_4b2eff9001a6b53c43b71e6632216679d9d4fd61814ac358a75cb32db9cc44b8[.]exe

resource
unpack001/$PLUGINSDIR/System.dll

resource
_4b2eff9001a6b53c43b71e6632216679d9d4fd61814ac358a75cb32db9cc44b8.exe

_4b2eff9001a6b53c43b71e6632216679d9d4fd61814ac358a75cb32db9cc44b8.exe

IMPHASH 6e7f9a29f2c85394521a08b9f31f6275
SHA256 4b2eff9001a6b53c43b71e6632216679d9d4fd61814ac358a75cb32db9cc44b8
MD5 415cda707edaa722ca7aac2ef2a0cd78
SHA1 6baf8e90e1fcfa7341e67138e3720c52d840446d
SHA512 3cc5078055ff0ce32665eb3545de1205451ff8a4286098eded69339bb38a868e0da3168f88658584675e532d3552da9d094adaadd633177bba9d785e61171c71
SSDEEP 6144:f0Mm4CCx78Zmfz2vymL4DFQqmAlr/7oFLTebGtafGjJyjiBA:sMwI74gSymLMCqm/Teagdji
TLSH
T1F07412123761D4B3D6B146302D76D23526A1A7EA3911D76F13A0AFC47CB2FA21E1F329
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

b7:17:c4:06:ea:f1:57:a1:7e:55:11:d2:97:f7:96:6e:38:4b:93:44:a8:e6:63:e7:86:f3:1b:71:7f:04:fd:39

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Eventualiteterne,OU=Kronikr Rammish Platode\ ,O=Eventualiteterne,C=FR,1.2.840.113549.1.9.1=#0c19546f696c776f726e404469736b72696d696e787a722e47676c

Chains

Jun 30, 2026

CN=Eventualiteterne,OU=Kronikr Rammish Platode\ ,O=Eventualiteterne,C=FR,1.2.840.113549.1.9.1=#0c19546f696c776f726e404469736b72696d696e787a722e47676c

PE Signature issue

Digest

f5:49:c6:71:e0:10:87:2a:69:8f:72:e6:40:93:ba:e6:f7:96:86:06

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Eventualiteterne,OU=Kronikr Rammish Platode\ ,O=Eventualiteterne,C=FR,1.2.840.113549.1.9.1=#0c19546f696c776f726e404469736b72696d696e787a722e47676c

Chains

Jun 30, 2026

CN=Eventualiteterne,OU=Kronikr Rammish Platode\ ,O=Eventualiteterne,C=FR,1.2.840.113549.1.9.1=#0c19546f696c776f726e404469736b72696d696e787a722e47676c

Minor OS version

0

Major OS version

4

Entry point

13455

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCreateKeyExW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken SetFileSecurityW RegOpenKeyExW RegEnumValueW

shell32

SHGetSpecialFolderLocation SHFileOperationW SHBrowseForFolderW SHGetPathFromIDListW ShellExecuteExW SHGetFileInfoW

ole32

OleInitialize OleUninitialize CoCreateInstance IIDFromString CoTaskMemFree

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

GetClientRect EndPaint DrawTextW IsWindowEnabled DispatchMessageW wsprintfA CharNextA CharPrevW MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW GetSystemMetrics FillRect AppendMenuW TrackPopupMenu OpenClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetWindowLongW GetSysColor SetWindowPos PeekMessageW SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint EmptyClipboard CreatePopupMenu

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateFontIndirectW CreateBrushIndirect DeleteObject SetTextColor SelectObject

kernel32

GetExitCodeProcess WaitForSingleObject GetModuleHandleA GetProcAddress GetSystemDirectoryW lstrcatW Sleep lstrcpyA WriteFile GetTempFileNameW CreateFileW lstrcmpiA RemoveDirectoryW CreateProcessW CreateDirectoryW GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersion GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW ExitProcess CopyFileW GetCurrentProcess GetModuleFileNameW GetFileSize GetTickCount MulDiv SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW MoveFileExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 b7823a15e7b1866ba3d77248f750b66505859d264cfc39d8c8c5e812f8ae4a81
MD5 a1da6788aeaf78ca4ae1dece8019e49d
SHA1 d770155e6e9aa69223be198c44a8da26a1756d89
SHA512 eada9c1528563ddfe3d4d8ed5dbc52b85a9190765535b68da90e6d623288bf0090adac5118e1ed6e3cb3e0abb9af025d3a2a73121413a4471a90fd04bc861e18
SSDEEP 192:uenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XBUIwL:u8+Qlt70Fj/lQRY/9Vjj+L
TLSH
T144428D1193B089F2F590583801A67F2A6FBEAC5C27E84963CFE341853D702DFA47A243
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10719

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Gemmembel/Phosphatise59.skr

SHA256 863bfdd3eaee0ed965b790baba9938d80e4be994428bfffd45519a05058c0c75
MD5 34201a3a406b9a61f666487f765a4405
SHA1 0827d8ea33a2d479ddf1ed5d7f73c5da59bbe209
SHA512 576502be3621dcb28d52e413b65a5ce68a61f9d0b8820110761cba2d1413f7a422a09929c43a34adfb657ec8ddef15dc5d264738f94b43538d4af3690d2ef0fc
TLSH
T14A412232200A22E3E202C30082202A820CC000320E0820233028200AFC3ECF20B2E003
MD5 SHA1 SHA512 TLSH

Gemmembel/Shortheaded145.opr

SHA256 4f458004539c9d32ddae3846e0f054337a7df90cdc5677cd8bb6dbc6b0b29811
MD5 e13ecf5c7d038794e79f60e6a98aa3a2
SHA1 20d80b6517395faf46b86f41606e125c4efbcafb
SHA512 a26a930bdb9eaec71de9a8b338016f4a89a1188cafc98451ed60602e533cfc532f823e70fda79d34594a9237f4ff5171e7d4536af09d7959404222af1e612e85
SSDEEP 96:L2El1Y2dQP0HA3Qo2OW9rLkZUCP6Az5QdjFj2It:L3ltdhHAHdarIZU5Az5QZFaIt
TLSH
T10653F80809E8B02BAF076EA4D2DB9FB479F46554582315275282DB84217D48E24FF487
MD5 SHA1 SHA512 SSDEEP TLSH

Gemmembel/cartulary.bip

SHA256 e5fcded92e672424476502a6bf017bb4f2185cf58165ab4ba4d25180a6f1da53
MD5 45631bbb229c1423c21e76bdebe8d032
SHA1 3bf641bda8662bba313b4c9fff96003db233b3d9
SHA512 358adef88080d14d589461b91b2f93c3ed5bfc435af5f545bcaa82b795e9a9b9af6d187aaf1da0287b104f53b6c0f0714d782463e966bdcd137aca3c204d30bb
SSDEEP 96:GuzKAShBU87/tJ2hZ3LUGmib/wrKH2zvLUDXtlHXBy:GISwQ/tshZ3LUGmk/wRL6XtlHRy
TLSH
T182C37DC05DB309D282168EBFC3C4754778060714D30BC2C291A6AEA9F65E6E89EE60C8
MD5 SHA1 SHA512 SSDEEP TLSH

Gemmembel/liquesce.skb

SHA256 071d45de5efd26e7c92f1c1b72d1a45ee4bbd6b6a53c3796f69327e30857ec20
MD5 68fe39942d2a183ba9571ab0dee80630
SHA1 b481911895e2f6e8932c07d9c839bb4a851f12c2
SHA512 f485010520b467564e6494ee2c49165a33593b172ab528915eb383602b0e57fac942bd531c78b64c9ef1c5cb527a98e720e28abeded79f4b03796a01b96732fd
SSDEEP 96:6nat/Wu2ePSGMQfFXb2XrXoMGeXnINk2TNmV0+4Oz1zP+sq1xb:6nChRPvMiFLWrXoMGeXIW2TNmRzP+sqb
TLSH
T1F483F8D6A2513899F1C617078FEC126AABD583C64BC83041478A9382A7DA86A9737287
MD5 SHA1 SHA512 SSDEEP TLSH

Gemmembel/luftlagenes

SHA256 f277120bf43927c6940c92ae7e29535e90f5e3dd1dcecfd8430291c78f7723b8
MD5 0f709a33faa7edaf9a4dc24ee2a8472b
SHA1 911f41a5923e814516b2e0c1706d3fdb5d533951
SHA512 207c62fcc63d9e1bd45ee26943517759996074d47841d36b390d3682a30452090ad46dbeae1d59d34ae1365ad29620708f629cfc24deaa68c20986ab7eddd364
SSDEEP 3072:ed22PS4wLEf+BgJBrDByWYKag8k/ZJXfVoFI3:ed2GwIf+BgJdBJakf6I3
TLSH
T163D3BF91E796CCFBCC0BC53CD4AE60E68C6570125B4FD0ADA239A518C1972E31774ABB
MD5 SHA1 SHA512 SSDEEP TLSH

Gemmembel/pyarthrosis.ell

SHA256 cc3f7ce9a02157cc0c270e5d273c2ab5cfa0518cf946bfb29466e566b7b095b3
MD5 a43dd16e6fdbc5acd107f4109809cd5c
SHA1 08c1ed2abbe64057de054b82a106cd099e8c06e0
SHA512 c5d405c60f2c0849014a277aa8b2926b50263b853291da9311f2a3945c595a5c02272fae0fbaa848923b1be2454f4b2aa90909e85bf019dc1785fe5e882cde19
SSDEEP 12:cTQENfsqoykmEqH4dzfO1eUHdMzH7fMwtyfYa6:sNkON0DcmzAD+
TLSH
T11D22EBC2C986E9D326CE0A29FE48419AB43A431AA402C3940F8D81A5317C061F5AECAD
MD5 SHA1 SHA512 SSDEEP TLSH

Haandgribelighederne

SHA256 7d6b64a04d901fbd28cee5c8761de8a0612363ca47eeae93a9e94b4fcb3d4a15
MD5 c994e25d0501c0bf7e8dddd6fe7c45bb
SHA1 116bfaaff3bfa2d6e5ef537b9f21345f74c0e58d
SHA512 34fc5253a4705674b58f2c9e48bbd43f2908010a265aaebf569fe23eab31f473c051f3e3cd24de47d6cc95ff87145bee47f7ee3ed5071b2d2edee18f8f0c3090
SSDEEP 3072:bLLgJd6iDqyvDLXSKkFWt9gcGVDOWj7YfqK8gyTqL5MaJFdKEjVZ:DZMbeKFtKZVDrO8R5EjD
TLSH
T15AC302AF527ED687E58EB8393C49032B1F1822E9D50875C04FA16F9870EDE91695CB43
MD5 SHA1 SHA512 SSDEEP TLSH

Hoofy.pre

SHA256 b53a690f5fb41860eeaf4c63809e76b337fe6686ea7afd7a604d03761e54191e
MD5 fb0a5781fbe8ce3dddecc25bec74ed60
SHA1 e4e517318b754fc52942327c1c259896f154a897
SHA512 7b0e257bf980177c6d4299d62af445723224867dfcb2460be47e2e53d5d8edd17a89338c64ed85679e70d5956195fecefe11cd513265684669ccf4f05fdd109d
SSDEEP 48:Oi3fHmJ9C8hX1OVTXMm19RrCZCRS/see59u8HTSikEUlrPbIbRS:PvHmJ9CuYXMm1PA3/Ba9u8HGi0DkY
TLSH
T121430A8FA7E55C592C14911EACD2B6068660F9503F8FC59EF2093A2401B2F257FAE571
MD5 SHA1 SHA512 SSDEEP TLSH

_4b2eff9001a6b53c43b71e6632216679d9d4fd61814ac358a75cb32db9cc44b8.exe

PE Signature issue

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Gemmembel/Phosphatise59.skr

Gemmembel/Shortheaded145.opr

Gemmembel/cartulary.bip

Gemmembel/liquesce.skb

Gemmembel/luftlagenes

Gemmembel/pyarthrosis.ell

Haandgribelighederne

Hoofy.pre

Sharing

General

Malware Config

Signatures

File Explorer

_4b2eff9001a6b53c43b71e6632216679d9d4fd61814ac358a75cb32db9cc44b8.exe

PE Signature issue

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Gemmembel/Phosphatise59.skr

Gemmembel/Shortheaded145.opr

Gemmembel/cartulary.bip

Gemmembel/liquesce.skb

Gemmembel/luftlagenes

Gemmembel/pyarthrosis.ell

Haandgribelighederne

Hoofy.pre