2d89c72b44ae19e629b7e5ae636c95dd1381806addda852d85068f830660b906[.]exe

resource
unpack001/$PLUGINSDIR/System.dll

resource
2d89c72b44ae19e629b7e5ae636c95dd1381806addda852d85068f830660b906.exe

2d89c72b44ae19e629b7e5ae636c95dd1381806addda852d85068f830660b906.exe

IMPHASH 9dda1a1d1f8a1d13ae0297b47046b26e
SHA256 2d89c72b44ae19e629b7e5ae636c95dd1381806addda852d85068f830660b906
MD5 04334e4c4356edcd7e2dbb6edc5aa6a4
SHA1 6493dce0cd60681781e51da6eb2fbcba0847cf6a
SHA512 bb19b8df7e95a5679736c6a671ea1622f74b15dd886149c36eceda6353f6280ff8b514422c2f3cc693452cd66e45873558e7507dab8b89163d632515718e70ba
SSDEEP 12288:cHadGnZ7YYQGQ+XR8+pObcwvj2w3RUw31:4adGnGN+XR10j5RUw31
TLSH
T1E8B4121EF780D86BEE5265723476D3DA5BF84C764A39E74B7B183F08AAB30A04E17141
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

2d:7c:86:c2:14:87:3e:c9:30:20:2a:61:7b:2d:bd:70:38:42:c2:c6:b2:77:0f:2e:06:f7:65:75:d5:fe:7e:7b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Homogenize,OU=Overprosperously Benzoxyphenanthrene Dees\ ,O=Homogenize,C=GB

Chains

Aug 6, 2026

CN=Homogenize,OU=Overprosperously Benzoxyphenanthrene Dees\ ,O=Homogenize,C=GB

Minor OS version

0

Major OS version

4

Entry point

13925

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegOpenKeyExW RegCreateKeyExW

shell32

SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW ShellExecuteExW

ole32

CoCreateInstance OleUninitialize OleInitialize IIDFromString CoTaskMemFree

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create

user32

MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW CreatePopupMenu AppendMenuW TrackPopupMenu OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW IsWindowEnabled SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CharPrevW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint CharNextA wsprintfA DispatchMessageW CreateWindowExW PeekMessageW GetSystemMetrics

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor

kernel32

RemoveDirectoryW lstrcmpiA GetTempFileNameW CreateProcessW CreateDirectoryW GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW WriteFile ExitProcess GetCurrentProcess GetModuleFileNameW GetFileSize CreateFileW GetTickCount Sleep SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW MulDiv lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject CopyFileW

$PLUGINSDIR/System.dll

IMPHASH 509a34b3a68a773e0afb4259e68f9f82
SHA256 23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6
MD5 192639861e3dc2dc5c08bb8f8c7260d5
SHA1 58d30e460609e22fa0098bc27d928b689ef9af78
SHA512 6e573d8b2ef6ed719e271fd0b2fd9cd451f61fc9a9459330108d6d7a65a0f64016303318cad787aa1d5334ba670d8f1c7c13074e1be550b4a316963ecc465cdc
SSDEEP 192:ljHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZqE0QPi:R/Qlt7wiij/lMRv/9V4bfr
TLSH
T1B1427C1297B089F2F551493419667F2A6FBEAC5C13F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Amygdale/skospndernes.ini

SHA256 7cef4343a01c5d589411428406da5a379ac037e8f657b54d02ac0e0bc0136b0b
MD5 c4e5a1e6711d3be1c2ccb90a91831825
SHA1 1aa436dd31b6a33fa855f669a9a49937272bb86e
SHA512 096b24c3b3c24002a0e1d068fbe55af2e4751fabe5fab7ae70675b4028c313c19b91445c445b4c8d86aa3ca81a02602257909fa29517ea8c2fafc7f8a6d2ab9d
TLSH
T14DE0F178E89E509BC1051FBF7C805B923BF27208180C01D4E589CB0C380395BD3BFA45
MD5 SHA1 SHA512 TLSH

Amygdale/unwarn.aad

SHA256 4b4ddd6883f1ed724e73195cec45ebb3c0ee1229df87430dd3d6e665df955f86
MD5 5ed39b36ad7ac10b8c018d11e76f68df
SHA1 cbe4628532ce2301f2a987203467fe65d8d27331
SHA512 6e50b41035c91bfa57e54713adba7a6a259ef5b197269b3541a0cdf6d44eca7ed03fb18a8c8edbe70731f4fa32b9d564a1829d10fe5f1341121774133f5075d6
SSDEEP 768:XWx/bV4tJuUop+ARtb9R1Jqg1aQPNnJcAsRVyTJM2SzIZxjgCSfnZvnzBp8Ui0x5:sq2Wglw
TLSH
T18E561273386A72CC724C6D56CE6D4A1FDA6DB7DF4EE50BA4B80A2C7138C6758081EE50
MD5 SHA1 SHA512 SSDEEP TLSH

Neurocentral

SHA256 95d23fbadd27163f88998337bba01ea086e0f1e6c7be59684fca66ff53f6a235
MD5 36122d7b0fa9f006a486585e98e9ad18
SHA1 e1a8c57d4e553e3957654c69d01bf2e9d0efc576
SHA512 103f0d11c9f834a5c5473df24b9a986cb754816fda9b1d894ef822d3b1afe2f097a01926f8b52e53510806f0e5bf99fce3b0eb2f6123f77e1f6bc0d4a4e383cd
SSDEEP 768:4YRXeYgOUKi7dxdK3oUTB10X3+aFTaI6R6QBbW:pXfgJMBo+aoI2DBbW
TLSH
T1E9D2AF90DB26CD77E9135B34C1AF725F0D9420066B0EE5ECF1359528C1832EB7368B6A
MD5 SHA1 SHA512 SSDEEP TLSH

frdigkonstruere.txt

SHA256 e68b3f6dfff949f6965ab9f766c9e8be3f2cdeb9d3f1a26c061ad53783a7d1f6
MD5 57f84c41d4bd84477418e3d5e3cdcc41
SHA1 1e1bdca4106615afa1b13a501469a5669cb49380
SHA512 53283e5a330fadd0fe91f1a8d6655c5b59c056041c2f5336f44c147e96a19f75a49dd392a243e1a024904c42d0b6ff01b1ff41eec58943358c00a624e2c7c179
TLSH
T1C2E0F184EA11D12D1903A1853DC62D26130C72059836C7E4BCCE27CF3123C08A5FFB1D
MD5 SHA1 SHA512 TLSH

mandaarene.ini

SHA256 880c7245685b8e787bd53bd95ebb018f0a9b087d290ed3fbdbc2df26cdc3b7d5
MD5 632386e6a877820d530804d8e95efd5b
SHA1 db983a7ebc77e086341b66eda1faf3ce0e136a72
SHA512 3b7647c27b51d4d3727dbf289ccaf84be3dedfb20beda56c5cace269ad9d0e50f187759ba905605f33061f95c76fff0230dad91b9f093225bb842d6e143961bf
TLSH
T1BFF041D44C7C7922191E03F40E21C850CCADE0B2872803EBE5D39B8D4217488FA7DB5E
MD5 SHA1 SHA512 TLSH

seksualklinikken

SHA256 ec94f492e722a633f82e6009e14d845fca8c3859661603c00dcd033455933d10
MD5 45bf1d5b9067b9ac9fa5c5713830aa0a
SHA1 64dd5009a4401c3b8a9111fa253891efb80160f4
SHA512 206bc629665be9b2ccf8e0ea98a4cd0cca1dac3fe5e5ec323ae9dcdf321d1c17aa34c598950feed22ee8189e9eb10ca1b3f599c97a3e7a5e524b5b6d6006cc00
SSDEEP 3072:R5W1NCTvM3XcXQ24Q5XUIvd3CR99h+gsT2rEPBZ9GN/ItG+zV:X6NT3Xcz4DwI6gsTiEb9iQPzV
TLSH
T124D3F117A72D6CA4CB53AD788C461EF4461DD830EC85990AFCF85B7B4DFE036A7046A8
MD5 SHA1 SHA512 SSDEEP TLSH

2d89c72b44ae19e629b7e5ae636c95dd1381806addda852d85068f830660b906.exe

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Amygdale/skospndernes.ini

Amygdale/unwarn.aad

Neurocentral

frdigkonstruere.txt

mandaarene.ini

seksualklinikken

Sharing

General

Malware Config

Signatures

File Explorer

2d89c72b44ae19e629b7e5ae636c95dd1381806addda852d85068f830660b906.exe

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Amygdale/skospndernes.ini

Amygdale/unwarn.aad

Neurocentral

frdigkonstruere.txt

mandaarene.ini

seksualklinikken