cf

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Deviationspl,OU=Stomapoda stangbid\ ,O=Deviationspl,C=US,1.2.840.113549.1.9.1=#0c2155666f7264726167656c69676540456b7370726f7072696174696f6e656e2e4d61

Chains

Jun 25, 2026

CN=Deviationspl,OU=Stomapoda stangbid\ ,O=Deviationspl,C=US,1.2.840.113549.1.9.1=#0c2155666f7264726167656c69676540456b7370726f7072696174696f6e656e2e4d61

Minor OS version

0

Major OS version

4

Entry point

13709

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegOpenKeyExW RegCreateKeyExW

shell32

SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW ShellExecuteExW

ole32

CoCreateInstance OleUninitialize OleInitialize IIDFromString CoTaskMemFree

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create

user32

MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW CreatePopupMenu AppendMenuW TrackPopupMenu OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW IsWindowEnabled SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CharPrevW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint CharNextA wsprintfA DispatchMessageW CreateWindowExW PeekMessageW GetSystemMetrics

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor

kernel32

lstrcmpiA CreateFileW GetTempFileNameW RemoveDirectoryW CreateProcessW CreateDirectoryW CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW WriteFile ExitProcess GetCurrentProcess GetModuleFileNameW GetLastError GetFileSize GetTickCount Sleep SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW MulDiv lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject CopyFileW

$PLUGINSDIR/System.dll

IMPHASH 509a34b3a68a773e0afb4259e68f9f82
SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
TLSH
T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Ballongynge

SHA256 947efa3a99594609bdbaefcab15258572d5bf335adb637e9b984f68bb360a16a
MD5 6dd27ac38a06291ddb5b2ab4e99d9593
SHA1 a7caae0965c0106d500b7fa711818d79a9f28f8d
SHA512 78428122e90d0aa348aa457ebf1dedf48d75e6bfa6d1ed2040416d1f52c0b757d55371ba28a66c354e2770c95c4fe987f91802338e4eddf2b0b2733e31e1bc36
SSDEEP 384:MCJOugmD2UsTqK/5dJGa+r4iQ0/9QOVMsRDQEGAhyqJRX6zuKTxKs8P:9OVu2tTqKHJGaw4iJ/LVZfFn6zuoS
TLSH
T12AD29D1B4BD6DCBBCC0BD13CC5AE62A78D6C70192F8F95EEA079985180871D357106D7
MD5 SHA1 SHA512 SSDEEP TLSH

Merci34.jpg

SHA256 a2b59db9f194a4194f25ef598ce26938690bd538e43fc6e8a753ebb7f2a20778
MD5 9fef050d6847b69819dbe5b2136551eb
SHA1 c22675bc8aaa69f74db6d5541a7846d46a49dfc7
SHA512 6194b6007ecd75cacdacbb6f41df76978feb20671bc8610c9198120942c35d46daad632cc6911c95ff63c4f337a684eba96e81732407278203cfb5c95ede4098
SSDEEP 192:L+szsbnRIK37oc6tK3JiH7DkQ9y9w+0j3sWGbZjF/4JdR5SBqfnEv1Z0+raouhYI:KCsbnRJratkJi1964OhiJdSqfEv15uhv
TLSH
T13122AE9781633562CF4F82747E0E1E6D236C899B19B03B3152E94C537F08EA06BA98CC
MD5 SHA1 SHA512 SSDEEP TLSH

Serranos.txt

SHA256 14697f69c8d4db8552d96081e298b4537830cdc88570fc0c1ed7b00f015f6946
MD5 e0eff6ddb8945e66b7c25ac983c52aca
SHA1 755b9c5d68e36f67d5cba462357fe8a68cfcb402
SHA512 9aadb7a87077c336b9a1c84d67db446d26e568b60543d2ae2c352e0a5af3468fd89ed07980b22ca17fbf9584e36c01b787ad08b4674bebf4f50a4f45bc2a2cbf
TLSH
T188B02B58D00317F100112688819C1A64644C79858C320900F03117A15029807416EC4D
MD5 SHA1 SHA512 TLSH

Uvisses

SHA256 bf0f675abfa64f8914c0f232b5f8b4d47085b8f746977b86ffcccca1e70587ca
MD5 8818b4f5e6ee94ba0c7248f29d7c5ba6
SHA1 94aaf67cb27d16e7376ac7a63964924729f71f64
SHA512 e78670a1475a7a880d201683d04568dd9920c03fd4a663a14fb5aaa1a80376669d9c88f49091f5df3ec3eac44c46490c441430e5018d380dc3aba4ce6d8eaef6
SSDEEP 6144:LsOaxFJiIUyiz0vhqECrhTcjXfM76XoSYS8D7QMK7:BSJiI+AhqEiTcjPDoxVD7XM
TLSH
T1DC5402FBF6DB48F3D58D25BE23B42CDD42127B27260E9B586374DB48FA1A3159E10602
MD5 SHA1 SHA512 SSDEEP TLSH

bespatters.txt

SHA256 cce8a6936004c4dff47459d8e6b0b38172448e23b4344a65c4a2dcec34b8ef4a
MD5 d4e6fd4746e134200fa96a7c832d6c28
SHA1 c71ac43bd529bdf9de37a4496a7f5a9499ea7e09
SHA512 e0351d207ed4a949327495378f2152af8adae41081a7b823da1fb3025d8a27d49ccd5ad454fd675a59b97533297a0739b906474bc981dc7290c6e9f553f509da
TLSH
T1C3F08B24EC021E19562EC8A6F8228E474464042A5A24F170F2850B19FA0695FD7BE75E
MD5 SHA1 SHA512 TLSH

betrykningerne.ini

SHA256 2163d07c602ee75c66c54d120a30ef3ac36e8474e2be4a60dc90706ee3017a3b
MD5 6376c7fe646cad896046f61e527a4685
SHA1 58cb36defb0297c503166b3e249f5870817e5dd1
SHA512 108e47ab572e22538645143498dc5bc6547dac15aeccd2b3d47633505ad4cd15cdacd1c54cba0be7d00b60fe31b1c6f9c07cade768b76c7ef2850f17213ec7fe
TLSH
T1C1E07DD48BE0062D1F0A0276ED310F4C2273A2B680484A8ECB595B1A5866C7DDF5AFD5
MD5 SHA1 SHA512 TLSH

dematerialiseredes.ini

SHA256 dd72d1f646273f63242b3cf1c600305547739462c4a19d5c74186dab07b6caf6
MD5 75a5001c49da35201629a30d9f088562
SHA1 37502187e65519d4232d431d57c4ca583acc5c0d
SHA512 2215e2ecfe3c15def6d52c25c7374f5b6e5fdd9ea2d179af04e4c71ef632f7edb014cb366f91b27da4122656d3881451ed1bbbd0fc77d2ca8baba21cbcf22ba4
TLSH
T167F002D0D212309E3033AE891C74190FCCED8D21935C5190E71CB76D35C691DCD6D635
MD5 SHA1 SHA512 TLSH

erland.jpg

SHA256 4bbe69d698c0c68ce8ab8a1fd76e6f7f3f7617176fb29e1280e5e55572c194e9
MD5 0ccbc36f0f7f900e7b0ede4990cfe3da
SHA1 bbe34323bf0829310dfa4b8faf3f97a7794b8c01
SHA512 63f9eaef1cadb506c2b2d90f78eaa19d313e1af70fedda8b1803629cdd3ad0cd801767ae73ccc71bd09c23915085a510dc53971143b9a22eb5257b3a418f4e2d
SSDEEP 768:Iw9ij3PRMITcXnpPIMq3/yG+XlE3DY9d7jh0umeJMUo:IHfOISpPWqGq+3DY9j0aw
TLSH
T1E3E2E151DA7C17C4D202C6FED342286917AFB5DDEA2586E9D4D4A0B2FC1ADF0062863D
MD5 SHA1 SHA512 SSDEEP TLSH

retinitis.jpg

SHA256 af7805d83dc0ca796f0ea0498f19fa7176d53bbef9773b8b67d04c72a97d25b5
MD5 c103cd3c6c5d381baea8e60a925bb2c1
SHA1 675c9fbf6a65a5786ceb8784e9687f48a29db94f
SHA512 02e24326471fd228d617853fec8a705086d9bd8096ea89e18c2c446791188bb3340a2b57e6f0f1d12f888c4966c623f39ac28e837cf6e34e65670f0d9fca686c
TLSH
T12D616E22B602C2D0DF5B52A44F3A278DC64315C83F5D29392AAE1AFC17C0E7D7880141
MD5 SHA1 SHA512 TLSH

skkestolens.brd

SHA256 cd6b823f8a71aca5db4d1017d0c1fad5ab96dbbfc2e7dbe16e6ca63461052212
MD5 fbec00df5d255b82a4094e79470675b2
SHA1 15cd0fba9b3ce544554073091d0f724157cf1413
SHA512 93f3f29c2b2fb753bd936505cc76ba3170588cfb2941c9a41d8bc08680514dc21f62ffda949da1b29772ae2c0a4ab42d02e4fbf1f48f58bb948dd2f12ca54875
SSDEEP 192:M3ptbhXR75dfMI4x8IFDaGs7kkjzbY6p/bPQ57I7CUZIxFElseXi27JUVspmYFR0:61mbUen6SuzoK9dYn2h2JTUSuNTQb
TLSH
T114761279E786DACC0A3CD28A4346C40362E4AAC78158B32DC41A395F4177A2F9FCB55B
MD5 SHA1 SHA512 SSDEEP TLSH

suggestionable.jpg

SHA256 8f552a91ea03debd75715b8a4d84064c186272913a5d2aaf793da3113b5b4809
MD5 b2e36a959a91fbabecb35864dfed27d6
SHA1 6ac6cb1b781851333c32cd66e88bb1273b5fe700
SHA512 47a5ba94137ff6795d2db9e74cc632f5b1eebdd9071f58430897608aa30b82abbe82f57384c9f7dcd0099d57835c72b3bf6ccc4a6d026401747fc984f254b3d0
SSDEEP 768:VFj/b2WHmcPMXwTcPkXJLXg5BcEumsmU8BOeurlVhFTOJBG7VoSLQR9yx9b/B:VFj/bnX4PkZLXOWEumilVDCJB0VoJkbB
TLSH
T13113F10B4EA11D594FEBF13A315D0865998F99B0C9D4AFF558C3C41B5030EB2BA6EC68
MD5 SHA1 SHA512 SSDEEP TLSH

superlied.ini

SHA256 a055c5aaedc4cfe44bafa542913a54c9d73ab36c0716e1341edf4d7006a10d2a
MD5 c272ba779b70792405f896b7d7059314
SHA1 77bbfa2571535fcee4e19f421f534e817d898a48
SHA512 1bb82a4bc159cc2f58ee437458db464e476f1b086ea442800d09844d6f0fd62e9444f759d870177aec6e24b0c2c63982a1003456e29da3f3993839c3b6c8a01a
TLSH
T1A7F062659E499D06090132B4DFEDA1B2029CA5C21F201CE658CD03CCE2CB8CFA733319
MD5 SHA1 SHA512 TLSH

suspiciousness.txt

SHA256 11def5796bd54f63a394edb4e5e80617f2c6612be2e75370ee0d9cd71e0a8fb7
MD5 01f5c77fc8e98d24edabbfe701f0336c
SHA1 a9a47a90bd14840fa6fee97000f60b4ef3b4f651
SHA512 9a6d6fa3ad0ae95381a85a6991107d97d5467a1b565dbda737132b6641fa9b6f86aeb43daa8ce8637c934e78a86929f5faa949490532e9ebb1f61032a9ea52e8
TLSH
T1D2E02014796045BDCC0766C5DCD7572554CCFD3109416A50D94D890DE110198D27F3C5
MD5 SHA1 SHA512 TLSH

cd34135861112338b55e8cf1dc3239e5b0ec290810bcbc1e3b411bc6366a816b.exe

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Ballongynge

Merci34.jpg

Serranos.txt

Uvisses

bespatters.txt

betrykningerne.ini

dematerialiseredes.ini

erland.jpg

retinitis.jpg

skkestolens.brd

suggestionable.jpg

superlied.ini

suspiciousness.txt

Sharing

General

Malware Config

Signatures

File Explorer

cd34135861112338b55e8cf1dc3239e5b0ec290810bcbc1e3b411bc6366a816b.exe

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Ballongynge

Merci34.jpg

Serranos.txt

Uvisses

bespatters.txt

betrykningerne.ini

dematerialiseredes.ini

erland.jpg

retinitis.jpg

skkestolens.brd

suggestionable.jpg

superlied.ini

suspiciousness.txt