34b2921f06fbad2a5eb78b0abe6f88a6d1f23995766214212af9a0de795a10b9[.]exe

resource
unpack001/$PLUGINSDIR/nsExec.dll

resource
34b2921f06fbad2a5eb78b0abe6f88a6d1f23995766214212af9a0de795a10b9.exe

34b2921f06fbad2a5eb78b0abe6f88a6d1f23995766214212af9a0de795a10b9.exe

IMPHASH 7192d3773f389d45ebac3cc67d054a8a
SHA256 34b2921f06fbad2a5eb78b0abe6f88a6d1f23995766214212af9a0de795a10b9
MD5 e541f3e3e4258f9c314141c4eae990d1
SHA1 812733251bb335680e3c3bf298a61b41a16155ef
SHA512 11923164a76a12c8c9c51b4ace0f47e49e562260bf86091dd5a615fbcabe7b846027a06500b40be47bd325df42cbfbef09214ed38403525f7faffa559aee57d3
SSDEEP 12288:TDGZKmormA1yB8sRQF3/naKqjMZyM9/NBtT9FWfRFpKdYLyHCf7neOQm8zKeGc0:1mor/1yBraBva3jMU6FBtT9OFpKCLyHS
TLSH
T190F4232713A8C067C1306330C917A7F2C9B05D96E46A9F831A12BD5E787B2D2693D7E9
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

3d:71:04:99:2f:49:d3:89:11:43:80:72:ab:b9:03:73:3d:e4:76:53:01:07:6e:89:95:f2:6c:45:cd:c6:79:00

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Sequela,OU=forttningernes Fedtdepoters Preoccurred\ ,O=Sequela,L=Pittsfield,ST=Massachusetts,C=US,1.2.840.113549.1.9.1=#0c16646961726565726e6573404e79666967656e2e53706e

Chains

Aug 6, 2026

CN=Sequela,OU=forttningernes Fedtdepoters Preoccurred\ ,O=Sequela,L=Pittsfield,ST=Massachusetts,C=US,1.2.840.113549.1.9.1=#0c16646961726565726e6573404e79666967656e2e53706e

Minor OS version

0

Major OS version

4

Entry point

13238

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetCurrentDirectoryW GetFileAttributesW GetFullPathNameW Sleep GetTickCount CreateFileW GetFileSize MoveFileW SetFileAttributesW GetModuleFileNameW CopyFileW ExitProcess SetEnvironmentVariableW GetWindowsDirectoryW GetTempPathW GetCommandLineW GetVersion SetErrorMode lstrlenW GetCurrentProcess CompareFileTime GlobalUnlock GlobalLock CreateThread GetLastError CreateDirectoryW CreateProcessW RemoveDirectoryW lstrcmpiA GetTempFileNameW WriteFile lstrcpyA lstrcpyW MoveFileExW lstrcatW GetSystemDirectoryW LoadLibraryW GetProcAddress GetModuleHandleA ExpandEnvironmentStringsW GetShortPathNameW SearchPathW lstrcmpiW SetFileTime CloseHandle GlobalFree lstrcmpW GlobalAlloc WaitForSingleObject GetDiskFreeSpaceW lstrcpynW GetExitCodeProcess FindFirstFileW FindNextFileW DeleteFileW SetFilePointer ReadFile FindClose MulDiv MultiByteToWideChar lstrlenA WideCharToMultiByte GetPrivateProfileStringW WritePrivateProfileStringW FreeLibrary LoadLibraryExW GetModuleHandleW

user32

GetSystemMenu SetClassLongW IsWindowEnabled EnableMenuItem SetWindowPos GetSysColor GetWindowLongW SetCursor LoadCursorW CheckDlgButton GetMessagePos LoadBitmapW CallWindowProcW IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard wsprintfW ScreenToClient GetWindowRect GetSystemMetrics SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharPrevW CharNextA wsprintfA DispatchMessageW PeekMessageW ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW GetDC SetWindowTextW PostQuitMessage ShowWindow GetDlgItem IsWindow LoadImageW SetWindowLongW TrackPopupMenu AppendMenuW CreatePopupMenu EndPaint SetTimer FindWindowExW SendMessageTimeoutW SetForegroundWindow

gdi32

SelectObject SetBkMode CreateFontIndirectW SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW ShellExecuteW SHFileOperationW

advapi32

RegDeleteKeyW SetFileSecurityW OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges RegOpenKeyExW RegEnumValueW RegDeleteValueW RegCloseKey RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumKeyW

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/nsExec.dll

IMPHASH 0b75f1007d3cc8e457970ae3e3fd53c3
SHA256 13ebc725f3f236e1914fe5288ad6413798ad99bef38bfe9c8c898181238e8a10
MD5 1b0e41f60564cccccd71347d01a7c397
SHA1 b1bddd97765e9c249ba239e9c95ab32368098e02
SHA512 b6d7925cdff358992b2682cf1485227204ce3868c981c47778dd6da32057a595caa933d8242c8d7090b0c54110d45fa8f935a1b4eec1e318d89cc0e44b115785
SSDEEP 96:s7fhfKaGgchPzxK6bq+pKX6D8ZLidGgmkN838:UbGgGPzxeX6D8ZyGgmkN
TLSH
T140D1E7B832C20DF7D44D86743F22381717BDD47617B542A1CB932AD61EA2AE2FE21B41
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4231

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Fenja.Bes

SHA256 20331b84d2d929064043dcc479ddf4bba9287b3c31af3b319098ecee3869e4bb
MD5 c0b57020d60ea066bac9d3ea1aa8da80
SHA1 de4e6ec6f8b88048e0aad9716b8181b5bee79f18
SHA512 4345f71457b18b5e3a4a45424a06309eb31b25e497ac09e6e0ded8d0b92ae5aff6eeed5f7f6d2cc2c92a7b76bc6ba70e181d42ea73a255345256026542a5fa00
SSDEEP 6144:3kGSsmKGFHqg9K5H1eXaT2E4crkRxbIenqrseH:3kGj2FKg9K5w4MUkjI91H
TLSH
T145540121CF81DDA9EE40BD3380DCB49B5F8527DAC6635BEA44A0007075634DFB36A979
MD5 SHA1 SHA512 SSDEEP TLSH

Frontoparietal.ruf

SHA256 f59f52215b994807b8ecbb7804ca1c8b4214a8baaa2dd465e49080b695410842
MD5 87e50d263f04628637c01fdd66a8f091
SHA1 c6b097fd62805352c893727a5eda4beede2e413c
SHA512 3e0bf1bdfebff9c29e0c82b0e37ebec4fe6d94954391658f6cd95e485b76aa7e6fae87cb70e809684b060a5c966855ee9eb4e8eeb6f178a23ba1e5b69f7954f7
SSDEEP 768:wzAcmELvlCt64oADSmhDEZNe508HYwhsi6zgTmx5upMjAthZFH/Jd3gmXTQu5Y+U:
TLSH
T19FB5125197B9A16FE10603750E5EB87CEBD1A869E4BDE8CD85E1417372CA271E033B8C
MD5 SHA1 SHA512 SSDEEP TLSH

Hysterelcosis.Ski

SHA256 cf9fe81bfd78fb9f6e6eb9a73c8640ca13268d27f33f510e5fb0e12af0d33290
MD5 1a58145e0d35d2b804b724aeac7102f1
SHA1 0bc1a4491ee23168008ef21d0f61dc686680b870
SHA512 ab5d6862ce343c3554424977363e5cc494676221820ec62e54d091d589e63f23240f69bf304ea47233896db75d122a21d9d408344bd97caff72737c4bb08d738
SSDEEP 1536:9RLw8vCqwiuBEoQi+r3/5j5STXRwgBuinWt98906V:9xw89duBER5ST6gBn4Ep
TLSH
T1A173D0C0FB07096C8A8426DDD8550729177C4F35952AC0E3EBAF11AF60C22ED5B7EE5A
MD5 SHA1 SHA512 SSDEEP TLSH

aarsungens.bla

SHA256 09c869bfbb2a5b7cc84d9e0f56c4f9fa728e1f23c2415ddc0e74fc3d39aa6154
MD5 a7d919b312c1c74ab4c35a522d946b77
SHA1 80dbdc65b19cfb6cbe8aecfa41d28f450857dcc5
SHA512 389824fe2c76c6c2204a56acc7a160d133279b1c0c1f4a0635da9351c4d82661d31df2c536dc2a238f040a23aed46addd62657350edfba6820869b5b9c0473a5
SSDEEP 768:RaE9710bnra8qiClzbvAx57Ano7sKqOSTiTSqBoChrYB6j2QwGcklvNWuxDgQ4uv:C
TLSH
T1B4D5023A51206206C986963B77C6DAF50FDA713A173F0CFCA4B054DCA2C66771A76E32
MD5 SHA1 SHA512 SSDEEP TLSH

forsmgt.txt

SHA256 a85acbe8f4fad0ca373d1bc143633962c89d69e1503a3c310e283da4ef97b4d7
MD5 a01cf8b2f34d6f8d6a6067ad87ad420f
SHA1 c49bfd81a1418697165cb62edbeef5e8d47157ba
SHA512 b4784a1754abe449c17a5b88e2d4eca4d0b9a80e5a20416b80caaf8989fab9a6babcd711691d91246c9b1f12ba7c01fd00450af247ab4e4b64174e79466636d9
TLSH
T1EDE0F1208AF0B9AA16A1158E3C97191F14F100BF00050139BE6EC70DA21B7BFE77C18D
MD5 SHA1 SHA512 TLSH

salpen.zoo

SHA256 b8664acceaff8edc30b830ccee20bf79bac7d003169e8bd7a4c7fb025bbc83a7
MD5 862f3b806ed8ee61690b5cb807e4039f
SHA1 63579479347755219148db8926c9fae8ff3456a4
SHA512 64b1617eb008a3496732d5737f2602f47796b6342de64498bb93e1a3d94487fa1167dd008400fd19c46df013fd6c211420af4c33a9bac3e15d13c5be5984430b
SSDEEP 768:T+W5rfWR61urINGFhHyjTYYfH8tfhDPzQnR64u4EMMHPdu6izJlM/j2ZGoDuTmnj:moVSf
TLSH
T1AE36122661B5B96EC3AC51BB0332D43954863DCA9C84477C322A9F4E0AA52DD71BC0F8
MD5 SHA1 SHA512 SSDEEP TLSH

34b2921f06fbad2a5eb78b0abe6f88a6d1f23995766214212af9a0de795a10b9.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/nsExec.dll

kernel32

user32

advapi32

generic

Fenja.Bes

Frontoparietal.ruf

Hysterelcosis.Ski

aarsungens.bla

forsmgt.txt

salpen.zoo

Sharing

General

Malware Config

Signatures

File Explorer

34b2921f06fbad2a5eb78b0abe6f88a6d1f23995766214212af9a0de795a10b9.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/nsExec.dll

kernel32

user32

advapi32

generic

Fenja.Bes

Frontoparietal.ruf

Hysterelcosis.Ski

aarsungens.bla

forsmgt.txt

salpen.zoo