b0e94f6295e469e77f16759ad1a117e4f5c120455032f375b38660f050bbf9ca[.]exe

resource
unpack001/$PLUGINSDIR/System.dll

resource
b0e94f6295e469e77f16759ad1a117e4f5c120455032f375b38660f050bbf9ca.exe

b0e94f6295e469e77f16759ad1a117e4f5c120455032f375b38660f050bbf9ca.exe

IMPHASH 573bb7b41bc641bd95c0f5eec13c233b
SHA256 b0e94f6295e469e77f16759ad1a117e4f5c120455032f375b38660f050bbf9ca
MD5 4b68c75c72823af59074f1dd0d07b1f5
SHA1 84f81b908bd93e017c25cebb74b970cc42c23287
SHA512 6faa6d1ae1c6d4c54aa28271a7d997da4b5cc11fdc54b66bd8a49c759cabbbc2594eda3c28012bf363027137d0bee0e1d8dda39e4e0dbf8251a596fabb886977
SSDEEP 6144:3bfoprb/eSgnR253Ghob6cbz28k3ptWX/eELXZCr7YBLwf5ct7Es:3ba/etn+H6az2823WXWSXZCr+gaws
TLSH
T11CD44996A63BE0A9F61A98B34D0F0FEE8512DC52E6BE60D5DF0072C84DF2D91D435C0A
MD5 SHA1 SHA512 SSDEEP TLSH

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

aa:d8:bd:16:5a:49:20:05:9d:fb:5c:3a:db:46:b6:44:9e:40:a7:82:d2:cd:ec:44:76:69:d0:95:f5:d9:10:d0:1c:d2:b7:25:17:5f:92:10:0d:f8:48:9a:1a:3b:0b:81

Digest Algorithm

sha384

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Hyetography,OU=Marinesoldaten Nervebundtet\ ,O=Hyetography,C=FR,1.2.840.113549.1.9.1=#0c1c7472697673656c73404e6f6e6465666563746976656e6573732e5376

Chains

Jun 26, 2026

CN=Hyetography,OU=Marinesoldaten Nervebundtet\ ,O=Hyetography,C=FR,1.2.840.113549.1.9.1=#0c1c7472697673656c73404e6f6e6465666563746976656e6573732e5376

Subject

CN=Hyetography,OU=Marinesoldaten Nervebundtet\ ,O=Hyetography,C=FR,1.2.840.113549.1.9.1=#0c1c7472697673656c73404e6f6e6465666563746976656e6573732e5376

Serial Number

4c:26:e3:81:ca:36:8f:e1:f9:0a:95:91:a7:c8:b6:89:53:b8:2e:f8

Issuer

CN=Hyetography,OU=Marinesoldaten Nervebundtet\ ,O=Hyetography,C=FR,1.2.840.113549.1.9.1=#0c1c7472697673656c73404e6f6e6465666563746976656e6573732e5376

Revocation Status

Not revoked

Timespan

May 28, 2026 - May 28, 2027

Subject

CN=DigiCert SHA384 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0c:20:43:49:f9:d0:f7:59:fb:98:2d:e4:08:1b:88:7b

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

13674

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegOpenKeyExW RegCreateKeyExW

shell32

SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW ShellExecuteExW

ole32

CoCreateInstance OleUninitialize OleInitialize IIDFromString CoTaskMemFree

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create

user32

MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW CreatePopupMenu AppendMenuW TrackPopupMenu OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW IsWindowEnabled SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CharPrevW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint CharNextA wsprintfA DispatchMessageW CreateWindowExW PeekMessageW GetSystemMetrics

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor

kernel32

lstrcmpiA CreateFileW GetTempFileNameW RemoveDirectoryW CreateProcessW CreateDirectoryW CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW WriteFile ExitProcess GetCurrentProcess GetModuleFileNameW GetLastError GetFileSize GetTickCount Sleep SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW MulDiv lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject CopyFileW

$PLUGINSDIR/System.dll

IMPHASH 509a34b3a68a773e0afb4259e68f9f82
SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
TLSH
T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Autoincrements.ini

SHA256 d19c70a980257d17060b61e4de85d480cf5182d63cab8adae5fec742b382e45d
MD5 7064020700f7965b88aa7342069e087f
SHA1 a4e4908c2f912db18c50bcee8a2117ab4a31d3b8
SHA512 24aa8dc941d1f3a220d46b5837db387a16797f2dc91afc3a7e3b853cee6a8d2d60c3b6ec7f46362c91de03663c04b319334be6f14d2c51b7ea73cbb7fb338488
TLSH
T193F05460CD8730014D01A6A23CA0267546F180497E8B04BA433D478FE18C5AFF48E67B
MD5 SHA1 SHA512 TLSH

Bargees

SHA256 18906fa1b4fe19b9094c91d7c6c309a398f8cf73f13182af031b3559043952a1
MD5 b8b828202398d248b360f3d22db580a8
SHA1 22ad98b5f5d0e157253391f80065e3725d0c9e93
SHA512 9356cc24ca5d32b7ecc59fb6131f27a10253cf661e49c647ae2411f1e62cb1c586681217d975d5b7c40ba89ae9399d66830fb97907f6f4ab194e833acbf0dc42
SSDEEP 3072:oBEnFX2pNgm6VB08A3dMGH+6Nf45AZfYzATEJKhy7S7ohRgCBFsv:SEFX8Nyq8ASGDlZfCATEJ4y7S7ohrM
TLSH
T13114E1924A5B2511C61809D0E6EBA7FE335DB131A1CCC989B535E1EE0BFF1DC02B85B9
MD5 SHA1 SHA512 SSDEEP TLSH

Laichs

SHA256 ef0fcde553869a5a7b9b349d68c50cef0bd40945572663672957d205542ca632
MD5 bfbe2945710515d49d5bdea63038ddc4
SHA1 1d7b0014eba5b29b1f6312cc765e19dae63be2ea
SHA512 8ed5f48c0c104919cea3d65a73ac26d207e41bcf54b48b533717c80e473394399c34639a165e8606ba3646a5389c767741d3309c1f5a758655326d37c682b24c
SSDEEP 384:TXJhktIptI8qd4lyA1X5wjUmMy+e+xQAH8mKip+1iGWE0yK0:TIIedUnX5saRXxQAcmK++oEy0
TLSH
T138A29D0ACB72CDBFCD55C73CC96E247D8ED9B40C8F1BC46D51B5A418C18AAD3672462A
MD5 SHA1 SHA512 SSDEEP TLSH

Sumpskildpadde/Sprudledes/pjuskendes.ini

SHA256 0394eef75e8ee5a03368e5fb13b761c4847468dc9ec084e44a7e55020f438103
MD5 a313482d1899ffb51e7845c9da788cd8
SHA1 12b14323cb3565dfc63d82b52cec89584213b4bb
SHA512 dfc3a360f3d064cf650a386934991434f25634c9ade4ef479785e0408a0bdef64e49d91fc4afa898fb9d7bb2fb7293f94bf6ee9d0865fe2d86600249b878a3bb
TLSH
T1B9C0C00040003CC24D823E01F4C00FD12A301224429E33C1DA3911840097F9C431E6D3
MD5 SHA1 SHA512 TLSH

Sumpskildpadde/Sprudledes/skikkelig.ini

SHA256 b5d0d13aae3916188c294e755d7814255a25da25dc35947546d0b47f881fc93e
MD5 c6f6a6cdb7c08aa4bb5325ab8cd87d29
SHA1 4b7dd6c0116fd34bf0baf7651fedaa0eb3141ebc
SHA512 409dd50b32a9e59f67eb6fa05b024e271f9a5cf1021d3e7cf666fe6a30a2240ebb5af19c29ee0fbd263068420bc621383139d15a15e2ed30f7794187064a7c6d
TLSH
T13AD02342CC8E1B170357FB27CC4A5853C060DE18001B67BCEA6B231C025904187FDBAE
MD5 SHA1 SHA512 TLSH

Sumpskildpadde/Sprudledes/skolelreren.jpg

SHA256 a1fc5fd3ffa6c0a10050369b70629944b24e900b3085dbf3f5e8e4fed3a329bd
MD5 054cb72d094d7d9a946638fa52a753e7
SHA1 c5182148411cc74b7741dd5201f256e22f867f80
SHA512 e096fae0a84bb9f2afcf73981b84b714bd8858860694be24de8657b5c7fb731944c8c2906d45c447511bb5c8feaabe15405a0fe30cc87232ed6ce5a00061ea89
SSDEEP 384:5bwV96m1jBS7lygetVlW4yPGqyHFssYe6SG96SvgqoJx3:5btmNc7oneylUe6vAx3
TLSH
T16E82D107AB52BAC3F706BDB49628B97A47DF0396191C655D2EA834C6C14CCF539C129C
MD5 SHA1 SHA512 SSDEEP TLSH

Sumpskildpadde/Sprudledes/zoophobous.hap

SHA256 25299352e7307e9ea9bb91c6879dd5915d517735c1607506480f429baefc93b7
MD5 76cddaddc239b36b030743d0d90344d0
SHA1 f6e880389dbd206a3b2b3f3e35af21ce437bc1ba
SHA512 e1f9ccb7bd661a831b44cb266338c318598f67b0f98d2349a85ed3fb6dd377749b96e00f54b31d2a9594b7f1e58c1f64d01257104f4b340bcfc345ed7c46722b
SSDEEP 3072:FDdTeiPDMGvC8praIVgePwcaZR/aLja2eyx4SHCFcVQfF9p4:X
TLSH
T1B555F1279D7A0CBC1BF2E7764216DD1C3388BE1C35E41EA839CE51E69040DE93AE5869
MD5 SHA1 SHA512 SSDEEP TLSH

Sumpskildpadde/afbrydelsesvektorerne.txt

SHA256 d4a0b8f8239067c8b4ce755f11d7ed09621438d1025d048f1aa20155317466f0
MD5 2f296f2567f5d0d5592a74c392df49da
SHA1 2d817c725360a819724beacdf362dce1587a7513
SHA512 ef7ebbf8dea4b9bce6f52ad3c459e0187447793e4509790708a619226597b3b26e874758723133798b3294ed1e7f6831915f35afa8980681e64d0f67453cdb97
TLSH
T1F3E0A3299616A66C06093763BE555DC515B0E832C51718243F475F4A654449CE331429
MD5 SHA1 SHA512 TLSH

Systat.jpg

SHA256 47487785b94a447cb2d86b9d8b109d15ccaaedcdecda617e3e41aa2ad3c42bd9
MD5 e08201c1b9a7326d1ef197fd59643994
SHA1 d571963bb4d5a503ad20a09c57c2b7c2ed2f690b
SHA512 2f7cb74e7c2856693e73d84e1cb92e864cf35e25eb5663255a1cea3bf0cb0fe5e8873d9ab397c2d026eb25768397a752b876009331a77e20d0a686ebd1147a30
SSDEEP 384:xWWkFgz0lV6vVybMu9qYwqHkm0pYJGlYZv:xWWZw0Vy9jwqEmCYUlY1
TLSH
T15F62BF998069C6D16F0B10BF94736D3DA355DAC4EFA4BE27803981AC7B91E38D539E0C
MD5 SHA1 SHA512 SSDEEP TLSH

b0e94f6295e469e77f16759ad1a117e4f5c120455032f375b38660f050bbf9ca.exe

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Autoincrements.ini

Bargees

Laichs

Sumpskildpadde/Sprudledes/pjuskendes.ini

Sumpskildpadde/Sprudledes/skikkelig.ini

Sumpskildpadde/Sprudledes/skolelreren.jpg

Sumpskildpadde/Sprudledes/zoophobous.hap

Sumpskildpadde/afbrydelsesvektorerne.txt

Systat.jpg

Sharing

General

Malware Config

Signatures

File Explorer

b0e94f6295e469e77f16759ad1a117e4f5c120455032f375b38660f050bbf9ca.exe

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Autoincrements.ini

Bargees

Laichs

Sumpskildpadde/Sprudledes/pjuskendes.ini

Sumpskildpadde/Sprudledes/skikkelig.ini

Sumpskildpadde/Sprudledes/skolelreren.jpg

Sumpskildpadde/Sprudledes/zoophobous.hap

Sumpskildpadde/afbrydelsesvektorerne.txt

Systat.jpg