e051040d946596352938a6f7bb789dc2aba4953d31c803fe66e1616986545807[.]exe

resource
unpack001/$PLUGINSDIR/System.dll

resource
e051040d946596352938a6f7bb789dc2aba4953d31c803fe66e1616986545807.exe

e051040d946596352938a6f7bb789dc2aba4953d31c803fe66e1616986545807.exe

IMPHASH 46ce5c12b293febbeb513b196aa7f843
SHA256 e051040d946596352938a6f7bb789dc2aba4953d31c803fe66e1616986545807
MD5 a6595f6624d0c36864d2c2459b5993cb
SHA1 d12e406c4a3b3258124d79f60b84e2bd1d3ecdda
SHA512 6c3d04560bec39cb326ac30820d47b4e026d2a95668e3eb9b7c9c88575a3c8636b60def867231eddee56e95d0d502c044bc457afd6f4eab600cb40b22c1c472a
SSDEEP 3072:IlnffjVrwUak7uVPaEEIdNBuHA7RRr/Kb7uHL3thNqxufn58gCGX:IlnhrwtVPZEiXUA77rgwhNqxi5Z/X
TLSH
T1F704E151BAA0C977D9E10A310E3546FAD6E7AD54119083072F803FAB7D376B2990F7A3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

12:bd:8f:c2:4e:09:01:5b:fe:6a:2a:cb:55:b8:2c:b5:4e:ee:c1:fd:25:80:4c:2c:78:3f:49:38:70:f7:7e:a5

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Philosophize,OU=Fastball Patinated\ ,O=Philosophize,C=US,1.2.840.113549.1.9.1=#0c1866657564616c697a696e6740466f7265627261696e2e4269

Chains

Jul 31, 2026

CN=Philosophize,OU=Fastball Patinated\ ,O=Philosophize,C=US,1.2.840.113549.1.9.1=#0c1866657564616c697a696e6740466f7265627261696e2e4269

Minor OS version

0

Major OS version

4

Entry point

13983

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegOpenKeyExW RegCreateKeyExW

shell32

SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW ShellExecuteExW

ole32

CoCreateInstance OleUninitialize OleInitialize IIDFromString CoTaskMemFree

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create

user32

MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW CreatePopupMenu AppendMenuW TrackPopupMenu OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW IsWindowEnabled SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CharPrevW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint CharNextA wsprintfA DispatchMessageW CreateWindowExW PeekMessageW GetSystemMetrics

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor

kernel32

RemoveDirectoryW lstrcmpiA GetTempFileNameW CreateProcessW CreateDirectoryW CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW CopyFileW WriteFile GetCurrentProcess GetModuleFileNameW GetLastError GetFileSize CreateFileW GetTickCount Sleep SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW MulDiv lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject ExitProcess

$PLUGINSDIR/System.dll

IMPHASH 509a34b3a68a773e0afb4259e68f9f82
SHA256 996645d7f16a6294babb6da83478062aed7b72318d7a51b66e90ab5d3edc51a5
MD5 6d08f0d5503bb100b8429fefaad163a6
SHA1 2a79aac2d3b715326c3dcd3c5cf2e33de3632a0a
SHA512 e259b1aff39c533e3e31cf4eb323c8eb22b2beeb5d8ce2c929de30702a6d8ab8076aeacc983d724b05d7d99a6de8c4d239bd159642c7e75fb86faef683360a1f
SSDEEP 192:cjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZr0QPi:s/Qlt7wiij/lMRv/9V4brr
TLSH
T1A9427C1297B089F2F151093819667F2A6FBEAC5C23F405A3CFE304C63D212CB9879243
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Kanvassen

SHA256 6da19eed67e3f67882dd7bcfe38e05c898c6c0b0b21dd92816875b8f861501f1
MD5 67e2de0596e12e9d8a622dc25d282bc6
SHA1 11429c36cba1b48476030a3ab22059033ef8ec62
SHA512 3ca00f7d6b731f865ecc3c949cd5441a408f656e74d2dfbb177241364cfc645e9f12f4a2a75ab5fe9c85aef9f43f775210caf09f12fbf2edf433d80e51e08c7d
SSDEEP 3072:ddOqz27ni2zAY5KBeMh4LJsMfKk4FlVcwv9:ddOqz27npELbLMjMTcc
TLSH
T1F4D3E102958D4C29FC66A738F438D1A7C71FA74AD64F80E13E5DA92B82DB1CEC15C396
MD5 SHA1 SHA512 SSDEEP TLSH

Ninepennies/Datakommunikation253/coequalness.bil

SHA256 280d229745e9bc3a80d1c5d6ea86167fb3f78ce37ed9f0b5ad26165a85ebfe8e
MD5 957ce108769622e6a825051e6f391aa5
SHA1 416b8bc6e078461ad14b793336393aa4862c8dae
SHA512 edcdd5f3f285d7a5c6a50aec5f0c009f7ac37e2901abd1a0040ec192b13013321b3a2c28a1ef27b700af5f29670dc9c17df5d310d27a863cb623974c5e0a1949
SSDEEP 6:y1hYHj2jRnlhRYtj9hhm2YhBThrmXPLQhSbthhykhJ:wqj2XRYtj9jm2YRr826hvJ
TLSH
T1ABC180545054B47A7048FB80FD0AE66549417B46258750E118DF3C3CF572571CE4C866
MD5 SHA1 SHA512 SSDEEP TLSH

Ninepennies/Datakommunikation253/dataskrm.bio

SHA256 a0332d36644105e5a2e4e6054a42e4cca324cfa234633c4b869522be35a7c5d0
MD5 c33bc833c9f863156f71c42035ce7bd9
SHA1 fbbc4a01e28e10a8df27917b29492a098161bd8d
SHA512 5ce3c62dafcd0febd333d2e4ebcc3ad80d54883571be1613c5f2a1b02a5eb6f33ce7acdc83588a31d685321526d95256f0315f60a426e4181516274b694dc334
SSDEEP 6:JUIPUINrYGNEINNBYJUYNNsvScIU3hNiGNIrIBrUD/:J3lrYGjvwxi6BU3XiGuruQ
TLSH
T109B11206B43F1A35694DB7C4915C1CB3304569ED1C9461454543490A0CA99A4DCF2528
MD5 SHA1 SHA512 SSDEEP TLSH

Ninepennies/Scapegoating.bar

SHA256 affa537fd0755036e9669c739d694c99ee1d072434dd2c495247869018bc7b90
MD5 2073eb8b0074c7d281e520318ea34a95
SHA1 edcd02d486a88e14c814ed4b6f5d0a1a369813ac
SHA512 bcf977f84121d2072cd36a1352ddae8d2aef635174fe25faaff223ba0eb1b1cec4ec12a616ef66339dd253ac80aeb6dc1670d71dc2c591f9d0f34b21ea078b00
SSDEEP 12:QfTrRhuysTuRbuIxmbQMniQvuBulfu2DTQ:QfJhgTtJQXBonQ
TLSH
T17102E75048839CBD8AFB45C5352DE64D10D55DB2B28E43F3375553DD01355CA3D51CD5
MD5 SHA1 SHA512 SSDEEP TLSH

Ninepennies/Zygantrum

SHA256 ad638934fbe447c87c17ca175b1361c1ed20f9d43af3e1f1ebfb99d370cae77f
MD5 703d29a056ac45bff2004b753bbd8ece
SHA1 420fec5a354ee788ae96864ce507ddd83b4fcef9
SHA512 50c30b52c17d397124bdd7a0e8f3d3e9009e7a99c3db839e5f1c71520e283712a3ef21b3b7b565beda27e629fab05970f44f889845bc0dea0883bc2bc96afbe4
SSDEEP 768:uvqouv+NmGVPYi3auUwdAAm5+vKwER1fgiAz3rVa:uiNexuOQwdegiNAz3rVa
TLSH
T15AF29FC9F769CDBBDE0BC938C96A20A14C0CD0154F0FD55E916DB956C28E2E733146A7
MD5 SHA1 SHA512 SSDEEP TLSH

Rebuilds/detoneringers.syg

SHA256 90b4964e775b1179ee11b90c9c3063f8ef13109ba893ea1a899d602d2519986f
MD5 2d0d6e61a05ae394e6889618ccde2453
SHA1 b9d96c38eee73ff27b351198cdf3ea76e2c5e359
SHA512 e224d414f5142e6412e86c5454440087a3ed381543928f313c4c6f60105f4bab533e1bec6ae9263a07685eaf6a7a0706a1c98bf6c43c22996788c481c4399830
SSDEEP 24:m0zqMX8slz6fr7QiZOHt9pQ9ncltAHsGqE2PXyUH195T:m0OMX7l+Dci0FQVcTMsnz195
TLSH
T18B13B777521ED0DD40439D19FD2093984233903D8DAC1E74E30C59A42BB1BF189193B0
MD5 SHA1 SHA512 SSDEEP TLSH

Rebuilds/formspndt.unt

SHA256 3ee6c1e6f5adcceaa37bcd45821a28ce7c86d385dc5abda8009045b3afe2aba1
MD5 e105c55777e3debd9a4047345f593b27
SHA1 ce6170011f9e46a276e7853775f69563e631f254
SHA512 bc41fa1f18b6465dbf0bbde4fa2c6792811a90eb1d39f4fe75bbad4843e41561958ca6de0a732029def3d1b7d95bb103ed2631ffdc92498662daa57a1879137d
SSDEEP 24:VhBlJUK32G0p0BbdzkIFBpkfIwYvuwSjOln0aEjAXjKKftyXC7eiAAFwfo7:+9GbN53nkfMMOhvjriqAAiY
TLSH
T19713C80989673417A1B9781230F4C551C7A049EA29A480E89DB6CFB46BE526B0183C0F
MD5 SHA1 SHA512 SSDEEP TLSH

Rebuilds/grinagtigt.his

SHA256 625521af0b4e478931a211001330911c077bc002ad4392e73edbb5ee80f769dc
MD5 4b161ae288c22dd38d22b79442b19802
SHA1 774633d0eebebe35db32f4adcb0f521a2908d56e
SHA512 b6ffe83ef6f9ae39bec9b247265ae55f8d3ea15fbcabfdfb18cbf49473e44b93c17fd79a58a7f666c8c46a8499ebab1ffac1288bce7be3a82b7cdb7c63e2d232
SSDEEP 24:CC3vTeo3m09qxC78W1qu1fcgVJy1lUCA+pRf+A64woaHdx:Cav6yve24gvglUQa9/o4H
TLSH
T1E423E7A28CDFBA26190E4A99706034505BC9134394A37C51B12795A5BA20D709212827
MD5 SHA1 SHA512 SSDEEP TLSH

Rebuilds/ndsituationer.hrg

SHA256 304ff482da5b05c502a65457eca87b6ff9fa4b0ddc585ecc2a81a728593281bd
MD5 af6234943b3c21772c1d1c63cde300aa
SHA1 68cc7b49f4755b6cbee1fd9789ad712976ac6716
SHA512 e9e20afdced3de970e81890d805f59fa2a73c17003bec3aeebb0ce86f71fb1d4cca2eb6730cc28a92d2d0d7fdf41522620b9efe9ff66b485adada1a989448b4d
SSDEEP 48:4PD4edPTj4Q+ByLK2SDqVOBrtm8GYdElgvL+pC664FwBt8L9/v:47TjYyjI5mVYdugvLaCGSs
TLSH
T13C43D6B0C4920432832C1E0C9B62B4A99E2A9F2CAF58510903C628933AF7778117CF9A
MD5 SHA1 SHA512 SSDEEP TLSH

Rebuilds/preparatively.ove

SHA256 5964d660fc8745c75e8b9515d851e4dfa083f03f51f395b55b70b92bae900ee2
MD5 4392b696c0325efd139f67469ac35a6b
SHA1 bb73818658eec593244220859f7732f2dd990049
SHA512 9ebf2a18ac99e7f41a2206438e79bdba83074356b0cb9b46b73b072c83811ec9ea47ac3731c2596fe835e5831b179d3cce77e0e01cb0ebf5557ec22b994f0649
SSDEEP 24:z5dqvMilZntDNSOWt+3cV3nOFtO7JEPCKN1N0IhONe:MjBMPk4O/sqN1ZhKe
TLSH
T177C2C53CBA488A604B365A7E8E133C67602283F54BB2018DCCD3D107803ABBF3325639
MD5 SHA1 SHA512 SSDEEP TLSH

Rebuilds/swarmers.inh

SHA256 76d443cfbc0718d351a7bcd387c847ba7a0ea0e4cd3fe7a53c238a22421efcc6
MD5 4327e693d74e63e8e1365bfb36245603
SHA1 fa199e97468977168489f2abc69883bd91abcec4
SHA512 133500922f579dd6eafdb46207d76282fb08821acf5e8ca85c61e7aaa88131fce683b2beb0bc21178ab626168fefa7c0fb6ceda90791086513df1ac924199500
TLSH
T161411212B464500372481219048D100B4B90444C05690C2C010851430615B00A332114
MD5 SHA1 SHA512 TLSH

Saddeltagets226.typ

SHA256 d44279553e2df9b0e77ddeb77f51988031fd34658c6ca9f3b0286f5390b2f082
MD5 39052f11f8f3525e111438293abbe650
SHA1 073c9ba7c4006cef5fdbafb0e142fe4d97b29780
SHA512 d83e3c5c988b7818ef39494d1b6930b6a1f93219403c59b4620b6b63dcb6344840c5cf31d64ef8e76020aa2dc729c61fe80850f8170220114ca3b52e976d8af7
SSDEEP 48:KfAumkcwXRqsNxrCOi2f16HoLEHGFhufxweyT4Y:KfK09x1JdmyT4Y
TLSH
T10433A7AD5CBE95B85378576E4A6A1C49322C0411DE4EA9881824B8E7500682BB503AB3
MD5 SHA1 SHA512 SSDEEP TLSH

e051040d946596352938a6f7bb789dc2aba4953d31c803fe66e1616986545807.exe

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Kanvassen

Ninepennies/Datakommunikation253/coequalness.bil

Ninepennies/Datakommunikation253/dataskrm.bio

Ninepennies/Scapegoating.bar

Ninepennies/Zygantrum

Rebuilds/detoneringers.syg

Rebuilds/formspndt.unt

Rebuilds/grinagtigt.his

Rebuilds/ndsituationer.hrg

Rebuilds/preparatively.ove

Rebuilds/swarmers.inh

Saddeltagets226.typ

Sharing

General

Malware Config

Signatures

File Explorer

e051040d946596352938a6f7bb789dc2aba4953d31c803fe66e1616986545807.exe

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Kanvassen

Ninepennies/Datakommunikation253/coequalness.bil

Ninepennies/Datakommunikation253/dataskrm.bio

Ninepennies/Scapegoating.bar

Ninepennies/Zygantrum

Rebuilds/detoneringers.syg

Rebuilds/formspndt.unt

Rebuilds/grinagtigt.his

Rebuilds/ndsituationer.hrg

Rebuilds/preparatively.ove

Rebuilds/swarmers.inh

Saddeltagets226.typ