8698a2bb4ff21a5bb6c6f7cc43dbaf13827cb8248014377013a0f3daaace67c3[.]exe

resource
unpack001/$PLUGINSDIR/System.dll

resource
8698a2bb4ff21a5bb6c6f7cc43dbaf13827cb8248014377013a0f3daaace67c3.exe

8698a2bb4ff21a5bb6c6f7cc43dbaf13827cb8248014377013a0f3daaace67c3.exe

IMPHASH 573bb7b41bc641bd95c0f5eec13c233b
SHA256 8698a2bb4ff21a5bb6c6f7cc43dbaf13827cb8248014377013a0f3daaace67c3
MD5 959b979590021ee9c0e1e7ccb610aa4c
SHA1 5664db0dda33ad5cd12d7579ae53074b884cd343
SHA512 784fc9195c9a2501a6a7e39839fe12571606cda61975e5c90cb79dd7d1d441558fad4ff0d512aa54c3d4d332de7fc59b458c9ba9741aae3627abd66306d803ae
SSDEEP 6144:CTA8oPSCIjT6W7scfdwQf4iTuDf2eBN1UglPPG2QYnu+jR1Z+:CTA6TPIGwJieBwgduAO
TLSH
T18F94BE23F654C986D85023F04C7FD86A22676D7458A3560F3DAAF33D6EB3292F11724A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

2a:40:97:ef:6a:3e:c6:f8:1c:55:88:ef:b6:25:8d:c0:11:ed:d1:87:52:8c:f7:c4:58:08:56:de:a8:26:b2:a9

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Unsympathizables,OU=Pelecani Sadomasokist Rendlewood\ ,O=Unsympathizables,C=US,1.2.840.113549.1.9.1=#0c1e536c75677465726e657340496e6578686175737469626c656e65732e416e

Chains

Aug 6, 2026

CN=Unsympathizables,OU=Pelecani Sadomasokist Rendlewood\ ,O=Unsympathizables,C=US,1.2.840.113549.1.9.1=#0c1e536c75677465726e657340496e6578686175737469626c656e65732e416e

PE Signature issue

Digest

1c:63:f6:36:17:44:52:5c:1c:20:6f:fe:0d:7f:36:66:0f:f3:b8:16

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Unsympathizables,OU=Pelecani Sadomasokist Rendlewood\ ,O=Unsympathizables,C=US,1.2.840.113549.1.9.1=#0c1e536c75677465726e657340496e6578686175737469626c656e65732e416e

Chains

Aug 6, 2026

CN=Unsympathizables,OU=Pelecani Sadomasokist Rendlewood\ ,O=Unsympathizables,C=US,1.2.840.113549.1.9.1=#0c1e536c75677465726e657340496e6578686175737469626c656e65732e416e

Minor OS version

0

Major OS version

4

Entry point

13709

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegOpenKeyExW RegCreateKeyExW

shell32

SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW ShellExecuteExW

ole32

CoCreateInstance OleUninitialize OleInitialize IIDFromString CoTaskMemFree

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create

user32

MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW CreatePopupMenu AppendMenuW TrackPopupMenu OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW IsWindowEnabled SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CharPrevW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint CharNextA wsprintfA DispatchMessageW CreateWindowExW PeekMessageW GetSystemMetrics

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor

kernel32

lstrcmpiA CreateFileW GetTempFileNameW RemoveDirectoryW CreateProcessW CreateDirectoryW CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW WriteFile ExitProcess GetCurrentProcess GetModuleFileNameW GetLastError GetFileSize GetTickCount Sleep SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW MulDiv lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject CopyFileW

$PLUGINSDIR/System.dll

IMPHASH 509a34b3a68a773e0afb4259e68f9f82
SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
TLSH
T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Deferents/Nabofamilien/doktoreres.ini

SHA256 f4d7cb7c91fe0402312b9d161d65c8546e84ddb8876632601522842cabd9836c
MD5 95579c7d1d17da8d8c1905df40cd9cdd
SHA1 30de2f4adbbdbf7ec413416ca414b9127d541c58
SHA512 ebbae9b82618b108834a947c8533c549e8d92b19d39a892ee985f1f1a34eee08f56f96cfbc6efbfd5c21463981660bc70174e50e905f7f187e57721cafdc6c8e
TLSH
T1FF0123B7F20D02CA2B0B87DB4B0D2491065E6A8D461B88B635CE578F65404FA837AE7D
MD5 SHA1 SHA512 TLSH

Deferents/Nabofamilien/goss.enk

SHA256 d982a898cfd075313298c8b41a296b2736e09e2cf0ed5da1668416e3b66b4e35
MD5 800c3ad12be47654479fcb4240eba045
SHA1 69925cff1ca5d632b735f8181d2bb19c0a69d72b
SHA512 4efaaf9f627b265b417ed71dad4a60213233be03ef8ba1263a4acd99ba1751794e1d815765b56b1969858ff759d1f19366c1a1dd8803cf06fe74e73da14140e6
SSDEEP 768:QtANQxUHkUOZlU8vEcBnQysp6SGo99yUPj18jZoy421OeN62HIXhle+Fjl8gUOhd:WG
TLSH
T1AF55F12219841CB889A3A98B8B91A3515B7DF1902DB70852572F9707BAC6FC9017ADF3
MD5 SHA1 SHA512 SSDEEP TLSH

Deferents/Nabofamilien/unbuckled.ini

SHA256 f20ef98f8a13fb275294eeb327e9200319b5399d44a2ddb2ec07a8957ac589cb
MD5 2a222f2385f46cf562d108926d67aaba
SHA1 b44999310ac77ee63f638376b9368fc8a21cbe8b
SHA512 7a68fa1437964b08cf3113c2aa41ce9e57594fca91fea41ec21bed4c6c2a8dd1caa0a0512a323635daed900b2b595d60ef692a4ed6393d0d309a86b660255d36
TLSH
T18FE0C076B5913A5E264B09038C00CCC5B380402D0505602C3C54536FA0012AC9E39336
MD5 SHA1 SHA512 TLSH

Deferents/Programlinjes

SHA256 d2bc181c046f7cfa93ba681704e262e98036a0b03be67d332b209884baac4bd1
MD5 33efdb41c0e303c1367eb9310aaeb3f7
SHA1 437e2f2fb1b36327891b3d4790a69b34d3711283
SHA512 58aa4df2483f6f26a17722c45e01763da85ac972a52b1e7ad92dbc16646860e8d4a75790017575bffaa337f8044c33a20caa6ea15bf723d270ce26f3fb2588cf
SSDEEP 1536:8hce8d+dyOWtV0mB3zhyWU+Row6AucWtBRglT85GEcmZrg380QZE3KXsKukeY:YfsjttNzxTItklTucorg380Jal1
TLSH
T1A9C3CF95DB658CFECC17C53CD46E36A58C68B026070FD4BD61726829C28B2E353786EE
MD5 SHA1 SHA512 SSDEEP TLSH

Deferents/anettas.txt

SHA256 0dd727fd57863ab3beb5b4ead48b94192b017d0d8430bdfa1bec1def208ba0f7
MD5 a1ca49008a0117c40931ef10f2227278
SHA1 4b3fcac52488739fe76c480626b86a978af040d0
SHA512 2839936d24f30def881e7bcf281eea8ccb38617a90661ea9629610cf69c271c895393c4f8fa980f9f09ac1fd94a3ac2f5e1a691c9233f3fbd9040b29eeec0fb4
TLSH
T1720144C48C86831E884A530ABDE15583C93D584CAA3662ACFAF0574B068577E533CB69
MD5 SHA1 SHA512 TLSH

Forskningslederne195

SHA256 7d21877e42b0ec65c2472ffeb553b48f03ff60af0a2ddd34cb3a768f6228d0bc
MD5 cd064765393f38a29834c7b694d7b440
SHA1 c530c99494acb7806c30e5893e15ee75e47af7bb
SHA512 ff43c7348a81fb62c51c0e51a17f7bccc5777006e786fbb7585131e2dff4feb320e0366e6bf98b4818b4715298919aa8fd70634b39f98e063c516f5594df2361
SSDEEP 1536:n1oYCaZpwid0QiWh3M+u9LF9Z2jDGcRlZbxrMO3LMsjdDcrSaA50JPYgX0UdLpa5:uApwidpfAISCVM6LzdRh5yPzkUXa2vqP
TLSH
T1DDD3F14E23B2C126CC18EDB37BFA0691067E24B890ECD4DF8869D55EE2B5178DCB4917
MD5 SHA1 SHA512 SSDEEP TLSH

8698a2bb4ff21a5bb6c6f7cc43dbaf13827cb8248014377013a0f3daaace67c3.exe

PE Signature issue

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Deferents/Nabofamilien/doktoreres.ini

Deferents/Nabofamilien/goss.enk

Deferents/Nabofamilien/unbuckled.ini

Deferents/Programlinjes

Deferents/anettas.txt

Forskningslederne195

Sharing

General

Malware Config

Signatures

File Explorer

8698a2bb4ff21a5bb6c6f7cc43dbaf13827cb8248014377013a0f3daaace67c3.exe

PE Signature issue

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Deferents/Nabofamilien/doktoreres.ini

Deferents/Nabofamilien/goss.enk

Deferents/Nabofamilien/unbuckled.ini

Deferents/Programlinjes

Deferents/anettas.txt

Forskningslederne195