word[.]exe | Triage™

resource
unpack001/$PLUGINSDIR/System.dll

resource
word.exe

word.exe

IMPHASH 9be4f90f50c714bc00cc8beb2e137299
SHA256 aa223638cd0363efd4195a0081ff36b953c45b36b2bc1dca0aba27ded47259bd
MD5 2cfe98bab49dca2acdbef9ef5dfe6521
SHA1 334250dac756bfa665aeea509b0660f8b7945733
SHA512 ff5f903da123cde0ae430b59fe2f5c7734e8f806d4def44247cd4fc66d80b321afd0859d8efd9cfcddd5f527183c2e64b8f7ede6d583fc3c5af90c95ab3b1e62
SSDEEP 12288:KrZRD+8idy7j40JXwTWaA7V7Z3a13zdVlAptU+vR17F+ZoXfAHu7Cm5:K7D+Po4CwT/+Vlad/sVnFcnHuGm5
TLSH
T1C7F40224BA272CC8E436F8B44FB7D07FD7A57C285D14926B3664F67F2E30261C826A14
MD5 SHA1 SHA512 SSDEEP TLSH

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

0a:2f:87:ad:ff:ac:36:fe:af:fc:f5:e0:0a:26:d9:70:55:23:a4:c9

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Kommateringsfejlens,OU=Fetishize Forskaanet\ ,O=Kommateringsfejlens,C=US

Chains

Jul 27, 2026

CN=Kommateringsfejlens,OU=Fetishize Forskaanet\ ,O=Kommateringsfejlens,C=US

Minor OS version

1

Major OS version

5

Entry point

17331

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegCloseKey RegCreateKeyExW RegDeleteKeyExW RegDeleteValueW RegEnumKeyW RegEnumValueW RegOpenKeyExW RegQueryValueExW RegSetValueExW

comctl32

ImageList_AddMasked ImageList_Create ImageList_Destroy InitCommonControls

gdi32

CreateBrushIndirect CreateFontIndirectW DeleteObject GetDeviceCaps SelectObject SetBkColor SetBkMode SetTextColor

kernel32

CloseHandle CompareFileTime CopyFileW CreateDirectoryW CreateFileW CreateProcessW CreateThread DeleteFileW ExitProcess ExpandEnvironmentStringsW FindClose FindFirstFileW FindNextFileW FreeLibrary GetCommandLineW GetCurrentProcess GetDiskFreeSpaceExW GetExitCodeProcess GetFileAttributesW GetFileSize GetFullPathNameW GetLastError GetLocalTime GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetPrivateProfileStringW GetProcAddress GetShortPathNameW GetSystemDirectoryW GetTempFileNameW GetTempPathW GetTickCount GetUserDefaultUILanguage GetVersionExW GetWindowsDirectoryW GlobalAlloc GlobalFree GlobalLock GlobalUnlock LoadLibraryExW MoveFileExW MoveFileW MulDiv MultiByteToWideChar ReadFile RemoveDirectoryW SearchPathW SetCurrentDirectoryW SetEnvironmentVariableW SetErrorMode SetFileAttributesW SetFilePointer SetFileTime Sleep WaitForSingleObject WideCharToMultiByte WriteFile WritePrivateProfileStringW lstrcatW lstrcmpW lstrcmpiA lstrcmpiW lstrcpynW lstrlenA lstrlenW

ole32

CoCreateInstance CoTaskMemFree OleInitialize OleUninitialize

shell32

SHBrowseForFolderW SHCLSIDFromString SHFileOperationW SHGetFileInfoW SHGetPathFromIDListW ShellExecuteExW

user32

AppendMenuW BeginPaint CallWindowProcW CharNextA CharNextW CharPrevW CheckDlgButton CloseClipboard CreateDialogParamW CreatePopupMenu CreateWindowExW DefWindowProcW DestroyWindow DialogBoxParamW DispatchMessageW DrawTextW EmptyClipboard EnableMenuItem EnableWindow EndDialog EndPaint ExitWindowsEx FillRect FindWindowExW GetAsyncKeyState GetClassInfoW GetClientRect GetDC GetDlgItem GetDlgItemTextW GetMessagePos GetSysColor GetSystemMenu GetSystemMetrics GetWindowLongPtrW GetWindowRect InvalidateRect IsDlgButtonChecked IsWindow IsWindowEnabled IsWindowVisible LoadCursorW LoadImageW MessageBoxIndirectW OpenClipboard PeekMessageW PostQuitMessage RegisterClassW ReleaseDC ScreenToClient SendMessageTimeoutW SendMessageW SetClassLongPtrW SetClipboardData SetCursor SetDlgItemTextW SetForegroundWindow SetTimer SetWindowLongPtrW SetWindowPos SetWindowTextW ShowWindow SystemParametersInfoW TrackPopupMenu wsprintfW wvsprintfW

Name

.text

Size

36KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

368B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

35KB

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

284KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ndata

Size

512B

Virtual Size

568KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

242KB

Virtual Size

242KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

$PLUGINSDIR/System.dll

IMPHASH cf8eee620b3371ff06e99c34f39ea84c
SHA256 33b570d86c4aac8c6785944f9b2992dc3eccc99e35c20ab79d81917bbef35622
MD5 7f6837692e4c3ee810fe8302b7e0db99
SHA1 2dff99100da9588dd828fc4436a82d0b1a9f1354
SHA512 923d20a4396a788f2073ee9a1f34c7a74013e4a424a39a1b0bc14c1533c0c496e06e3ab702debfa193c84adf909203db8bb9ad52cad436c4d7a3b5cde6776678
SSDEEP 384:WZ2pfUx9eVLwDKO9XYD/isN7lCEjgwMU/ktKi+R45Duwomq8pqdDvHb1Q:Wr96YIrx7lC7vU/kaG9uLmCdb
TLSH
T120B24C07F38398BFC50BC1B186EF5772AA32BE211B616F6F1220F5756E24E90871DA14
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

12726

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

Name

.text

Size

14KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

112B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

1024B

Virtual Size

916B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

384B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

179B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

88B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Alumins/Noseless

SHA256 f6d3bf51f916decc49f083d8eb3e7ae5c39255247dd2b162fdfdbd44953e946a
MD5 5000834999c19ddf3fb2d9bc83e04be1
SHA1 e938f8e84824835dad859308e5d25ebb5845f274
SHA512 5fbb3a54c63bfd98e428096ac93e43b313840c84e6e0ab1359bfd7ec889c881e017de9cfaa8b8c2bcb5a703abec710e22319eb1da3bee44f884b141626fd15ee
SSDEEP 6144:qlTtQOBz4r2NOiqjqWjwNU8aldMn2tJIJHyMqPMHV33sybk9RsIrdy5ZHshybVhZ:mTESOiqfwOve3SMqPeVsKxqYPshy58S
TLSH
T1DEA4CFF2B74D8301908B197EFD964594D378A07FADA971000B1642DDFAF760A72FA683
MD5 SHA1 SHA512 SSDEEP TLSH

Alumins/Plying72/Repolarizing.udr

SHA256 735b6c229930767a14914143fb2a5e73ec331d8476964c9b91110ee568a72afb
MD5 b72e582150624d9084c3f2711db1144e
SHA1 151f639065e328bb2a8caa5f3bf328f355327663
SHA512 00c225a4b2079c0233dc2229e296d81253f51b7ce666ff4c87123a1eb4bc41ac3a0426a9c2860936060683aaca2d4446e481320372b1b3caa0a7bfaf50bacb74
SSDEEP 48:60EAD5JwBeMjZUw478+bN+rXTHqvVfFcIC:60E45JnOK7wrDHqJC
TLSH
T1FDD206A98A7810E70A3343E2859862402DAA8CCDC0F9B17134C3CF81B131F566DFEA41
MD5 SHA1 SHA512 SSDEEP TLSH

Alumins/Plying72/Solymaean

SHA256 f9e4d9ac675df8625d182b21cf9f9d714a278f171f26937948452c2a52fb7153
MD5 6b355c4f50418b4706bc7a54f840e97d
SHA1 1649209053982665811786f6753937ae19b8ba10
SHA512 668168a75ba14f8defe2899068327ee9938a4c520e3fef1412f3cfa0758c7ef01eefb8f5394867fc0de23767caa89ec55d6300cb9a577f0c369a9900a7a689b6
SSDEEP 384:0aEFEEEEjTTKK22GBLZCREx/2AgQJ8sCvQ2x:0aEFEEEEjTTKK9GBtCREx/2VQJ8rvQ2x
TLSH
T18D823E5075C98AE4F60A5984EA78FF7211333963AFCA1CD22324F6405FBE9513A4D91F
MD5 SHA1 SHA512 SSDEEP TLSH

Alumins/Plying72/issers.mau

SHA256 f6fca0db373c500aef717fee5324e1a541ac557ef4eb861fce6a9a089445f7cd
MD5 53e3399d11ad386ca020ef816a5f5db5
SHA1 a99f14164aecc748aa9db481fb248741ca024717
SHA512 5f7df9c02a01008d2581fcf8a55edf7babe54f211839e61c7551165f7b1577013c4f7f8892179f2853a1287e1183143516b00e6fd6ad0b9fb32827b68ab6e3c4
SSDEEP 96:szgGUh5BDWGCBef/gsgikun9Yry5ln5nKBae55jn0MGK/1lZ:iIceFgibnlZYae55n0MGEZ
TLSH
T125239EBEE18BDBE8C128293F4497E8C65E7C27A08580428C5DF502F3C361672E3D594D
MD5 SHA1 SHA512 SSDEEP TLSH

Alumins/Plying72/klverbladets.ste

SHA256 356be165de128a2a2eb68a7b0522ff5ff330c0c244e0c73c676c037cf7ab4ceb
MD5 9a597cc0ec612b54d9678228b7408f94
SHA1 570d06814d04a9fee673fb02320b22ca37e5bbe8
SHA512 b27f1f3410dcdbe2b2a80fb0e367eda21221cb39ec05e319faf945288cec350c63292b256bddd3e382d43818e35748d0db7c48f351ad3313279efe2435c78fa1
SSDEEP 96:O2I1WydkbH1ToHyowGAls22AMm+Ukt8aY06gwr4NyqjYX72qGaSNWLVB1Tv:ztWHyKyV7MmYHS20wWnZ
TLSH
T1B4639F8F1114D2D8F96A6B0ABF2A0DC879079E50E4B85A711DB0BB803FBDA5141DA9D4
MD5 SHA1 SHA512 SSDEEP TLSH

Alumins/Plying72/leucochalcite.bur

SHA256 cfec0c35cf34efa4a9c26b7e87020f19359c07b1a4290c7db39147016201cdbc
MD5 7c7ec161b78c826f762f23f0946ae20c
SHA1 5e5395dcf51dca2ef0b2f7d33295bc1cf661a39b
SHA512 d23eb1e4c2e3712c29b14fb30569ed4afa6958a945a92efe32b6a17dc17fd32745d48f5b30682b49a41cb19cc54ab599939419c3251b1fa190c9561faad88748
SSDEEP 192:x6368VmP7YmJx6bY2xQ2z+6rRnBnUFx6JwDzan+BzQe+q:x63WzYhk28Ss
TLSH
T1E993ADDF88F68B0A6DBA03BD2DCA1404D934CD22F7D8BDC60999A84EC7796125190512
MD5 SHA1 SHA512 SSDEEP TLSH

word.exe

PE Signature issue

advapi32

comctl32

gdi32

kernel32

ole32

shell32

user32

generic

$PLUGINSDIR/System.dll

kernel32

msvcrt

ole32

user32

generic

Alumins/Noseless

Alumins/Plying72/Repolarizing.udr

Alumins/Plying72/Solymaean

Alumins/Plying72/issers.mau

Alumins/Plying72/klverbladets.ste

Alumins/Plying72/leucochalcite.bur

Sharing

General

Malware Config

Signatures

File Explorer

word.exe

PE Signature issue

advapi32

comctl32

gdi32

kernel32

ole32

shell32

user32

generic

$PLUGINSDIR/System.dll

kernel32

msvcrt

ole32

user32

generic

Alumins/Noseless

Alumins/Plying72/Repolarizing.udr

Alumins/Plying72/Solymaean

Alumins/Plying72/issers.mau

Alumins/Plying72/klverbladets.ste

Alumins/Plying72/leucochalcite.bur