4d5696c5f59664e09584c457d82e78b2fd7ac681431ee0d5656907d404d34551[.]exe

resource
unpack001/$PLUGINSDIR/System.dll

resource
4d5696c5f59664e09584c457d82e78b2fd7ac681431ee0d5656907d404d34551.exe

4d5696c5f59664e09584c457d82e78b2fd7ac681431ee0d5656907d404d34551.exe

IMPHASH 573bb7b41bc641bd95c0f5eec13c233b
SHA256 4d5696c5f59664e09584c457d82e78b2fd7ac681431ee0d5656907d404d34551
MD5 ad3f54dc188882ed692b865923c19e72
SHA1 7b1adc98fd65ba1221f9bfd1c6088a49ef081a83
SHA512 3ba320a62208ebfa9905fcaae324335aeaa75bb383252b73b1b87e84eb2f3fa10e2cfc5f73c64aa2c38243500caac41fcd81300dcc4e31f4fd2d723971f33aef
SSDEEP 6144:Vbfopdha+pV8OJt1FQGYZVkFkMfNj0bKUK3voc:VbIc+p+O71FQJ4N0dSoc
TLSH
T14F54CF2533B5E047E6923A31CE65E1F8A8196EA1ED1AE40733117F0FBD78F92DD49281
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

95:50:54:af:79:4f:c4:dc:25:75:6d:0f:c8:d2:e4:18:56:e4:ec:29:d0:1a:60:a4:44:a3:ee:71:9d:30:41:f9

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Startelementets,OU=Sk Outsally\ ,O=Startelementets,C=US

Chains

Aug 6, 2026

CN=Startelementets,OU=Sk Outsally\ ,O=Startelementets,C=US

Minor OS version

0

Major OS version

4

Entry point

13674

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegOpenKeyExW RegCreateKeyExW

shell32

SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW ShellExecuteExW

ole32

CoCreateInstance OleUninitialize OleInitialize IIDFromString CoTaskMemFree

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create

user32

MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW CreatePopupMenu AppendMenuW TrackPopupMenu OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW IsWindowEnabled SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CharPrevW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint CharNextA wsprintfA DispatchMessageW CreateWindowExW PeekMessageW GetSystemMetrics

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor

kernel32

lstrcmpiA CreateFileW GetTempFileNameW RemoveDirectoryW CreateProcessW CreateDirectoryW CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW WriteFile ExitProcess GetCurrentProcess GetModuleFileNameW GetLastError GetFileSize GetTickCount Sleep SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW MulDiv lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject CopyFileW

$PLUGINSDIR/System.dll

IMPHASH 509a34b3a68a773e0afb4259e68f9f82
SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
TLSH
T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Blodforgiftningerne

SHA256 78c8ad03a75b0d91660bb587af4293b2ed5690e5a9f05cae2bb4f2947d12bad1
MD5 7e172c3e275aea7596ad463cb1bdd2d7
SHA1 c81f2bbd36515bddd53f57e0909930015714d6b1
SHA512 6ee98ea3be23427f1b5b2bfe2e2a18b3279f2f141839ffa7f45aa93db28fe44896d5a3d67c2f0240fac78108451ff701acbb18dac4c3054795739e61e6f20f2d
SSDEEP 3072:17klNJL7EmkHRp/HhWv3vwghmWxx0eIuuuuuuuuuuuHgMyARRRRRRRRRRRRRRREu:YYn/Ew1WuuuuuuuuuuuuYARRRRRRRRRv
TLSH
T1E4E3E1D70A2DCD5AC514F3BC6F2CC531A5B0B142A6BAD1AA41B68573DB5AF708C087CE
MD5 SHA1 SHA512 SSDEEP TLSH

Fordoblingers

SHA256 18b913e01ae0d0e2972032dd46c67539be7aeb91f0e44c78a2d40d65e03cb4cc
MD5 46a423ff4a3bf4d23968c0fb68b4b695
SHA1 90c673a1abc0b499d380fffe7f5c290891551e7d
SHA512 9db2a433c5edcf4fb604b1b2317061fc642a63f4724fc7b94e96e4093a51365e52104b8186db15602f7e404d4200bbaad130dce38f9df53a9dbee990ba02bf7d
SSDEEP 768:rKbrKVlpmaoOzQvjcGaiQxaMMjy6Jyf/HYcf5iMR:rKPeDXooQvIGa1xazj7yf/4miM
TLSH
T1EDD2AE57C35AACE6DF0A8134812B76964CA870C2FB5FF0B9A27DF454C11B2E27364726
MD5 SHA1 SHA512 SSDEEP TLSH

joshes.nat

SHA256 32539d9e474d9b275a86ddae3598343f928f450022fab52005c8189a312565a6
MD5 9e53819b4a7021a2d50e9b8ba3aa43bb
SHA1 0844d22eb7cc552781183de93d73c5a38b8e92fb
SHA512 11757ec6d586570d9121c8f8e3060b4a61a375c9bbd76e2c64d9928799a38663482da2960cf8095e2fa15c61fb2ac1380cc2239b42104ab3fae45f5ef6487f22
SSDEEP 384:eUat966cP9gQ6DZQMvRyn0De7Ly07F2e5:eNt966cP96DWM80De7LXF2e5
TLSH
T114536D2198F8231F45186FA1DEA8DB88EC17623237571720D86ADF8391BFC45C22A874
MD5 SHA1 SHA512 SSDEEP TLSH

joshuah.rea

SHA256 862dccbc39e1a91532e9ee039a37175b59c7eea1aaf58977da9a6f76bd0fd7bd
MD5 6f2c47fd815436f6bacff4469bee07ca
SHA1 eb45cbd1efb622afee348d4363437834f9b6fb93
SHA512 fae3f00020a83f9ea5dc63d0ec5e694933cbd149044ec8b237cb427b6e2f43e632011170130ad3964352a7c1ab015356c46786de8c7a73d58bc272d0a1bd037a
SSDEEP 48:K1KOBRWqoJV4+MK0hHWiIKn2FJrsEBJzVv5dymy/pj4pgLW6s80W3ZxV1UOK:qKQDLTnGB1XdybpjQ6sLWJRI
TLSH
T141C22BC1806ACFEBE2B4ADC173F4354D5318044A4E1A5A023875D8461C0948B33BEA70
MD5 SHA1 SHA512 SSDEEP TLSH

partivares.tan

SHA256 cdd526f1cdf1f62b3e0a61231614e0d6d986db20fb115a17769141c23c90ef44
MD5 cfb8c4a0df44a19758a52035ffb237fa
SHA1 52b6779060f65b56316347168574093019e98844
SHA512 3404a286a53b184fab52f21a098986a01f6196fe0b88943ed08e5f98b581356586ce0e9e3425ab0a9558ee707351a2c85ff16a4cf829ef7ffdcfdcaf0b9cb5e6
SSDEEP 384:SUFYRifGcVdN1vY76oQg92LZnuwQUILXdPKSAZRM:S2fGcF1vY76rgcLZuwQgSADM
TLSH
T17A839D98EDA8FEFE60FA6DB5C48DAEA5848591E746B06F00FF2CB348A008D102DD7105
MD5 SHA1 SHA512 SSDEEP TLSH

tilskadekomst.emp

SHA256 40dc37d959c8c4f5d17d3d757b44cbcd84dca0ee395140a5a70e622e83e97ef0
MD5 abf25fbdd3a8635fab7c61922dbc6191
SHA1 acea7476254437bd3eeb081d27d78cec2af2f871
SHA512 745a8e3246128b409c6c473ef6b22db8241c8164a28f7e017b6af40912d412fe218d662e2e8f0abde16b9cb717661ebfe863ee9d60f415caa19f407fb16205f8
SSDEEP 24:eyBPzRykF2wsc8gVTdZT72a0qMfwNHI8b06uGyIUKBDUBy:eyB9yknt8gNdZThMIRYGyI1BAg
TLSH
T158520A269034FECFAE04500DACD964D7A60607C1D6492E7648A3109CDB1792586731C3
MD5 SHA1 SHA512 SSDEEP TLSH

4d5696c5f59664e09584c457d82e78b2fd7ac681431ee0d5656907d404d34551.exe

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Blodforgiftningerne

Fordoblingers

joshes.nat

joshuah.rea

partivares.tan

tilskadekomst.emp

Sharing

General

Malware Config

Signatures

File Explorer

4d5696c5f59664e09584c457d82e78b2fd7ac681431ee0d5656907d404d34551.exe

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Blodforgiftningerne

Fordoblingers

joshes.nat

joshuah.rea

partivares.tan

tilskadekomst.emp