bd117ccb307115d2610149dcc14e9123ed9f5f215dc54474c62c1ee318693f89[.]exe

resource
unpack001/$PLUGINSDIR/LangDLL.dll
unpack001/$PLUGINSDIR/System.dll

resource
bd117ccb307115d2610149dcc14e9123ed9f5f215dc54474c62c1ee318693f89.exe

bd117ccb307115d2610149dcc14e9123ed9f5f215dc54474c62c1ee318693f89.exe

IMPHASH e2a592076b17ef8bfb48b7e03965a3fc
SHA256 bd117ccb307115d2610149dcc14e9123ed9f5f215dc54474c62c1ee318693f89
MD5 61dd141d997193c13c120fdd8feb9acd
SHA1 fced7fc1075285b562c5e08d7c00e6bb78cc190f
SHA512 adccbd3251dd5dcab048f1503bb2480fb3487a965163038581f2f521c9d0a82df7b93c636c931a96edb050b4397f35a10c5893b5f3552dd3ce2f28e3adb2917f
SSDEEP 6144:uLsBN8xoIP1Lr3S8CkVTAqlIoY/53YDBPuOE9iCwGzcWYoB+isgImdCE1dbpL0x:pBoBJrVT+Q9uOE9igYoB5s5mdCOdix
TLSH
T16384E0893B90D89FDB5246729DF2FB7C62B99FD03E0246032340374C3F7AAA95B46549
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

e6:b5:7c:52:4d:13:74:2e:b8:70:50:56:50:0c:9d:89:db:ff:9a:3d:ad:a7:83:6d:31:3f:8e:43:de:10:6b:f1

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Clamative,OU=Lannerets Ngletals\ ,O=Clamative,C=US,1.2.840.113549.1.9.1=#0c215472796b6c756674736265686f6c64657273313540526f6775656c696e672e4869

Chains

Aug 6, 2026

CN=Clamative,OU=Lannerets Ngletals\ ,O=Clamative,C=US,1.2.840.113549.1.9.1=#0c215472796b6c756674736265686f6c64657273313540526f6775656c696e672e4869

Minor OS version

0

Major OS version

4

Entry point

13073

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetCurrentDirectoryW GetFileAttributesW GetFullPathNameW Sleep GetTickCount GetFileSize GetModuleFileNameW MoveFileW SetFileAttributesW GetCurrentProcess ExitProcess SetEnvironmentVariableW GetWindowsDirectoryW GetTempPathW GetCommandLineW GetVersion SetErrorMode lstrlenW WaitForSingleObject CopyFileW CompareFileTime GlobalLock CreateThread GetLastError CreateDirectoryW CreateProcessW RemoveDirectoryW lstrcmpiA CreateFileW GetTempFileNameW WriteFile lstrcpyA lstrcpyW MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GlobalFree GlobalAlloc GetShortPathNameW SearchPathW lstrcmpiW SetFileTime CloseHandle ExpandEnvironmentStringsW lstrcmpW GlobalUnlock lstrcpynW GetDiskFreeSpaceW GetExitCodeProcess FindFirstFileW FindNextFileW DeleteFileW SetFilePointer ReadFile FindClose MulDiv MultiByteToWideChar lstrlenA WideCharToMultiByte GetPrivateProfileStringW WritePrivateProfileStringW FreeLibrary LoadLibraryExW GetModuleHandleW

user32

GetSystemMenu SetClassLongW IsWindowEnabled EnableMenuItem SetWindowPos GetSysColor GetWindowLongW SetCursor LoadCursorW CheckDlgButton GetMessagePos LoadBitmapW CallWindowProcW IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard wsprintfW ScreenToClient GetWindowRect GetSystemMetrics SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharPrevW CharNextA wsprintfA DispatchMessageW PeekMessageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow LoadImageW SetTimer SetWindowTextW PostQuitMessage ShowWindow GetDlgItem IsWindow SetWindowLongW FindWindowExW TrackPopupMenu AppendMenuW CreatePopupMenu DrawTextW EndPaint CreateDialogParamW SendMessageTimeoutW SetForegroundWindow

gdi32

SelectObject SetBkMode CreateFontIndirectW SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW ShellExecuteW SHFileOperationW

advapi32

RegDeleteKeyW SetFileSecurityW OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges RegOpenKeyExW RegEnumValueW RegDeleteValueW RegCloseKey RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumKeyW

comctl32

ImageList_AddMasked ord17 ImageList_Destroy ImageList_Create

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/LangDLL.dll

IMPHASH 3e8d18bb71c7ebbda2ddc2a4bb03547b
SHA256 6dff504c6759c418c6635c9b25b8c91d0d9ef7787a3a93610d7670bb563c09df
MD5 f1e9eed02db3a822a7ddef0c724e5f1f
SHA1 65864992f5b6c79c5efbefb5b1354648a8a86709
SHA512 c22b64fff76b25cf53231b8636f07b361d95791c4646787ce7beac27ad6a0de88337dcceb25b5196f97c452dda72e2614647f51a8a18cb4d5228a82ed2e0780c
SSDEEP 48:S46+/fTKYKxbWsptIpBtWZ0iV8jAWiAJCvxft2O2B8mjsofjLl:zRuPbOBtWZBV8jAWiAJCdv2Cmj/L
TLSH
T141C1A470B3C248B9C491453378E773D36A12EE746784600F9B6711AA38209E7AD3EBC3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5439

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb
MD5 17ed1c86bd67e78ade4712be48a7d2bd
SHA1 1cc9fe86d6d6030b4dae45ecddce5907991c01a0
SHA512 0cbed521e7d6d1f85977b3f7d3ca7ac34e1b5495b69fd8c7bfa1a846baf53b0ecd06fe1ad02a3599082ffacaf8c71a3bb4e32dec05f8e24859d736b828092cd5
SSDEEP 192:eY24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35Ol+Sl:E8QIl975eXqlWBrz7YLOl+
TLSH
T1E3325C12135081F3E4918138C86B3A276B6A15029BF98E57DFD39546BE31BE3BD7D603
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10183

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Brugtbilens.sku

SHA256 70c94c9d296defe4d68f018d13f5219432b6f631a938048d7a7076da1636edba
MD5 00d0b2d597ffd905b12a51f555458647
SHA1 479464030ef06b20f47b20f34611edaa66d1c634
SHA512 9ffbf4905dc562c01246125ceaf7310de4e0992e68469d464cdb4bfb5dacf02b185f03de01958de8a13cd15936aec5e235b5061fd53da6913e746968b0e10220
SSDEEP 48:L29w9b8jwxClw2z6Upsv+s99gfbVHJzz9cT:LEw9b8SClRVsvFMBPA
TLSH
T194F2865DDD951B786144F575CAE90711D88B7658247BB504B6910A7D4192613382C783
MD5 SHA1 SHA512 SSDEEP TLSH

Hearken

SHA256 015487a257ab8600a0e0d44ac86abdc55de7e556065e827553a1a1149aaf476e
MD5 85dd91e4e813007e613bd51bd60e8594
SHA1 2d73f976a99038d082bfb2b6fd323dc4286c867b
SHA512 1c40bacd557ed11f1b7d8e1da1634d7175f3d950e86c226c40b5007b98810bf2adb94e494b6996f570453c36ee346e5ce9ec3d1b97f117a6e3341a87a107c289
SSDEEP 3072:Yp7mtk50VU2Qwfh4SvMxfGux8uC2qpxSWs6kCJ9/VA:YAm5t2aRpx8uC2qVBJBy
TLSH
T12944B06ECDDD8F8FA2B6013EC9217CA76196C4E304B58E0604E28DF4A5FDB4359B7819
MD5 SHA1 SHA512 SSDEEP TLSH

Indoxyls200.sev

SHA256 9a0e4fcc5c58aac06eb5dc3cebbed553bb9e3c08572efde39cb2f8a32d957919
MD5 474b2f5818aa75bdd0221a953da223fb
SHA1 93aa831ba82c3ccd2e0f1962865ba1fabb532bf9
SHA512 3baeef020a2bd0901998ee995405eeef1a18754bb1b6f1539bfb3fa398801782a3042dd0b57f839ac89e4bb1cfb24b1ebf9a37c4af137694dfa0beacc0563204
SSDEEP 48:cu1DA09U98s55CWGxuwUaMVYtv/flcqtO0coSKf1eZJr2S4vioh0:d88UuaC7P/cFH89iJr2a
TLSH
T1C333D7B6BAA52DF2451641EC08781B84D12426D9E93476B5CD021AB00ACCA8CFDCBBD1
MD5 SHA1 SHA512 SSDEEP TLSH

Lnindkomsterne16

SHA256 da625437cbbce7cc5562614cb840c40d46b633e12123300a58c66a924b01b3e4
MD5 86eb06f6b798c717fbb160d802b43716
SHA1 93ef92104a6e2c2cdfff8b2ff87948b1b895ba89
SHA512 fe60071a6259ee2d3d139495568cb9beeae49c6602e5f10ad7a26cced0bb7ff92f4fedf238795738411ebfdc457aadbbdb687eadf4088387214930d2dee5329e
SSDEEP 768:p4nG6WBR+G34qe9lC+eef/qKE6HWKtBcbNKyilFd6/6wZHI3GEi75O2epkeECwVh:KGhBIGoo+53OKtYwZlFd64JMOJOenwNN
TLSH
T11173AF92A7269CFFDC05C138D9AE62924C65B0259B4FD47D623AE454C1E32D327383AF
MD5 SHA1 SHA512 SSDEEP TLSH

Postgraduation135.sti

SHA256 699a70861833f1d6b2c0d32e0ae058843fb31f682c15da5969a604aa2b6e3ba6
MD5 846ea2f01587d07887be65faf6ad9f8a
SHA1 82ffea719f83aeb7934f5a3225c95a1ac9c97ccf
SHA512 aac6c8b04a45e31124b555d07056ee90dc4cd558a2c6c28506ae5ee9e6b509e98bf7b2f62047c9a6606655aaf827647612f5a402e27b02e3aa52e3175e76f164
SSDEEP 12:drDAYrateKkSrVUglwWKM2CP+LwbqcM4amEcu2PMvgZkSRwr5z86MyZ3rT:hXateKHaL3wdosP4gZkyEabu33
TLSH
T1029247813102117969659CE885F942EC3B7CEFE2ECDC788F5181529D1C4434F342A5A4
MD5 SHA1 SHA512 SSDEEP TLSH

Returneringens/Formssagerne/Betonfabrik/Amphipneust/stilnet.enc

SHA256 d8ab686260064f2d3a79a0b0145987eb1dde4ab8f9ca7dd659740ba41491ad7b
MD5 7c700374b1d46fcddd0d1d0447ef0c07
SHA1 9a5796adc88f5021644b949d5d5e72c8604b7ba2
SHA512 08477e2ef6ad8d4dfb57411408a5234dc17863861d332bec9eeeb97e890b83a2638827ee84eec78152e16c1976c7697b9eb345e2fb27bf188b4fcced116857a7
SSDEEP 12:9gc2lg62wi16QyYOQa2U+7og8XmPxXFYTnYMaXWVDWFIyZQXGkwR:9gcUdti16VYOQRnkWPB0Y5PGyR
TLSH
T14C72814CC199D98462A6611F5A6F79D0A541E1A1CE492935955A249DD1FC11D00D0EE3
MD5 SHA1 SHA512 SSDEEP TLSH

Returneringens/Formssagerne/Betonfabrik/gerrymandered.ton

SHA256 065ae157bcf38d88e079b43be08055db2e0256dbc044b19c307e9d7e215c7d7d
MD5 c0f0fdcb12d6e0eef815e2fe557875f3
SHA1 854628fc3b9b11c511fa7d331ea3eb723b3dac2e
SHA512 0d04fd2e34ff7ac53430f85063184aece520ffdc52b1f3354af45caf99e33cb1f7124f6e6130a5bba19d0cfbe3362ce38213b44557fe94fa391bbaedb8dd0335
SSDEEP 96:Kal1hQMBZcVg4znCEONy4kHL1axQQBzYTV:BfQMBZbeCTSHLUxQQhu
TLSH
T1828319641BDB2FCD32A7A4260D318E139CD83815FB74C6B028CD4DD22950B1971B600E
MD5 SHA1 SHA512 SSDEEP TLSH

Returneringens/Formssagerne/Betonfabrik/saunaernes.san

SHA256 5888cb0402b99c15454d84c38ce26f221ed4ff8a181df3c23a957299e94aedf1
MD5 a43375f2fe1ea47460d918e5ac269821
SHA1 19df7f95073095e97078add8697502a3fde9e7d3
SHA512 de37e6c5c429f069dd7a42917c4adc8fc36867704a07ade60925faa0e01e696d6f2cdfbf043d896a5777b990d7e34d0c136d54b70aef9cb35eb46233570562d6
SSDEEP 48:/3ffJD6A6ju5UixgBRnL0ZDkOKULqFh7/Km02MUs9:/3JD65jI1gBxgZDTKbtKm0Us9
TLSH
T1D9633A5442E6B4D3028C3D8210318E91446F362AA34B2A6C8B647DBB2C49BA87B9D67C
MD5 SHA1 SHA512 SSDEEP TLSH

Returneringens/Formssagerne/funktionsbeskrivelse.tic

SHA256 56a40b2382a757f431910386c284cd64d0dee3724759f946541a8557cc86897b
MD5 5241bd474c5405fb7fe40e84df4bc5d9
SHA1 34978ff75fc7d1ab825fb6a6282ec27ff5ddbb0f
SHA512 a95bd715965bad414a7f3ba3b0f7c80c7709c3d74bcdc1e1e0bab627cbab7fdda740b6c51b5f132b5b5bb5fe6107afce5481c4f16c51e2a49799c787fc578000
SSDEEP 12:E0RsOt7F5LjABOIOv1TCO5qnlOMVogTM0vsaOYOqHZs:ae7/LTIY1TCe8lOQVgYOq5s
TLSH
T16062AB8C0541FA2CB789D83894083D5226F084FE3AA92423549923638106BD1D5F1F23
MD5 SHA1 SHA512 SSDEEP TLSH

Returneringens/bogensere.san

SHA256 54a81551607d4968b8e6289864a4dd9aeb10bd179424ad99733ea4cd8a770456
MD5 2e6ed39f968216953d8d0647d3fac986
SHA1 518f226b67db7a9f6a992b7edd4ca09a404e3cfc
SHA512 68609cb4b4b81f55994499184b53c01fcd4f6dee974c5222f761814e897e5a6379603333c7a4b4e237489d5f03c275785b81d7db967fc9ef36f94e7237e96a85
SSDEEP 48:snBDfZZygSN0uhu1eGcjsQCUg9wUcpb4iXwAmi+spdIydVDA6GAxT3:MFyzQyEjw/XwAmibpdIyrcT+
TLSH
T17723057B47974D0841B9FA485E1A8EDCA88C522584CE638CA3023E5B589AF39300896B
MD5 SHA1 SHA512 SSDEEP TLSH

Tat.bro

SHA256 37801fb5a2ce2bc805757eb76d78ae01f54bf9ccee46925d2aa1bbdb084c653d
MD5 884c821b8adfa98724771d1feede4503
SHA1 52fcf7e96fc953a7e1eb8c5358b4404f847fb4d1
SHA512 e0260ae35de3338333ed574ed10a25a23162d88c8a3be22d1728b7a323e27b4047152b09479b25d379555d5348976ecebf60d5a7e823496da200773addc2702d
SSDEEP 24:awN5aamCCqAwfvX8z2jamrlGXEXDg/yTRETOGNdhzdbDMFsKChezipApZ:l5afGPfvM2/rliEX2ydETOk3hCsV0z/Z
TLSH
T12813D53311A8100B878B0C922207B03A01F39276CBEE68A2AD8BA71168CC83752B31D9
MD5 SHA1 SHA512 SSDEEP TLSH

Underbindendes.unp

SHA256 eb88b7c931ca8527239cfa24ce165e3dc54059ea3f94daf0d8d16e801c049899
MD5 249aa8efd6fd18567bf787ff2f7249bc
SHA1 c243e0b01a1ff4192ae2f50737d6fa5aac07f717
SHA512 710adf0b3312fb0f468aa388b11f202990d3cd64bd652019539adcb8481aa4977961ce47501c7f3bc0f8351cf559993c30d3aab59205b8d652ddb043dc88c6d3
SSDEEP 96:HUSfxoVseKn/cRJ6SeA339BKiYUKklR+MOYcZz:BiseQrA3Pz5JR+MVo
TLSH
T1F0730757B49C44AE2612158B8DF4ED7BF3541F58FF516418600C33A289A24C7AA8DBA2
MD5 SHA1 SHA512 SSDEEP TLSH

bd117ccb307115d2610149dcc14e9123ed9f5f215dc54474c62c1ee318693f89.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/LangDLL.dll

kernel32

user32

gdi32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Brugtbilens.sku

Hearken

Indoxyls200.sev

Lnindkomsterne16

Postgraduation135.sti

Returneringens/Formssagerne/Betonfabrik/Amphipneust/stilnet.enc

Returneringens/Formssagerne/Betonfabrik/gerrymandered.ton

Returneringens/Formssagerne/Betonfabrik/saunaernes.san

Returneringens/Formssagerne/funktionsbeskrivelse.tic

Returneringens/bogensere.san

Tat.bro

Underbindendes.unp

Sharing

General

Malware Config

Signatures

File Explorer

bd117ccb307115d2610149dcc14e9123ed9f5f215dc54474c62c1ee318693f89.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/LangDLL.dll

kernel32

user32

gdi32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Brugtbilens.sku

Hearken

Indoxyls200.sev

Lnindkomsterne16

Postgraduation135.sti

Returneringens/Formssagerne/Betonfabrik/Amphipneust/stilnet.enc

Returneringens/Formssagerne/Betonfabrik/gerrymandered.ton

Returneringens/Formssagerne/Betonfabrik/saunaernes.san

Returneringens/Formssagerne/funktionsbeskrivelse.tic

Returneringens/bogensere.san

Tat.bro

Underbindendes.unp