daf8f37785d226524b5403bc24e018955f01d5d2ce7d0952cb74c18bd79d09be[.]exe

resource
unpack001/$PLUGINSDIR/System.dll

resource
daf8f37785d226524b5403bc24e018955f01d5d2ce7d0952cb74c18bd79d09be.exe

daf8f37785d226524b5403bc24e018955f01d5d2ce7d0952cb74c18bd79d09be.exe

IMPHASH 573bb7b41bc641bd95c0f5eec13c233b
SHA256 daf8f37785d226524b5403bc24e018955f01d5d2ce7d0952cb74c18bd79d09be
MD5 b63697cb6128ae927b67e1f95fcbbe0f
SHA1 bbf557d7b8ae61cec5b68d251ea12c78c97453f7
SHA512 c8d96d823be0124dd63f6e7ad040f3f967afdd3b5095ee6c9090b45f2e7f72078a5a27e7fa7e44cf77eb6f9d359eeea910b1377f2a20d21ee7fd1969a27281cc
SSDEEP 6144:HTA8oPSCIjFo6XHfvTx2yQy8ARUvOa40Di4Ynu+ja:HTA6FoAHoy8ovz07A4
TLSH
T1E994CF53F694C986D81112F04C7FD82922676D7898A3520F3EADF73D6EB3292F11724A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

92:38:f0:69:56:02:7c:83:c7:ec:82:86:2b:15:72:ec:50:1b:ec:e6:87:8f:8c:12:f3:bf:8f:17:77:a9:3f:c2

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Aerolitten,OU=Undeliberativeness Aflastningernes\ ,O=Aerolitten,C=US,1.2.840.113549.1.9.1=#0c1548656674657240506f73746f63756c61722e4d656a

Chains

Aug 6, 2026

CN=Aerolitten,OU=Undeliberativeness Aflastningernes\ ,O=Aerolitten,C=US,1.2.840.113549.1.9.1=#0c1548656674657240506f73746f63756c61722e4d656a

PE Signature issue

Digest

22:95:86:58:80:d3:40:2e:30:d4:58:a7:70:bb:c1:ea:a4:a3:a9:69

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Aerolitten,OU=Undeliberativeness Aflastningernes\ ,O=Aerolitten,C=US,1.2.840.113549.1.9.1=#0c1548656674657240506f73746f63756c61722e4d656a

Chains

Aug 6, 2026

CN=Aerolitten,OU=Undeliberativeness Aflastningernes\ ,O=Aerolitten,C=US,1.2.840.113549.1.9.1=#0c1548656674657240506f73746f63756c61722e4d656a

Minor OS version

0

Major OS version

4

Entry point

13709

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegOpenKeyExW RegCreateKeyExW

shell32

SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW ShellExecuteExW

ole32

CoCreateInstance OleUninitialize OleInitialize IIDFromString CoTaskMemFree

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create

user32

MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW CreatePopupMenu AppendMenuW TrackPopupMenu OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW IsWindowEnabled SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CharPrevW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint CharNextA wsprintfA DispatchMessageW CreateWindowExW PeekMessageW GetSystemMetrics

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor

kernel32

lstrcmpiA CreateFileW GetTempFileNameW RemoveDirectoryW CreateProcessW CreateDirectoryW CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW WriteFile ExitProcess GetCurrentProcess GetModuleFileNameW GetLastError GetFileSize GetTickCount Sleep SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW MulDiv lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject CopyFileW

$PLUGINSDIR/System.dll

IMPHASH 509a34b3a68a773e0afb4259e68f9f82
SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
TLSH
T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Koagulering

SHA256 ec0179078c27c580670bdb32f9256a9ab35fe4cc25dbe14d3516cb837bf83cff
MD5 36aa61d99473cf5706075a43b5224538
SHA1 4aaa0b9887f062c793e6c26ad763ee6647fa4f25
SHA512 f187e131c36a05ac59b997821e38e19e61f6dc088023b1f3752a9f22ae160aeb1921697e55676c4d53eeab706db3546ff1d799b9346056b4e839f6f6d664e194
SSDEEP 1536:xgxoCPSmmX8Qik0Hwm0VXfqcbhAqrp28FrXTq:qoGLQ8QiV50BF/l285Xe
TLSH
T1A693BF42D7A65CFFCC07C638D17E22958CA970135B4FD06E617AE809C1972F36724AAE
MD5 SHA1 SHA512 SSDEEP TLSH

Sunderment

SHA256 2218c51f28e1bc4c4bab3c43b4f0d408dfeb61f264e13e97dba281002e830428
MD5 8015ca2bdbf412c87b72a5b491545492
SHA1 11f03722f42ae6522bfeb25f444367a7ce0f64b5
SHA512 6d9fff6efac558265940831d39bf024739dac497f69e76a393e0f3707dd889f7a960543c6641d6f7cc457f6949f702e7eebfc7d6f10f1275c5de9e45e574e8e3
SSDEEP 3072:ZRPiWHeLl6xw9vCJJJXoolfbl3NWoirZD5dghfs45a26xqER/T:76GeLt9KJJJ4olfx3NWpZDbgNsA0qE1
TLSH
T166C3F16C2996AD13C27901FE6DC21933A13DFCEE22AB047125E45F20ECD54566FFAB84
MD5 SHA1 SHA512 SSDEEP TLSH

anettas.txt

SHA256 0dd727fd57863ab3beb5b4ead48b94192b017d0d8430bdfa1bec1def208ba0f7
MD5 a1ca49008a0117c40931ef10f2227278
SHA1 4b3fcac52488739fe76c480626b86a978af040d0
SHA512 2839936d24f30def881e7bcf281eea8ccb38617a90661ea9629610cf69c271c895393c4f8fa980f9f09ac1fd94a3ac2f5e1a691c9233f3fbd9040b29eeec0fb4
TLSH
T1720144C48C86831E884A530ABDE15583C93D584CAA3662ACFAF0574B068577E533CB69
MD5 SHA1 SHA512 TLSH

doktoreres.ini

SHA256 f4d7cb7c91fe0402312b9d161d65c8546e84ddb8876632601522842cabd9836c
MD5 95579c7d1d17da8d8c1905df40cd9cdd
SHA1 30de2f4adbbdbf7ec413416ca414b9127d541c58
SHA512 ebbae9b82618b108834a947c8533c549e8d92b19d39a892ee985f1f1a34eee08f56f96cfbc6efbfd5c21463981660bc70174e50e905f7f187e57721cafdc6c8e
TLSH
T1FF0123B7F20D02CA2B0B87DB4B0D2491065E6A8D461B88B635CE578F65404FA837AE7D
MD5 SHA1 SHA512 TLSH

goss.enk

SHA256 d982a898cfd075313298c8b41a296b2736e09e2cf0ed5da1668416e3b66b4e35
MD5 800c3ad12be47654479fcb4240eba045
SHA1 69925cff1ca5d632b735f8181d2bb19c0a69d72b
SHA512 4efaaf9f627b265b417ed71dad4a60213233be03ef8ba1263a4acd99ba1751794e1d815765b56b1969858ff759d1f19366c1a1dd8803cf06fe74e73da14140e6
SSDEEP 768:QtANQxUHkUOZlU8vEcBnQysp6SGo99yUPj18jZoy421OeN62HIXhle+Fjl8gUOhd:WG
TLSH
T1AF55F12219841CB889A3A98B8B91A3515B7DF1902DB70852572F9707BAC6FC9017ADF3
MD5 SHA1 SHA512 SSDEEP TLSH

unbuckled.ini

SHA256 f20ef98f8a13fb275294eeb327e9200319b5399d44a2ddb2ec07a8957ac589cb
MD5 2a222f2385f46cf562d108926d67aaba
SHA1 b44999310ac77ee63f638376b9368fc8a21cbe8b
SHA512 7a68fa1437964b08cf3113c2aa41ce9e57594fca91fea41ec21bed4c6c2a8dd1caa0a0512a323635daed900b2b595d60ef692a4ed6393d0d309a86b660255d36
TLSH
T18FE0C076B5913A5E264B09038C00CCC5B380402D0505602C3C54536FA0012AC9E39336
MD5 SHA1 SHA512 TLSH

daf8f37785d226524b5403bc24e018955f01d5d2ce7d0952cb74c18bd79d09be.exe

PE Signature issue

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Koagulering

Sunderment

anettas.txt

doktoreres.ini

goss.enk

unbuckled.ini

Sharing

General

Malware Config

Signatures

File Explorer

daf8f37785d226524b5403bc24e018955f01d5d2ce7d0952cb74c18bd79d09be.exe

PE Signature issue

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Koagulering

Sunderment

anettas.txt

doktoreres.ini

goss.enk

unbuckled.ini