0092837465509072026[.]exe

resource
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll

resource
0092837465509072026.exe

0092837465509072026.exe

IMPHASH c05041e01f84e1ccca9c4451f3b6a383
SHA256 b134896ab4f8a75cb79f559a1f3aa65b5cae52a3c39fb95ac8371d600c2c92a9
MD5 2d569c5eaec74172ee46fb7af42962fc
SHA1 60e26cfee4817ebcdfee1448396ef6e6a9b05469
SHA512 97e8995bd4244316888b7649ba741123cc8eebd824365e8d994caf8f98dd136a3fe9763201a9b2a6dac8ff50b0ed53c8de96afaa1ede91a2e1294d8acfd6ff45
SSDEEP 6144:EgORaspjQel+F3MjvEypW/VFNUCFIrsai8:Egyjz+F/gW/zNUCF7ai8
TLSH
T12074C0A1F299C8DAEC52227158BBDC3315577E69B875051F312F3629ADB33C3106BA0B
MD5 SHA1 SHA512 SSDEEP TLSH

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

f1:5b:76:70:b2:b3:fd:59:0c:17:a3:34:73:62:b6:ec:a9:19:38:e6:af:36:fe:b5:4f:7a:46:ec:b2:38:4e:bc:68:0f:6f:95:48:34:5d:b0:45:14:e3:2f:bd:04:98:e1

Digest Algorithm

sha384

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Birdlike,OU=Snupper Tryingness resministeriers\ ,O=Birdlike,C=FR,1.2.840.113549.1.9.1=#0c1e5072656d656469746174696f6e405374726964736d616774656e2e536b6f

Chains

Jul 9, 2026

CN=Birdlike,OU=Snupper Tryingness resministeriers\ ,O=Birdlike,C=FR,1.2.840.113549.1.9.1=#0c1e5072656d656469746174696f6e405374726964736d616774656e2e536b6f

Subject

CN=Birdlike,OU=Snupper Tryingness resministeriers\ ,O=Birdlike,C=FR,1.2.840.113549.1.9.1=#0c1e5072656d656469746174696f6e405374726964736d616774656e2e536b6f

Serial Number

4e:a3:e4:fe:46:7a:9d:68:9e:6f:c7:66:4f:4a:b1:04:3c:41:db:51

Issuer

CN=Birdlike,OU=Snupper Tryingness resministeriers\ ,O=Birdlike,C=FR,1.2.840.113549.1.9.1=#0c1e5072656d656469746174696f6e405374726964736d616774656e2e536b6f

Revocation Status

Not revoked

Timespan

May 28, 2026 - May 28, 2027

Subject

CN=DigiCert SHA384 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0c:20:43:49:f9:d0:f7:59:fb:98:2d:e4:08:1b:88:7b

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

13784

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCreateKeyExW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken SetFileSecurityW RegOpenKeyExW RegEnumValueW

shell32

SHGetSpecialFolderLocation SHFileOperationW SHBrowseForFolderW SHGetPathFromIDListW ShellExecuteExW SHGetFileInfoW

ole32

OleInitialize OleUninitialize CoCreateInstance IIDFromString CoTaskMemFree

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

GetClientRect EndPaint DrawTextW IsWindowEnabled DispatchMessageW wsprintfA CharNextA CharPrevW MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW GetSystemMetrics FillRect AppendMenuW TrackPopupMenu OpenClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetWindowLongW GetSysColor SetWindowPos PeekMessageW SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint EmptyClipboard CreatePopupMenu

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateFontIndirectW CreateBrushIndirect DeleteObject SetTextColor SelectObject

kernel32

GetExitCodeProcess WaitForSingleObject GetModuleHandleA GetProcAddress GetSystemDirectoryW lstrcatW Sleep lstrcpyA WriteFile GetTempFileNameW lstrcmpiA RemoveDirectoryW CreateProcessW CreateDirectoryW GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersion GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW ExitProcess CopyFileW GetCurrentProcess GetModuleFileNameW GetFileSize CreateFileW GetTickCount MulDiv SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW MoveFileExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 b7823a15e7b1866ba3d77248f750b66505859d264cfc39d8c8c5e812f8ae4a81
MD5 a1da6788aeaf78ca4ae1dece8019e49d
SHA1 d770155e6e9aa69223be198c44a8da26a1756d89
SHA512 eada9c1528563ddfe3d4d8ed5dbc52b85a9190765535b68da90e6d623288bf0090adac5118e1ed6e3cb3e0abb9af025d3a2a73121413a4471a90fd04bc861e18
SSDEEP 192:uenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XBUIwL:u8+Qlt70Fj/lQRY/9Vjj+L
TLSH
T144428D1193B089F2F590583801A67F2A6FBEAC5C27E84963CFE341853D702DFA47A243
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10719

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsDialogs.dll

IMPHASH 6b5c4f7d679059f68f1269aad3a5cecd
SHA256 48c290cf400a8e3a5e6cded2f4817d344c4d20745c8659cccbc09edad5866dc0
MD5 9cbefc918a4560f3e780bc927e0e4008
SHA1 4c23e9947f5d2338b4cfeb870cc9f9dcb7ee37e3
SHA512 7a11aeba9bfe309c9baaa9bd907218b238fd09a98c55c5d34949b8f5b4b6402e3efb7cb3279c211459cb6d27b689896c0a54ed92155d25f5828d18377a5b4bff
SSDEEP 96:o1svUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YrJNqkz6:o1svWyNO81b8pCHFcM0PuAgkOybIFc
TLSH
T1E512F992E6A450B3C5D7533A35AA2F2DCBBD5325B0926C00C7738E4D39355B66E38353
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

7527

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Phyllocyst/Plimmed27.eft

SHA256 8ae791a9222a83448fc21bb2380d65578a5d452ef3a44fffe702d2a52f7743f6
MD5 81f06122eb50658479c8e3c40344ddc6
SHA1 dfc1f1c5ec7d74d9a6e20de638ffdad803fb1319
SHA512 b6abb401f2df90eee7fbce275a50d825acb72b2ac3f24a198e3857f05c2f45b2d62151c4e54918c3e4ced2412965cc4de8413466ae76e8c33b5cfcd90bf7f755
SSDEEP 96:FIx2mP41U8brvrU1bZgy6d28gvTcOaNIEFw0Tk/c1:FIYmP/83v419gy608oTchYLc1
TLSH
T14D730AE7105F8BC8AD11A133F8B376E2049B70A0DE79C74C8C541EDA768224859AF87B
MD5 SHA1 SHA512 SSDEEP TLSH

Phyllocyst/Programbetjeningen

SHA256 095bfddb6c984b7948c9c383b714701a6025060093ac542081f6472f768e95c7
MD5 6813422fb6ce1f3877baba6c899adbc5
SHA1 8615d922da89cadd85deb8a1b98024e40bff2387
SHA512 bb9b5152a2e503cee9fcfe7cd9b7ab71f2ca7659f9feeb7b02a5b353003517289e02dea1754a96dc16955a567d19431f73dd4ec99c608c94ce18c54c3255e632
SSDEEP 192:0RSSwu3QXb/VI04pofvDJSo0wKLZ+8/4GfUBRGyYRMt3iL3Fb9Hq/aEavbP+:0173cNr4p6cPUGjWiL1bIe7+
TLSH
T1A2629DA2EB45CDB9D80AD234C8DE14968A44F034871F505FA5B7EB39C1E71531B349F2
MD5 SHA1 SHA512 SSDEEP TLSH

Phyllocyst/Rutebils76

SHA256 cdcc177fe5d85f98bed0c2aa6f3136ef97d6f7c533569b5ba3b3f607c54e0fe6
MD5 f58c35dd05ff991f70a97f038365c95c
SHA1 ae9110721346b5c7d7b7ace440b1b33189b3f4fa
SHA512 b0f1962b37ce8efb971c000db83cf01757a53a02e1403ff1c028dc34eba151f89d2962e3439fe2456c9f5b807a62353b5262c2e4ed9ccd646342b388e15ff3a7
SSDEEP 3072:DxLQTpVuBvzvH6Vw3wgj7gtMk4vihP5Po9/qdiLVJ6CY9BmgPkUIFom5qR1opppw:DhQTSR6I1vEP1y/qQLVJ6CY9BmgCa8M
TLSH
T12204E0A45E1D1704F056A152AD729063F23CCAC9E73FAD0ABCBEB78B5DB7046E300568
MD5 SHA1 SHA512 SSDEEP TLSH

Phyllocyst/aspergillum.boo

SHA256 2d659b5e3c065a35eb9751570b4721ff9c77cfa1dd84317ca788e442a30bdf25
MD5 7de02641b7058e9953b9309af0482d9b
SHA1 88e35bbd87a38d09554567073825eb7178780774
SHA512 8a9733c69bca8bbabb906f5e6375a95f76ac27ac5acea168cd093122e1e5b81a9a99a0cc1e2e54543addcacd6309cb15909f290d45e76cbb586d41e57d21729b
SSDEEP 96:9jmjEtczLzI1jqcbC5tFfZ2E44Te581DHTomg4QT446S3DtPC:96jES/I8AMrZace581i4R3S3DtPC
TLSH
T1F88319272A71431864F588CBE3B8A4E4192D643318A2D8789F9AC6FA10EE4EA251D438
MD5 SHA1 SHA512 SSDEEP TLSH

Phyllocyst/encashed.str

SHA256 ace03c0e0538479639fda114ee7d8ab66013e974a0e885d3f7f1ce5dcf0ce558
MD5 b8da49722308f27fae15e943d546b35a
SHA1 ad37bf480ef287538c5168ad9f7cd19f8e05851c
SHA512 e621e933815e0e1c148cad67ed07a5d7503600d8481851749fe30ef8d765190d3e51fe1ed5530910c82e5395566afd9c838d81f86a7f4632718095711c65129c
SSDEEP 96:LkldiR5YMhdZuqd5P1SWK6JAzdzB9qdYEjti12RbA45rAj8JzEH1:L+dik8dZhdt13K6gdzB94jE12Rb1k
TLSH
T11AE37D1C2B2D94C1DB845D183B1FBD4E2C0CB1DE07B7DA78EAE224208914EEAE16013B
MD5 SHA1 SHA512 SSDEEP TLSH

Phyllocyst/ribband.edu

SHA256 471bf1026b758c15cc05ff6f6c5555191d4cd258d80841f16fc2b57754287696
MD5 f00e001bbc3664142379f9197e606ffc
SHA1 fed9987f2f8343bf3ec9194fd06a2b2cd69d4946
SHA512 ed19698bfb2df381dada269f970d5877d15cc3874ecf172a7e6885b614e859926dc51224666bcd9b8884e8274b2239ccb78ff164780a72c9ec7a6789755b3348
SSDEEP 48:OE1bmZCL81mktijCRlTdxeIOQkySWBlm5frHXZqUi/wMSJ55vpMA7sHT7EZOjy/s:O60CLuDtfdSdzJG54KZHT7E0jyu9
TLSH
T130836C2A02E09C2E17084F21F390C276A7EA8C01BDFC4CEC2190F426913F58CB7962B6
MD5 SHA1 SHA512 SSDEEP TLSH

Phyllocyst/straffesparkfelterne.ant

SHA256 32668d90f11b134a2a79d60873126c064d3fa3533665e2bbca06e79f2a16e0ff
MD5 9db57da570f4eb8e0c9d64f30a4f3e09
SHA1 54528db527e1800a78b2955e748233c1e5d3972a
SHA512 06349d58db1794288ff5c0e91ed9f0549a143b6b777b0c8a80185dbd0f217d359861f72539eaf82e796c55b045444a1ec746e1b55082ae8efd77d534d05a5301
SSDEEP 96:6UQVQjkohLzkTX0FGKyfO7U6eqOoBXq7BosgLoWjJa:6LQjNhLwTS57UeI7O5Looa
TLSH
T105733BBB060B42A21780FEA164D5E60CD9C58EEDB290541D10A0F8AB495EF8C028134B
MD5 SHA1 SHA512 SSDEEP TLSH

Phyllocyst/tegnefejlenes.met

SHA256 06ae827db79ce0745a870aa98322e70ba05c58e49ba526de1b9ea74c42d24760
MD5 ac691a6499429b8fd3910c1fcddb05bb
SHA1 113e991060811c7768463e3d68d7584a10fdbb25
SHA512 8b2f1f375c14a6768919d703e66d0e5c4dc5ce1397b1ae24b535ff813cc1f7c4ce96edb0c2ed3f2e63772dcee975cea3bd9443823ca0f9636a3ef7a70b8366c6
SSDEEP 48:1Yz0h6LwnfrfB4R8ofDmnoeBPCjrinedjX3FTrjD5h:1Z6Lwnfr5JormnoeBP6riedjHFTrjD5h
TLSH
T16223C9DE9434101AF9264F886459B43FCE5C77C136799D4761DF0F2EA46D6C4CC0515D
MD5 SHA1 SHA512 SSDEEP TLSH

0092837465509072026.exe

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

Phyllocyst/Plimmed27.eft

Phyllocyst/Programbetjeningen

Phyllocyst/Rutebils76

Phyllocyst/aspergillum.boo

Phyllocyst/encashed.str

Phyllocyst/ribband.edu

Phyllocyst/straffesparkfelterne.ant

Phyllocyst/tegnefejlenes.met

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

0092837465509072026.exe

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

Phyllocyst/Plimmed27.eft

Phyllocyst/Programbetjeningen

Phyllocyst/Rutebils76

Phyllocyst/aspergillum.boo

Phyllocyst/encashed.str

Phyllocyst/ribband.edu

Phyllocyst/straffesparkfelterne.ant

Phyllocyst/tegnefejlenes.met