90ac576f-cbda-6c6e-af38-4b04bfa0d05c[.]eml

resource
unpack002/TP_Keyboard_Setup.exe

resource	yara_rule
static1/unpack002/TP_Keyboard_Setup.exe	innosetup

90ac576f-cbda-6c6e-af38-4b04bfa0d05c.eml

SHA256 f2ee9eeeb277c43c94e7923d335a48813cff863fb6d5221d274d12b9e9e09f71
MD5 d33f67fbf49d7c5831a9234a163ab7b0
SHA1 83c86897442e0993f15347e774ff37c8890a69ba
SHA512 a491d5f3330798da291b5081fc8fef606b3c2d23b1b3a882910812de5d1d5e88f0cc5f7de8aa6b85802aa2f61833f365ffae4900a02bad53639cc7a4f04e2a66
SSDEEP 49152:H9zpwL9EXgEej8xN1FL6afxArz2d7rJAEuU0nNVNmV4SduZ9G7+ghvdq4TNj+b69:f
TLSH
T105472338999D27DE0D11E2FBF616B88871DD23874C82576743ACC6B131E94B4DA63CB2
MD5 SHA1 SHA512 SSDEEP TLSH

Password

M@yIsangPun0NgKamatisNanabaliDahilSabigatng!bon

Email Headers

To

[email protected]

From

[email protected]

In-Reply-To

OSQPR04MB80576D64F968C2DE67478F03DCCF2@OSQPR04MB8057.apcprd04.prod.outlook.com

Return-Path

[email protected]

Date

Fri, 24 Jul 2026 08:39:32 +0000

Subject

Re: Install Software

Content-Type

multipart/mixed; boundary="_008_SI6PR04MB795481A4119C1DC9BF5A506F87CF2SI6PR04MB7954apcp_"

Received

from TY4P286CA0042.JPNP286.PROD.OUTLOOK.COM (2603:1096:405:2b2::12) by KL1PR03MB8288.apcprd03.prod.outlook.com (2603:1096:820:114::5) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.245.11; Fri, 24 Jul 2026 08:39:54 +0000

from TY2PEPF0000AB87.apcprd03.prod.outlook.com (2603:1096:405:2b2:cafe::1) by TY4P286CA0042.outlook.office365.com (2603:1096:405:2b2::12) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.245.11 via Frontend Transport; Fri, 24 Jul 2026 08:39:54 +0000

from esa1.hc847-16.ap.iphmx.com (139.138.45.217) by TY2PEPF0000AB87.mail.protection.outlook.com (10.167.253.6) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.270.5 via Frontend Transport; Fri, 24 Jul 2026 08:39:53 +0000

from mail-koreacentralazon11023142.outbound.protection.outlook.com (HELO SEYPR02CU001.outbound.protection.outlook.com) ([40.107.44.142]) by ob1.hc847-16.ap.iphmx.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 24 Jul 2026 16:39:44 +0800

from SI6PR04MB7954.apcprd04.prod.outlook.com (2603:1096:4:24a::14) by SI2PR04MB6146.apcprd04.prod.outlook.com (2603:1096:4:19f::7) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.270.6; Fri, 24 Jul 2026 08:39:33 +0000

from SI6PR04MB7954.apcprd04.prod.outlook.com ([fe80::3581:68b8:c79c:ef35]) by SI6PR04MB7954.apcprd04.prod.outlook.com ([fe80::3581:68b8:c79c:ef35%6]) with mapi id 15.21.0270.004; Fri, 24 Jul 2026 08:39:33 +0000

Received-Spf

Pass (protection.outlook.com: domain of bergebulk.com designates 139.138.45.217 as permitted sender) receiver=protection.outlook.com; client-ip=139.138.45.217; helo=esa1.hc847-16.ap.iphmx.com; pr=E

Message-Id

<SI6PR04MB795481A4119C1DC9BF5A506F87CF2@SI6PR04MB7954.apcprd04.prod.outlook.com>

Extracted URLs

file http://www.bergebulk.com/
file https://www.facebook.com/BergeBulkOfficial/
file https://www.linkedin.com/company/berge-bulk/

TP_Tool_Windows.zip

SHA256 42e55407caff40189fa5bf8e6e2d114db247546458bd09c4a2c74e50ce66ed79
MD5 19544d31c065f1dca5490a2b18280867
SHA1 27e8dd0d3ab4442da200f138f47200da4b948b90
SHA512 ef7334358349395ad55450ffcf11db1fc374f247beeb86d27ac3026160e0fd93ec49668a07e2c97eaba4a12a7994d2b33654137c25306b5c45bd66ef9d4a2330
SSDEEP 393216:4rVxWgbKcWhQbMen0o6Ng+N6LcLkiH2zIRq6IaoNa7XPnkrZ:4LWhcW6j0YTKkiH2zIw/U7Xw
TLSH
T1B51733841AAF33839DF7677F248570D23FCC568A33A72560099DAB99FF9D12464C48B2
MD5 SHA1 SHA512 SSDEEP TLSH

Password

M@yIsangPun0NgKamatisNanabaliDahilSabigatng!bon

TP Keyboard Tool – User Guide (Windows).pdf

SHA256 3817b8705b28da07c14fae4ac88bbb12ae89e6686e088ae907095dfba554022d
MD5 86709b737e22faa074f2eb1fa741eb62
SHA1 316394376e620060c4cea75ecec7eb75d5f9cacb
SHA512 20c4b466a4808aae67e0dde8d3ec87937628acc5e810dfca7ff76abd502917457f70690ab8d81e6ae13484f6621d529c5eeb1dc2bc702a3035724ed9d0c8f90f
SSDEEP 12288:8T16R+j5JEMll+kzMfPHLNa77phedxvwZix/GszNAMaGjOz:8B6y5JXAkgfha773e7btZbc
TLSH
T1B9C40293E84D4CCDD84EC235D81794A91BA8B31AA7F938E731760E96F1815606F4E2CF
MD5 SHA1 SHA512 SSDEEP TLSH

Password

M@yIsangPun0NgKamatisNanabaliDahilSabigatng!bon

TP_Keyboard_Setup.exe

IMPHASH 88016fcdef7f227c62171d0afad9aae4
SHA256 4f4a31eb8772a67305ea65f570dca9e828aa3b25dd6ae0b74f61f4de13a4d262
MD5 a2c3bfa31eb980ee92bec38ef8650855
SHA1 04673c6c2e3cd6d8e86d8c71fdbb991269057acc
SHA512 f6ad89d0109bb31978506c122ca2ec8dcd1ffa291b649cab8281a2735f8ddc8ebe65f069b997ee2aafed9e4061344073da7cc76ef85796c243872254482f916b
SSDEEP 393216:X/tLtoA/mwk3sHeSPo6kb6ClOXKnCkRSDIdaQIaedKtR7rh:P/ohwk8PgszUCkRSDI0VwtRp
TLSH
T12F1733BF728B213AE46B5A3A7972E170583B6E5166134C0287E4CD8FFF250711D3E692
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
Inno Setup is an open-source installation builder for Windows applications.

Inno Setup installer

installer

Password

M@yIsangPun0NgKamatisNanabaliDahilSabigatng!bon

Minor OS version

1

Major OS version

6

Entry point

728672

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetACP GetExitCodeProcess CloseHandle LocalFree SizeofResource VirtualProtect QueryPerformanceFrequency VirtualFree GetFullPathNameW GetProcessHeap ExitProcess HeapAlloc GetCPInfoExW CompareStringOrdinal RtlUnwind SetFilePointerEx GetCPInfo GetStdHandle GetModuleHandleW FreeLibrary HeapDestroy ReadFile CreateProcessW GetLastError GetModuleFileNameW SetLastError FindResourceW CreateThread CompareStringW GetFileSizeEx LoadLibraryA ResetEvent GetVolumeInformationW GetVersion GetDriveTypeW RaiseException FormatMessageW SwitchToThread GetExitCodeThread GetCurrentThread LoadLibraryExW LockResource GetCurrentThreadId UnhandledExceptionFilter VirtualQuery VirtualQueryEx Sleep EnterCriticalSection LoadResource SuspendThread GetTickCount GetStartupInfoW GetFileAttributesW GetCurrentDirectoryW InitializeCriticalSection GetSystemWindowsDirectoryW GetThreadPriority SetThreadPriority GetCurrentProcess VirtualAlloc GetCommandLineW GetSystemInfo GetTempPathW LeaveCriticalSection GetProcAddress ResumeThread GetVersionExW VerifyVersionInfoW HeapCreate LCMapStringW VerSetConditionMask GetDiskFreeSpaceW FindFirstFileW GetUserDefaultUILanguage lstrlenW SetEndOfFile QueryPerformanceCounter HeapFree WideCharToMultiByte FindClose MultiByteToWideChar LoadLibraryW SetEvent CreateFileW GetLocaleInfoW GetSystemDirectoryW DeleteFileW GetLocalTime WaitForSingleObject WriteFile ExitThread DeleteCriticalSection TlsGetValue GetDateFormatW IsValidLocale TlsSetValue CreateDirectoryW GetSystemDefaultUILanguage EnumCalendarInfoW LocalAlloc GetUserDefaultLangID RemoveDirectoryW CreateEventW SetThreadLocale GetThreadLocale

comctl32

InitCommonControls

user32

CreateWindowExW TranslateMessage CharLowerBuffW CallWindowProcW CharUpperW PeekMessageW GetSystemMetrics SetWindowLongW MessageBoxW DestroyWindow CharUpperBuffW CharNextW MsgWaitForMultipleObjects LoadStringW ExitWindowsEx DispatchMessageW

oleaut32

SafeArrayPutElement VariantInit VariantClear SysFreeString SafeArrayAccessData SysReAllocStringLen SafeArrayCreate SafeArrayGetElement SysAllocStringLen SafeArrayUnaccessData SafeArrayPtrOfIndex VariantCopy SafeArrayGetUBound SafeArrayGetLBound VariantChangeType

advapi32

ConvertStringSecurityDescriptorToSecurityDescriptorW OpenThreadToken AdjustTokenPrivileges LookupPrivilegeValueW RegOpenKeyExW OpenProcessToken FreeSid AllocateAndInitializeSid EqualSid RegQueryValueExW GetTokenInformation ConvertSidToStringSidW RegCloseKey

Name

.text

Size

702KB

Virtual Size

702KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.itext

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bss

Size

Virtual Size

28KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didata

Size

512B

Virtual Size

420B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

113B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

Virtual Size

24B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

93B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

72KB

Virtual Size

71KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

112KB

Virtual Size

111KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

User_Guide_Windows.zip

SHA256 a9555c2830c99356993a5ebc19e3a6cd3d75ebe34ca69b574a95184f78bb94fd
MD5 61a6b6d6175e9594c923129d0a778623
SHA1 e34265399b956764672f6fcb0db5a11332843f5f
SHA512 566cd05b2630d205f1972a7a6b7a4092aa2c255ef182f32275f245e5f662a9223563b165d0586e8bb96f57bb60c8749d64f166c4cbe5dea2eea86a895ff74a38
SSDEEP 12288:YwmrHebes86xEwLbVSA7fpE+13wAjUVqbb/LddH:YxebeHSbVd7f31gAIVMFdH
TLSH
T1FF8423DA1398EE068865DA77F9073D5F024BFB3C8949F6CE455901A93CF834A2C4AE16
MD5 SHA1 SHA512 SSDEEP TLSH

Password

M@yIsangPun0NgKamatisNanabaliDahilSabigatng!bon

TP_File.ex5

SHA256 7f8ad8ced3e9dccf964c03bd7d0315594797553b32444eb45b4640e0a9cc9f1d
MD5 90fbe2cc6f537f1a92c58f8b5d1c60ee
SHA1 a802d4c2d348240bf7ab0989d373373f3ea44358
SHA512 a8291a4481dafab0cb4552b889a4d8a72864218ebc5178aa677eb9621096d9cd4b3ddade9117231db1976a2c828888e5c958e90bef515400212d0ada7624d071
SSDEEP 1536:7lIQtm/odqH2Qe+m7oYYm56aqJqdjSxHlpJwfpgagv7YbbySndN57V85JSHMSrdo:7ltYodqWQIo8KqRsHbCfplYEbeedNj8H
TLSH
T1BC93026707A43008F9822BF2E641356B9E6BF33B64DB5F5C0F3C1A869EE0462449B964
MD5 SHA1 SHA512 SSDEEP TLSH

User Guide - Tradingview.pdf

SHA256 b77915f269da473a496f04d165efa853d963a80703a50e623370b00ed5905e39
MD5 820bd33f4873091db137fb95974614d7
SHA1 3fc6a45ef888ab36b97b9ced6c8faaf482d1b326
SHA512 39a9143dbaae6e451de7e0a70587e2706ed01cd52c76f153611ee5b5d90bc739d5b8c5aa3d9a4b4c5f2ec5ae27da23227ee5e539994d438c78bc867d4a87bf9f
SSDEEP 1536:wqWxV70NKgNQep63lHLxsMJj9ea/dNwGWDh0MrSuj:w3MN1Qy63dWMJxeIuGXGv
TLSH
T110839D70F8C9DC8CFC46D639927E345D4B1DB66B66CDB485093C0EA9F082A85EB83197
MD5 SHA1 SHA512 SSDEEP TLSH

Password

M@yIsangPun0NgKamatisNanabaliDahilSabigatng!bon

User Guide – MT5 (Windows).pdf

SHA256 eb80e3e7cbcbedbe9e5c4cbd77cd2c5c80244afee8137dfb882b87a8a53f8087
MD5 f443e90419bd8451d119f0f73bfe35a8
SHA1 af16d99d80f851a141f10996c611befe1cd4864a
SHA512 8f3af0c3af95343bd57ec1660442573289b6d3e8162371b5af723a42bdfd6554abc57b4cea559ef09b9b7a8cfbd9583f51d9b46563c17c8a4fc7f15fdbf1b194
SSDEEP 3072:QEwbtLazojyeultTcxqwm3XExEt+INumE+47CU1NWYzkeH+AwO6g/rGzYCjmQJgi:QEG1ueIL4O+INEayNhPG+kMFgrnp
TLSH
T16144D070F4999CCCF889C1389AAA389D0B5DB05B77CD38AD012D0F59F446A94FB87297
MD5 SHA1 SHA512 SSDEEP TLSH

Password

M@yIsangPun0NgKamatisNanabaliDahilSabigatng!bon

email-html-2.txt

SHA256 eae482bb87fbf55ecc37a8e8a4ae3894439b1c57fec523e8c0653568f9900b77
MD5 14f2c51f12a1b5b872636fcbd8990c67
SHA1 77578f061503704cb718a8ae9c296ec049762763
SHA512 f05ed5e6ac8fc54bef72dae66e37a0f4a38458ac11f48af29ff4546ec0486f11d49c76ab4866300b207f6fce812728eba77cfd1ba7821038ef8cb410ceb85e55
SSDEEP 96:Cw7d9Z9N9Flhiz6yE6X6t56kR62BDniC6+GCuMC6uxVjkRmnh/KRFKReR9H935Fv:zyWzCBTKRFKReRNbujSCcK93yrZP3
TLSH
T125423216E3150A1B52FEA9F9F0276745708B0B9983076AE5317563ABADCBE7022523CC
MD5 SHA1 SHA512 SSDEEP TLSH

email-plain-1.txt

SHA256 418dcac7cb874eb23f7e3474ac524671f67237637bb128e6f9901923394d4795
MD5 474f35af565c24bbeabf72394691d33a
SHA1 deb55e6db98a005f25332a033c4e9637f7482547
SHA512 897e1953986d75aae3e74d4dabbfa0c10a461fb8fe67742e1ca2922f4c997d9c5a43ac8c4728d247557b7a50d10f104d0a53a3f33a0497c4dfd8f3057e52bda6
TLSH
T14C51407FDA5F133206B0E6F4F953654FEE6B0579EB4E1E88380E42C863066159A7940D
MD5 SHA1 SHA512 TLSH

image.png

SHA256 53dff13ae877ac35ebb21568618a9c99aec4e58ca01fe93f8db5bfafa9a283ec
MD5 eb48e4b5e2caebbc167176c9cf40d5e9
SHA1 bf0991320d05cf9d4457d8b7d11692efa2475e49
SHA512 abd781141ead913fbb4db88b46431ae2ee0800814b2f2f8eedaa40cd3811deee268983eb35796a6afff73637be315c9fd57d3626ddb9ba647fced0e93d47cc39
SSDEEP 768:9e4/I5gIEfZneOnKUbQrLo3KHVZ6qt4r7K3WXM/6U0JogsGKscxXYxHByOdqn:igFwOnnbiqK1Zlt4HKsteTb3ADdi
TLSH
T14B237AA8EAF298445CDD9315621F3FA8C16A6297FF4D83580C1E6F4C29FC239D23A175
MD5 SHA1 SHA512 SSDEEP TLSH

Password

M@yIsangPun0NgKamatisNanabaliDahilSabigatng!bon

image001.png

SHA256 53dff13ae877ac35ebb21568618a9c99aec4e58ca01fe93f8db5bfafa9a283ec
MD5 eb48e4b5e2caebbc167176c9cf40d5e9
SHA1 bf0991320d05cf9d4457d8b7d11692efa2475e49
SHA512 abd781141ead913fbb4db88b46431ae2ee0800814b2f2f8eedaa40cd3811deee268983eb35796a6afff73637be315c9fd57d3626ddb9ba647fced0e93d47cc39
SSDEEP 768:9e4/I5gIEfZneOnKUbQrLo3KHVZ6qt4r7K3WXM/6U0JogsGKscxXYxHByOdqn:igFwOnnbiqK1Zlt4HKsteTb3ADdi
TLSH
T14B237AA8EAF298445CDD9315621F3FA8C16A6297FF4D83580C1E6F4C29FC239D23A175
MD5 SHA1 SHA512 SSDEEP TLSH

Password

M@yIsangPun0NgKamatisNanabaliDahilSabigatng!bon

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

90ac576f-cbda-6c6e-af38-4b04bfa0d05c.eml

Email Headers

Extracted URLs

TP_Tool_Windows.zip

TP Keyboard Tool – User Guide (Windows).pdf

TP_Keyboard_Setup.exe

kernel32

comctl32

user32

oleaut32

advapi32

generic

User_Guide_Windows.zip

TP_File.ex5

User Guide - Tradingview.pdf

User Guide – MT5 (Windows).pdf

email-html-2.txt

email-plain-1.txt

image.png

image001.png