174047faedae187b42c666c6c34ba1fdb1791b16f1c63f6bd2258fbd6409b77a[.]exe

resource
unpack001/$PLUGINSDIR/System.dll

resource
174047faedae187b42c666c6c34ba1fdb1791b16f1c63f6bd2258fbd6409b77a.exe

174047faedae187b42c666c6c34ba1fdb1791b16f1c63f6bd2258fbd6409b77a.exe

IMPHASH 4ea4df5d94204fc550be1874e1b77ea7
SHA256 174047faedae187b42c666c6c34ba1fdb1791b16f1c63f6bd2258fbd6409b77a
MD5 05303a7d2a6b9a8672abaa23abf2c99c
SHA1 6c7c555a55f3b3d7b58c71f6ecb8df87e9296a06
SHA512 8402dc6f418451b3b832e367ddf35758e7b10ca2e3c59d1057cb736a134ed9d5a86f85a4a726b5fbcd77fc764da6862c803eec8ed4b518c4491f54df8e5fbaea
SSDEEP 6144:Jwq3Nplp8rtzZ3vxjmMAQFEY86jgGf5LYR1tQ73cnfU71437AU4asFS7kq9DCfQz:JzhufPAgEYFVLaFkqooa4F8LW/cQ5
TLSH
T1F294BF423D0CA8D7ED3D2372296785862FB474BA4B92169F7AAFF65648023034E1FD5C
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

1a:b5:bb:8f:4c:c6:d1:cc:dc:5a:e0:a3:1b:ac:cd:c2:c5:2a:f2:71:56:70:4b:cd:bc:80:62:b8:83:24:cb:89

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Forbarmelsens,OU=Kloakspildevands nonemphatical Kommandonavnes\ ,O=Forbarmelsens,C=US

Chains

Aug 6, 2026

CN=Forbarmelsens,OU=Kloakspildevands nonemphatical Kommandonavnes\ ,O=Forbarmelsens,C=US

PE Signature issue

Digest

7d:fe:f2:af:02:19:64:53:24:a6:03:e5:bd:5c:e8:f0:a8:2e:40:83

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Forbarmelsens,OU=Kloakspildevands nonemphatical Kommandonavnes\ ,O=Forbarmelsens,C=US

Chains

Aug 6, 2026

CN=Forbarmelsens,OU=Kloakspildevands nonemphatical Kommandonavnes\ ,O=Forbarmelsens,C=US

Minor OS version

0

Major OS version

4

Entry point

13386

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetCurrentDirectoryW GetFileAttributesW GetFullPathNameW Sleep GetTickCount CreateFileW GetFileSize MoveFileW SetFileAttributesW GetModuleFileNameW CopyFileW ExitProcess SetEnvironmentVariableW GetWindowsDirectoryW GetTempPathW GetCommandLineW GetVersion SetErrorMode WaitForSingleObject GetCurrentProcess CompareFileTime GlobalUnlock GlobalLock CreateThread GetLastError CreateDirectoryW CreateProcessW RemoveDirectoryW lstrcmpiA GetTempFileNameW WriteFile lstrcpyA lstrcpyW MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GlobalFree GlobalAlloc GetShortPathNameW SearchPathW lstrcmpiW SetFileTime CloseHandle ExpandEnvironmentStringsW lstrcmpW GetDiskFreeSpaceW lstrlenW lstrcpynW GetExitCodeProcess FindFirstFileW FindNextFileW DeleteFileW SetFilePointer ReadFile FindClose MulDiv MultiByteToWideChar lstrlenA WideCharToMultiByte GetPrivateProfileStringW WritePrivateProfileStringW FreeLibrary LoadLibraryExW GetModuleHandleW

user32

GetSystemMenu SetClassLongW IsWindowEnabled EnableMenuItem SetWindowPos GetSysColor GetWindowLongW SetCursor LoadCursorW CheckDlgButton GetMessagePos LoadBitmapW CallWindowProcW IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard wsprintfW ScreenToClient GetWindowRect GetSystemMetrics SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharPrevW CharNextA wsprintfA DispatchMessageW PeekMessageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow LoadImageW SetTimer SetWindowTextW PostQuitMessage ShowWindow GetDlgItem IsWindow SetWindowLongW FindWindowExW TrackPopupMenu AppendMenuW CreatePopupMenu DrawTextW EndPaint CreateDialogParamW SendMessageTimeoutW SetForegroundWindow

gdi32

SelectObject SetBkMode CreateFontIndirectW SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW ShellExecuteW SHFileOperationW

advapi32

RegDeleteKeyW SetFileSecurityW OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges RegOpenKeyExW RegEnumValueW RegDeleteValueW RegCloseKey RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumKeyW

comctl32

ImageList_AddMasked ord17 ImageList_Destroy ImageList_Create

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb
MD5 17ed1c86bd67e78ade4712be48a7d2bd
SHA1 1cc9fe86d6d6030b4dae45ecddce5907991c01a0
SHA512 0cbed521e7d6d1f85977b3f7d3ca7ac34e1b5495b69fd8c7bfa1a846baf53b0ecd06fe1ad02a3599082ffacaf8c71a3bb4e32dec05f8e24859d736b828092cd5
SSDEEP 192:eY24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35Ol+Sl:E8QIl975eXqlWBrz7YLOl+
TLSH
T1E3325C12135081F3E4918138C86B3A276B6A15029BF98E57DFD39546BE31BE3BD7D603
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10183

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Datatransporterne19.sus

SHA256 a6d6883710544eb03082235af962f44052d94d96b1a3c23e99e3a7748037cf0d
MD5 323546928f4f22d277fde366d2327592
SHA1 188a6d7812be8db3a527f4ea2207d8f43a6ab3c1
SHA512 650c92e6a32c13f3f344308f647198ba38dfcdd4beda4710ebb552abadfcd36b8e2df40f1041f7ab6eaaea2b5021e2acaf4facf942fceb1e1a26413e9d5d6f1b
SSDEEP 24:z/EP4OS5r4Cla20EvWs9/yB6s9ZYMthH8OVA3MkeeCAynG5f:zMP4Z0Ya20SWs9/yosPJTjVeMkeeZB
TLSH
T1FF92B585231298C9D858F2B194DC3D598060B09903E48BC28AE23F592DF5481AF050AC
MD5 SHA1 SHA512 SSDEEP TLSH

Joyrode

SHA256 1d5b4ca4a903171950efe0c1ddba8258fd8192b09fd6d7940f336a96f229c527
MD5 a942b80f9a40274971b913bc66ee2b93
SHA1 ffd08e823503ee445b00db12af625de2cc52ad0c
SHA512 ddc11f15f13763d410aae6c41d72cd63113c7d07ca8d7bb82dc70feb908622d52f5f58ed3a8b8ff46b20c32d286ffdda82ca85eb515354204d6393fc6e2d61b9
SSDEEP 3072:bUoAWCk9fe2zDvtTQwzXDUyXwC8OzzmVizKXGjmfUyDKQ6Aupdwqpnpca/Q5O6Vi:BFZLtRzX4et8qKizYGKfUybcpmqpni3i
TLSH
T12004F1D5EFEDC4B1D9404C3CCD256883EE187373996E29D4362EA87C86AB27391580DE
MD5 SHA1 SHA512 SSDEEP TLSH

Materialiseringer.lar

SHA256 4b5ec96a76b78db6b314cc92d487527bfa00316158722cf2492f88873c94fd88
MD5 7e5c9d140be99be0b9ccc348b4b28d6d
SHA1 c3996dee5e4dc9eb2a7b717085533c04b3a4a3c2
SHA512 8109d87e38d85831d683b8e853e1797592a47cfa7d3ecd61b3b97a4b872d9cff1a69f179ef9f52015c5ae0cf56f8722c8cbc150d6b9df5fd541515a3249fbfa7
TLSH
T11441223B2EF02F0E2000C00B03A8283CC0C0E8FACF830028B020303008208B82C23C80
MD5 SHA1 SHA512 TLSH

gangers.mij

SHA256 6f1b69f174b58c667c0982a62b3c49608ffadf9eecc7297863f24c497a113bcc
MD5 3d524fd450821db5b3788b02c4d2ed17
SHA1 cda2933f2b8c3774686db2c0d80013f85f422a12
SHA512 e2da4262e68e33264de505ee6285a4ce6eaa8ffc1a4db3dbd6e143a360b28ebb7d9133f804d0c8fe13062d22e919c98a11984b7f521fa2552176eb2119699090
SSDEEP 24:iJcgPTp1nVwFDINn3Bl69YnPArLqac19n:Et1nVwukYnISac19n
TLSH
T173F2E9F919B2133604DF3D62283F10011C8680B5269714C5329DDE795F144E3EB83317
MD5 SHA1 SHA512 SSDEEP TLSH

marinesoldatens.syn

SHA256 1d0ba2763c9492b85b214b07d7e74aeda8cb70917ee3164640fad4c50d6019cc
MD5 ad1a9e82df169d9c31bd3343170a7efe
SHA1 10677cbe827d6327fa4f58fd264f28b7ac7d782a
SHA512 f097126fc80cbeac49be5361d6c3f2564c3e63c0f81c20cda75010fba8230be79b04ffb26ae89507dec25f10d1b6704ddfda3603740c3fc29961d3d6da146a30
SSDEEP 24:dGH6+sgaUycwg0zkihP6VeqCx8VCLpXtm0NyyhdmpuPQMwaNO4EsYcZ9vrMus2cj:dGH1sUSw5ux8WRU05UJcZ9FcO04aN
TLSH
T16A13B768C3646E75232F6C6B76190853E0B9B34EB9EA4015971C8C8FF14EE4B04D2972
MD5 SHA1 SHA512 SSDEEP TLSH

174047faedae187b42c666c6c34ba1fdb1791b16f1c63f6bd2258fbd6409b77a.exe

PE Signature issue

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Datatransporterne19.sus

Joyrode

Materialiseringer.lar

gangers.mij

marinesoldatens.syn

Sharing

General

Malware Config

Signatures

File Explorer

174047faedae187b42c666c6c34ba1fdb1791b16f1c63f6bd2258fbd6409b77a.exe

PE Signature issue

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Datatransporterne19.sus

Joyrode

Materialiseringer.lar

gangers.mij

marinesoldatens.syn