5cae1bc499bb70c7bd93592360a9d6d5a4fefa3969feecb4c87553ddb582976d[.]exe

resource
unpack001/$PLUGINSDIR/System.dll

resource
5cae1bc499bb70c7bd93592360a9d6d5a4fefa3969feecb4c87553ddb582976d.exe

5cae1bc499bb70c7bd93592360a9d6d5a4fefa3969feecb4c87553ddb582976d.exe

IMPHASH b34f154ec913d2d2c435cbd644e91687
SHA256 5cae1bc499bb70c7bd93592360a9d6d5a4fefa3969feecb4c87553ddb582976d
MD5 74d740193b40387b0bb8d31d4e681146
SHA1 1c179c0c5b6d40186ee0599775f179817e65f4e4
SHA512 f8b85d60bd68b26d4c569a81fb1bb374542ec63b6b97becf3556fbc0d0ed7af845948226f613e24ede3004df249f43894bd00dfe873efc2b66cf7167865e4d45
SSDEEP 6144:bmGIhCrl0WKxHId8CUJfF23Pmrp9qBQdu0hfJnXBqzzSlq0Pfglyq56zJ:ym0NxodvUP23P29Rdu0hfRx6ZlyqQ
TLSH
T1AF94DF83F680C6AAFC3D4D75899392701B72ADB556C64F4357E43A223BB22C0753B52E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

88:2c:b9:da:3c:e3:a0:44:ee:02:78:35:04:66:db:57:78:16:25:c5:5c:ee:b6:e5:e4:d6:59:78:75:56:d4:60

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Abbroachment,OU=Retards Krydstogterne\ ,O=Abbroachment,C=GB,1.2.840.113549.1.9.1=#0c174d616c67757a61726936324047697665747669732e5564

Chains

Jul 23, 2026

CN=Abbroachment,OU=Retards Krydstogterne\ ,O=Abbroachment,C=GB,1.2.840.113549.1.9.1=#0c174d616c67757a61726936324047697665747669732e5564

PE Signature issue

Digest

48:fc:7f:89:97:0f:b2:f3:0e:8a:eb:9d:a3:9a:61:f7:45:6c:0a:73

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Abbroachment,OU=Retards Krydstogterne\ ,O=Abbroachment,C=GB,1.2.840.113549.1.9.1=#0c174d616c67757a61726936324047697665747669732e5564

Chains

Jul 23, 2026

CN=Abbroachment,OU=Retards Krydstogterne\ ,O=Abbroachment,C=GB,1.2.840.113549.1.9.1=#0c174d616c67757a61726936324047697665747669732e5564

Minor OS version

0

Major OS version

4

Entry point

13199

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetEnvironmentVariableW SetFileAttributesW Sleep GetTickCount GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW SetCurrentDirectoryW GetFileAttributesW GetWindowsDirectoryW GetTempPathW GetCommandLineW GetVersion SetErrorMode lstrlenW lstrcpynW GetDiskFreeSpaceW ExitProcess GetShortPathNameW CreateThread GetLastError CreateDirectoryW CreateProcessW RemoveDirectoryW lstrcmpiA CreateFileW GetTempFileNameW WriteFile lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject lstrcmpiW MoveFileW GetFullPathNameW SetFileTime SearchPathW CompareFileTime lstrcmpW CloseHandle ExpandEnvironmentStringsW GlobalFree GlobalLock GlobalUnlock GlobalAlloc FindFirstFileW FindNextFileW DeleteFileW SetFilePointer ReadFile FindClose lstrlenA MulDiv MultiByteToWideChar WideCharToMultiByte GetPrivateProfileStringW WritePrivateProfileStringW FreeLibrary LoadLibraryExW GetModuleHandleW

user32

GetSystemMenu SetClassLongW EnableMenuItem IsWindowEnabled SetWindowPos GetSysColor GetWindowLongW SetCursor LoadCursorW CheckDlgButton GetMessagePos LoadBitmapW CallWindowProcW IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard ScreenToClient GetWindowRect GetDlgItem GetSystemMetrics SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharPrevW CharNextA wsprintfA DispatchMessageW PeekMessageW ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow GetDC SetTimer SetWindowTextW LoadImageW SetForegroundWindow ShowWindow IsWindow SetWindowLongW FindWindowExW TrackPopupMenu AppendMenuW CreatePopupMenu EndPaint CreateDialogParamW SendMessageTimeoutW wsprintfW PostQuitMessage

gdi32

SelectObject SetBkMode CreateFontIndirectW SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation ShellExecuteExW SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW

advapi32

AdjustTokenPrivileges RegCreateKeyExW RegOpenKeyExW SetFileSecurityW OpenProcessToken LookupPrivilegeValueW RegEnumValueW RegDeleteKeyW RegDeleteValueW RegCloseKey RegSetValueExW RegQueryValueExW RegEnumKeyW

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
MD5 0d7ad4f45dc6f5aa87f606d0331c6901
SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
TLSH
T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10643

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Preballoting

SHA256 9355aa18f24998a7be927d8bef4252cbf9bfe513e2c9eaa54dee3ab261825124
MD5 cbcfa4eabcac29ffc9d9b4413c2d22da
SHA1 462d63645cb8954f5bbc9e4815f9c3a1b8b4bbfb
SHA512 56388e5413f81d47b375aa48ef17a3bf24aef5621743a82747415480d3833fd22c3ebfbeadd3a76e4f889c514f8b6f268e24a5a58cb90191cd468bbd7d821579
SSDEEP 3072:gRbrmo3LRPFLrvF0D7BiEk/wbmnMvjxJzeFLDGiXA:gRbqo7RPFd0DFa/woMbr8bA
TLSH
T1B1C3F1E3776470F5D8C680FE1E4B99FBCE34C695FEC252A27A46DB94A2200E47E35211
MD5 SHA1 SHA512 SSDEEP TLSH

brevit

SHA256 1d660f6b18e4f355dba4afd688bfca2e50f8717b0aae6329455c544d7c8e29eb
MD5 27ca9258b12a85e079226e40ce7aadd6
SHA1 8f02165fafba22e711ca0f1417c6fedbeaf8d362
SHA512 6ab65efbe097061bd536944b13c1a3fd291e8f3620622a95064f2064ae909d64d1b7e38a19ffa39f940a4e8ffb69a41730cd80101546c55703d0ff657ce452c2
SSDEEP 1536:AB1aZqylj0zkJUgdCoEZtmsh7ntt2aQlTyMqmgOzxUBX4x8QY59b:cWx4zkJUACoEZtFh7bzQlbqm1zx8h9b
TLSH
T119C3BF92C7579CFADC068538C46D71A68D98B0175B0F90BEA176BC15C2872E37334BAE
MD5 SHA1 SHA512 SSDEEP TLSH

citharoedic.fej

SHA256 a12bbe461500124cb57abd8269782d01e99ff7b9a1cfff94bffe6151987cd4ad
MD5 33e88b2adcc23edbd5aedcde1f864560
SHA1 9c25c1497d5dfb736655ee4b84a2f1ce8ae83d9d
SHA512 c05795c1e9a00165f5419bbc8cefcdc978f32e0c7d32a4db484481c347e23a06c6cccd1f989766e9ca66602856057b329d5ab12709c6aab8b20a27e9d01ed180
SSDEEP 96:T4oNedzW0PauOAKS/k2DTVm/Q9AbJChkAE:T4oNe1W0Paufs2s/DbJChkAE
TLSH
T1EBB33B783137757D79AA0F2A9FF908F4A725C834D5C41A2A16D1BB478452CB262A0D64
MD5 SHA1 SHA512 SSDEEP TLSH

friherrer.top

SHA256 bc7a7694cfa2960e325873f199cf729127d341f5f8e501c908b9e3f3d99a1780
MD5 562212551266d8910717dcb94034c4ed
SHA1 3d7ef02e5714fd9af35a02180358f97c564f3954
SHA512 9714d4e1742b965bfc59773e057460b4f460b06363def01db0bc7fc25affed5d801d38ad3a72a6f066beb56c1636722b6deeaec2790e2ce9fabaee8610387770
SSDEEP 192:KeTsrSdbgk/PvaFx51alj3ZUNUv+0mFFPcVSULW96clAJspg3w+:Bsfknvy12j3sUvAjiA6lj
TLSH
T12CE37E10607EA2D3D831F72F5E71B804FEA0215D69CE5A1815B887DFEE5C22913C8524
MD5 SHA1 SHA512 SSDEEP TLSH

kommutativ.bid

SHA256 3d648fbe3d01502afd5f9a50835538253cde7466a5c6e9082c8d08d5751a0e89
MD5 3571a1ced72f05e97c79e69d93d0f642
SHA1 d0a1cc9524bdb1f51f102b3325ed77aa16e31abc
SHA512 2207af5e0a139063c18a00252e828c3314974c14764336257e760de02f36ca0cc6fb5b29ad457a2ba8f4c18acdc4431610a454483adf6c8810ceb11206ab5f1e
SSDEEP 24:xJX6HvvNTPGE0+mf+oQInG2je49GphfoYM1PjuBqqbzhjjBGcC:x6Tulz1yfoVyLz5BGcC
TLSH
T161631C215D35A1079BB3B520C859B7347DEB674362FA8CC8DE075E8501F10CC8A4DD43
MD5 SHA1 SHA512 SSDEEP TLSH

reportage.tro

SHA256 f407ab2817125b159ed6fe459a996cec15ca0141de926251a280811b3c80142b
MD5 80565e3507bc21502ab1cb351bec773b
SHA1 d702be8ba79838243e75894f46a0b23cd3ccc68e
SHA512 972542e1096f9ddf60fb68efd107c97307028b7216ef2c9a9ad46db87765ba8113a931fc15fc14edb717738edd23bbefbca3a04f6aa607d2d83b9dc65cd102bc
SSDEEP 48:Hd6P2niSGsU8A7fNRz9ONxE/kffqMiDLgojCFo2vkM75PrEFYqrPzo3rK:HM+nnWl3rLgoSBC9Pzo3G
TLSH
T13C5319182BE72AF10D1A05155290F816426297A0168CD9BEE46577CD81ECA1B7F24226
MD5 SHA1 SHA512 SSDEEP TLSH

spermaets.syl

SHA256 4a7f25f2134f7a2e6febf5289b9c7817d875daf7f6d001cc1ba409022f87bfef
MD5 5a96c67cf987717ec6acbfc9f232cd3c
SHA1 3cdfaa592b4d1b3fa6ad2fae008ace5b1e5ebba0
SHA512 ba853c8d3296902888b83b98e79a7265406f75fbdde49bc298f19d13474244cbc9a8878d5500292b60ea3bb24bda45a730f77102891f362b3b3a96a95a4bac30
SSDEEP 96:Wotyb/5JnTtIW68vSkcc76er/BGjtVX2zN:WoEbvnTOW6fNE6a/BGxVX2zN
TLSH
T158A35D1E62287A84B8310AC5000752895D96B150CCBFD1E4B38E9F2BEF73E97218E274
MD5 SHA1 SHA512 SSDEEP TLSH

unsharply.pos

SHA256 5fc5bb4302e39698f6c0794041ff2d6d695e45533ae7214c87d2c4c8993bf3f0
MD5 619dbe3677fe84d57252d9b030bc5407
SHA1 d62fc1b0c7c63fd805667cc42aba8af8a264a279
SHA512 547cca26f1c53acd6dd0f1ea50bcd6a858680134740aa4ac6efbe42fa7fc02b6a1726446e5e3c97c4b2a53f8b50a592a6ee380a4346f6f9b5eef6b4c04f7f1b5
SSDEEP 96:2371+VBH/YuojEm2t7Hy1a22UoQPElTEfDsczbLb8e/q3r:23g0GlO7zpQyE
TLSH
T1F5C34AE3C683B036F588157E8247DA7B588AD78FEB88EB650A6B66526A54E400FD1402
MD5 SHA1 SHA512 SSDEEP TLSH

5cae1bc499bb70c7bd93592360a9d6d5a4fefa3969feecb4c87553ddb582976d.exe

PE Signature issue

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Preballoting

brevit

citharoedic.fej

friherrer.top

kommutativ.bid

reportage.tro

spermaets.syl

unsharply.pos

Sharing

General

Malware Config

Signatures

File Explorer

5cae1bc499bb70c7bd93592360a9d6d5a4fefa3969feecb4c87553ddb582976d.exe

PE Signature issue

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Preballoting

brevit

citharoedic.fej

friherrer.top

kommutativ.bid

reportage.tro

spermaets.syl

unsharply.pos