60eba5a1a2fa28987cd59ff28a4f051dbbce369eef926f133914a1bd5ace8204[.]exe

resource
unpack001/$PLUGINSDIR/System.dll

resource
60eba5a1a2fa28987cd59ff28a4f051dbbce369eef926f133914a1bd5ace8204.exe

60eba5a1a2fa28987cd59ff28a4f051dbbce369eef926f133914a1bd5ace8204.exe

IMPHASH b34f154ec913d2d2c435cbd644e91687
SHA256 60eba5a1a2fa28987cd59ff28a4f051dbbce369eef926f133914a1bd5ace8204
MD5 26e7c59d95b5b20bee49faae31238fef
SHA1 459fcd8675ad1dc52c4474bca8d7efe6da15fb2f
SHA512 df3810ba4bc0e6b033d96f51bd8f5fa78d865cea5d968bc0688bb2d2bac57bb91106ada7a4c0dcce87e95c135427bb3018bca131343410e464fdb50378459a5c
SSDEEP 6144:YmGIhCrl0WKxHId8CxrM38tm0T0mAfnF5kc/JrJqoAq56zJ:fm0NxodvW38tm0HeIc/RJjAqC
TLSH
T1D674BE93F680C6AAFC2D4C75D9A752300B72ADB696C58F4353D879123FB2280753B52E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

01:5b:5a:14:0a:5c:9f:4e:a8:72:b1:95:7d:c6:4b:74:27:49:20:a8:da:91:5e:2c:ae:e7:2d:84:97:00:c4:61

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Ekskurs,OU=Unrevealingly Terrors\ ,O=Ekskurs,C=FR,1.2.840.113549.1.9.1=#0c1e416674656e73746964734046656c74646566696e6974696f6e65722e4361

Chains

Aug 6, 2026

CN=Ekskurs,OU=Unrevealingly Terrors\ ,O=Ekskurs,C=FR,1.2.840.113549.1.9.1=#0c1e416674656e73746964734046656c74646566696e6974696f6e65722e4361

PE Signature issue

Digest

9e:32:49:c8:0f:3a:90:56:f3:18:82:07:cb:ba:eb:1b:ef:20:fb:9f

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Ekskurs,OU=Unrevealingly Terrors\ ,O=Ekskurs,C=FR,1.2.840.113549.1.9.1=#0c1e416674656e73746964734046656c74646566696e6974696f6e65722e4361

Chains

Aug 6, 2026

CN=Ekskurs,OU=Unrevealingly Terrors\ ,O=Ekskurs,C=FR,1.2.840.113549.1.9.1=#0c1e416674656e73746964734046656c74646566696e6974696f6e65722e4361

Minor OS version

0

Major OS version

4

Entry point

13199

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetEnvironmentVariableW SetFileAttributesW Sleep GetTickCount GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW SetCurrentDirectoryW GetFileAttributesW GetWindowsDirectoryW GetTempPathW GetCommandLineW GetVersion SetErrorMode lstrlenW lstrcpynW GetDiskFreeSpaceW ExitProcess GetShortPathNameW CreateThread GetLastError CreateDirectoryW CreateProcessW RemoveDirectoryW lstrcmpiA CreateFileW GetTempFileNameW WriteFile lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject lstrcmpiW MoveFileW GetFullPathNameW SetFileTime SearchPathW CompareFileTime lstrcmpW CloseHandle ExpandEnvironmentStringsW GlobalFree GlobalLock GlobalUnlock GlobalAlloc FindFirstFileW FindNextFileW DeleteFileW SetFilePointer ReadFile FindClose lstrlenA MulDiv MultiByteToWideChar WideCharToMultiByte GetPrivateProfileStringW WritePrivateProfileStringW FreeLibrary LoadLibraryExW GetModuleHandleW

user32

GetSystemMenu SetClassLongW EnableMenuItem IsWindowEnabled SetWindowPos GetSysColor GetWindowLongW SetCursor LoadCursorW CheckDlgButton GetMessagePos LoadBitmapW CallWindowProcW IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard ScreenToClient GetWindowRect GetDlgItem GetSystemMetrics SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharPrevW CharNextA wsprintfA DispatchMessageW PeekMessageW ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow GetDC SetTimer SetWindowTextW LoadImageW SetForegroundWindow ShowWindow IsWindow SetWindowLongW FindWindowExW TrackPopupMenu AppendMenuW CreatePopupMenu EndPaint CreateDialogParamW SendMessageTimeoutW wsprintfW PostQuitMessage

gdi32

SelectObject SetBkMode CreateFontIndirectW SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation ShellExecuteExW SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW

advapi32

AdjustTokenPrivileges RegCreateKeyExW RegOpenKeyExW SetFileSecurityW OpenProcessToken LookupPrivilegeValueW RegEnumValueW RegDeleteKeyW RegDeleteValueW RegCloseKey RegSetValueExW RegQueryValueExW RegEnumKeyW

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
MD5 0d7ad4f45dc6f5aa87f606d0331c6901
SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
TLSH
T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10643

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Multiramous/kommutativ.bid

SHA256 3d648fbe3d01502afd5f9a50835538253cde7466a5c6e9082c8d08d5751a0e89
MD5 3571a1ced72f05e97c79e69d93d0f642
SHA1 d0a1cc9524bdb1f51f102b3325ed77aa16e31abc
SHA512 2207af5e0a139063c18a00252e828c3314974c14764336257e760de02f36ca0cc6fb5b29ad457a2ba8f4c18acdc4431610a454483adf6c8810ceb11206ab5f1e
SSDEEP 24:xJX6HvvNTPGE0+mf+oQInG2je49GphfoYM1PjuBqqbzhjjBGcC:x6Tulz1yfoVyLz5BGcC
TLSH
T161631C215D35A1079BB3B520C859B7347DEB674362FA8CC8DE075E8501F10CC8A4DD43
MD5 SHA1 SHA512 SSDEEP TLSH

Multiramous/reportage.tro

SHA256 f407ab2817125b159ed6fe459a996cec15ca0141de926251a280811b3c80142b
MD5 80565e3507bc21502ab1cb351bec773b
SHA1 d702be8ba79838243e75894f46a0b23cd3ccc68e
SHA512 972542e1096f9ddf60fb68efd107c97307028b7216ef2c9a9ad46db87765ba8113a931fc15fc14edb717738edd23bbefbca3a04f6aa607d2d83b9dc65cd102bc
SSDEEP 48:Hd6P2niSGsU8A7fNRz9ONxE/kffqMiDLgojCFo2vkM75PrEFYqrPzo3rK:HM+nnWl3rLgoSBC9Pzo3G
TLSH
T13C5319182BE72AF10D1A05155290F816426297A0168CD9BEE46577CD81ECA1B7F24226
MD5 SHA1 SHA512 SSDEEP TLSH

Multiramous/spermaets.syl

SHA256 4a7f25f2134f7a2e6febf5289b9c7817d875daf7f6d001cc1ba409022f87bfef
MD5 5a96c67cf987717ec6acbfc9f232cd3c
SHA1 3cdfaa592b4d1b3fa6ad2fae008ace5b1e5ebba0
SHA512 ba853c8d3296902888b83b98e79a7265406f75fbdde49bc298f19d13474244cbc9a8878d5500292b60ea3bb24bda45a730f77102891f362b3b3a96a95a4bac30
SSDEEP 96:Wotyb/5JnTtIW68vSkcc76er/BGjtVX2zN:WoEbvnTOW6fNE6a/BGxVX2zN
TLSH
T158A35D1E62287A84B8310AC5000752895D96B150CCBFD1E4B38E9F2BEF73E97218E274
MD5 SHA1 SHA512 SSDEEP TLSH

Multiramous/unsharply.pos

SHA256 5fc5bb4302e39698f6c0794041ff2d6d695e45533ae7214c87d2c4c8993bf3f0
MD5 619dbe3677fe84d57252d9b030bc5407
SHA1 d62fc1b0c7c63fd805667cc42aba8af8a264a279
SHA512 547cca26f1c53acd6dd0f1ea50bcd6a858680134740aa4ac6efbe42fa7fc02b6a1726446e5e3c97c4b2a53f8b50a592a6ee380a4346f6f9b5eef6b4c04f7f1b5
SSDEEP 96:2371+VBH/YuojEm2t7Hy1a22UoQPElTEfDsczbLb8e/q3r:23g0GlO7zpQyE
TLSH
T1F5C34AE3C683B036F588157E8247DA7B588AD78FEB88EB650A6B66526A54E400FD1402
MD5 SHA1 SHA512 SSDEEP TLSH

Potteplante

SHA256 f7f88dccb65cefc017987f965d6c0308c5701677d8c1180286f45fde89eec4db
MD5 25cd27d78b2c363c2cbc18ac27e11a59
SHA1 ac434b10fc66440612663aeff2dbfe8fdd9ee6b3
SHA512 40323bc7005b5216e1c6778f0ac151dfc36840355452533548519fa009d8f814d1c9e00f955abb1405abe50a510e8121fea6d4fa1fd2394606afefcc035433c7
SSDEEP 3072:9GYSzPdZARTFVKCHx0V4uy5nccmak86vvviNi+///q17viD+:5SzPnAVHRHnwvvv2k1o+
TLSH
T194B3F286F58476A0F4B0067E53C9EBEFC086759A8CD67513B3E728F98D3E45A738A014
MD5 SHA1 SHA512 SSDEEP TLSH

Selektivitetskontrollers

SHA256 429eb6d1a8afd1e057c0a79f8ec641891fda86c9d07b851f0aa2163e944f6ce6
MD5 75356b9a4cad4c317009555b1d993ff5
SHA1 cb6ba7e6227285fb6d92cc5a53835da6a4a7f731
SHA512 6d7625f5266fc2ec8a326a03b0e35db0a49531de7f20ce438476364280a7d75f5f690e51cc2a785c7acfb3c18b18937285084bc1741bc373966189a579d49f6e
SSDEEP 192:efmUYpabSGos9EKdgigMokgju+my9gUTtaWrVTGOHKJ64urcKgE8YP/i:e+rYQs9E82MotV9g4/cOq1u
TLSH
T11342AFF187168CA6C905E734D5A935664E383429CB4FE05DA3721AD68BC30E3A32C37A
MD5 SHA1 SHA512 SSDEEP TLSH

citharoedic.fej

SHA256 a12bbe461500124cb57abd8269782d01e99ff7b9a1cfff94bffe6151987cd4ad
MD5 33e88b2adcc23edbd5aedcde1f864560
SHA1 9c25c1497d5dfb736655ee4b84a2f1ce8ae83d9d
SHA512 c05795c1e9a00165f5419bbc8cefcdc978f32e0c7d32a4db484481c347e23a06c6cccd1f989766e9ca66602856057b329d5ab12709c6aab8b20a27e9d01ed180
SSDEEP 96:T4oNedzW0PauOAKS/k2DTVm/Q9AbJChkAE:T4oNe1W0Paufs2s/DbJChkAE
TLSH
T1EBB33B783137757D79AA0F2A9FF908F4A725C834D5C41A2A16D1BB478452CB262A0D64
MD5 SHA1 SHA512 SSDEEP TLSH

friherrer.top

SHA256 bc7a7694cfa2960e325873f199cf729127d341f5f8e501c908b9e3f3d99a1780
MD5 562212551266d8910717dcb94034c4ed
SHA1 3d7ef02e5714fd9af35a02180358f97c564f3954
SHA512 9714d4e1742b965bfc59773e057460b4f460b06363def01db0bc7fc25affed5d801d38ad3a72a6f066beb56c1636722b6deeaec2790e2ce9fabaee8610387770
SSDEEP 192:KeTsrSdbgk/PvaFx51alj3ZUNUv+0mFFPcVSULW96clAJspg3w+:Bsfknvy12j3sUvAjiA6lj
TLSH
T12CE37E10607EA2D3D831F72F5E71B804FEA0215D69CE5A1815B887DFEE5C22913C8524
MD5 SHA1 SHA512 SSDEEP TLSH

60eba5a1a2fa28987cd59ff28a4f051dbbce369eef926f133914a1bd5ace8204.exe

PE Signature issue

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Multiramous/kommutativ.bid

Multiramous/reportage.tro

Multiramous/spermaets.syl

Multiramous/unsharply.pos

Potteplante

Selektivitetskontrollers

citharoedic.fej

friherrer.top

Sharing

General

Malware Config

Signatures

File Explorer

60eba5a1a2fa28987cd59ff28a4f051dbbce369eef926f133914a1bd5ace8204.exe

PE Signature issue

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Multiramous/kommutativ.bid

Multiramous/reportage.tro

Multiramous/spermaets.syl

Multiramous/unsharply.pos

Potteplante

Selektivitetskontrollers

citharoedic.fej

friherrer.top