16131fdd48c28529684d83a0687e3500e70c6abd8d86fbaefd49cbfdff57f5ff[.]exe

resource
unpack001/$PLUGINSDIR/System.dll

resource
16131fdd48c28529684d83a0687e3500e70c6abd8d86fbaefd49cbfdff57f5ff.exe

16131fdd48c28529684d83a0687e3500e70c6abd8d86fbaefd49cbfdff57f5ff.exe

IMPHASH 4ea4df5d94204fc550be1874e1b77ea7
SHA256 16131fdd48c28529684d83a0687e3500e70c6abd8d86fbaefd49cbfdff57f5ff
MD5 fe2a6761da82e99dbdf387aba9b8dd89
SHA1 8903d9554c088f185ad7d8671d4e429adbb76e7e
SHA512 c80cd5f5921f4694e4a9302c80be6391a6013f270f96cac58161fb4ff1488f3c74e14a31cc70a079a2a4b1356756f121f8eeb25157bcdeafc4a7760ac4126357
SSDEEP 6144:6B+pgU8ZHm5GjJ6PTQvcwCW5YG1Fe2bdSSufD02Un0sllit+ma9/cqGIHwBRvkha:6gwHmebvT9rSkdSFfDZU0AVdkqCRJp
TLSH
T1DA94E0154BA7981BD9D6173184A2DB325A74EE402D31D68B13C8FE4B3DF2BC0F946297
MD5 SHA1 SHA512 SSDEEP TLSH

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

38:68:33:2e:d8:36:3c:f2:47:0c:f6:6c:11:b8:52:7e:90:86:6b:eb:d1:bc:bd:e2:2a:01:88:c5:7b:5b:cd:a2:33:1a:d8:2d:0b:58:4d:01:c9:54:1a:6a:a0:37:c8:06

Digest Algorithm

sha384

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Engangsemballagernes,OU=Acridities Mdes\ ,O=Engangsemballagernes,C=DE,1.2.840.113549.1.9.1=#0c174d6163726f746f6e65406f766572666f657274652e5572

Chains

Mar 13, 2026

CN=Engangsemballagernes,OU=Acridities Mdes\ ,O=Engangsemballagernes,C=DE,1.2.840.113549.1.9.1=#0c174d6163726f746f6e65406f766572666f657274652e5572

Subject

CN=Engangsemballagernes,OU=Acridities Mdes\ ,O=Engangsemballagernes,C=DE,1.2.840.113549.1.9.1=#0c174d6163726f746f6e65406f766572666f657274652e5572

Serial Number

79:49:00:41:24:92:5f:b4:e1:17:01:31:47:89:20:9f:47:9d:24:ca

Issuer

CN=Engangsemballagernes,OU=Acridities Mdes\ ,O=Engangsemballagernes,C=DE,1.2.840.113549.1.9.1=#0c174d6163726f746f6e65406f766572666f657274652e5572

Revocation Status

Not revoked

Timespan

Jan 18, 2026 - Jan 18, 2027

Subject

CN=DigiCert SHA384 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0c:20:43:49:f9:d0:f7:59:fb:98:2d:e4:08:1b:88:7b

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

13238

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetCurrentDirectoryW GetFileAttributesW GetFullPathNameW Sleep GetTickCount CreateFileW GetFileSize MoveFileW SetFileAttributesW GetModuleFileNameW CopyFileW ExitProcess SetEnvironmentVariableW GetWindowsDirectoryW GetTempPathW GetCommandLineW GetVersion SetErrorMode WaitForSingleObject GetCurrentProcess CompareFileTime GlobalUnlock GlobalLock CreateThread GetLastError CreateDirectoryW CreateProcessW RemoveDirectoryW lstrcmpiA GetTempFileNameW WriteFile lstrcpyA lstrcpyW MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GlobalFree GlobalAlloc GetShortPathNameW SearchPathW lstrcmpiW SetFileTime CloseHandle ExpandEnvironmentStringsW lstrcmpW GetDiskFreeSpaceW lstrlenW lstrcpynW GetExitCodeProcess FindFirstFileW FindNextFileW DeleteFileW SetFilePointer ReadFile FindClose MulDiv MultiByteToWideChar lstrlenA WideCharToMultiByte GetPrivateProfileStringW WritePrivateProfileStringW FreeLibrary LoadLibraryExW GetModuleHandleW

user32

GetSystemMenu SetClassLongW IsWindowEnabled EnableMenuItem SetWindowPos GetSysColor GetWindowLongW SetCursor LoadCursorW CheckDlgButton GetMessagePos LoadBitmapW CallWindowProcW IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard wsprintfW ScreenToClient GetWindowRect GetSystemMetrics SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharPrevW CharNextA wsprintfA DispatchMessageW PeekMessageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow LoadImageW SetTimer SetWindowTextW PostQuitMessage ShowWindow GetDlgItem IsWindow SetWindowLongW FindWindowExW TrackPopupMenu AppendMenuW CreatePopupMenu DrawTextW EndPaint CreateDialogParamW SendMessageTimeoutW SetForegroundWindow

gdi32

SelectObject SetBkMode CreateFontIndirectW SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW ShellExecuteW SHFileOperationW

advapi32

RegDeleteKeyW SetFileSecurityW OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges RegOpenKeyExW RegEnumValueW RegDeleteValueW RegCloseKey RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumKeyW

comctl32

ImageList_AddMasked ord17 ImageList_Destroy ImageList_Create

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 2e226715419a5882e2e14278940ee8ef0aa648a3ef7af5b3dc252674111962bc
MD5 a4dd044bcd94e9b3370ccf095b31f896
SHA1 17c78201323ab2095bc53184aa8267c9187d5173
SHA512 87335a43b9ca13e1300c7c23e702e87c669e2bcf4f6065f0c684fc53165e9c1f091cc4d79a3eca3910f0518d3b647120ac0be1a68eaade2e75eaa64adfc92c5a
SSDEEP 192:em24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35OlESl:m8QIl975eXqlWBrz7YLOlE
TLSH
T168325C12135081F3E4918138886B3A276B6A15029BF98E57DFD39646BE21BE3BD7D603
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10183

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Nohes

SHA256 547a04095767c5c6a35ac0f4ea18a58e27dea4f7ea31105c6e1ca6dd06254bcf
MD5 5014a9f1a1c938c67005824460c8eb1a
SHA1 cd781bbeec1c11eebdad7e0ff7b31ca7e328adcf
SHA512 06e876c49f53a6224fd2097a4318a75da28f10d8fc19267b1929693035f1b49e67000e4f6759e426d5b4fee3c5bb5f1e2ea054a5d3556fe933ca270460829f34
SSDEEP 384:oePgNI9RWoOynEBQw7SCZCV1eE+PHq3ZVDOfn2AtV:oePWWbOyyaC8VwV4NcDL
TLSH
T1E5829E0AC31AAC77C45BC63CD46C92E1CD142053A7ABC1BEC03AB408C5976F967ADBE5
MD5 SHA1 SHA512 SSDEEP TLSH

Sprogligt62/radiobilers.hve

SHA256 8fac8e8589207401d7e773c7ccbb15d70364388c950bd02192903a9e701d1f62
MD5 be891c9ea49460ed551f16601a6e8a44
SHA1 6f98cfadff235eb2d125f444c7de619787e9545a
SHA512 15d8197441f4e1ed2ebe24a6b5760c4338423019521360ff591553afc37f43790b016c9a252ee2ecffd609c9a5b08096c3a5e12aae4a994168fd4ff9c9f515a4
SSDEEP 96:t5jcZ5xiAu6wLXtETSGiPnZ9qrEsoBlk1GF0T7YbRfO7JDvWU4S:PM65L0SGizqrEsoBlnqrl4S
TLSH
T1F563288133911ABB34B4E2180A2D19C716D32284A7333E472AAB709C326FA253178D7A
MD5 SHA1 SHA512 SSDEEP TLSH

Spydkastenes

SHA256 d09f4846655dc8dd0835271791c5c4389ca5041d591e77d4898f897e1fa5d0dc
MD5 79f36e8137f32c68fbdda56eae1d62bd
SHA1 7acaf458a84041fcdf4b97e64ff9d614a7bfd399
SHA512 1682fd9e3b399798ed098520dbbf46a8fb61542d6d06036d884fe5a0e49df1cb143a1e60dfc3a9c9e129571a6015e761456bd1a4354bf5ae5a2a30663d1c1b2f
SSDEEP 6144:PGDJ6/B7vT8VEAWc8eKIHkNDoWbJePQqGsjbQ9vN:A6/BbToWc8eKIENDIPz8l
TLSH
T19654F1E762197996EAAF907FF10C4B7CC6EC00E0724DE9B87AD54F09CCB9DA79114068
MD5 SHA1 SHA512 SSDEEP TLSH

Vandrelyst/udlades.bob

SHA256 5c99761ee5223efa694af85033c5af1f028e1efef0c4720642fb16b66b77cae4
MD5 d75f93fb2adbea8ddd2ee8ee8ae31c2a
SHA1 7d3fbc01ecd3ca5e1a56340dc85f1c7e5af13a9e
SHA512 5a46e36f8ef1366b38eb04895580c58ac0b07c5ca9afcfc8adb1f7ff1f3c3f86cdd6dcdc9a429bcdfc332af12f8b6c245abbfdc1cddad5154fc4de7d1acb0c28
SSDEEP 48:i87tUWKgAXFrZLjrYyTg91ehlawfquRFKynwWl8265Fr:iaUVFVLfI91XwfGEVl8BPr
TLSH
T1C4833B24BBE4961E745EEF222DDE014C59081D6A4D08D29C88A91CDD96F60873B2CC2C
MD5 SHA1 SHA512 SSDEEP TLSH

Vandrelyst/virussernes.arr

SHA256 32cf84c348413dce3631788dd73b3d27dd88ecfb52caff695c8cf9a04e0d7f40
MD5 50a144d34d62f38df000f8cb11b7f43f
SHA1 e28556ff0bdfc6fb7f8f3a6d5d323e4de53cf3a9
SHA512 91a07cb68e96cf7d0dc50f55dbf35842fa36b0175294c473f0c8b32b2e4bc2b88774b67d8af50dbcf75ef9dbdf1abf0d51f8db3eebdf4352ee4a26780d224e73
SSDEEP 48:CJuV5oYw1XeqUaXdlw7nCorokY/SZeJPnRDXdGYvP:CJz+8tlanCorokY/SZeJRNFn
TLSH
T196637C816FDBCFE431E821352AE1A0B185A2294D72220C1AC030DF60592433EB172D9F
MD5 SHA1 SHA512 SSDEEP TLSH

ketols.her

SHA256 0ab8d5f0419ca3970843b6806764007cbf3438c48439a605807532411c30b139
MD5 62099bee4916ddd1724706cec4ea68a4
SHA1 c9d313876803f7b3f417ec510837be706ef92031
SHA512 44b44345522ec952da4c2a49beb063c169a095a0deebe93a48957475ef270f6dfb390e1e6c8d2d1f3988512c9dbe9deee03de1089aaf8e61a373f0b74eb55d79
SSDEEP 48:ny0bP0nNzGg0sKI3gOaYx19siFmdvVq/XwJkTmPere4s6SGQBRhOzDfAA9jz34:nyGPENFTd1qKX8Smmy0Sl84
TLSH
T16C43D8C28144077B764A891C44D51F0E70A4E359D7C862DB76A9EB2013A9B4F92D6DD8
MD5 SHA1 SHA512 SSDEEP TLSH

16131fdd48c28529684d83a0687e3500e70c6abd8d86fbaefd49cbfdff57f5ff.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Nohes

Sprogligt62/radiobilers.hve

Spydkastenes

Vandrelyst/udlades.bob

Vandrelyst/virussernes.arr

ketols.her

Sharing

General

Malware Config

Signatures

File Explorer

16131fdd48c28529684d83a0687e3500e70c6abd8d86fbaefd49cbfdff57f5ff.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Nohes

Sprogligt62/radiobilers.hve

Spydkastenes

Vandrelyst/udlades.bob

Vandrelyst/virussernes.arr

ketols.her