XeroxscannerPO080726[.]exe

resource
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll

resource
XeroxscannerPO080726.exe

XeroxscannerPO080726.exe

IMPHASH c05041e01f84e1ccca9c4451f3b6a383
SHA256 2b1f09c4559ffa9c0c4400d2bf96807e14243144c242b4d58d57af2fec004f18
MD5 0ac806ee073f53b035d805fac4f532fa
SHA1 8ed2be4f406cd7012bbc432229c8938a97f02b5a
SHA512 f2c1b46babe641ca4d646af7a76681b1707618b71b0cd624f382748f48cdb2f41e3ecff953d64617866ab5fe5ce820b143e917053f6376e8599f985fa59834af
SSDEEP 6144:GgORaspjQeluy+cu67Vb6+LMi7opmQosCLDVDcooc:Ggyjzuy+B5+LMey9oZTt
TLSH
T18874C0A1F399C8DAEC122275587BEC3325577E2DA874050F216F7729ADB3393046B90B
MD5 SHA1 SHA512 SSDEEP TLSH

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

95:41:0c:a3:11:c6:a1:6d:79:ce:8d:cc:32:58:d5:5d:97:33:a0:00:da:d4:94:1d:5f:2b:bc:70:90:2f:02:f5:e9:b4:3b:1f:61:b3:6d:fe:f9:d8:6a:d6:ad:41:eb:6e

Digest Algorithm

sha384

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Udryddelseslejr,OU=Rentemarginalens Roundhead Optimizing\ ,O=Udryddelseslejr,C=US,1.2.840.113549.1.9.1=#0c164c61647965727340556c74696d6174656c792e456765

Chains

Jul 8, 2026

CN=Udryddelseslejr,OU=Rentemarginalens Roundhead Optimizing\ ,O=Udryddelseslejr,C=US,1.2.840.113549.1.9.1=#0c164c61647965727340556c74696d6174656c792e456765

Subject

CN=Udryddelseslejr,OU=Rentemarginalens Roundhead Optimizing\ ,O=Udryddelseslejr,C=US,1.2.840.113549.1.9.1=#0c164c61647965727340556c74696d6174656c792e456765

Serial Number

03:22:fe:a5:04:76:4f:66:a9:24:4b:15:f7:8b:6a:4b:1c:af:a5:34

Issuer

CN=Udryddelseslejr,OU=Rentemarginalens Roundhead Optimizing\ ,O=Udryddelseslejr,C=US,1.2.840.113549.1.9.1=#0c164c61647965727340556c74696d6174656c792e456765

Revocation Status

Not revoked

Timespan

Jun 23, 2026 - Jun 23, 2027

Subject

CN=DigiCert SHA384 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0c:20:43:49:f9:d0:f7:59:fb:98:2d:e4:08:1b:88:7b

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

13784

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCreateKeyExW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken SetFileSecurityW RegOpenKeyExW RegEnumValueW

shell32

SHGetSpecialFolderLocation SHFileOperationW SHBrowseForFolderW SHGetPathFromIDListW ShellExecuteExW SHGetFileInfoW

ole32

OleInitialize OleUninitialize CoCreateInstance IIDFromString CoTaskMemFree

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

GetClientRect EndPaint DrawTextW IsWindowEnabled DispatchMessageW wsprintfA CharNextA CharPrevW MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW GetSystemMetrics FillRect AppendMenuW TrackPopupMenu OpenClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetWindowLongW GetSysColor SetWindowPos PeekMessageW SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint EmptyClipboard CreatePopupMenu

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateFontIndirectW CreateBrushIndirect DeleteObject SetTextColor SelectObject

kernel32

GetExitCodeProcess WaitForSingleObject GetModuleHandleA GetProcAddress GetSystemDirectoryW lstrcatW Sleep lstrcpyA WriteFile GetTempFileNameW lstrcmpiA RemoveDirectoryW CreateProcessW CreateDirectoryW GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersion GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW ExitProcess CopyFileW GetCurrentProcess GetModuleFileNameW GetFileSize CreateFileW GetTickCount MulDiv SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW MoveFileExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 b7823a15e7b1866ba3d77248f750b66505859d264cfc39d8c8c5e812f8ae4a81
MD5 a1da6788aeaf78ca4ae1dece8019e49d
SHA1 d770155e6e9aa69223be198c44a8da26a1756d89
SHA512 eada9c1528563ddfe3d4d8ed5dbc52b85a9190765535b68da90e6d623288bf0090adac5118e1ed6e3cb3e0abb9af025d3a2a73121413a4471a90fd04bc861e18
SSDEEP 192:uenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XBUIwL:u8+Qlt70Fj/lQRY/9Vjj+L
TLSH
T144428D1193B089F2F590583801A67F2A6FBEAC5C27E84963CFE341853D702DFA47A243
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10719

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsDialogs.dll

IMPHASH 6b5c4f7d679059f68f1269aad3a5cecd
SHA256 48c290cf400a8e3a5e6cded2f4817d344c4d20745c8659cccbc09edad5866dc0
MD5 9cbefc918a4560f3e780bc927e0e4008
SHA1 4c23e9947f5d2338b4cfeb870cc9f9dcb7ee37e3
SHA512 7a11aeba9bfe309c9baaa9bd907218b238fd09a98c55c5d34949b8f5b4b6402e3efb7cb3279c211459cb6d27b689896c0a54ed92155d25f5828d18377a5b4bff
SSDEEP 96:o1svUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YrJNqkz6:o1svWyNO81b8pCHFcM0PuAgkOybIFc
TLSH
T1E512F992E6A450B3C5D7533A35AA2F2DCBBD5325B0926C00C7738E4D39355B66E38353
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

7527

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

nyctitropism/Plimmed27.eft

SHA256 8ae791a9222a83448fc21bb2380d65578a5d452ef3a44fffe702d2a52f7743f6
MD5 81f06122eb50658479c8e3c40344ddc6
SHA1 dfc1f1c5ec7d74d9a6e20de638ffdad803fb1319
SHA512 b6abb401f2df90eee7fbce275a50d825acb72b2ac3f24a198e3857f05c2f45b2d62151c4e54918c3e4ced2412965cc4de8413466ae76e8c33b5cfcd90bf7f755
SSDEEP 96:FIx2mP41U8brvrU1bZgy6d28gvTcOaNIEFw0Tk/c1:FIYmP/83v419gy608oTchYLc1
TLSH
T14D730AE7105F8BC8AD11A133F8B376E2049B70A0DE79C74C8C541EDA768224859AF87B
MD5 SHA1 SHA512 SSDEEP TLSH

nyctitropism/Taklets186

SHA256 c8775a9c37da91ad399bf0e9cb66cc5aef397e9474b6476f734a4a4def2f0032
MD5 af0d07484d50f670fc84d882e0cdfaf4
SHA1 418d99db955841e0fdfa8f5e41cd63b2ba633323
SHA512 8cd67661c0b4a4b493288213ad9922f893a74a28b9fed8e68891d66c8ff8053b86ecb2ba92863a5bd8e4b14bc6f3cdd8361651efecbc6aea9abf5e3d4738b145
SSDEEP 3072:CsztYCGBY9FqVeAzuIGE6w8zpumT09Gcqt3ajz3o8uHrPLE2eTNPLuW/wa:5YCGB2QVeATGc8FumTcIKP9YTEHTJuWN
TLSH
T18D14F1110D6959BAE518BF6BC7EB3969DBD90C7958EBC4EB0748391B2C1DB03012C86F
MD5 SHA1 SHA512 SSDEEP TLSH

nyctitropism/Tvangsfodrede

SHA256 e9ea42201e9d3eab050803f29ff8ac01ef5de743ba3385a125e1a9e0fa5a786e
MD5 560afdf7da7d07d37a0ef197173070a3
SHA1 e78d273f7df4e4bfa5277eb9ba6723d45a1f1bb5
SHA512 6169f6bdb29d9b340c52335c588f87fc55fc8c22796c1873bee9ad0979f2a92d47b42d8a12787b194568af0255ecd869a76e1f1270ff1fd38ad08d39627df6be
SSDEEP 192:9kXCLJlswqmdFF6OSIDqXq3qR9LSvRY3PT7hDw5do1eqhq:9kXwJYmdFF6O5UngvG3PT9wPoNc
TLSH
T168526E0787878CBEE907F638C7FB209A5955B45A1E0FE0DF622B550680561E4A3246BF
MD5 SHA1 SHA512 SSDEEP TLSH

nyctitropism/aspergillum.boo

SHA256 2d659b5e3c065a35eb9751570b4721ff9c77cfa1dd84317ca788e442a30bdf25
MD5 7de02641b7058e9953b9309af0482d9b
SHA1 88e35bbd87a38d09554567073825eb7178780774
SHA512 8a9733c69bca8bbabb906f5e6375a95f76ac27ac5acea168cd093122e1e5b81a9a99a0cc1e2e54543addcacd6309cb15909f290d45e76cbb586d41e57d21729b
SSDEEP 96:9jmjEtczLzI1jqcbC5tFfZ2E44Te581DHTomg4QT446S3DtPC:96jES/I8AMrZace581i4R3S3DtPC
TLSH
T1F88319272A71431864F588CBE3B8A4E4192D643318A2D8789F9AC6FA10EE4EA251D438
MD5 SHA1 SHA512 SSDEEP TLSH

nyctitropism/encashed.str

SHA256 ace03c0e0538479639fda114ee7d8ab66013e974a0e885d3f7f1ce5dcf0ce558
MD5 b8da49722308f27fae15e943d546b35a
SHA1 ad37bf480ef287538c5168ad9f7cd19f8e05851c
SHA512 e621e933815e0e1c148cad67ed07a5d7503600d8481851749fe30ef8d765190d3e51fe1ed5530910c82e5395566afd9c838d81f86a7f4632718095711c65129c
SSDEEP 96:LkldiR5YMhdZuqd5P1SWK6JAzdzB9qdYEjti12RbA45rAj8JzEH1:L+dik8dZhdt13K6gdzB94jE12Rb1k
TLSH
T11AE37D1C2B2D94C1DB845D183B1FBD4E2C0CB1DE07B7DA78EAE224208914EEAE16013B
MD5 SHA1 SHA512 SSDEEP TLSH

nyctitropism/ribband.edu

SHA256 471bf1026b758c15cc05ff6f6c5555191d4cd258d80841f16fc2b57754287696
MD5 f00e001bbc3664142379f9197e606ffc
SHA1 fed9987f2f8343bf3ec9194fd06a2b2cd69d4946
SHA512 ed19698bfb2df381dada269f970d5877d15cc3874ecf172a7e6885b614e859926dc51224666bcd9b8884e8274b2239ccb78ff164780a72c9ec7a6789755b3348
SSDEEP 48:OE1bmZCL81mktijCRlTdxeIOQkySWBlm5frHXZqUi/wMSJ55vpMA7sHT7EZOjy/s:O60CLuDtfdSdzJG54KZHT7E0jyu9
TLSH
T130836C2A02E09C2E17084F21F390C276A7EA8C01BDFC4CEC2190F426913F58CB7962B6
MD5 SHA1 SHA512 SSDEEP TLSH

nyctitropism/straffesparkfelterne.ant

SHA256 32668d90f11b134a2a79d60873126c064d3fa3533665e2bbca06e79f2a16e0ff
MD5 9db57da570f4eb8e0c9d64f30a4f3e09
SHA1 54528db527e1800a78b2955e748233c1e5d3972a
SHA512 06349d58db1794288ff5c0e91ed9f0549a143b6b777b0c8a80185dbd0f217d359861f72539eaf82e796c55b045444a1ec746e1b55082ae8efd77d534d05a5301
SSDEEP 96:6UQVQjkohLzkTX0FGKyfO7U6eqOoBXq7BosgLoWjJa:6LQjNhLwTS57UeI7O5Looa
TLSH
T105733BBB060B42A21780FEA164D5E60CD9C58EEDB290541D10A0F8AB495EF8C028134B
MD5 SHA1 SHA512 SSDEEP TLSH

nyctitropism/tegnefejlenes.met

SHA256 06ae827db79ce0745a870aa98322e70ba05c58e49ba526de1b9ea74c42d24760
MD5 ac691a6499429b8fd3910c1fcddb05bb
SHA1 113e991060811c7768463e3d68d7584a10fdbb25
SHA512 8b2f1f375c14a6768919d703e66d0e5c4dc5ce1397b1ae24b535ff813cc1f7c4ce96edb0c2ed3f2e63772dcee975cea3bd9443823ca0f9636a3ef7a70b8366c6
SSDEEP 48:1Yz0h6LwnfrfB4R8ofDmnoeBPCjrinedjX3FTrjD5h:1Z6Lwnfr5JormnoeBP6riedjHFTrjD5h
TLSH
T16223C9DE9434101AF9264F886459B43FCE5C77C136799D4761DF0F2EA46D6C4CC0515D
MD5 SHA1 SHA512 SSDEEP TLSH

XeroxscannerPO080726.exe

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

nyctitropism/Plimmed27.eft

nyctitropism/Taklets186

nyctitropism/Tvangsfodrede

nyctitropism/aspergillum.boo

nyctitropism/encashed.str

nyctitropism/ribband.edu

nyctitropism/straffesparkfelterne.ant

nyctitropism/tegnefejlenes.met

Sharing

General

Malware Config

Signatures

File Explorer

XeroxscannerPO080726.exe

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

nyctitropism/Plimmed27.eft

nyctitropism/Taklets186

nyctitropism/Tvangsfodrede

nyctitropism/aspergillum.boo

nyctitropism/encashed.str

nyctitropism/ribband.edu

nyctitropism/straffesparkfelterne.ant

nyctitropism/tegnefejlenes.met