319b75ccfd07cc7aaed69cd1e1363846480ef7b8ee532f0cc13e7631c1bfae9a[.]exe

resource
unpack001/$PLUGINSDIR/System.dll

resource
319b75ccfd07cc7aaed69cd1e1363846480ef7b8ee532f0cc13e7631c1bfae9a.exe

319b75ccfd07cc7aaed69cd1e1363846480ef7b8ee532f0cc13e7631c1bfae9a.exe

IMPHASH e2a592076b17ef8bfb48b7e03965a3fc
SHA256 319b75ccfd07cc7aaed69cd1e1363846480ef7b8ee532f0cc13e7631c1bfae9a
MD5 ce163245770bfa3d5e039aa2bf5b44ff
SHA1 465fbb6d799dadc8a851e76b325649bed61818d9
SHA512 d5d7dcdd6dcde7553f99fd17e2b35aeaef050e8b6bc1654c8064084e41dd983ab43db4f5e9407ab31dcceacf5027fccb0a38eca36b4658d22b5f397ee2cbeb37
SSDEEP 6144:spkXGhE4TrIg1+MoMRAjKOvF72AJOufkPYrz90hY0YPOOHSZX:JiTrIg1+eaj57kPY/OWrOOyZX
TLSH
T17294F1883F68ED0BD5E48C344DB4FA2B92B89DA04D87B702DB623D4CBD397C47949616
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

17:aa:58:82:c8:67:fe:88:dd:81:9c:8b:f5:40:36:0e:92:c5:1c:43:2b:f8:98:f1:c7:cb:88:9d:7e:7e:ea:a7

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Soggier,OU=Gravsknders Derailing\ ,O=Soggier,C=FR,1.2.840.113549.1.9.1=#0c16456b7365646540466c796465646f6b6b656e2e496e74

Chains

Jul 7, 2026

CN=Soggier,OU=Gravsknders Derailing\ ,O=Soggier,C=FR,1.2.840.113549.1.9.1=#0c16456b7365646540466c796465646f6b6b656e2e496e74

Minor OS version

0

Major OS version

4

Entry point

12960

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetCurrentDirectoryW GetFileAttributesW GetFullPathNameW Sleep GetTickCount GetFileSize GetModuleFileNameW MoveFileW SetFileAttributesW GetCurrentProcess ExitProcess SetEnvironmentVariableW GetWindowsDirectoryW GetTempPathW GetCommandLineW GetVersion SetErrorMode lstrlenW WaitForSingleObject CopyFileW CompareFileTime GlobalLock CreateThread GetLastError CreateDirectoryW CreateProcessW RemoveDirectoryW lstrcmpiA CreateFileW GetTempFileNameW WriteFile lstrcpyA lstrcpyW MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GlobalFree GlobalAlloc GetShortPathNameW SearchPathW lstrcmpiW SetFileTime CloseHandle ExpandEnvironmentStringsW lstrcmpW GlobalUnlock lstrcpynW GetDiskFreeSpaceW GetExitCodeProcess FindFirstFileW FindNextFileW DeleteFileW SetFilePointer ReadFile FindClose MulDiv MultiByteToWideChar lstrlenA WideCharToMultiByte GetPrivateProfileStringW WritePrivateProfileStringW FreeLibrary LoadLibraryExW GetModuleHandleW

user32

GetSystemMenu SetClassLongW IsWindowEnabled EnableMenuItem SetWindowPos GetSysColor GetWindowLongW SetCursor LoadCursorW CheckDlgButton GetMessagePos LoadBitmapW CallWindowProcW IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard wsprintfW ScreenToClient GetWindowRect GetSystemMetrics SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharPrevW CharNextA wsprintfA DispatchMessageW PeekMessageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow LoadImageW SetTimer SetWindowTextW PostQuitMessage ShowWindow GetDlgItem IsWindow SetWindowLongW FindWindowExW TrackPopupMenu AppendMenuW CreatePopupMenu DrawTextW EndPaint CreateDialogParamW SendMessageTimeoutW SetForegroundWindow

gdi32

SelectObject SetBkMode CreateFontIndirectW SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW ShellExecuteW SHFileOperationW

advapi32

RegDeleteKeyW SetFileSecurityW OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges RegOpenKeyExW RegEnumValueW RegDeleteValueW RegCloseKey RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumKeyW

comctl32

ImageList_AddMasked ord17 ImageList_Destroy ImageList_Create

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 2e226715419a5882e2e14278940ee8ef0aa648a3ef7af5b3dc252674111962bc
MD5 a4dd044bcd94e9b3370ccf095b31f896
SHA1 17c78201323ab2095bc53184aa8267c9187d5173
SHA512 87335a43b9ca13e1300c7c23e702e87c669e2bcf4f6065f0c684fc53165e9c1f091cc4d79a3eca3910f0518d3b647120ac0be1a68eaade2e75eaa64adfc92c5a
SSDEEP 192:em24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35OlESl:m8QIl975eXqlWBrz7YLOlE
TLSH
T168325C12135081F3E4918138886B3A276B6A15029BF98E57DFD39646BE21BE3BD7D603
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10183

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Findyrkelses/Raderbart/smerternes.ped

SHA256 d026aeff51c17ffd6b31e142367eccc5e9d2665789c62aabc5a6c435d594793b
MD5 dea3c7afae2496934e2724d319f534e3
SHA1 700b1c7d99024d67ccf61f48473d94e4abe73ebd
SHA512 f12b5b0f081fea8dacebddb207a2c71541418326396ffb2771ff5009200618062a82e15e57e10f9fe89d0cfc0011d55f7185f8d31410fb7fb010d7efe026cabb
SSDEEP 48:YtnTY/CBBYOFx6KQ7b41JBOYVtZcN036jAMY4xkutRVnB58+kQV7V:Y9TYKrL6KtVtGN036jAMY4t558+keZ
TLSH
T142432B1CEED35150A3AC276492973BD229200B3A50068C706FB7D6EE20C4406CD7229E
MD5 SHA1 SHA512 SSDEEP TLSH

Findyrkelses/Raderbart/stonelaying.bra

SHA256 3d82dbbd213adaa89f85c68670e0c45c87ed62e87eb33ec0198d335613d66b4d
MD5 15db425a3dbb26cc50dbd362ae64e4e8
SHA1 49657cb8e64527d82c53dedd7dc0ee77076a149b
SHA512 7b442357f11154368145e83b86943bb47bdafa6120b7fa0e6b8451876b886a4f516878db92b0b6b90841264149d7d6453a2a9092ea280b7a4e56480490f62867
SSDEEP 24:y1c3nQg0w8IouI6Msd2B1pdznVz+N4cLxogkcmRshi9Fzi0jYAbQXfw+b/G3EfCS:y1c3QoI6M82BPjc44oNVVHbQRq0fl
TLSH
T153834A614241DA04BAD211BDE111BCCCCFCDB8C02EF140C45362F588A9FA24A59117CE
MD5 SHA1 SHA512 SSDEEP TLSH

Findyrkelses/Raderbart/subeffectively.wiz

SHA256 b4e3246a0b97cf67d2c68ce559d97b17fa97001967bcb05baaa20fbb035af99c
MD5 7dfdb8f6c0830d339a7d2448c254857b
SHA1 e864371312cc609e299ec41858b9781bfc712b54
SHA512 172dd3bc06b861c4ad296843bf4a36db0628b4f0167c869a195815fb8b646432cd9aa39a3b32ae883f6d8f21ca0c2d092663302e714c74613dba53b4b9afd306
SSDEEP 48:4n/IjzvNgwkNm1AeEBEWK8e6oL53T+q7Cc8Wo:44V519NW66s56q7CLx
TLSH
T1ED33E9F6B27F72A1A67C6F3E5776750D5A7E66E1F043420428CB061ECA0FA8E087055C
MD5 SHA1 SHA512 SSDEEP TLSH

Findyrkelses/Unspeakableness.tic

SHA256 b035b2ce0b387f41c5e521c0f0faa1506aa275a2057737924a27a12ea1fddf63
MD5 bfe970f082e9861a6e7854942ae70f03
SHA1 4f3a4255523d439ecef0cc0305f767897e6f20d0
SHA512 71590ff24d156209dc7c05c5c44cdb4460d7cbed713274e355194f99253d26295250fc90d31c5fde66acb0591c24e61f7aed22abe9a3de85f790bbae3f658f46
SSDEEP 192:EhgfId6FF00BqFozfiUnaSwp1zJPF3kCLj:vfy8PNzfi9JpxJPF3kWj
TLSH
T16E837D480175C06D8632F173CF5138DAB397896917262F5BB15F9160D2FF3405918341
MD5 SHA1 SHA512 SSDEEP TLSH

Findyrkelses/gastroesophageal.all

SHA256 382fd202d1598d320297be2effb86d2160a656aa80614e87fe44fc4f778257f0
MD5 bb359f04d432e8ba87fd52e320404e3f
SHA1 f0a873fceed6a7c9d6c461369992937297c88ff9
SHA512 cdf203a7f060c0ae8c13d744af980e8b2f9531b7e6554b9fb402def3b468b50c606dbd45ce4febc4ba1e8ad8554f0864691401fc705e5128f203910b2b6f7f9d
SSDEEP 3:nZnnZZZZZZZZZZZZZZZZZZZZZZZZZZZZZtZZZZZZZZZZZZZZZZZZZZZZZZZZZZZb:oZqZiUSZnn0Znn+ZnZU+ZUZs4Znn
TLSH
T1C3B12BA072B0CA8D4EDC004A104C1FCE112B00002C4E36873FC88F814C6F774048A340
MD5 SHA1 SHA512 SSDEEP TLSH

Findyrkelses/nomineredes.for

SHA256 03ccb6d9a488d9b6cbb9ad02894756480cadaba51ccf3115e7ede5e840075808
MD5 6f866492875d38531f43c74b8b993c4a
SHA1 b3313c147161dd05709b1bef91bf4820f5b677d4
SHA512 9057ad82700abd1786c1e4af00bcb026016ec0a5ac8aa3c581141d09fcc78bfe010fa345cd8544a87ea86a65ff0de8f615d0a359bf63d80f60c3962ec1cd967c
SSDEEP 12:qbpVPH7q7o0ByUPceRf8UCmBQI8iNoAy2iJ91wex1XsGNmBtvA3Ayxes3aOCqkLk:l7gUPLXOx19meL8PtvA3ACtCqQk
TLSH
T12E23B619557352AE1E69C2FAC49686A378DE8A40C27C50411EB373E38AD163769BB82C
MD5 SHA1 SHA512 SSDEEP TLSH

Findyrkelses/pseudohermaphrodism.mid

SHA256 1134d3554b1813e47359490710445e28fba9bfff1c4cdc1967bea6a098aa6420
MD5 59cdaa612e608555614ddfa47cb8a67d
SHA1 8e6ed1545c91a56c62c6e701cc6558072864b329
SHA512 ccba3ca184c6263c95e819e2d14901d98917521c7a9136eb57979dad215d4a41279259a6b0b5c40b57acfae48d4d22e1c9e2ac6556f67e35049d7bb35481382e
SSDEEP 48:OyGYksa0LinUUk+cQWwgBcdAZHbEOuSt8UszUNP8nP:N/a0Lic+clwvuZHbETkxNEP
TLSH
T1313327F409C0FB803B336947B2B0E3FC40C03CD45A7AA93038AB2251A34764E8CB8893
MD5 SHA1 SHA512 SSDEEP TLSH

Findyrkelses/rrformede.sys

SHA256 d42f08e63f3fde28325aa76e496b36f6a5b469dc5f81503dc99db4965737785f
MD5 5ac74693c5d3119b44590a42f762c376
SHA1 43d9673f0b8bfb2a5331fb0451a027d6b0d8c614
SHA512 989de2052c1f5663914501e38bf5fbfa5317cbd5c8142cca7731afb3afd380e86f6752d44f7a2d8528e70f63510cf46a7afce4fbfab20550cd0be609fbdcccb1
SSDEEP 48:R8uzQvOlmbfWlLiz27Z9wKyJq9tAM4ucbgoXRmzvnhry27WQMfwlRGcATY5:lQm4TWlLr7ZKKp9+Z3B+hrCQM4lR0g
TLSH
T136431888D0472F73E4E1B958B70B32615724E8E889DC1A3F1290A4257F4B9D750BDCC3
MD5 SHA1 SHA512 SSDEEP TLSH

Findyrkelses/skriftsprogsnormer.gom

SHA256 432bf685ce01c99aedcdf3478969e6cf7d46a2884eadaa6b4cdc6ef3e66b91c0
MD5 cd2b0ef73fb1897e01980121b4e51197
SHA1 d46f6893fe2be64292a350d3a8f7a7850a708837
SHA512 5f5f3e927f1bd812a7a6c502ade0c8848b190abda6f8b11976d4141c27f868b2d49488ea13761fa76a5e78086f6793ad251ad6a391a19c499dff5795d65c702c
SSDEEP 24:pAVFMp7V4L/PWnSRJ98ODdWxOi0YaxrIYq9mfMgZxMtFu6yXL+sxXjdOYaMeoSOv:EL/PWncinpp9sxXaKas1jBh9isF
TLSH
T17523D8D84FCAFA94855271B93B27BD6C261EA414D1258D603F6A22642581AE3239180A
MD5 SHA1 SHA512 SSDEEP TLSH

Kastellers194.opi

SHA256 2ab7c9f686af8b6c450072ef8714da86fab7c1baef662d81aac07c5bfe70b6ab
MD5 303f79f694918a30028b505fb38ec2dc
SHA1 e337d0448539c1f0db6e8d042623d81da13b728d
SHA512 78ac9aa5ca3f44a00662506df869c0aa1c17458bbe48e04b6a3d722922cc3799cc8dab38d4f661f515f95de063d1c05b4570b6990100348ca29e060053f7ecea
SSDEEP 12:U0uMi9o9cX4y9w82E9eaMk4LD8A490K90MyR/YU9yoXk8SUA9oXuEX09gCcG9/:hiSSIyK8XdwLYv0MsAUntzwoPk1cGl
TLSH
T173222B4EE1238D6526640B72DC6A9605A0D6A3445A5998294396A3ECE93A4182E03795
MD5 SHA1 SHA512 SSDEEP TLSH

Twalt

SHA256 20e4c5d040a61675bc8d570173070756210d011f402181f2d163517101acd346
MD5 0712a0845a977055f3a2bbd3b2b4f6e3
SHA1 1f0882b22fc80a1c9cab920a9bf7ee0c18176bb0
SHA512 195891244a7ae6926ed3c81d9e469e59c3cea11bb575019e21f97b3b81038f6ca7c7cd1c4115ecb1592202c526c37cf21e0875cfe1a778fdf7619990dc2f89ac
SSDEEP 3072:GBM0X41o0IeKVhL2QUr30PR0Lgoy+GgzHGupi6cCAb97iGsIUNlfaZwS0f:cM0o1xsh8r3MyBTHGScCm9iVISlfa50
TLSH
T172E3010FD6F31CEAE8A216BDB60765559732E033B75CDE3DEAA9D0D0042A137C0172A6
MD5 SHA1 SHA512 SSDEEP TLSH

319b75ccfd07cc7aaed69cd1e1363846480ef7b8ee532f0cc13e7631c1bfae9a.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Findyrkelses/Raderbart/smerternes.ped

Findyrkelses/Raderbart/stonelaying.bra

Findyrkelses/Raderbart/subeffectively.wiz

Findyrkelses/Unspeakableness.tic

Findyrkelses/gastroesophageal.all

Findyrkelses/nomineredes.for

Findyrkelses/pseudohermaphrodism.mid

Findyrkelses/rrformede.sys

Findyrkelses/skriftsprogsnormer.gom

Kastellers194.opi

Twalt

Sharing

General

Malware Config

Signatures

File Explorer

319b75ccfd07cc7aaed69cd1e1363846480ef7b8ee532f0cc13e7631c1bfae9a.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Findyrkelses/Raderbart/smerternes.ped

Findyrkelses/Raderbart/stonelaying.bra

Findyrkelses/Raderbart/subeffectively.wiz

Findyrkelses/Unspeakableness.tic

Findyrkelses/gastroesophageal.all

Findyrkelses/nomineredes.for

Findyrkelses/pseudohermaphrodism.mid

Findyrkelses/rrformede.sys

Findyrkelses/skriftsprogsnormer.gom

Kastellers194.opi

Twalt