001002998384756_pdf[.]exe

resource
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll

resource
001002998384756_pdf.exe

001002998384756_pdf.exe

IMPHASH f4639a0b3116c2cfc71144b88a929cfd
SHA256 7861a056a2451cb107a0f489df465ea836cb57d8921dac618db52d62bf349df3
MD5 dd41baba80d0a2af43c82141444c5122
SHA1 93c884d47a47dcf65c87ae3e28b80558d23a201b
SHA512 1dbc2ce888c1ff0254ecbfeb7a84901e6afa02f584963ff8e0fbe155b1b01f51354c8cdde3c24103c3a4db0806c30f4e06be96159842de4d8f022bd8679dc161
SSDEEP 6144:fXsKoGSLxIxDZzoJDGj90YskfccUPZqOidAoJkY3vA64cZbXCi/mLPmvLX6frOzO:fX1xliGj908+PBid9JkYfKcZ6LE6OzO
TLSH
T19DA4F1293EE9C916D2609D75C9B9D7F92C796E90ECC4861BBE7C7E043A331BD2901093
MD5 SHA1 SHA512 SSDEEP TLSH

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

37:32:89:fd:67:5b:22:5c:27:b0:a9:06:48:53:eb:ca:aa:31:84:ca:e4:7a:78:a1:35:b7:1b:36:62:7f:9e:63:b6:01:46:82:70:14:0e:61:a3:e0:02:e6:19:75:39:28

Digest Algorithm

sha384

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=polkaens,OU=Langstrakt Xylofoners\ ,O=polkaens,C=FR,1.2.840.113549.1.9.1=#0c1350617069726572734048616c6d6679722e4272

Chains

Jun 30, 2026

CN=polkaens,OU=Langstrakt Xylofoners\ ,O=polkaens,C=FR,1.2.840.113549.1.9.1=#0c1350617069726572734048616c6d6679722e4272

Subject

CN=polkaens,OU=Langstrakt Xylofoners\ ,O=polkaens,C=FR,1.2.840.113549.1.9.1=#0c1350617069726572734048616c6d6679722e4272

Serial Number

07:a8:15:26:0e:3e:3e:30:dc:c1:a8:67:f5:e9:1d:63:1b:86:35:8f

Issuer

CN=polkaens,OU=Langstrakt Xylofoners\ ,O=polkaens,C=FR,1.2.840.113549.1.9.1=#0c1350617069726572734048616c6d6679722e4272

Revocation Status

Not revoked

Timespan

Jun 11, 2026 - Jun 11, 2027

Subject

CN=DigiCert SHA384 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0c:20:43:49:f9:d0:f7:59:fb:98:2d:e4:08:1b:88:7b

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

13596

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegOpenKeyExW RegCreateKeyExW

shell32

SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW ShellExecuteExW

ole32

CoCreateInstance OleUninitialize OleInitialize IIDFromString CoTaskMemFree

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create

user32

MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW CreatePopupMenu AppendMenuW TrackPopupMenu OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW IsWindowEnabled SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CharPrevW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint CharNextA wsprintfA DispatchMessageW CreateWindowExW PeekMessageW GetSystemMetrics

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor

kernel32

lstrcmpiA CreateFileW GetTempFileNameW RemoveDirectoryW CreateProcessW CreateDirectoryW GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW WriteFile CopyFileW ExitProcess GetCurrentProcess GetModuleFileNameW GetFileSize GetTickCount Sleep SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW MulDiv lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject SetEnvironmentVariableW

$PLUGINSDIR/System.dll

IMPHASH 509a34b3a68a773e0afb4259e68f9f82
SHA256 23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6
MD5 192639861e3dc2dc5c08bb8f8c7260d5
SHA1 58d30e460609e22fa0098bc27d928b689ef9af78
SHA512 6e573d8b2ef6ed719e271fd0b2fd9cd451f61fc9a9459330108d6d7a65a0f64016303318cad787aa1d5334ba670d8f1c7c13074e1be550b4a316963ecc465cdc
SSDEEP 192:ljHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZqE0QPi:R/Qlt7wiij/lMRv/9V4bfr
TLSH
T1B1427C1297B089F2F551493419667F2A6FBEAC5C13F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsDialogs.dll

IMPHASH 3b477381217c97b22146297f93df2a92
SHA256 89a82c4849c21dfe765052681e1fad02d2d7b13c8b5075880c52423dca72a912
MD5 b7d61f3f56abf7b7ff0d4e7da3ad783d
SHA1 15ab5219c0e77fd9652bc62ff390b8e6846c8e3e
SHA512 6467c0de680fadb8078bdaa0d560d2b228f5a22d4d8358a1c7d564c6ebceface5d377b870eaf8985fbee727001da569867554154d568e3b37f674096bbafafb8
SSDEEP 96:ooEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YMNqkzfFc:ooEvCu5e81785qHFcU0PuAw0uyyIFc
TLSH
T16A12F992E2A454B3C5D6523B35AA2F2DCBBD5329B0927C01C7738E4D393957A6E38343
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

7527

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Fertil.her

SHA256 db3f786fa937af612e5c6ea5b440ee0a7c687349e45d64b9a29607993321ef0b
MD5 36775c6333b7441740ee91bf03f47419
SHA1 48147f4db0abd1ab1a3c5b76483d0512370d3773
SHA512 69e3c8ecf80407d1f7a5a08b5b4a2567a9cce87c870713dac7f04941567cc20b13a4aaa93c58c655e2f9f4116c784c5118925fa9f29d91b7c68ffbe58a26c083
SSDEEP 12:24g2QrHNHFhxEHgaf/J+wbkuxHSE0Ige5HFHCaGs2d2NHylmHSyeHonHc4rszGEp:2PHNefJlRL9F6QNTCoHdsSEhcKKG
TLSH
T15EC252A4A53D193747CE02A3A04C2BF2B761494EC19CC17ADC656024F05C0605C1C23E
MD5 SHA1 SHA512 SSDEEP TLSH

Liquors212.udm

SHA256 4453a325cdadcdbfeb0f16623234537639ef45cf8131a78c087bd72d494218a9
MD5 bf5dfdeaf72c7a9d56b210c9b9a046bf
SHA1 6caf53347a7468106f93a6e0a1cd2d4b915db354
SHA512 aa489406dc5fdc85151d658bdfca93dfcc05cb4388f8fb1cdb06202ef2066e80ffbb5ab7012b5a8e90b2103ed6834ff090e7d9067671c7d22e196a660c2c8ac3
SSDEEP 96:O/KU6WpBta8ih4chWTefX8qtNkxIC2dv+rHRCAug:EKUlp/anhWi/8sNkOWug
TLSH
T136D38CED784498C8029792C692E57F8EBA68A44D64A4F352378B1077BF48ACF5094383
MD5 SHA1 SHA512 SSDEEP TLSH

Quadruped

SHA256 f6ecedbeefd7467f333c08a687a7152d55f4e72b40263f5ef642e23ba9a18e2c
MD5 b1f725f728a4076d6ecb7247b36bace5
SHA1 04355a64dd4f40346662f0ccda424ff6a5ecdbb2
SHA512 a2adf49a51613aad7639b3a941e7d2e5d3060c002689afb4574fc53c820b50f09600a62ef1478bd590e21ba051a4ca5ceb968551b7dbf10ffea1068c2ef65436
SSDEEP 192:x0ckeZVV/6U+Flewz7BnlZFsUPXX+sHQlBS/uXq7pLvxinBCWsWjGEBEvOca:xkqVTeXBnlZv+swzSQkDxgbjpBEvOca
TLSH
T185526EA2CB658DFEEC49833CC9FF19671DED905D6F0ED4B9906A270440422E31A51BAF
MD5 SHA1 SHA512 SSDEEP TLSH

Semidigested132

SHA256 9cc6820d46065ba3e77ae929420f0452b126a82772cdc8aac17be2b065925583
MD5 0b3e11216d9c6032cc0284fd9462e7a9
SHA1 44cd700408ad572c05e30d798e8282f824dc716a
SHA512 9a1a1e8ddece0ba30b3c0cc82384a37abcf150ae7e1d43f33fefbfce6e2edd7b1fe7e44d5d7d2c527410340f1a38f0393eb7a79b6990e04e65a9a7752a98a9ba
SSDEEP 3072:XOlznIjRQoucDvQHYyq6k5lOWeCf7dUCDRlvkuQ+ussa/p7XezXeiaJQwS+f:XOlEjRQ2DmYD6tWeCDd/XkXE1Zodof
TLSH
T13604F196ADA53303DE50E8B9EDE874C3509A14732829CE3D290CA6634AF2E595C7FC5C
MD5 SHA1 SHA512 SSDEEP TLSH

blodlegemerne.svi

SHA256 99e416fa5e168f6e5036b89965560f2d19aeddb82eb2426639c6f47eb8317dbc
MD5 1ec9d600c9e8d7e25ad8960e0937b650
SHA1 be457a78b6282366c19d44a69c0ec2f1fcb265e1
SHA512 6ec6fee32710b1a9d40ca5cb8a692451f0be19c98e3839da6a4f900bdcf59343668c63ab4686f32821ba5725874628832f68b21f841d29ee66198af7713a9ce6
SSDEEP 24:Ctdj0Osgc/9W6U850oZ63RVOmUtPCCst6uTR5:CtdjiHpZySPtPCCst6uN5
TLSH
T1BFC29691B0A7B5C2F964726A9739106D4A3C733AD9CD127605686081F4FF3042C17805
MD5 SHA1 SHA512 SSDEEP TLSH

nonconformism.ove

SHA256 bd9f0295f1794be03ba6180fafeff4d90a404133a5640a6de1a8b7c3ba5bf520
MD5 4fc9503891967ec9f8a754c14b7f7099
SHA1 bfe84be4ccb3fafc558629cc837af2414523713c
SHA512 cbe6569395062736094ab4ec05ecff565436c860c9e30bc37976636d43d730b0c4910b2a5dcf8d031e640ef9bbd59d1e7ce23f6b2d6717d2ea7fc3a5e7d23ef5
SSDEEP 96:Qyvsx6cAtUBnWxMW4+pbpLXMCrW5loNDMMJ:r0xL8UBK8+pVrW5loNDj
TLSH
T17EB32BD7C27BB2A84114EC1453FD0BA9C1A837CC1D85D5D4836B9454BC1FA1106EE676
MD5 SHA1 SHA512 SSDEEP TLSH

sulfathiazole.bra

SHA256 03423bd328f35f05c04f307c903e981c23f1a1d02c0a66cbe577ff49e4c6ef8b
MD5 2ece71c132b1305a6050f29a72451549
SHA1 1a55bf2fb0f1470b86be10fedf3c6c4d1bbaa509
SHA512 c521c4e89427df967d4b0efb1deedad86d76ec6057bdec7679a1dfde37e2a5d1ffa5362832c68f4af2736563037820805bef934fd93950a48f13dc18b98df6f8
SSDEEP 96:trprYydhdQINGkr9jVVzR2aQle9uXLp99:trpr/naIvNLlu1D
TLSH
T10B432B197F8AB2DDB086C1D965BBE17B08B5DF2C62EA4221C390826C0C7483B32935C0
MD5 SHA1 SHA512 SSDEEP TLSH

thermantic.ove

SHA256 559313838ae5197e78f7a85c195b5ce6c47ea90c462367477307755991d3c563
MD5 38ac582dfc8e01225810fa8d747ca777
SHA1 fe10cb90101b4c9312fb521e3e6505633e3f0ec2
SHA512 1e090a87521cde736ee9b745cffcfffb2c5602c2af97d2d67a26392e6ac85be182cc7db8884d1c65fe00e96c168c9cc41eba11b562602e1367c382f1ebe504be
SSDEEP 48:/Z5nfmZWk7LuThX5ktFpqE5Krk6spL7r6gDb2pqlMBqUc66QqvJnv8r8Mo:XK5/YpUpqEORuXOgWpqfH6BJr4
TLSH
T111735BC886604A91B3333CB7CA50DEAB2A3C0CC84B664E70816B46D96D00470BD7B3F1
MD5 SHA1 SHA512 SSDEEP TLSH

001002998384756_pdf.exe

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

Fertil.her

Liquors212.udm

Quadruped

Semidigested132

blodlegemerne.svi

nonconformism.ove

sulfathiazole.bra

thermantic.ove

Sharing

General

Malware Config

Signatures

File Explorer

001002998384756_pdf.exe

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

Fertil.her

Liquors212.udm

Quadruped

Semidigested132

blodlegemerne.svi

nonconformism.ove

sulfathiazole.bra

thermantic.ove