2009c2095160ce4c016855f7af23529a143e7533a5624b60f4dbc277ae9a7bbf[.]exe

resource
unpack001/$PLUGINSDIR/System.dll

resource
2009c2095160ce4c016855f7af23529a143e7533a5624b60f4dbc277ae9a7bbf.exe

2009c2095160ce4c016855f7af23529a143e7533a5624b60f4dbc277ae9a7bbf.exe

IMPHASH f4639a0b3116c2cfc71144b88a929cfd
SHA256 2009c2095160ce4c016855f7af23529a143e7533a5624b60f4dbc277ae9a7bbf
MD5 bd9d6c8361b4d9ab9cf22f177273ca03
SHA1 a33adebc327a5548fda826b1c0cdf55899af31e4
SHA512 f758e7e85657965ca12dc7a93043f91d9b8b0b9b189072d0cfa135526379e7e9257e82bcd4d11c40183e6ef0aaa2acbdf1cdf06adcc8811f2062d99e197241b3
SSDEEP 6144:8fY+onP0DOYpTXPtd/d3u08BuOwiGoqrwZi:8fYgOYpTXP/E08BMigii
TLSH
T1AB3402417FC0E006DA9262396CB93F7693B52E7AD6D38B9F4390A7483ED2782015F653
MD5 SHA1 SHA512 SSDEEP TLSH

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

4b:d0:2c:bf:85:15:bd:30:9b:58:5d:72:a3:fa:5b:11:32:82:e6:76:b3:51:64:ca:a8:c4:ce:b2:b1:39:1d:ec:e2:97:1c:9c:b0:d2:dd:b3:1f:b1:7f:91:59:c0:91:c9

Digest Algorithm

sha384

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=afblomstre,OU=Tvangsarving Dispersionslakkers Hexoses\ ,O=afblomstre,C=US,1.2.840.113549.1.9.1=#0c124672616768616e4052616469616c2e4b6575

Chains

Jun 22, 2026

CN=afblomstre,OU=Tvangsarving Dispersionslakkers Hexoses\ ,O=afblomstre,C=US,1.2.840.113549.1.9.1=#0c124672616768616e4052616469616c2e4b6575

Subject

CN=afblomstre,OU=Tvangsarving Dispersionslakkers Hexoses\ ,O=afblomstre,C=US,1.2.840.113549.1.9.1=#0c124672616768616e4052616469616c2e4b6575

Serial Number

6c:79:e5:ca:ec:ac:b2:c9:33:a4:f0:46:6a:12:ac:f2:38:e5:05:ce

Issuer

CN=afblomstre,OU=Tvangsarving Dispersionslakkers Hexoses\ ,O=afblomstre,C=US,1.2.840.113549.1.9.1=#0c124672616768616e4052616469616c2e4b6575

Revocation Status

Not revoked

Timespan

Jun 22, 2026 - Jun 22, 2027

Subject

CN=DigiCert SHA384 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0c:20:43:49:f9:d0:f7:59:fb:98:2d:e4:08:1b:88:7b

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

13650

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegOpenKeyExW RegCreateKeyExW

shell32

SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW ShellExecuteExW

ole32

CoCreateInstance OleUninitialize OleInitialize IIDFromString CoTaskMemFree

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create

user32

MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW CreatePopupMenu AppendMenuW TrackPopupMenu OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW IsWindowEnabled SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CharPrevW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint CharNextA wsprintfA DispatchMessageW CreateWindowExW PeekMessageW GetSystemMetrics

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor

kernel32

lstrcmpiA CreateFileW GetTempFileNameW RemoveDirectoryW CreateProcessW CreateDirectoryW GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW WriteFile CopyFileW ExitProcess GetCurrentProcess GetModuleFileNameW GetFileSize GetTickCount Sleep SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW MulDiv lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject SetEnvironmentVariableW

$PLUGINSDIR/System.dll

IMPHASH 509a34b3a68a773e0afb4259e68f9f82
SHA256 23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6
MD5 192639861e3dc2dc5c08bb8f8c7260d5
SHA1 58d30e460609e22fa0098bc27d928b689ef9af78
SHA512 6e573d8b2ef6ed719e271fd0b2fd9cd451f61fc9a9459330108d6d7a65a0f64016303318cad787aa1d5334ba670d8f1c7c13074e1be550b4a316963ecc465cdc
SSDEEP 192:ljHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZqE0QPi:R/Qlt7wiij/lMRv/9V4bfr
TLSH
T1B1427C1297B089F2F551493419667F2A6FBEAC5C13F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Betruknes.prj

SHA256 5256187aaf725891f84a9ad72aca74b1ba8a61a9437b7cb824f645a27fe0f942
MD5 06aa0272567205e16cb24493ca14ba64
SHA1 01b964603ad601f2a04876b8fdef74f623a11199
SHA512 d7eb6dd6558a6a08e764170e1d7ae60bb2efd7e5a8e2c19cfb1219b12a831f834a64979445f22697d9ac1aabb33fc9f9638351172fadfc1225c2477734bba9d7
SSDEEP 6:1X2f66krOUGqGGY4EzfizfgXUYzfmEAzXk9oGXWyzX2+z6t:1X25MNi4EbQtYbRAI9oqSM6t
TLSH
T18EF1228FBC29A28B32E0B0CCB112F1339A0E7CB1C60E7423C41322903401629228CA37
MD5 SHA1 SHA512 SSDEEP TLSH

Bouch2.sto

SHA256 6928be6484e884d3dd961e412b1638829af8d7527f8ba627d08fc4848c7af12f
MD5 d5f1aead33955449d4c58becdf65fd67
SHA1 fc3dcc401432bba5bcab3569dff38980d26bc761
SHA512 f29a28c60b1eb53c96ab364681794ef626382c3c46ed4ad67fbba204d51b79a3d71675600d71bf36a53b0fa663b8240f627cfa00b986208b64d7aa01de05351d
SSDEEP 48:Y+YhESz7pjaJ6T1soI/lJBIJKkI2idu7xYRv9cIuUIWy7e8OoGV4kt81e8:xYiU3hsNkI2/9O/ToGjqF
TLSH
T135430BC079347719AC62C19B4C544E02DB7C84B76258BAD4565431FC46380BF76EBC9A
MD5 SHA1 SHA512 SSDEEP TLSH

Indstningsprogrammernes189/tonsil.scu

SHA256 1da3f833dcb0cd92cf0091bdfce8afc6b084b463d538f158aadadeb2be06c994
MD5 a41ada08aee38fa0df17885da26c1d39
SHA1 30fd310a397fa16f0238f6860bbba89cbf9f7657
SHA512 e99c1fec414ccb232aef6cf2f76619612cce926e3ddfa710826c06696a9970d4106642198508e77c779351fb7ca09eebe18cd1570f9fcfc83ae0f782da2fc2c2
SSDEEP 24:vsbS0PyP0OZLdgc8HLkhDcwHHMGKoYNlIDCSoZQ1CX3A2YmI9vAj:v+60CgrHLjQMLoYfI0O1CXdYf9a
TLSH
T14603B4ABF93CCFDB900D7C865410B905619AABB8FBA548DD8A45419C32C7D00B098AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Quadrilateralness

SHA256 1ad9b691c6c762ec2614ad8c8ff512b247b218d23b28aebe19e38b811fd2f7bc
MD5 9bae4f271923f07a29fa6962d7f11f82
SHA1 7b331f6bb70e2ecce560095178188b2020611960
SHA512 082fb94ca1adff49ade0d323ef601585fa11f12a95c63961b32c4934588b0672079cb00c32493fd96699649c777d471e8dc3943a26fd8cfb138b7b6d0c0f3f52
SSDEEP 3072:645ZAg6H8MXuZv33SsLhxoooooooooooooooooooo0Mktg05n9WJJF/RsNdAnFst:645SgkELLooooooooooooooooooood6F
TLSH
T16604D15A6C0435466205872B93FB041DADF30DEAAC10FBC4BDD7612D0F9AAC6786D36E
MD5 SHA1 SHA512 SSDEEP TLSH

Reganges

SHA256 db61023843e9b940daac863b65d49050d934d28f04afb9b53618366d790427f4
MD5 414f6daf599c422b333c98f369b4d452
SHA1 3a3c16d5b569acfa3e6857ac6361bd0c8bb8c18b
SHA512 5db79e518d2b9a37637475ac54cf1895655516d56295aea38f826c770e784c91ec4ff4b4332b120475c4f16cc5d97787c86ef296a2ab29f7725a3cf42a5f8afa
SSDEEP 192:hUFp2W/ctgYTDLigqjuTZnnx4hK2fPRtjuH0LC3NFGp+AfwIY:OFp2W/ctgOegGu9nx+vXRCipMIY
TLSH
T11D528E85A752DD6FC542C634C0EB6C67ACBCB206474DC878E232782A40963E35769F7E
MD5 SHA1 SHA512 SSDEEP TLSH

abought.unp

SHA256 42d868836e8ec4fa39ac264fd7dfae57d496711321578b938d0676de35ed4c4f
MD5 757fd8bbd9185dd17c183febc1c2288e
SHA1 68cfe37a72541f00839943088a56070eefbd2e1e
SHA512 e2f2dd482860897751ae4d73e954083a39cb45fc73cf2242a26e45ccafb154781f67daff41588b736550b6076eeafee801c47cdd02bfd9164c27b97add35dc80
SSDEEP 48:IP2OOCUQ70hCEq3bHJMoHSO0NoElw3v0dnLvUeS3nu:IuKZcCz7JEoinr7S3u
TLSH
T1B7731A3C826AE34FD359D2B71261234DE628A622DDBC963F603C0E582B4736C1A27179
MD5 SHA1 SHA512 SSDEEP TLSH

aragonese.obj

SHA256 e96dc8139113109cfb850785c5bbf6df72e5cf3a2ebd58b694d00183caabe2d5
MD5 471e97c30a58ced2484234a8d5ca1887
SHA1 2a5abbdc4ae26a43d51522f23a9090addf17e2c6
SHA512 ed57335bd5325afaac1c9984554cfae838a9c1e1dfa7d27d978902b8e78029b3d1ce9e845b5d11ed69f5c0bfa0ddac62ad5745f6443c66bbe759ceb5c1f2ec13
SSDEEP 48:vaaHDqcXtYCmapWAnhvKA6w9wYzh0xIBRa6n1Pynv4+XT:FWcXdb6wWvg6rXT
TLSH
T19BD286D19A66BA10E6839CEA1C40077FE90DC5116E82A55D5B5C27575C9261033C8D90
MD5 SHA1 SHA512 SSDEEP TLSH

coneflower.van

SHA256 a129c6375d03e75bf1754a9a85e2de9e4d287b49d4069e3d48003269d7fc0d93
MD5 60f4a1eaeff12f0a61bd79bec51e2e69
SHA1 da704832a5e2242d8a1556bab0b489e475baa979
SHA512 980edb961b46d1a1693526703362f93749d73b9362560805225b257b6a574d7f356dbb381721ee2518fb643f14a1df2e60650b97c564b8bf89dc006587a0a3f4
SSDEEP 12:IdgCJwHT70APgM6D71EXU74SZmH6X/8pBM82XGQpKsowQgslh:Idgcw30APB6D5Ee/makpBMHWQQtwQgsD
TLSH
T11E625483CDF47E8A010B10C896F0395C02EAA0C2B2F105A105A4DF6F02B731CBC80E4C
MD5 SHA1 SHA512 SSDEEP TLSH

implementering/normaltilstandes.par

SHA256 a6536c64590ff209758e9fc27d93e1c51c908fe243bd104629a1d6d50512f0b8
MD5 500118d1617a83b0a053336e4b350614
SHA1 9087c95011c286ae6809c362dbf9d2e75fef2d29
SHA512 d571a2d346d07b0ec446c49802fa146c2759d97affc5017c5d65d569ef88c0528cab9a6462a88548ceacc8ce8a47b9742927f66794f04919c3ac18ee03ad4dd4
SSDEEP 24:E7SjIBvy4mLYCIiBn56x+JJKMlNf9nOBjC6n6rv20natf:E7SaKX/ILx+VV66rOqatf
TLSH
T15CD2D68DBB3004F18087CC1A3A4AB001D1D180351C42EE117977684A9AEF8C2CC4F33C
MD5 SHA1 SHA512 SSDEEP TLSH

implementering/skraakants.sku

SHA256 6167aae62410f3bc53cc344b5b61e38618972f6829aa6aebe18243b897da6fe6
MD5 e24f07b5e7f1c4490e31189d5ed427bd
SHA1 2a81ae60f6fd9ee82a0bc920cb560a6b14a0cac2
SHA512 30402eef790a93f25ee81680882d138d1606fa73cd7df099ddd349cfa4929104d05b11beb9ba679b110d8f40b58f5ca374fe098750e96c82adbb48f37c70d491
SSDEEP 3:PNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNK:YklkMalCdI6lmWdMCVdIlwlACWl9
TLSH
T1F4A12B5CDE6D00091A401C4FD33F2A187232C2E8150149C0149C14179020C307C4D446
MD5 SHA1 SHA512 SSDEEP TLSH

implementering/skydesejls.ops

SHA256 ef12bc3006cee739fe1d83e1bd1198aaf7a0059e7542784fa4b93aa3f1d21517
MD5 5c6e4720cc89e79e00b96ca8882893b8
SHA1 b179d7999baca22c1d5cb247664393a0ae49a212
SHA512 b087010e429d6ec5f4f9e7d158e7ba5c3cd18a8cfa83fd2b42613d5b966c2c0dfe5df14a50e0cd52a815b280b247d48d13af38630393c41a8c3ad4aad0b60eeb
SSDEEP 6:2i+g/Yqu////T6qgVD//k7ii//cXIXq/kz1S/MO//Zn8ko//828SX2XgXm///+WE:NDZeXGtbcHA4UPOxmhWm72ucM//6
TLSH
T1B2522303AA594C95411C6CD9CD8D89051C20BA094B703B04CA44EB123C5137D79CC2F9
MD5 SHA1 SHA512 SSDEEP TLSH

infirmly.hyd

SHA256 dd97e2733c2bb05a196580a3c72dde2791a643468bfb4d1044909adcc1fd6167
MD5 5de871a3c1ae0fc97b1e35a69146261c
SHA1 a4fb1686c80f342a0673badc2d4793cf975eb57c
SHA512 a398828f9ec4c9cb903348b77df17fa49c3c06734e04a8d30108d57cf56cef0d929fc9a86558b26d615a4db56bccedb87abd9df1dc194e9cd310685da1dc73b9
SSDEEP 24:9szcz/3iXhqn7YaKT+oa8LwALa63ak/W+uoUWAZmZui:977bc4Ze7LaYBzsmZui
TLSH
T167D2673DD35D087752A0CA5A15C4CF6903FE1A34B9655695C2A193404AB3D06926914B
MD5 SHA1 SHA512 SSDEEP TLSH

2009c2095160ce4c016855f7af23529a143e7533a5624b60f4dbc277ae9a7bbf.exe

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Betruknes.prj

Bouch2.sto

Indstningsprogrammernes189/tonsil.scu

Quadrilateralness

Reganges

abought.unp

aragonese.obj

coneflower.van

implementering/normaltilstandes.par

implementering/skraakants.sku

implementering/skydesejls.ops

infirmly.hyd

Sharing

General

Malware Config

Signatures

File Explorer

2009c2095160ce4c016855f7af23529a143e7533a5624b60f4dbc277ae9a7bbf.exe

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Betruknes.prj

Bouch2.sto

Indstningsprogrammernes189/tonsil.scu

Quadrilateralness

Reganges

abought.unp

aragonese.obj

coneflower.van

implementering/normaltilstandes.par

implementering/skraakants.sku

implementering/skydesejls.ops

infirmly.hyd