30b621487d030203a584c14d1c4d5e7cbc120ab337b4fb30b7f6706f1b460950[.]exe

resource
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll

resource
30b621487d030203a584c14d1c4d5e7cbc120ab337b4fb30b7f6706f1b460950.exe

30b621487d030203a584c14d1c4d5e7cbc120ab337b4fb30b7f6706f1b460950.exe

IMPHASH 46ce5c12b293febbeb513b196aa7f843
SHA256 30b621487d030203a584c14d1c4d5e7cbc120ab337b4fb30b7f6706f1b460950
MD5 7a0f5af5800ab5078de44b66a9a67d9b
SHA1 33d64e1c8a809458cd6f9f00c68a574a5f6d3b63
SHA512 25ca538184af3be761c7a594c23eda34de732324b784e7c6119cecff80d5e345b9146a4db5e8142af94a3f192df40ec97e745a115e4dc5d151c37fa818fb7d01
SSDEEP 24576:S4RWatMM3A+Wh9V72jiN/U6kX/3NZooFR/kNuwxMa+bE0FJAyuRFZF5UCTy:DYatMqA0MU6kXPNioD/yu+MZ0WCG
TLSH
T1BD65AF91E958D9A9E57E46B2BC2F68B114878E7EE25401ED167E33081CB2317E0DEC1F
MD5 SHA1 SHA512 SSDEEP TLSH

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

5f:b7:b4:37:ff:ac:e4:b1:d9:6d:e3:d4:6a:32:da:52:cb:a0:46:6d:d9:8e:20:c8:2c:38:c5:54:32:8e:f9:38:c6:40:11:bd:33:24:40:38:ae:c5:e3:d4:90:b7:a8:9c

Digest Algorithm

sha384

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Pharyngobranch,OU=Mailplanes Floksilkens\ ,O=Pharyngobranch,L=San Luis Obispo,ST=California,C=US

Chains

Jul 2, 2026

CN=Pharyngobranch,OU=Mailplanes Floksilkens\ ,O=Pharyngobranch,L=San Luis Obispo,ST=California,C=US

PE Signature issue

Digest

40:b1:c1:7d:89:3a:aa:0b:c4:ef:28:34:5f:78:1b:62:90:a1:e2:5f:e4:70:07:28:e6:56:f6:72:2f:88:57:e5

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Pharyngobranch,OU=Mailplanes Floksilkens\ ,O=Pharyngobranch,L=San Luis Obispo,ST=California,C=US

Chains

Jul 2, 2026

CN=Pharyngobranch,OU=Mailplanes Floksilkens\ ,O=Pharyngobranch,L=San Luis Obispo,ST=California,C=US

Minor OS version

0

Major OS version

4

Entry point

13983

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegOpenKeyExW RegCreateKeyExW

shell32

SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW ShellExecuteExW

ole32

CoCreateInstance OleUninitialize OleInitialize IIDFromString CoTaskMemFree

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create

user32

MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW CreatePopupMenu AppendMenuW TrackPopupMenu OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW IsWindowEnabled SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CharPrevW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint CharNextA wsprintfA DispatchMessageW CreateWindowExW PeekMessageW GetSystemMetrics

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor

kernel32

RemoveDirectoryW lstrcmpiA GetTempFileNameW CreateProcessW CreateDirectoryW CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW CopyFileW WriteFile GetCurrentProcess GetModuleFileNameW GetLastError GetFileSize CreateFileW GetTickCount Sleep SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW MulDiv lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject ExitProcess

$PLUGINSDIR/System.dll

IMPHASH 509a34b3a68a773e0afb4259e68f9f82
SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
TLSH
T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsDialogs.dll

IMPHASH 3b477381217c97b22146297f93df2a92
SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
MD5 8f0e7415f33843431df308bb8e06af81
SHA1 1314272e6ad3be1985d4a1607b890a34b0bde8b5
SHA512 5450b2070c40b257c28ba9a472d762f91b78928d1e8d4d88e0576992065a61fb9a6513006e6b5947c415c9e02ae80a90a85b58da7e016a424331c8cd596ed684
SSDEEP 96:obEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YHNqkzfFc:obEvCu5e81785qHFcU0PuAw0uytIFc
TLSH
T19D12F892E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

7527

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Chlornal.txt

SHA256 1181d08a3953be99139a8deb0406c3ae336a129286920faf153c48d55ccd7643
MD5 66dc216b82eba69b4a0a3cd935d42583
SHA1 f532d20f983f70b6ea8cc0df7d983789de019db6
SHA512 24af735dc9e9080dc877a2a8198f26883d46b093c98525c3c1233ad3b9ba76677acfb55d4424760204fff5cd15d30c3ef9f0def533f737cbb018aa8353d82e2f
TLSH
T190F020A4B995143E8E130AC2EE988F6B8963055A246744A0B084031F24D8CBDF736EB8
MD5 SHA1 SHA512 TLSH

Doggerelling94.jpg

SHA256 f037f2e3ed9f252aac96407b64d9f053ca4ba5af39f99d84cec9b4af8356e74e
MD5 a4fa8c0e6c5294d5b658abd9b7f00a0d
SHA1 2c08ee13ad42d36700180da5cc387479a45fa8cf
SHA512 9888f9c68e7c90c643aaf80fde2fbee8a7e7ca41922f29dcb78ead85d5b46549577b861bd6468ddcbe04e4f3ff8c1ffe5fcf0e71bd3f9b0a42f6797e9386e509
SSDEEP 768:o7s5JdmU291LBh4A/8bRvDYeS9Iu6pHtxeArW49+5LLpZ8YA4lzlFieuAms:oI5JdmT9tn8bVD9S9jwHtlW44Lg/4lzL
TLSH
T11523019240DACC853ADFA1B5363B741B22F44C79ECD19D7296B68C91F2D2CB2580C5A7
MD5 SHA1 SHA512 SSDEEP TLSH

Galvanoteknikere127.txt

SHA256 93c72ee14f27e7743ead29b0aed3b9fb37bd8631bdaa2231aa20d1196a1244fa
MD5 b259e93bacc2619b1e081dbd86f2ade4
SHA1 16013fcc7dc8c5f674aacbcb9567ad1c9b24a4b9
SHA512 ce36a2dccb6a405763e807212beef8eab2ced7556d8a2140d24f0e962db4d750e633703785568ca224d2d39abc0e7904554031346fae9c62e4b1d072daa3d349
TLSH
T14401D3515C40DB6A4E3F3B71E80135EC297E910D5394E1E1C496968C2858B6C9B7F0C8
MD5 SHA1 SHA512 TLSH

Hadramautian.Amm

SHA256 7aa1e278fdfe31be591f491f174941bd3bf74955ee955cff0fa989c555c7b051
MD5 08615eff9cfa0496d6427f7326c370ef
SHA1 7b3c24864a37b36dd6cc8f8be85a433c94136890
SHA512 06778cbdb276f468f98db4bd72e87838efd69bf763c60d2bff9575ff326ca7ed46b150452e50e7d73979549111f8331ecaff9b690471867a5c4e6fd11fa228c2
SSDEEP 768:UMgU2ZITvp1v4rZ50zGijiIUGJuZ2/Fwj+n1gOtgK8tdyhhulaK5FLfPreAltIz:ySbXiHGs2M+n1bgK8/yh0lfLfP0
TLSH
T11F73AF91DB5A8DBBDD06C43CC12E21E64D68B0169B4FD5BF6035F809C09A2F367346AE
MD5 SHA1 SHA512 SSDEEP TLSH

Ilsebil85.ini

SHA256 a03c0aa4d23385bcaa3c37b8b4dd9026cdbc68ab9aa0bb474f0bc564b7233a6b
MD5 9e117e99bbe58f784628e07cc04b4881
SHA1 88676d2f9d58b5a59ef950656d134d203debfe20
SHA512 ea0f39e7db6101d721738374d1975eec41eabc7f1ab21851c357c8b4abe9c20717b8e275d6da2dcb1a546641af7f7eb9beb8ec540516eebb62cd48e2fb033147
TLSH
T1CE0123B6D8C3393D6C570EC8BD014B2206A98A16870D50B5E8D5434F9AA2DD8D06F10D
MD5 SHA1 SHA512 TLSH

Interessernes.Unl

SHA256 e20b9f6e60a249ac47c9ff1d0e6e2652a2431094f3a4c4532ab910ef142422d3
MD5 f08099b6575a7b3d45af85e3aaffd078
SHA1 20cc558bf8e14aaa897344d589ad8428073e0c1f
SHA512 3ece61c2265240df60e63fb44c132595c52a761b3783143c486f2b7addee7a6c8fe2565022460aaf7ea35220dcaaf614969a2f0ecff057d1e5d37c1136adb0af
SSDEEP 12288:WlvW1JyoympxIeMZRmeNX2x6XJHAo/vADO6gn:OO1JampxyNl7ZHlHADO6gn
TLSH
T1B8B4F1C9CF16CE08D86086FCA1CBEEC518DB6EE649473E8126BB78F835B116555C8D8C
MD5 SHA1 SHA512 SSDEEP TLSH

Nondexterously.ini

SHA256 5d6c7149314a7064b9873c2003ba9fe4c9e3688a7417af69a8ac61cf03ecfa72
MD5 70d1cd8fdf2327c9342dba989c176b77
SHA1 be94d63eeecc9573d34f280df66f931f9cda6af0
SHA512 e361885659b4365f29f8b50077b20532186a5da934d1ede3affe23bf85b30209610dfa40e69a320ecb7932d3bbe693a8693e80d9c87738ab91e79b814f1db67d
TLSH
T1FEF0D4E0DC0C430E2916338B1DA5D3C6C8DB56765A65139057212A6D3047ABFF58D65A
MD5 SHA1 SHA512 TLSH

Pogonatum.ini

SHA256 77060aa55616ce375f67f6b7e7b79ede6b90cec3b1dcfe10859f5803c7c08f20
MD5 44ba2c1b06821f3051056942de3d9094
SHA1 4cd67db739f259a482ce112b437ca190ceeb0b51
SHA512 093a185dc9683c244b961d12c08bfe607848ae0c6fa0106db2e6eebcd54a3577deb0e76859b6a183167c798ce73025700378d572545815a4ac3c4e821789b84a
TLSH
T157F041CA890C061C6EAF57D3B84769A208B894048A26C190FFE60B8F00155FD976BB6D
MD5 SHA1 SHA512 TLSH

Unbesmirched111.rea

SHA256 042fa84825fab7383a70a65e4d005be9da933c14e9da144f36b8b5fe7c4e8da6
MD5 92a89345bb3d42cfcdabdf673dfb6bc1
SHA1 c7b5213ebf19ca44a77a263a6cf09d47f98b5e1e
SHA512 748d10314e9c85bcf92d29246b76f7449103f05cde9c8d1574ab3f66b007876b009feac0da5fc458119b400a378fda8c49987c4fea731b952c1adb80c8f8a9fc
SSDEEP 384:kxquGDOYNDB7EafUou66fhVQbHBxErCtXzQ7V58KFrmbCnD/F2OVNaHxLYRXp15V:AGS5C2F4K7b/2jlCXnSuBzJ
TLSH
T1116622736904198C41EDB7B04EA5D305D66B6CCB1D0870A6F9B68263B3D1A097FE8EC3
MD5 SHA1 SHA512 SSDEEP TLSH

alkoholiseringernes.jpg

SHA256 4c3612b98facb64f48c1811237b56d109d7b8e1b89003e347e1e97c2ad8d024c
MD5 ed80ef714a71660a5f12cfa0f35d907b
SHA1 8ca1f7252dcf02892612afaa32722eda167baa42
SHA512 b2a07cad3a0e33ac00c4b1568d6b04d4401d552a491f17729cf97e18d3a079723ad8a0ed603613e425e28eec9cfb9db95b94aa42b98f08075cf9babe2cde534a
SSDEEP 768:oCp6nUCLJ8QF4N3tlFg0585GynTdbGFWxY8Rpz8n/LtBiQUyI78p0GmgbX:oCp4UCLJ8C23TFg05XyTdbmWOCpza/L9
TLSH
T1E623025E6BF4D44CFB5690AD13DAC124C7A009BC3B862BBB7864803A90C8CFF55DA59D
MD5 SHA1 SHA512 SSDEEP TLSH

hungeringly.squ

SHA256 72a20b3c55f96bf499ac384b3772995862612d6d12b34ef5f14b6aa34ae787d9
MD5 b357aed7df0e8575e8249a1a64db24e4
SHA1 cff4c26056d2e8d6f5d1dd18b00191bd83756c0e
SHA512 11dba05ef033937a66282e829c8bf92b5dabf0c705007051132f41563f3da395c267d2de0f648912adef2fc30c07e724c172172aaf7bb74580c5e902425e0d3a
SSDEEP 192:YcYcSeku6NQBp2vizhdE5zc0HVaIZ3R19utwLQE1zU9Pf5MgHV2fugk9IdljhzvH:BA
TLSH
T1DFE4D0F377AA1295BFB5E2838DB8B8A1085063DC970436B46582C86B717BD39DB4348D
MD5 SHA1 SHA512 SSDEEP TLSH

karambolagens.ini

SHA256 c7b21025c50f5de0cb1f83c46026c9a0395b1fde783710d3d7fdf759a6cd1e19
MD5 3bf8caecefda017203adf38a594c36f5
SHA1 f9e57a5cf4891a630ef67e9692f9e73c72f4004b
SHA512 bc625e64b3b5fb24291b6a255ec30a648a86ce9cb7aa56518ca7fba762833579104a77fc1175e577fccbcf5eca833ad302c7279ca227b160d7924c1f1a95588e
TLSH
T159D0228DA9CF2402AE2911637CA0AD55CE20CD19C0A3003E60F9C3B1AB420282E2D94C
MD5 SHA1 SHA512 TLSH

kvalitetsvaren.ele

SHA256 8317ee27b128d66e79238b28b8e1114ad39950e84172558d0aae3befdce2b77d
MD5 ae7a6c96ed3249750a1c702329730027
SHA1 b64139cd3ef5700abe0fb00c34ede0ef48c3ca72
SHA512 404f1d64e43246435900fbc7ab91f533371fc99d970b19b4e357cfcbbaf30a699469f68b5f18b4bb853e4736882ce6a5761c300c5617eebfb043c72659b0ea10
SSDEEP 1536:BbjCn85Lq2RsQF7Sjg6kz0G+a52Y/9GTVyfDrsAs1m9eiv3Rl9GZaXFtEmqEMH+j:WiGyVx
TLSH
T1D53612161E82B4DC19201BD58EA9BBC9DCCB90B1C66D8B92344B76DDF2B940D354C3DD
MD5 SHA1 SHA512 SSDEEP TLSH

pejlstoks.org

SHA256 5247ec5caf3a882d818efd0db483235e41e46f68a2b2ce0715673fde8a6148de
MD5 a9c13b2ba1be7b0ec28df899245a99a3
SHA1 1890c94b34143dc7d6fac4c4b3c7feefcc1e3541
SHA512 9877b572a7f8db957ecbab3b038d8cf85a3254e2aae8b9a5b59a8379235400d473f83bbeb71d6c595aa9f270090d1d796f9055fd120320ff4a595d3b81f39ea8
SSDEEP 768:h78hx17CwYN9CV/806bOKydxSi6dld5jZza+bTnGrZY/qWboaxq38Z45q+QbHYGx:+6fT
TLSH
T1E39502E360E6DDA4367848E0BD121AADB08F0E1DFF58E4556369DB43B087F4E48258F8
MD5 SHA1 SHA512 SSDEEP TLSH

30b621487d030203a584c14d1c4d5e7cbc120ab337b4fb30b7f6706f1b460950.exe

PE Signature issue

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

Chlornal.txt

Doggerelling94.jpg

Galvanoteknikere127.txt

Hadramautian.Amm

Ilsebil85.ini

Interessernes.Unl

Nondexterously.ini

Pogonatum.ini

Unbesmirched111.rea

alkoholiseringernes.jpg

hungeringly.squ

karambolagens.ini

kvalitetsvaren.ele

pejlstoks.org

Sharing

General

Malware Config

Signatures

File Explorer

30b621487d030203a584c14d1c4d5e7cbc120ab337b4fb30b7f6706f1b460950.exe

PE Signature issue

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

Chlornal.txt

Doggerelling94.jpg

Galvanoteknikere127.txt

Hadramautian.Amm

Ilsebil85.ini

Interessernes.Unl

Nondexterously.ini

Pogonatum.ini

Unbesmirched111.rea

alkoholiseringernes.jpg

hungeringly.squ

karambolagens.ini

kvalitetsvaren.ele

pejlstoks.org