caf44a2d4d469a2ec1b8acf1df9e5dabb3561bc7d580ea0e83a3523bde454bf8[.]exe

resource
unpack001/$PLUGINSDIR/System.dll

resource
caf44a2d4d469a2ec1b8acf1df9e5dabb3561bc7d580ea0e83a3523bde454bf8.exe

caf44a2d4d469a2ec1b8acf1df9e5dabb3561bc7d580ea0e83a3523bde454bf8.exe

IMPHASH 56a78d55f3f7af51443e58e0ce2fb5f6
SHA256 caf44a2d4d469a2ec1b8acf1df9e5dabb3561bc7d580ea0e83a3523bde454bf8
MD5 47e5526a49468b5f09a308bdbcc14429
SHA1 1178819f033897aa05661ceadf24149e0f56ec19
SHA512 611a9a0533404bf26da8e0f317648002dd8403da4aec23c64a46d41add89522cb4b38fef618a2bc2a595824e373dc93fbff7650ebd97349b3759b95d823a5449
SSDEEP 12288:nNbPw+zB8c70DtiqjkyZMGFPxiBrzz64dCA1EVB22e/LVo:nN8+zB8c4D0OMmcBHu4YA1EVBC/5o
TLSH
T1C8E4F0197214A077C59406723AD6823FEA647ECCA6C6030723B8B73B79F154DFA057BA
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

25:e5:b0:ec:76:a8:c4:f7:c7:b2:44:d0:7d:e6:43:bf:f7:9c:4d:34:b6:73:f6:88:b0:1b:ed:f8:16:fb:08:a6

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Sadismen,O=Sadismen,L=Cesson,ST=Île-de-France,C=FR

Chains

Jun 25, 2026

CN=Sadismen,O=Sadismen,L=Cesson,ST=Île-de-France,C=FR

PE Signature issue

Digest

f9:7c:0c:44:f7:72:b6:21:b9:07:ac:16:fb:e7:72:74:97:1e:90:66

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Sadismen,O=Sadismen,L=Cesson,ST=Île-de-France,C=FR

Chains

Jun 25, 2026

CN=Sadismen,O=Sadismen,L=Cesson,ST=Île-de-France,C=FR

Minor OS version

0

Major OS version

4

Entry point

13559

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCreateKeyExW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken SetFileSecurityW RegOpenKeyExW RegEnumValueW

shell32

SHGetSpecialFolderLocation SHFileOperationW SHBrowseForFolderW SHGetPathFromIDListW ShellExecuteExW SHGetFileInfoW

ole32

OleInitialize OleUninitialize CoCreateInstance IIDFromString CoTaskMemFree

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

GetClientRect EndPaint DrawTextW IsWindowEnabled DispatchMessageW wsprintfA CharNextA CharPrevW MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW GetSystemMetrics FillRect AppendMenuW TrackPopupMenu OpenClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW PeekMessageW SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint EmptyClipboard CreatePopupMenu

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateFontIndirectW CreateBrushIndirect DeleteObject SetTextColor SelectObject

kernel32

GetExitCodeProcess WaitForSingleObject GetModuleHandleA GetProcAddress GetSystemDirectoryW lstrcatW Sleep lstrcpyA WriteFile GetTempFileNameW CreateFileW lstrcmpiA RemoveDirectoryW CreateProcessW CreateDirectoryW GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW CopyFileW ExitProcess GetCurrentProcess GetModuleFileNameW GetFileSize GetTickCount MulDiv SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW MoveFileExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
MD5 cff85c549d536f651d4fb8387f1976f2
SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
TLSH
T126426B129BB089F2F591583814667F2A6FBE9C5D27F50563CFE304D63D212CB983A283
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Bindemidlernes/biologer.gle

SHA256 f7a3f34d53fcdecbe15af74633cb91928cc8021832b0b0d070ea7d36e9972e20
MD5 0e6d9f95e3094b3a4d3e5f8c956ae009
SHA1 5339806a0b648ced814b1902b80ed134b3982137
SHA512 d95e8ad759b8640ae6b3476ce428d9acf88ccf49c14ab7d3eab3650fa3bfa9651691fd3bedfa2042738c60bc7a0bbd161a13ea4aa8021c701e4f6364fc8b0a5a
SSDEEP 192:7HyFG6oUrGqPNTw6hm3QzySz2jUvf6x37HZ:zyFG6o2GqVM64sySz20SdTZ
TLSH
T1D4A31C5CAE1D5651C56AA2C18D017B8C153461FE773074EBFB0540FAD0477569E6143C
MD5 SHA1 SHA512 SSDEEP TLSH

Bindemidlernes/citrins.fys

SHA256 f95d7eab4771a7ab8c43c3e1db4d4e8210e6ca541d2cad1367a25e1164aa3422
MD5 e494958b25ebfa824628db4e543b20c2
SHA1 b177c42e7a8c3eafbcc7fb907bfb2a7c5880c86c
SHA512 2f40a357cd6c90298e3914d7210f0ef433775afc412fbf530e5ee5919b1aded3194f156993ac39876680aa5dd95825b2f459cbf0841be743a0e805b2518983fe
SSDEEP 96:LjIFiCCZInjpeDVbIAe2KUVaFbGWpnMqhbtBdupa7LpIf:LjIFiCCAMlI7UUFFCqhbtrZ7Laf
TLSH
T1BDC36EBC6D883E936067583351B7C94A832166D78B3C68545884EAE71D018D99CD2ADF
MD5 SHA1 SHA512 SSDEEP TLSH

Bindemidlernes/digitaluret.tom

SHA256 39c70de76de12a53c4b1e750828d1c052ee71da268a3f4dae0cfee08153474bf
MD5 c1879831e9fb7fce22d1f56a7a2f31ba
SHA1 b289fc7b230eaa354af775059bc9136417f7fe32
SHA512 6a5d948cff142d3e99ee33433909322a8a6eafb900b526f7586b9f97e5a6687c515502ef670ded4cd97e0341f589ae6cb958d0da6fa02890c16d056de87b22b6
SSDEEP 192:MB6cWgG8zyxz0IFyK7KMvMGaZK7o6y7JUcWPeTG:aDG8zwQIFyK7KMUGe6YJUcWPeG
TLSH
T1E354AE326E32252CF7D256420A597A863CF68EE3B3832739D9E6F2313FD5512884590F
MD5 SHA1 SHA512 SSDEEP TLSH

Bindemidlernes/lesgh.mak

SHA256 9ebb12640dc3e8600c13171d68b9b0fb37f3a469d94658a0b5191b45c10d40ef
MD5 d51b74125156cc5cd9f00d9af16d786d
SHA1 5f5a3c8eb5643dfe50274084a498a15dfefccfb8
SHA512 cba20a74b632f75e352fdfef55ab596efe94164419626b1beef92d064919d09607d4ae3807b60b84de8d38de00b5ab9a1978a80d04a3c6bb409c02c26e5d9c12
SSDEEP 384:MSIPeY1Y3S+X6efhaN5OlGg2m+Hezt2ZW:MSD3EUAI
TLSH
T1BF44BFD160317C0AF5A0A3315DDF6B14D73959E0B249F632A0817FBA2C8687CBB45734
MD5 SHA1 SHA512 SSDEEP TLSH

Bindemidlernes/rainwash.Udm

SHA256 0bcbfcdca4d03308084a550d0e272457b3323a365f239e829c14fb58d05e19f9
MD5 199f58c36722ec2825f31dfccea029da
SHA1 7b64b4b916295494eb7601a941e2204304da43fb
SHA512 a2556f1a07c9178db5b061000010b4e1bd3312f5190e4f6e1dbdb1443473bdddec10e96905e5d0b9187f31056de64fb00bc2d996609ba026dbd127e424173810
SSDEEP 1536:fnapqW6gS4zbpVIMYq73zHhTbZ8fAmmvf7yL2dtpxM:v6Y4zdVIRAHd1Upmv9t4
TLSH
T19CB3C096D7228DF7DC06993CC45E30DA4D6430128B4FE9ADE276F814C24B3E367246AE
MD5 SHA1 SHA512 SSDEEP TLSH

Dramatikken.Res

SHA256 038cecf9f88797a914752e9463d6ee51a0d2ef89e66c1a4537e22d07f0c63598
MD5 93443731ac94677165938a4946c19c88
SHA1 38de3858da5705ce26234750177eea82ebc2153c
SHA512 30e7f518d94dadd95782ece97af9261de6e877e5a00bcb83d06f525478e315886a92a6183c9fc58d2224a6e24eae99aaaa42157bc80813ec1f52dca539f88bf3
SSDEEP 12288:PoFKIEO3D8z4nk2k6SyDzfuuGNyRmSuKVe/:PJbI4Ga6Zu+mSuqe/
TLSH
T182C40169D1BE0BF9C02C7A6B02CBA1EF71A55DEC116C7865E5E6F985D0F47CB0202AD0
MD5 SHA1 SHA512 SSDEEP TLSH

caf44a2d4d469a2ec1b8acf1df9e5dabb3561bc7d580ea0e83a3523bde454bf8.exe

PE Signature issue

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Bindemidlernes/biologer.gle

Bindemidlernes/citrins.fys

Bindemidlernes/digitaluret.tom

Bindemidlernes/lesgh.mak

Bindemidlernes/rainwash.Udm

Dramatikken.Res

Sharing

General

Malware Config

Signatures

File Explorer

caf44a2d4d469a2ec1b8acf1df9e5dabb3561bc7d580ea0e83a3523bde454bf8.exe

PE Signature issue

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Bindemidlernes/biologer.gle

Bindemidlernes/citrins.fys

Bindemidlernes/digitaluret.tom

Bindemidlernes/lesgh.mak

Bindemidlernes/rainwash.Udm

Dramatikken.Res