38f4ce7689e3aa05b30b6fa590f0de48ffb4fba1bfc47df3f5765d62c62422bb[.]exe

resource
unpack001/$PLUGINSDIR/System.dll

resource
38f4ce7689e3aa05b30b6fa590f0de48ffb4fba1bfc47df3f5765d62c62422bb.exe

38f4ce7689e3aa05b30b6fa590f0de48ffb4fba1bfc47df3f5765d62c62422bb.exe

IMPHASH 46ce5c12b293febbeb513b196aa7f843
SHA256 38f4ce7689e3aa05b30b6fa590f0de48ffb4fba1bfc47df3f5765d62c62422bb
MD5 aa2fd01ae69486d53264869144d0bebf
SHA1 b4aebe235a7955575916e3045fd5d1f9c24e1dda
SHA512 abd540345296620c18c32b32268cb54da3cdc025dfca123bb4671c798aa79844636e0fb34a01d968c712364cca38fad6d3c64eaa6d1f9d6acd82a3d60ae95c2e
SSDEEP 12288:NX4puwfzUnMxLdaimcqUgsp/yVFDmbNTZJ0cQC1fH2MeZWXTYdSQJw/13OK2fKKy:V4puNQucYiyVFa0cuZWDYEgmVAsj
TLSH
T11815332A5374139BF51905306ED5AFFC6DE12C25858C839F4346FAC96E627A24C3B83E
MD5 SHA1 SHA512 SSDEEP TLSH

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

20:50:d9:b5:85:63:8c:ea:2f:ae:5e:ac:88:d7:dd:cd:a5:eb:de:0b:4b:42:7d:d4:db:7e:01:35:aa:18:b2:63:88:f4:25:0d:fd:cb:a3:16:67:e9:b4:93:79:c0:d1:85

Digest Algorithm

sha384

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Smeltende,OU=Attachpcens Efterretningsvsener Palatinian\ ,O=Smeltende,L=Eston,ST=England,C=GB

Chains

Jul 31, 2026

CN=Smeltende,OU=Attachpcens Efterretningsvsener Palatinian\ ,O=Smeltende,L=Eston,ST=England,C=GB

PE Signature issue

Digest

2b:d2:1b:1c:6f:86:ee:04:61:f4:5f:11:51:13:05:ca:03:4d:ec:a0:ab:10:a6:cb:01:51:90:09:bd:86:3f:17

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Smeltende,OU=Attachpcens Efterretningsvsener Palatinian\ ,O=Smeltende,L=Eston,ST=England,C=GB

Chains

Jul 31, 2026

CN=Smeltende,OU=Attachpcens Efterretningsvsener Palatinian\ ,O=Smeltende,L=Eston,ST=England,C=GB

Minor OS version

0

Major OS version

4

Entry point

13983

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegOpenKeyExW RegCreateKeyExW

shell32

SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW ShellExecuteExW

ole32

CoCreateInstance OleUninitialize OleInitialize IIDFromString CoTaskMemFree

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create

user32

MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW CreatePopupMenu AppendMenuW TrackPopupMenu OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW IsWindowEnabled SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CharPrevW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint CharNextA wsprintfA DispatchMessageW CreateWindowExW PeekMessageW GetSystemMetrics

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor

kernel32

RemoveDirectoryW lstrcmpiA GetTempFileNameW CreateProcessW CreateDirectoryW CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW CopyFileW WriteFile GetCurrentProcess GetModuleFileNameW GetLastError GetFileSize CreateFileW GetTickCount Sleep SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW MulDiv lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject ExitProcess

$PLUGINSDIR/System.dll

IMPHASH 509a34b3a68a773e0afb4259e68f9f82
SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
TLSH
T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Dona.Rej

SHA256 d30824030889f08479c86482247b144edace2919f7a2a5fdae0dc53a77a095af
MD5 fa79bb9e2b14555d3282f8617dbf27e5
SHA1 9b0e06e25776fd3bc40c8c1ea0afa6da58f1958b
SHA512 7d784a94ae5367cf9513ea70501241900eac6480d4b2aa0586c59c9a06e4d16e7830198a7a5b21cec49032ee6105df6058d07ed10d479704c1d786fa9df4ddd2
SSDEEP 768:GQkO+0Lgzr89DbSLRtdyop1B5OzTf7iO3okwIf2gGnBheH/RP3XDMv/X5cpTVxmm:X+XQMtpYn7iewI2NEJfUCmfYcsf
TLSH
T13883BF65DB568CBBEC12C438D46E71E94C983017970FD0BDB1B66428C2972E36724AEF
MD5 SHA1 SHA512 SSDEEP TLSH

Frembragtes/udaandingslufts.sti

SHA256 2eda8fa22727e15669913d266a116a5db21cc611a4a44753bddc25f9d2b782dc
MD5 654647111369b5c3b29250fe47692db5
SHA1 4b76a236d90084a52e7abcc58093ecbb3b1f5961
SHA512 69869824edd3e5b31ff2b14f210469b7548477d3779f7a033775980eed4e114dd98ed6f68f9e0d1d7a060ffd0dda0418a4c974a667d675436db4566b43902d92
SSDEEP 24576:m/C783Ko5FnKh3dANXHhrbz/wMndHH35wF/8EoDFAo6Cy0WAjqZY7PXHlHvt91Na:n
TLSH
T191661297FE75D00A86E44BC6AEB00CAB8323452BD11D827229F7D1F8F284A5F995C95C
MD5 SHA1 SHA512 SSDEEP TLSH

Fructokinase.Eng88

SHA256 66f3a1bc5336cd57f61961c2c8ea700b2504f3fb5abe6e49b766b91d6e8efa53
MD5 e595544fd442b008194a2af83ce8449b
SHA1 95323929d0ff2414d27496f9bd509f99e10adbe1
SHA512 772ba7af8852a1579bbb9a950bafb1549bfcda47706831d4501915b5502184ae5224bda51128f50c08ea36c9500f7820f085a8b065f022c815da85d0d5b2ccd5
SSDEEP 12288:ZB/tk+5F9MBZZR1BJHCV4QMyw3ARCSYblekkpCSL4Dj1J:z/t/F9GnfBdfYYbLk8J
TLSH
T11BC4F1D76138E36C2FBF1626EFA47A940642FEC897AB3B498D50F3715834253AA05F11
MD5 SHA1 SHA512 SSDEEP TLSH

davidsstjernerne.jpg

SHA256 c2e8ad026128450f60a76524d0afde87143319f6f033465db858fb10d121f05a
MD5 6a00e8c68d4615f0e00b2e0eb49d8e15
SHA1 9c506d304ce09bb5f7c4e7c2bd9e905a10240135
SHA512 9b2574d5dc462168996460a4e4f33e34eac69e9c0886c36cac1ff57087804541cde2b6276cce95db33cb6b4956ffc52f6b91914ded8b4215fdf4f11abb835588
SSDEEP 3072:w0nB3nMD95L7hLjTZqZ5VgGb22026QjXyiJEeKa1o6+69PvYkf3:HB3MhvOfbxDLyO2ax9PAkf
TLSH
T1C9C31282EFAFBC6842EDBAF863E950F3EBF49DC44182952552085F66DA67D210104F4E
MD5 SHA1 SHA512 SSDEEP TLSH

durbar.res

SHA256 06a14381e4a395db61abc0955d6199bb1e9085e84106d90c542a9e25d31abcee
MD5 db8c0ae3b2c7cb82d02aaa8b3c985b0a
SHA1 f15ba45781797195ffbddbb9b0676e9cc4c60fe4
SHA512 2eff9c5bd20b33e6141403efa8911533071753fdef541fbfeae22ff5c94b8c0d46e0259d2b945b899f77881a69afa94ca38ab6803e453d5edea62fb7bd82353e
SSDEEP 1536:C9H0NGAXloSEuBEgW046sB+alFW5gSztBqjXv:D8
TLSH
T14D45F11A760FB283564CCDE22FEA4C799E77AE195415FAD658CC57F638B2013223C209
MD5 SHA1 SHA512 SSDEEP TLSH

invadmzr.txt

SHA256 af2862e8ee8c32f28847a83c3f9402b92cfe6b0a56ba2cab6205e4d702a9e54c
MD5 372cb262550f89702e6a2db8893f4b4e
SHA1 7dd30849a40e79642de85a1af8ade37834ce0120
SHA512 6848f736932c863e83ff532b2b709606e02c0d448053e5361e36dab0229c5149d9accab6661af4b8adbbac423bb3edbb2f50ce0df7cf54370cd45882ad5ff087
TLSH
T1CDD023C1FCD5E446460C070C799135CBCE8547DD10B2F99844508509580DC9CD13F29D
MD5 SHA1 SHA512 TLSH

38f4ce7689e3aa05b30b6fa590f0de48ffb4fba1bfc47df3f5765d62c62422bb.exe

PE Signature issue

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Dona.Rej

Frembragtes/udaandingslufts.sti

Fructokinase.Eng88

davidsstjernerne.jpg

durbar.res

invadmzr.txt

Sharing

General

Malware Config

Signatures

File Explorer

38f4ce7689e3aa05b30b6fa590f0de48ffb4fba1bfc47df3f5765d62c62422bb.exe

PE Signature issue

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Dona.Rej

Frembragtes/udaandingslufts.sti

Fructokinase.Eng88

davidsstjernerne.jpg

durbar.res

invadmzr.txt