347fc8e42f626099e60d82cae95a385abd8b68592d5244f2692ef641d53bf1eb[.]exe

resource
unpack001/$PLUGINSDIR/System.dll

resource
347fc8e42f626099e60d82cae95a385abd8b68592d5244f2692ef641d53bf1eb.exe

347fc8e42f626099e60d82cae95a385abd8b68592d5244f2692ef641d53bf1eb.exe

IMPHASH 4ea4df5d94204fc550be1874e1b77ea7
SHA256 347fc8e42f626099e60d82cae95a385abd8b68592d5244f2692ef641d53bf1eb
MD5 9caef9f6cf774a6695b360cc17994263
SHA1 926cf4d64a30e845de69894a552a3518bc5cf235
SHA512 48f04f3f2929372e4098ae3e46ff4ffd458be4ab6b8a06dde455939fe2df783810167a65ce8fd749d2df0e0d622d070081754e6176b19a47a94d4a8199acc0b9
SSDEEP 6144:LB+pgUDTo+3SNM59oaGcXiVpVLo6PDkh9jwRY6cWV5osSeliFPgun9hbW:LgbtlHoYW19O9jwRkeCsyFnzW
TLSH
T12E84F12136B4DA53F93205F04853C53620F76E3879164D539ED43BAE9EB2793FA2CA12
MD5 SHA1 SHA512 SSDEEP TLSH

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

77:24:4f:f9:5b:c4:3d:a3:3a:b2:7a:1a:c7:a1:60:b6:f5:0f:dc:d0:70:d5:8b:af:54:f9:a4:fd:10:43:94:d3:36:19:f0:c7:57:90:72:f1:14:27:5a:77:38:e5:b7:96

Digest Algorithm

sha384

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Lagerkapaciteten,OU=Opdrivendes Shackanite\ ,O=Lagerkapaciteten,C=GB

Chains

Jul 24, 2026

CN=Lagerkapaciteten,OU=Opdrivendes Shackanite\ ,O=Lagerkapaciteten,C=GB

Minor OS version

0

Major OS version

4

Entry point

13238

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetCurrentDirectoryW GetFileAttributesW GetFullPathNameW Sleep GetTickCount CreateFileW GetFileSize MoveFileW SetFileAttributesW GetModuleFileNameW CopyFileW ExitProcess SetEnvironmentVariableW GetWindowsDirectoryW GetTempPathW GetCommandLineW GetVersion SetErrorMode WaitForSingleObject GetCurrentProcess CompareFileTime GlobalUnlock GlobalLock CreateThread GetLastError CreateDirectoryW CreateProcessW RemoveDirectoryW lstrcmpiA GetTempFileNameW WriteFile lstrcpyA lstrcpyW MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GlobalFree GlobalAlloc GetShortPathNameW SearchPathW lstrcmpiW SetFileTime CloseHandle ExpandEnvironmentStringsW lstrcmpW GetDiskFreeSpaceW lstrlenW lstrcpynW GetExitCodeProcess FindFirstFileW FindNextFileW DeleteFileW SetFilePointer ReadFile FindClose MulDiv MultiByteToWideChar lstrlenA WideCharToMultiByte GetPrivateProfileStringW WritePrivateProfileStringW FreeLibrary LoadLibraryExW GetModuleHandleW

user32

GetSystemMenu SetClassLongW IsWindowEnabled EnableMenuItem SetWindowPos GetSysColor GetWindowLongW SetCursor LoadCursorW CheckDlgButton GetMessagePos LoadBitmapW CallWindowProcW IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard wsprintfW ScreenToClient GetWindowRect GetSystemMetrics SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharPrevW CharNextA wsprintfA DispatchMessageW PeekMessageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow LoadImageW SetTimer SetWindowTextW PostQuitMessage ShowWindow GetDlgItem IsWindow SetWindowLongW FindWindowExW TrackPopupMenu AppendMenuW CreatePopupMenu DrawTextW EndPaint CreateDialogParamW SendMessageTimeoutW SetForegroundWindow

gdi32

SelectObject SetBkMode CreateFontIndirectW SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW ShellExecuteW SHFileOperationW

advapi32

RegDeleteKeyW SetFileSecurityW OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges RegOpenKeyExW RegEnumValueW RegDeleteValueW RegCloseKey RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumKeyW

comctl32

ImageList_AddMasked ord17 ImageList_Destroy ImageList_Create

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 2e226715419a5882e2e14278940ee8ef0aa648a3ef7af5b3dc252674111962bc
MD5 a4dd044bcd94e9b3370ccf095b31f896
SHA1 17c78201323ab2095bc53184aa8267c9187d5173
SHA512 87335a43b9ca13e1300c7c23e702e87c669e2bcf4f6065f0c684fc53165e9c1f091cc4d79a3eca3910f0518d3b647120ac0be1a68eaade2e75eaa64adfc92c5a
SSDEEP 192:em24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35OlESl:m8QIl975eXqlWBrz7YLOlE
TLSH
T168325C12135081F3E4918138886B3A276B6A15029BF98E57DFD39646BE21BE3BD7D603
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10183

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Ansaetter.Kon

SHA256 81f381cb01a600ecf72b6237787779a872d81082e3abc4a3fb3b671360ddb190
MD5 bcc58926ac8a3108ad711619b0bd9f46
SHA1 8482fa8187bc82a141b3ad5db19d0bb5f739bfd4
SHA512 955873463fc5534c513325ab4b72bff41cd94d4588e883afc3e8316d072d0c2d5bdfade548a67ebf732f1c0b7516108f90e1e2ce424791ccbcc0f5a1f79c49ee
SSDEEP 768:ffHG0dtFMYvQmu0Jus5k0VPfbIOxc6Vfkc:ffm0dtFMrAu6BLcWMc
TLSH
T14FE2AD05D3A38DFBE806C778C8ED57A10E5C20565B4FE96D527BE820C2D62E397642BC
MD5 SHA1 SHA512 SSDEEP TLSH

Proliturgical/tequistlateca.fem

SHA256 441a64729a160063197046cb853de9432626f04785bac2158c6b1b3bdea628d0
MD5 a85b10ca72c2b8c57c6d681408fab2b6
SHA1 9cff3c338f4959e0b3ececa0063343fa2abc2212
SHA512 dc4746209d405041f1d80a6d8e681c2f7593e5199c50a4bb7541daa48563f68ff525d0255487fbf1b34404068a0a1ef8c1b1210c58088a85d4fa249a8cd07573
SSDEEP 48:9yZm/sASkuJjpxYp+KKOaPKpibwPW7e/3PvNEYGgZNpq9UMhFAErS:9wm/3Skax111CibN7e/3dEyLqSKuv
TLSH
T161824AE6868D813B3134624FCCAC211CDE398A9A6153F8E9C257631330B63218CF7E79
MD5 SHA1 SHA512 SSDEEP TLSH

Proliturgical/udsgte.emb

SHA256 46e2835cf187b72da21a2f58c4e9af331c37a9c49967f9ba38e110ec765ffcfe
MD5 b5d4b2c57b46408c3f1e86839140c031
SHA1 0ff06c2e271006b67002f832b109585492552f5e
SHA512 557797f04c53cd008c864655efbcdada1809988fe3baf466b4f07cc4020b700af2f9a9f94e815f575b585e29dd1ee419640bcc94ec682d3c72a17e393406bc3e
SSDEEP 24:YDgbdfv4Xn3DXnCuhVoO5kepbupDowKLN0uyehCNQ/WlJKjpLBnoN8qbx/nhzgID:K7zjbHY9uyAXQzs3sZvvW+Z
TLSH
T1F5422A74C88F19B5232540F942B505A25FB3EA83142E1F2699D0AFF72E60A51FA13E91
MD5 SHA1 SHA512 SSDEEP TLSH

Proliturgical/wellnesses.par

SHA256 9894b242fac871a7be24ddf3b76c3ef5ff98378de7d3810fada6570f8e9bf40f
MD5 5c3fdf2b1cd05dd0b785603e408f6d55
SHA1 590b16c3f200983ebcae8148e7f5555c478725ce
SHA512 33f38864f6ef44e636adebf65604af26d3a797c28985e7089e7150e72ad19c153c189a0d87193176a2f2d10741d52e887f34c719a2527bed82b9523a017a5b1e
SSDEEP 384:bt6dbkEjpO5pMaogaZgFEMXM6HuaKOmwDVJ8O18:bt6dvCayE20aLm
TLSH
T1A063CF4B2B1F98789311F0326B60FED15620520FA3DB5482B12B71BD06F69B63D467E4
MD5 SHA1 SHA512 SSDEEP TLSH

Sardinien.she

SHA256 0d267bcf99cae6bb6833aa2be0fb2deb5ee93deae6ecb4a4063677ffafb28120
MD5 896f42904a43adc922aa244d749798ad
SHA1 085b00c2d6f696c5232af2e32a37c4c8bb58d0a0
SHA512 bf8338f6b08a01c5d9a36a62c9a0dd95bd94a13a10032fb6a155b0403dad8432e960f82fa0609d06febe5b9bfb0e7befe22dc4510fdd705332684d116008bcb1
SSDEEP 192:oPDm+EBQ6P12mX1FMTlTUXk3/hHv9ZsiMbhA9YEQmiiXVgZpytygrk:sa+EpPQO72UXwNvCVA9YihXiytxA
TLSH
T12F038EFD69444EF5F167C2CA33B2ED39C2531985AC69AD4F19480739B401E3E69F2078
MD5 SHA1 SHA512 SSDEEP TLSH

Tvivlet.For

SHA256 ad4df7f33c2a5a4e3fcbca536ed8eef9e02353131bcf6b039bd592d8f108ceec
MD5 80205f328d07c81fb15626c9b5e8f688
SHA1 46f4fc15560d5198d6fc5d9ce191d5b5825b9f3b
SHA512 c262f61b57e309242439e9430640d69276c55f88c596c2c6183ffb5d13d89a09c93016435d9ab4a8bebbf62f3a52858801fc4af2dbf7c59dcff90a3e43941074
SSDEEP 3072:0rNzOepua/w7RUlK3yH6p99Ic6FdvOVzljTRvsw:0xPVoeo3yHE9Ic6mlZvx
TLSH
T14204F1699CA090F5D7811FF245AE9EFCFD112F5272CE2685B1F634D78042ECBA2190B9
MD5 SHA1 SHA512 SSDEEP TLSH

behandlere.svv

SHA256 4ef5bf964d97176a3eafcbf1276d8e623819f9c50d0dac5e7f75863ee7186951
MD5 b148957745cbfa9254914997fff8aca1
SHA1 24f4d679ae6391802dd25f2a9b548ab9e696812e
SHA512 f00e139cb77f25a71d260b7d6c45efd5ce0b1c8d78dd49ec0db23e9b2a2773f0dfc1ede2344b920ac2f882a7ada60bd372911ba4df78480e3ff7df772bc0eaa9
SSDEEP 192:lqGi2MbdiNL+SIeHT2M7SK7KrTebAgPxtg6Fbp9Ob:+xdUIeHT2M79KQtB9y
TLSH
T13833BF63C65FF28F054308A43DDD2D54278B2D34847B83AB4B0A8FA56287CC15998AD4
MD5 SHA1 SHA512 SSDEEP TLSH

botein.fyr

SHA256 67d84347120e6ea80da01d7fd16d2b6e6072f82c6e8b6a3cb3110c43e4896238
MD5 7f80659b67a57aafcd8aab1c3a1cc69c
SHA1 bf45ffdf6311271068a5594c49d295043af8aaed
SHA512 911c518231433fedfd455d8907332444c1e7dcb05a897a1d35705b593be8ed5b6a268a2bf2d5eceb17f42800611bbae758aba905f7a063ce5b672ca8c7ab7d54
SSDEEP 96:LLJ1VIZCbwaezzZ30QOVheKuw8qXzaf3wOfGVThe3S+:nVIZAwaeBrUZu4oApVdei+
TLSH
T19A139EAC97B62F52514D8CCDFBFF3E592588B2510D3B8133125AFB4441710106E3ADB2
MD5 SHA1 SHA512 SSDEEP TLSH

danicas.for

SHA256 a5a0ceb47511f22e437c88e6539e95c24fe1a2656ac828e1896d9f25abf1ef4c
MD5 45a4952ebf68677f79fa031bc87b8dd3
SHA1 7dd42b551a04e9d3d7c2a9350ceb4a8a4ac3c1bb
SHA512 2a69b1e653c1a270c16d52f2ef7472e276c0ee44ff25607ede07e7eadd143a271fe9695e57c5347bd7eece61d1a03578d0967b36b9f652fb9ea415cee9f3445b
SSDEEP 192:QJtHI2xdDG7fQdvpCNj+mgP+2nc9jtLfK/Mz4HbFHbMAQ2KjQZsj3FI9Fgyjsgze:utHI2ejQmOpgOMzQRQAKjlFCYg9UDPbP
TLSH
T1B263A03117E4FF2D4046ADFD0755C2BEA42BA9AA8BEA11D55CF77A0DF85B11384288E0
MD5 SHA1 SHA512 SSDEEP TLSH

dearsenicize.bor

SHA256 f0c84d2d263a19d91f2dbf2b6822ab9bcfb35d82132f1dd9035fd92354bf495a
MD5 44e39231b041d5994c575d98823f4c1c
SHA1 4d76faffdbd29f5fd647ca02289f213a7a1c430c
SHA512 824d1a4ad884bac921144b6efa8a3e9490d32eb533091be49a190200e21efed98a678754214ae78d7bca0b8a0618f56cdd61e5a3626041cbf77c79b73d33cd82
SSDEEP 384:UXdO9GE1qGaZWuxO2d7avEgnRnntIPuohNWEU3t32tyk5:eDnnnapzIHbhUt2AG
TLSH
T15083AF6A3550F3411496E4DFBC1DA8E33418BB9D5F02EE886446E94F78A3D173CA4255
MD5 SHA1 SHA512 SSDEEP TLSH

decollations.jil

SHA256 f6ccdef0025631637ca21255e80ee2c15eb6a14bb55d08c9452762a93f42f428
MD5 4b6c415ba6b77a0e3c0bfec5c28b7f65
SHA1 60fa654dddb363c4708cf59dffb7e93c4247de9a
SHA512 736fd279becfffd5873493a42951678784b040a7bef6f6fb89fbd7363c2f87edf1079cb64d1d2b7e7cab94ad1fb8a086c421168d66708e77a376345fa76fb861
SSDEEP 384:vPD6SmClumadHnCXuOUWrLCW44eHfpyCRdI:v1mAumapnCXuOU2eD429K
TLSH
T1BB93CFC72F0B8DE288DC66801C1FC60541C7D59E22DC63CA262E569FDA0BECC71187CA
MD5 SHA1 SHA512 SSDEEP TLSH

interxylary.air

SHA256 56f8016139eb34768072340daf47de45bba6f1eaa732a2a82f30f0971146c71d
MD5 63dd337bedf254f25966f7c930f99d8e
SHA1 6ab0b47e7a2d6e7690d8d64cfb89acbb20d5bf76
SHA512 57cd705cfee555c0016becc86c88057318315c7d372231ad9b011a8fb136088a3597dde3fdbb12a5f805696fd65540d57c0276df7bc83e8c0c688020cb250c8e
SSDEEP 192:kyrLWAgu+QBKMlErEetL7jNiwJ32s0lNDgUSZAt9hdlRBzPIjQHPtlEeEc:oAgZQBdex70l9ZoSF
TLSH
T1C943CF9B92A21F83E859C96C30488EBD458F56CA0A47EF414D3EA9F212C182608CF5CB
MD5 SHA1 SHA512 SSDEEP TLSH

miljadministrativ.kal

SHA256 602b8364a53fdfddf8bdae2e52a1ab71843c4c6a60112c600a3a9934ee54191a
MD5 d1365a11eb0cc057ef672318f883953e
SHA1 dba437027029aab1b63775a0baaa87518f922281
SHA512 a1de2ccb94ed44e6930bf85056493eac4b3097ea8601d068ff6a2d699c93804345d1343ab6ca0d22e67bb424814471a36eec23730f01845b1ba115bb85db53a5
SSDEEP 768:/hFc8GUqJeGA+wdPxa6njSLxR+FCwz+KvzeMi:05JyNz+Oi
TLSH
T11D43AEEF2CECA702E6FACD555C679CC8CD0EA0B7832288CDA001711E59CA3B549E65C9
MD5 SHA1 SHA512 SSDEEP TLSH

ministrene.sku

SHA256 837cf4070990f7c8d2afbd3343cf2b617a56c4b97901b39226d9b97bbde021d2
MD5 ccebe521a14ed63c87abb20ddb8f9d94
SHA1 cd2147a3faf682cc36ddacebb6b6996bc5b0af68
SHA512 28206ec898b8f4358d9c7903283d07e9e738b28d96cbe1abe74b871d8b13314fd3ab4c0d89c7b65c12df83c2e4beff331883637d82f3e7e9e029f92e8822e310
SSDEEP 384:TNGYunhkbVi4RBrN806jspPkxQ5ZstsezGSYswkQ9IRomtTWQ4CVh7sORcGwImhA:8hkL8XOkxakPzqCj3yWh7sSkFSSk
TLSH
T10A93C0AF30678DD31E96153F2AC46A8AC6426398FFC876B12098DD650147D2FE35C1B5
MD5 SHA1 SHA512 SSDEEP TLSH

morass.bis

SHA256 4049a880b028ef92bf384ed7d0196ad533ccaae6dd4082d749b79f969ab6f333
MD5 95690569d9d8a58c279a9b8d8fde3853
SHA1 b425aed8db2e442277dbe23ba01dc557d6df6c7a
SHA512 23ba9ef0eacbcad47e9a7ed15c6e08d4ba3577364ff69e610823f970825dcd5c15f920d6a8adcc5f3e91718cdb1e0c06bbbd5343f131064fe9b8aec50ccd69de
SSDEEP 192:nFZKutvcaZMajSIagoHR08I5FbEEBI0/s4bej9amzh5XIo80qKgpydQqLyBFLOB:WuOaZXUvkbUjP8dpy6qLMM
TLSH
T1FB339D0DF76A3594B8C9CCFB121EB6CCA1845C920449B295AE35D1982E64BDC4708DBD
MD5 SHA1 SHA512 SSDEEP TLSH

renathe.boj

SHA256 065a4af4ae743c40a56b52c207750ba0e820b45939c492ad48b38853ddb42ffb
MD5 81f009e698f5aa715e655f382be8c0e5
SHA1 bfe6cd80b3ddf3213bc54ff7eef24551c9525492
SHA512 7379e3573e1748cce17e19d51c79619d6033370a9300c4b970624cc06cdf743df203290e3fec19dff52888401d64504acbb98d29c62828106191b743ac0f695a
SSDEEP 192:4bZxMdjfMQOP/BMOFDuSKzT9CmCF2VXw95rqeXL:/4WMqvX7VXw95WYL
TLSH
T14153AF78C892DA57C35A24826DCD6EAD5FB8433C6C6E33A2D35EC1AA7C11435112CB7C
MD5 SHA1 SHA512 SSDEEP TLSH

sknsangens.sli

SHA256 1ad4f336f52218e2e43776eb3479581da4b3f4f2ebde091f91c9cbf4c616040c
MD5 b153f5d5a48474f5c7f0beba521dc55d
SHA1 676ef66bf313a4c951fe8ce3363f88fa1f279c96
SHA512 ea0fa7d60cea682701eb563d4313f7020230c1ae502770428071b3aebfa1c8e234004e59d96f7f602cb41739f8a2003f416be0609b4a27c052125de92ae2b6c1
SSDEEP 192:3khvU2LhYtVP8sT7JijP8zoZRFiN50j3AHxfJBLiiK2Ez2tmtXy:D75EKpVLExti
TLSH
T10253C0BEE959CE9BD89BE9004F81E81CCE607CE9843D7C050C3642535B4E2AF8860E83
MD5 SHA1 SHA512 SSDEEP TLSH

suboxidation.ebr

SHA256 4458389de2da21ffad3a690cf1b3221ab1dc73895a10093bf7b1199ffb8cd137
MD5 9e61426bf37ed1275718cd5649e92262
SHA1 e76b4dd7bb6c3e1357c0cfdd05f248207ebc4406
SHA512 89177c4b4a625c788f970582754b536deac619fb416a4f493841ad3fc1eeb37b09d88a7bf7ef99a42cff4cd1de40a675e82e25c56db96857b4db330ce3846595
SSDEEP 384:VWu6KYpsMSQYs9ttfoJ+D+Ks2pOx/Yhb4IF:0pJjqq+O3JD
TLSH
T18313BF642555DA0EF8E8784ACF6B3FBEE21D6AF16370B44087D610FF51246124887F27
MD5 SHA1 SHA512 SSDEEP TLSH

347fc8e42f626099e60d82cae95a385abd8b68592d5244f2692ef641d53bf1eb.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Ansaetter.Kon

Proliturgical/tequistlateca.fem

Proliturgical/udsgte.emb

Proliturgical/wellnesses.par

Sardinien.she

Tvivlet.For

behandlere.svv

botein.fyr

danicas.for

dearsenicize.bor

decollations.jil

interxylary.air

miljadministrativ.kal

ministrene.sku

morass.bis

renathe.boj

sknsangens.sli

suboxidation.ebr

Sharing

General

Malware Config

Signatures

File Explorer

347fc8e42f626099e60d82cae95a385abd8b68592d5244f2692ef641d53bf1eb.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Ansaetter.Kon

Proliturgical/tequistlateca.fem

Proliturgical/udsgte.emb

Proliturgical/wellnesses.par

Sardinien.she

Tvivlet.For

behandlere.svv

botein.fyr

danicas.for

dearsenicize.bor

decollations.jil

interxylary.air

miljadministrativ.kal

ministrene.sku

morass.bis

renathe.boj

sknsangens.sli

suboxidation.ebr