2ed6e8ea4a6b[.]exe

resource
unpack001/$PLUGINSDIR/System.dll

resource
2ed6e8ea4a6b.exe

2ed6e8ea4a6b.exe

IMPHASH 573bb7b41bc641bd95c0f5eec13c233b
SHA256 4978e16a7f6b716c324810ec44d5a82eeecd80382e4d5ccb4dc031cdc2559d9f
MD5 69b6e5c1d977f5569c8077dba0366e39
SHA1 c35b6e97ae6a49caa74ed37546c4b9433623d8d8
SHA512 cdaee293fad65e9c0101f962d9341477fbbf71dcdb8b93e666f21e8a814fc432373f08487fe0aa9ae1572ae97e3aa6362f506f8139a6cf7c7742c35949453711
SSDEEP 6144:Owavo7y90GBib6uox6zp6aDjpEBvZThp4czFLtqQfXUEsw9UQjqfShTqYPC148H/:OwG0GTuKiDVqNfz235w3F1PL3RHjnP
TLSH
T1EDA42200B790D55ACD372A345DE64B7B22ABBEA03555A8071320FD5FBC239D5CD2E0B6
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

0d:cd:6e:6a:58:08:2a:75:56:7c:89:a4:aa:0e:ae:b9:07:9d:d5:f4:a0:20:ba:d4:13:10:f0:62:7e:e6:cd:30

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Sandblserens,OU=Samraads Euler\ ,O=Sandblserens,C=FR,1.2.840.113549.1.9.1=#0c17416b746965626f6f6d404372757374696572322e556e72

Chains

Aug 6, 2026

CN=Sandblserens,OU=Samraads Euler\ ,O=Sandblserens,C=FR,1.2.840.113549.1.9.1=#0c17416b746965626f6f6d404372757374696572322e556e72

Minor OS version

0

Major OS version

4

Entry point

13655

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegOpenKeyExW RegCreateKeyExW

shell32

SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW ShellExecuteExW

ole32

CoCreateInstance OleUninitialize OleInitialize IIDFromString CoTaskMemFree

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create

user32

MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW CreatePopupMenu AppendMenuW TrackPopupMenu OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW IsWindowEnabled SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CharPrevW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint CharNextA wsprintfA DispatchMessageW CreateWindowExW PeekMessageW GetSystemMetrics

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor

kernel32

lstrcmpiA CreateFileW GetTempFileNameW RemoveDirectoryW CreateProcessW CreateDirectoryW CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW WriteFile ExitProcess GetCurrentProcess GetModuleFileNameW GetLastError GetFileSize GetTickCount Sleep SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW MulDiv lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject CopyFileW

$PLUGINSDIR/System.dll

IMPHASH 509a34b3a68a773e0afb4259e68f9f82
SHA256 996645d7f16a6294babb6da83478062aed7b72318d7a51b66e90ab5d3edc51a5
MD5 6d08f0d5503bb100b8429fefaad163a6
SHA1 2a79aac2d3b715326c3dcd3c5cf2e33de3632a0a
SHA512 e259b1aff39c533e3e31cf4eb323c8eb22b2beeb5d8ce2c929de30702a6d8ab8076aeacc983d724b05d7d99a6de8c4d239bd159642c7e75fb86faef683360a1f
SSDEEP 192:cjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZr0QPi:s/Qlt7wiij/lMRv/9V4brr
TLSH
T1A9427C1297B089F2F151093819667F2A6FBEAC5C23F405A3CFE304C63D212CB9879243
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Afruster

SHA256 06862449d2781fcb88dc8f147cf947b8e1700a25ff535b35aa8871d7aa30c40f
MD5 03cfb895141518084ca1de8b5a376e1d
SHA1 2c7f0637faa83ab8956fc85828c62de6e089babb
SHA512 f1fe5b5d76c2b45a98955ad9f6affbed8955b973a4b3336144b6256809174fafe6b64f6b55a47113a506a541df32163275ffdcfe16ec8770ae3f3b270d997845
SSDEEP 384:r86IywvMC/hgFTtvOG89QUMPwvoiVkNEydhBsZNBVpGl:o6IycM55BskNzfwcl
TLSH
T1CFA28D96B7714CEEDB82DB38D45B16348D9CB016975FF06D9021A950C0EA2F267303FA
MD5 SHA1 SHA512 SSDEEP TLSH

Harborward251.ini

SHA256 04f172f7b922bb120422b36fb189bbeafa647d5f8e4c4b8273a3f008bda16bfc
MD5 3548088333f832e57525c9b16885644d
SHA1 7fefb16f16f22e771d4fbb5dfe02d00e91266c8b
SHA512 92d66523173fc74ff414b764474acd27721a236d47025063e1221b76a332c96817acd8b6b809a5735d696b989a65fe9d22b5669c283cbcd6b0f768cbf5d0a6fd
TLSH
T12AF0E17AC5D906CE59634552CA5095B64538C592DA01005E2730137B1282EEDD1BF6BE
MD5 SHA1 SHA512 TLSH

Jauking/Upwith.txt

SHA256 3a4b320dd2900cef05eaa9e5d8679182f4bbc6caf95947a01821f3518492984d
MD5 dc11210bcb5b7a3d98b5d311ce8bc0cc
SHA1 044e94aad961edceacc89faea9a58cb33e3c798e
SHA512 d7da6a24390d6b10022e1623b08886169ee91cab9535a30db9956e77d1e9c2b25e8f44947441e33f8c798b93b40d685bc430255b0078683b3584b8fad8dc2efb
TLSH
T165E02D8CD02623AC4F816A022C42ECF602A113B5808C020C3CC01E1FBB8F1D8D4FC007
MD5 SHA1 SHA512 TLSH

Jauking/glasrrets.imp

SHA256 e047ea82ec848a9d312697b246ed0b7784019bd4cc03da9baaa6e273bd69663e
MD5 dc967c92cf712ecf02158515685623c5
SHA1 7110558557ed4f5e6bddb49808a31e6006dd3e98
SHA512 c3ca50f92b7b88740fe53849596013543cefabfbcba26e57abcc85d76c98bc93d7f4a446c26a67e281c9918b5ff3f4703f6ea86cd89d7eb6fbbf97ddfb01959e
SSDEEP 1536:hLpDcO+qHKYtGxlYS46DfP4ZHyj/bo24WkLHbu8FVFn9Kaa+n7LkyAZjYRWiw1V6:CeXA6/oS
TLSH
T1CD9623F61C9ADECE1FC4C3193AC1A11AA571A96D337351907E06B1A15FF35723EB048A
MD5 SHA1 SHA512 SSDEEP TLSH

Jauking/slices.ini

SHA256 648ced3030527e83ac33b535cd5fff9275ada93c57d17dcab17d51100a7556f0
MD5 b17464a0e730824efcb30e45fb657937
SHA1 6c48b63d382686ffc99473b968a0ae2223a642ff
SHA512 991ba67b1b4a69a250c3cb2460b72ce14d50bc6d5ce9c1116ee7d3c5ae0e9bfeba37dc730dacb799e1e5c7067cdfb5315bf91d1010d40152189ef084efc4b4f7
TLSH
T12BE02345C0E9376C1354065DEC0EB8BD7ACE8E79862C3011A2B806CE21A94384A1A985
MD5 SHA1 SHA512 TLSH

Tyrolerne

SHA256 d5c6122e2eb24739582a6a050e581bec472664d60a5af4ade54eeb317f5e0886
MD5 29a7d1fd1ac074129a2ca8d8b5a1fbc4
SHA1 44fe7e5ca67cee13df40c3b3ce64ac2ff6013512
SHA512 3b56d09cff7063d929087533f011bbfafe4b14d83e52a4301cb0135df13e44d6880951a84fd7d542092e317a8950956d0de54fede40b23e70f66cd40de3a8cf5
SSDEEP 3072:+akayLmyx2r7uoenAQx4+fEB+7yhSFDnrl6Fkte87Qlnml:+aD+x2rqi+7fZnrYFks8wm
TLSH
T19AE3E1BB229097EFFCD4A47070B2E4DC7421FAF70A9F9568E4724DB181471C26758A2B
MD5 SHA1 SHA512 SSDEEP TLSH

2ed6e8ea4a6b.exe

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Afruster

Harborward251.ini

Jauking/Upwith.txt

Jauking/glasrrets.imp

Jauking/slices.ini

Tyrolerne

Sharing

General

Malware Config

Signatures

File Explorer

2ed6e8ea4a6b.exe

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Afruster

Harborward251.ini

Jauking/Upwith.txt

Jauking/glasrrets.imp

Jauking/slices.ini

Tyrolerne