rMODELO1112T2026[.]exe

resource
unpack001/$PLUGINSDIR/System.dll

resource
rMODELO1112T2026.exe

rMODELO1112T2026.exe

IMPHASH f4639a0b3116c2cfc71144b88a929cfd
SHA256 66a1be3919f3f23710ebc6d58daf04e5abd52490f4a95993cea670cfc2314809
MD5 855a7d9da970dd7004a886c91bfda171
SHA1 d7547ce372b2c0a25439f77ad98e1ddc2d5f1eda
SHA512 91acfae799810a3e641564026b716d285dfffaaead4e7a8eb5a92aaa4eb35249023b546b19ebff514fd6c88a896c1e96ee08392201af59c00637df01559a24d0
SSDEEP 6144:lXsKoG8pL7qzqAeYyEM5zVPZI9PZY630ExBGogd6MOjZaM9oQEfj7S/fNM/f6HxZ:lXuLsq/DIVv5cdDO1aM9VGe/m/UDT
TLSH
T1FB9412962690D727C3761D76F954D6DDDBACAA10A2B49BA313F03A4FB832EC5440F321
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

3c:20:38:4b:5f:05:34:7b:b1:30:0f:e6:93:c2:1c:95:71:0f:06:47:fa:33:52:00:d2:9c:09:eb:82:5d:d0:d8

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Ekspedienterne,OU=Ensilate Alkyd Forplantningsevner\ ,O=Ekspedienterne,C=US

Chains

Jul 10, 2026

CN=Ekspedienterne,OU=Ensilate Alkyd Forplantningsevner\ ,O=Ekspedienterne,C=US

Minor OS version

0

Major OS version

4

Entry point

13596

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegOpenKeyExW RegCreateKeyExW

shell32

SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW ShellExecuteExW

ole32

CoCreateInstance OleUninitialize OleInitialize IIDFromString CoTaskMemFree

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create

user32

MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW CreatePopupMenu AppendMenuW TrackPopupMenu OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW IsWindowEnabled SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CharPrevW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint CharNextA wsprintfA DispatchMessageW CreateWindowExW PeekMessageW GetSystemMetrics

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor

kernel32

lstrcmpiA CreateFileW GetTempFileNameW RemoveDirectoryW CreateProcessW CreateDirectoryW GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW WriteFile CopyFileW ExitProcess GetCurrentProcess GetModuleFileNameW GetFileSize GetTickCount Sleep SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW MulDiv lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject SetEnvironmentVariableW

$PLUGINSDIR/System.dll

IMPHASH 509a34b3a68a773e0afb4259e68f9f82
SHA256 23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6
MD5 192639861e3dc2dc5c08bb8f8c7260d5
SHA1 58d30e460609e22fa0098bc27d928b689ef9af78
SHA512 6e573d8b2ef6ed719e271fd0b2fd9cd451f61fc9a9459330108d6d7a65a0f64016303318cad787aa1d5334ba670d8f1c7c13074e1be550b4a316963ecc465cdc
SSDEEP 192:ljHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZqE0QPi:R/Qlt7wiij/lMRv/9V4bfr
TLSH
T1B1427C1297B089F2F551493419667F2A6FBEAC5C13F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Extracorporeally

SHA256 7c6ae4d6965e1c8095f13a705ada6e7ea692029e9b3b52fdf2ac321c077df22d
MD5 82eccda4409d0ffa429b630be53bc83e
SHA1 6cbdc930ad762a31dd887bd8608ff787e56fd9c8
SHA512 ee4eac467f3d2d7b12447bc574f961604093198e040523d53930a004109a0756a6bb954cebbcac8e53562705bc5a9ec8af0353eea6a476048f5fdb26516158ab
SSDEEP 3072:ZUx8eldLwY4EJ08S9inahF+6Glllllllllllll+y7PUgC9s8js:+VtTl9nav+6zScgOI
TLSH
T1B0D3E1F5D668DC6AED69493AC4AAAFA0343C41580B60971F62FA3F5CC06879731087F7
MD5 SHA1 SHA512 SSDEEP TLSH

Familieaktieselskabers.jpg

SHA256 6cd13c744411bcc5e08d962c73dd516d64ec700ca75a72b60f03863a4ab68991
MD5 ba8d4d3b643fd4c0aa4160c8495c5ef1
SHA1 c877bd4d42c8ae332da39c9dae8edfe2499508d0
SHA512 fdd3eace236d12b31dd81b750bb4193376566434f4e534e0ca59a05bba7d4343bc11367c6f764f18e8c3835defba6306a93dcc2c6679be17086f4315a11a60d3
SSDEEP 1536:eN+mg4b/XeGKTs4C51vQN+vH7ZbSGB9SPIPfYhfQzguQRLWtMlv7vN0G/JbD2:hr4zX8Q4C5pQNgHlSGB8I3YhfQ8uCWtH
TLSH
T1B7930223CE1DA503591EC2D43E8B7D7D9216366D4D2328FE97258ECB2CA457328E853E
MD5 SHA1 SHA512 SSDEEP TLSH

Finials.mer

SHA256 4ccb05303971f645449cc9a3c8c626523e9ede4200a08f3c68d6a1ffeadf3b21
MD5 be31cec72841621c7e82773bff1c662a
SHA1 aa50a1b4be078ad421a3fdeebbdcb8f180056d05
SHA512 027512c3efbbf4801eee9c684c24c8fa7ed8fdf8c297a72945dd8963d7fcb2215aa85664ff2f63905ad499d77efbfd81a87c7524ddb5fd52cd9df554bfe5c775
SSDEEP 3072:KGJO4leMF8c6QYMAlf3OS231X9arUcmvFH7lfX2rns8qSm3td4:m
TLSH
T1C135E02AB60154ADD8F12138C8B8B8CAFC36C61BF26465CC9BD7C9597346F4126893F8
MD5 SHA1 SHA512 SSDEEP TLSH

Foreningen14.jpg

SHA256 04f3ea933f04c3d86acb72a9730e0e3326809a641d090ed922dc32fac9554a25
MD5 9e62a28f1facd16cc51467c8e46ded78
SHA1 331df640582e69b3226985bce0127351d7572450
SHA512 aa72c9362f62534ba339fec18f0c0ab8699535ae19cb68b764ccb3d0777c3235e70d83cf45cab97cdb34a7563870f4b56ddf2cee5ba9070d85a5d900309f78ba
SSDEEP 96:RhhElb7GS4Iy5IBgAw/NapoQrldtUYr78:Lhqb7G7qvaYk
TLSH
T1B6816E204DA311D88BA863BB52F551B791A78861BC29E6F52FB883F5CD61CF010FA946
MD5 SHA1 SHA512 SSDEEP TLSH

Spitous

SHA256 5dd2c1bbe3f73ac78f0dfc5dc7116d47dde6aab2ff0d3c56f57a5748a1d36952
MD5 1efcfea622a7a3b3785f804e960fb809
SHA1 60c36b444bbe4ef91ffab6a830dcf95924d3413b
SHA512 338781a3fc8117189ba56e03d4591ff69151d5cba6592e496b9349e130f592f8fd0de64c025daf407f41dc8b79f6b80ffd25a007f8ffbc8f077cb6c3e292dfb8
SSDEEP 768:tnmdolcvgWuyNtx6lLrfnodSLgqunuGOsON/:8d8qtWfodmgquuGONN/
TLSH
T10613BE55CBE68DBBE80ACA38C46E51578C6C7052D70FD4DC6276AC78C0471F2E224EBA
MD5 SHA1 SHA512 SSDEEP TLSH

chathamite.txt

SHA256 8904760fa44776aabe088002cf2575e0bdcb6dadb2fdd835e460c265b5066367
MD5 d0c1773555a0bc1ef89a411c71063fac
SHA1 e8541a2070964bed44f430c7b327f85f5c360b69
SHA512 cf91941818276ae598fd61f5a85072e7c2f3424edb6ea11d89f8ead7140b175403e794f19ec72d70fa47ef6a7a5fe2650fb7e9dca11c49fec40326ad6c00ff36
TLSH
T184011060CB1B104F0A9B77B8AC22058582AE12AE611106ACE42F5BC901CF358B37C6B8
MD5 SHA1 SHA512 TLSH

eiry.jpg

SHA256 d8c138603a1859060db5055079c306fc87f1a38fde8bdb57c717ce960dbcefbc
MD5 07de3bc35cb04b1db46158ac160d5df5
SHA1 9f7ed45098bebed9e55f5f61b62a734098317311
SHA512 ffb189f236e5034de8149dc014445ea173c3c7199fb09bb126803725244b28eeb35a48e0f09cef32deb0f3946db753e1144a81b7f5297bca59fd9826de8bb007
SSDEEP 384:JeUdt2LRP1J3bEn7foHiwOiC705NXecS81/Z:J3dtuJEn7gHiwOiC705Uvyh
TLSH
T1DD42BF0EE0889A59A7835BB3205726F67CB8BD545D06A17A21FB17D8C27CCF6400FA5A
MD5 SHA1 SHA512 SSDEEP TLSH

gedebollernes.jpg

SHA256 566854345c3fbc685c0e39fd28275118de947694a3da2306ee3db6693c5dc4f3
MD5 92804475892ba36f0039b07aa0fb2f7e
SHA1 f935f086c9b28a5e7f3a217803118ac68bef7485
SHA512 f43f98e8b70557f9c2bdf46d781cfeeab30a0e00f0b5a6624b838c6391d8adb40e452f47c75b6b8bcf21e666403725b98882af06a99ece412b8b05dff72e6886
SSDEEP 768:7SZgKmsKkFdFeBeskmZyd7W4WuRclJI49HHs5drNKsvfg:78gcKkFkPPRFHs5mgfg
TLSH
T17803F2CC3DA1CD458A192F8FE4AD744D5E1E8364FAD6A233A1E12323DB20FFB44559A0
MD5 SHA1 SHA512 SSDEEP TLSH

pegroots.txt

SHA256 53fc02e89e01addaa11ab24c8029d12960e748f0fe7ac81c158c3f468875938d
MD5 3e6efceede658289e20a1e9d04ad678b
SHA1 8f4a6119537dae98e029a5b7301e78ba65163410
SHA512 033bcc9ae1cfc004afa360e64ce26439c61cbc6a35753f755753c5b8f94a187da02efd0c32a919ffc8509a8f1b1874741149733b198ffa9fcf96ab48c22d01fc
TLSH
T1F0F0C911C8AB111984095DB8ADB386C2E02B48668B2391A8B6E05A0E7284281CB8E9CD
MD5 SHA1 SHA512 TLSH

pressionsgruppens.jpg

SHA256 e93fd6a8fae3c25902dd353509632f69a9d42a20ea747f793962e8a1fb8570e5
MD5 e0089e53870fba5e3d2513f2c865631c
SHA1 51a88f51acdc03c12ab6a979aac449652139691e
SHA512 dcf2680796bacf0e4bfe6ec468cd2f5857f8702710a1080307897fc61a781a07982f07cd4092605ca1f16bc9a54a8cd9144e1a3b9bd735ea5d3e941ffe88a162
SSDEEP 768:mUvbWBdvv2/P9UlsUAsXT/a52QIw6/YW8YfRvlcIOihCMuw/TSjA4+Zc0wqQ+GKt:mUvbWn32HCsU/82QIw6zrBlcyh0q2g
TLSH
T1CC33F1B2B8C4B0884A7DB428E54CC8875DBC6E5E30B3D13556E63DCBEC81D35390E661
MD5 SHA1 SHA512 SSDEEP TLSH

rMODELO1112T2026.exe

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Extracorporeally

Familieaktieselskabers.jpg

Finials.mer

Foreningen14.jpg

Spitous

chathamite.txt

eiry.jpg

gedebollernes.jpg

pegroots.txt

pressionsgruppens.jpg

Sharing

General

Malware Config

Signatures

File Explorer

rMODELO1112T2026.exe

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Extracorporeally

Familieaktieselskabers.jpg

Finials.mer

Foreningen14.jpg

Spitous

chathamite.txt

eiry.jpg

gedebollernes.jpg

pegroots.txt

pressionsgruppens.jpg