fa47f8ed6df07f9af55e237559196b7808d5f1babaf3b86201f7ba1eae674b66[.]exe

resource
unpack001/$PLUGINSDIR/System.dll

resource
fa47f8ed6df07f9af55e237559196b7808d5f1babaf3b86201f7ba1eae674b66.exe

fa47f8ed6df07f9af55e237559196b7808d5f1babaf3b86201f7ba1eae674b66.exe

IMPHASH f4639a0b3116c2cfc71144b88a929cfd
SHA256 fa47f8ed6df07f9af55e237559196b7808d5f1babaf3b86201f7ba1eae674b66
MD5 31662b7222b0bbc254dd2d7e2f1a8195
SHA1 b5ea4e2bf70e61839cf5cce6201d972ebe4cebd2
SHA512 8339c23eb2396d1ab4714c6ebf5f3af3e2c99105b3d6567a4d9975c6f239016c7784f6e3987fcb8f750b2c9b57e8e4d2fadba9bab0199e6dd0e2c9b15d3b8b8e
SSDEEP 6144:kfY+onfHhDRt/tGcFoPf6lnwbj0aukGyr7v+QqqnACmNz1PEQR8dqwiw:kfYbHh1RToPfqwboaZj7/LmNqh
TLSH
T12B842302F290C616D4666736083817BB1B5E3FDE50996B9F47C49D2EBEA1243E80FF94
MD5 SHA1 SHA512 SSDEEP TLSH

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

ee:dd:30:ab:8a:36:f8:ad:af:e4:e7:99:38:25:83:1f:55:f8:c6:34:0b:6b:7d:4f:7b:c8:37:c0:25:4a:33:23:0a:15:70:2f:a6:a4:39:b3:58:7c:1f:bb:3d:07:1d:71

Digest Algorithm

sha384

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Fortringernes,OU=Impudencies dialektologi marmorize\ ,O=Fortringernes,C=FR,1.2.840.113549.1.9.1=#0c13526f6164776f726b40547561746172612e5461

Chains

Apr 20, 2026

CN=Fortringernes,OU=Impudencies dialektologi marmorize\ ,O=Fortringernes,C=FR,1.2.840.113549.1.9.1=#0c13526f6164776f726b40547561746172612e5461

Subject

CN=Fortringernes,OU=Impudencies dialektologi marmorize\ ,O=Fortringernes,C=FR,1.2.840.113549.1.9.1=#0c13526f6164776f726b40547561746172612e5461

Serial Number

37:62:dd:f4:65:d9:c3:36:5b:59:5f:32:53:0a:21:1d:7a:1e:c2:3d

Issuer

CN=Fortringernes,OU=Impudencies dialektologi marmorize\ ,O=Fortringernes,C=FR,1.2.840.113549.1.9.1=#0c13526f6164776f726b40547561746172612e5461

Revocation Status

Not revoked

Timespan

Mar 30, 2026 - Mar 30, 2027

Subject

CN=DigiCert SHA384 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0c:20:43:49:f9:d0:f7:59:fb:98:2d:e4:08:1b:88:7b

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

13650

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegOpenKeyExW RegCreateKeyExW

shell32

SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW ShellExecuteExW

ole32

CoCreateInstance OleUninitialize OleInitialize IIDFromString CoTaskMemFree

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create

user32

MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW CreatePopupMenu AppendMenuW TrackPopupMenu OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW IsWindowEnabled SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CharPrevW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint CharNextA wsprintfA DispatchMessageW CreateWindowExW PeekMessageW GetSystemMetrics

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor

kernel32

lstrcmpiA CreateFileW GetTempFileNameW RemoveDirectoryW CreateProcessW CreateDirectoryW GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW WriteFile CopyFileW ExitProcess GetCurrentProcess GetModuleFileNameW GetFileSize GetTickCount Sleep SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW MulDiv lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject SetEnvironmentVariableW

$PLUGINSDIR/System.dll

IMPHASH 509a34b3a68a773e0afb4259e68f9f82
SHA256 23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6
MD5 192639861e3dc2dc5c08bb8f8c7260d5
SHA1 58d30e460609e22fa0098bc27d928b689ef9af78
SHA512 6e573d8b2ef6ed719e271fd0b2fd9cd451f61fc9a9459330108d6d7a65a0f64016303318cad787aa1d5334ba670d8f1c7c13074e1be550b4a316963ecc465cdc
SSDEEP 192:ljHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZqE0QPi:R/Qlt7wiij/lMRv/9V4bfr
TLSH
T1B1427C1297B089F2F551493419667F2A6FBEAC5C13F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Isopolitical

SHA256 dc064a0a749bd6d28f50329f707c8893c330122ed58b9b9879984fa6f4a77de1
MD5 db8d57946f47dfa9c19113253f0469d3
SHA1 6526040b3640aad749d91899482f9d6094692f26
SHA512 271f25061dab5debad264cf73d47c01571b307297862f80287e11b2c9979e4a9885f603723f205c511a14344d6ccacb6637beda76fde0260aad8e630d847aaa2
SSDEEP 384:58iR7wCkKjTdkxYK/afdDn5C4Xkk5Ew7O3WbzI9E3gpAvLoVBP88yARo3aOftyJm:5Z8+SWpHUkH7O3WPjonElAmqOVy6y2
TLSH
T1D8B29F41CB56CCBDC516A338C0AB813F5A25B111AF5F755E11A8F89082676E7A3342BE
MD5 SHA1 SHA512 SSDEEP TLSH

Richardiii/blaaskimlen.vol

SHA256 77b86d83d1b9d1e99f8a97c4fefd746e1c188809756392a82510e02456751db2
MD5 138d44ed321a86c0e4fa70521424596d
SHA1 732588cbeaabcb533b9301f0423d36e24c3dbb1f
SHA512 0715ab417959357a3ccb302334b5db2f5574b00c3504ed12861bf79cfc680b010f7b9d56ee1ee1c5e39d52674f3db6613e7f58993f8b5082c0750ade07d094f3
SSDEEP 3:/7rrrrrrrrru7rrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrw:urq2OaEWG8ZiXyrqXse+XI/n4a
TLSH
T125812B3D8207AC48E3FFC415BE2093C83831DCDC490E1104F4AD60138E712F1889212C
MD5 SHA1 SHA512 SSDEEP TLSH

Richardiii/transformatorernes.aro

SHA256 3201572919bf511cfc0ccbbd7845ba4e8ba9b98f8168c571a07c96b18f4ff258
MD5 ce8ec55cc60b6db3f4084e703bd4b2e4
SHA1 43c9a7299818d72fb73e46eb600d017e142804f4
SHA512 2bc2a590ecea6250e6c0739ece882f330ad5450d2b0495b68e1f3442a0b544821516b6fd36517dda8b95a262fdd4dd6825e813495089feb6774f8cd8a290129d
SSDEEP 192:IgYA5JupahmQ5MjH+yGYkkXVVIjZ2aYON:fV5JupahmQ5550CghU
TLSH
T11B732B912D6D2D92FB03DF5DF791C263933E6FE0460B6887BBA24006D2559B6E043160
MD5 SHA1 SHA512 SSDEEP TLSH

Soberness.dry

SHA256 e44b5d9b9d176d5bf08e9996b0d751f90d0e6912d33f00c189012649b4b45dcd
MD5 983d46804cc435ab8472a8d77da78ed6
SHA1 11359a544e3c794f1f4f6eb9843200a45310ba04
SHA512 8ec28d2741d8ddfa5f13935e43ed77190b79ce549a92b2c15d520c051e0f001b0fae917d250460ccf9d767bf0e77402b2def20d5b9325eabe1444131c9e2fce4
SSDEEP 48:P5JvLbUoHQnWWlektBsK2/E7kVXxev3Da9kYCFa1Px0w8M+wZ:P5JTbUFnWjktBs33xev3mPjx/
TLSH
T1E6634C1540C9355169112A2C1226EF64BE77E5F7869E4C83DF7D9B37E8AC7A3833130A
MD5 SHA1 SHA512 SSDEEP TLSH

Tronfoelgen

SHA256 9a5c86d453d43e8784ab1346275842e55808db2c411abe6541de48ba15b68b23
MD5 c54046f5084c1a63d45df16ef2d6e005
SHA1 1ff6829bc2ab7d70ad7eef6b0cdda8e0e6002838
SHA512 50c94ec656be42458f894314f7c3386a794b8e46971fa559efc6af90abe4cb6eb151229e8ca25a83aedef6a478df88977fff41f8e7fddd3c87e3e33f7013fab7
SSDEEP 6144:apWFfU9ZD8M7gR5KLnp/KN+Pz31s3DrKV5r8AR434sVyPj66CoBUTpqALa7:b44R5snpKWC3DrMWAj6z4UTcL7
TLSH
T1FB84018FAA32162AE6748BF72F8D5C981172E135177C758C3AF28C8CD3597E708C495A
MD5 SHA1 SHA512 SSDEEP TLSH

fa47f8ed6df07f9af55e237559196b7808d5f1babaf3b86201f7ba1eae674b66.exe

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Isopolitical

Richardiii/blaaskimlen.vol

Richardiii/transformatorernes.aro

Soberness.dry

Tronfoelgen

Sharing

General

Malware Config

Signatures

File Explorer

fa47f8ed6df07f9af55e237559196b7808d5f1babaf3b86201f7ba1eae674b66.exe

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Isopolitical

Richardiii/blaaskimlen.vol

Richardiii/transformatorernes.aro

Soberness.dry

Tronfoelgen