eb1b0429baa22c83c2d1aea6f3184c0437dfa60c858c0560a2e17b67bef455d7[.]exe

resource
unpack001/$PLUGINSDIR/System.dll

resource
eb1b0429baa22c83c2d1aea6f3184c0437dfa60c858c0560a2e17b67bef455d7.exe

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

eb1b0429baa22c83c2d1aea6f3184c0437dfa60c858c0560a2e17b67bef455d7.exe

IMPHASH 3abe302b6d9a1256e6a915429af4ffd2
SHA256 eb1b0429baa22c83c2d1aea6f3184c0437dfa60c858c0560a2e17b67bef455d7
MD5 599a56cc4d662d6058274aaac37c2faa
SHA1 7490ee13458a2e8892b848008b6ae05f1463b86d
SHA512 37b233de2faf3841f841f2138854ce88e8630baff244bcbe4eca3f803f2f5a7c7a5e35cc829997ab8782c2aff658917a5f4e842f099043fa1fd0dcdca1ab18ed
SSDEEP 6144:A8dWRY/5RH3Ctm1TK0tNcWG8AAhKd7O+0zK:BMRY/TncWGj97O+w
TLSH
T109441212E130E4B2D6A51633417BDFE60BB94D605A102BE77B487E0EBD73293C91F252
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

6b:b9:7f:cd:c0:54:13:11:8a:00:ac:98:d5:8a:d2:01:cb:ab:c0:c4:19:e2:e9:39:3d:b3:91:c2:de:0d:dc:98

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Misoxene,OU=Intellectuality Terroriseres\ ,O=Misoxene,C=US,1.2.840.113549.1.9.1=#0c20466f727265746e696e67736f7264656e656e404d756e6963697069612e446572

Chains

Aug 21, 2026

CN=Misoxene,OU=Intellectuality Terroriseres\ ,O=Misoxene,C=US,1.2.840.113549.1.9.1=#0c20466f727265746e696e67736f7264656e656e404d756e6963697069612e446572

Minor OS version

0

Major OS version

4

Entry point

12750

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetTempPathA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess SetEnvironmentVariableA Sleep GetTickCount GetCommandLineA lstrlenA GetVersion SetErrorMode lstrcpynA GetDiskFreeSpaceA GlobalUnlock GetWindowsDirectoryA SetCurrentDirectoryA GetLastError CreateDirectoryA CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA ReadFile WriteFile lstrcpyA MoveFileExA lstrcatA GetSystemDirectoryA GetProcAddress GetExitCodeProcess WaitForSingleObject CompareFileTime SetFileAttributesA GetFileAttributesA GetShortPathNameA MoveFileA GetFullPathNameA SetFileTime SearchPathA CloseHandle lstrcmpiA CreateThread GlobalLock lstrcmpA FindFirstFileA FindNextFileA DeleteFileA SetFilePointer GetPrivateProfileStringA FindClose MultiByteToWideChar FreeLibrary MulDiv WritePrivateProfileStringA LoadLibraryExA GetModuleHandleA GlobalAlloc GlobalFree ExpandEnvironmentStringsA

user32

ScreenToClient GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard PostQuitMessage GetWindowRect EnableMenuItem CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndDialog RegisterClassA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx GetDC CreateDialogParamA SetTimer GetDlgItem SetWindowLongA SetForegroundWindow LoadImageA IsWindow SendMessageTimeoutA FindWindowExA OpenClipboard TrackPopupMenu AppendMenuA EndPaint DestroyWindow wsprintfA ShowWindow SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation ShellExecuteExA SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA SHFileOperationA

advapi32

AdjustTokenPrivileges RegCreateKeyExA RegOpenKeyExA SetFileSecurityA OpenProcessToken LookupPrivilegeValueA RegEnumValueA RegDeleteKeyA RegDeleteValueA RegCloseKey RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/System.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 904fd5481d72f4e03b01a455f848dedd095d0fb17e33608e0d849f5196fb6ff8
MD5 55a26d7800446f1373056064c64c3ce8
SHA1 80256857e9a0a9c8897923b717f3435295a76002
SHA512 04b8ab7a85c26f188c0a06f524488d6f2ac2884bf107c860c82e94ae12c3859f825133d78338fd2b594dfc48f7dc9888ae76fee786c6252a5c77c88755128a5b
SSDEEP 192:MPtkumJX7zBE2kGwfy9S9VkPsFQ1Mx1c:97O2k5q9wA1Mxa
TLSH
T1F2324C15031086F3E1D2853D682B39AB2FB969118AF04E438FB35952EE347C7AD79352
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

9993

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Hamada235.cat

SHA256 2b85fe2d53bfab1d1a98968a57c9cdbad4a2d52e085fb517fa93bfb83f5188df
MD5 3c322fd3359a6e1b0c52de353c60f494
SHA1 636834fc7e55eda2288417b3aeb696f2d9173b9c
SHA512 2c448932e25f11213842087056b6374af16231ddc9e504f2ed2e5007e6944c03e725c5dd9f70830c0a04cd42331b91465f82f01d3d3e52f89077a35bece91015
SSDEEP 48:MBtZQcaOscGQQ6BJ5XIbVdBLkQ8ODz01xDnPCflR:YtKcHQ6BJaJGNPCfX
TLSH
T1D333F88E64344CAD8886EB3DFAE006DD61CD959E6A048E9C4064818BB76DB3021254AC
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Scoldingly/Bildks

SHA256 70157724b93a039049dec8a253ff8ddbbbd161076bd47f92c24dc6af49bd5d6f
MD5 61d1e59eaeaf0cabcdc777cb7195281f
SHA1 be81a956711330381ec7241573d51314c40077a5
SHA512 5de445471541dc56b7e1d8f979640712e5ca7be9d933e322990db70e65c0ef60ba3007b01113e2368d4871eb64e3725a3918deef915b95f81ff896f74dffba4a
SSDEEP 768:WLfcc9SBH1mppjzV8rrJZXOoobquZ+vK8sq2DYYPixzH:EfcqYH1EzV8HLPUP7Tixj
TLSH
T1F1B29ED6CB45DCB7CC26D138C83B22F68DDC3009EF4FA4A96161293AC1976F2639119E
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Scoldingly/Possodie.aag

SHA256 3d302a50b36ec4e397e2ceba8ab93e92b2d2a047d56d81075b125d735f17c467
MD5 5fbe71db499bcae8159909d144d57ef4
SHA1 ca9d177d2daa2e8d57403168712eb392b0b875f9
SHA512 aa9fa55eeb3d50a07f545fe313b5df3e5ec68dd68f79c8c4b1d368b3c20c877987bdb9f94b5e66790fe6cd77890807826fcbd37e12688bfade615b9f7f11f155
SSDEEP 12:0OnCOp0QcfIkOOm2RPOmytOcO8VTVYOWOH:06p0Qcf4O8mywzcxYKH
TLSH
T120222B00464997E61213E0A74502F27D7D40F89CC5C144AEC22B2982FE75AD86794BB0
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Scoldingly/adjudanturerne.prg

SHA256 0d5218628cc428947050f228d5b590d762ad1f0a794bcc6be7197101ea7f36bc
MD5 f65181dfba068f14fc94bb32fcd89e82
SHA1 f98138f484893b5afb5cfdeeb752f0f63288c9e3
SHA512 d49ac183fc8c4234e0bdd304105495e503b82f69fa4481dcf0e89996b2ad68ae8c403c7a86624857df94662c6e3bc5ead5190534eca1e337fb62abdeef1e99c2
SSDEEP 24:LF8vTV6Rlj0aprAVszjRqyppd5uTvvTge3UsKuD0v1IqDU1:LATMR5pcejkyppWTHUcwuDcIqDU1
TLSH
T18CC24E8EEA94661F0F1E1AE0D457AF20D3BC121A6A4A2A0F33554FD0091C2FD03AC85F
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Scoldingly/africanist.til

SHA256 5181193c6b65de5187358d57ca62cc0cafbd6942c654bbee11487a8b24585974
MD5 ab41a136502a8845f8a4149883556ae5
SHA1 9018a26d02d676dbc05cb38744eff25f7a4e9712
SHA512 ff88add8e5e3eeaafb0c618cfd2def3789743c2b197010bcc6c3bb679d330fb645d92ba476f58bf621f25ce6381d4e0834615b6c99d44bbb096feb98bb045b1a
SSDEEP 48:TIsXlmlODNkI10H/xPUs6FmHzMr7RfRHL:TIsXAXY0BOFuzC9Rr
TLSH
T1FD7307ED2471CA4C47B9417DE7187C062C62A7F86DA51AB639ACC25F930A0A1208F87F
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Scoldingly/anacyclus.ref

SHA256 9248bcbf7e526bf2e6ab44c37dd5313c11e45e1d1776fefde9e1002fe443d0a0
MD5 5e3f2cc90601a34f8a450e139e38ac4b
SHA1 7c691663eff59abff8e09350201be018426e6f88
SHA512 926c13848cb45fbfbfc0b6349dc45cdc3457ae7f338fdb2bcc4f426edc032378870ec07854bbfa133e5adc953577f4a3a9b9ed7068aefa5dda012621a73e216a
SSDEEP 48:1BKjdTjC3Dskkw5WgGGlaUtg5PpZg9nbBLfwyvd:1BKZC3Dsdw5b8U+5R0NLfxd
TLSH
T102834AB20E28E75D2F7231B803F3897E65EE5238CD04592CC769CE31428D896590F60B
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Scoldingly/successionssynspunkts.stj

SHA256 89297f463e822150c5a306335f87573a3fba91992db3d87b60a0eb420638c8a2
MD5 094139c6c423e09ef7eebbfb12657c6a
SHA1 10be594f41e6557019c207e51273b14d3a200d7b
SHA512 b7838c98699ebea5f9be0f222288328a590162b2dbe6d9e79e91f3b7e0b70960892fadd0e2a76f92c6cd0d20cb5e0228a8a5551a331781bc37c38be0b1905309
SSDEEP 48:+qAeWZ82dJen1QoW71QdmT0cHYuuE7R+nRFge/H6k8jZlBUNvEpxThb:vym+oU1Qdw0gBR+nzgChIl2ipxp
TLSH
T12233D7914D1265CADD468DDB3698BF83AD0982C62DC22827041F0D434124EBAB9B1E2B
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Spatelformede58

SHA256 b85134d0749d6e7229b9591d765c71d7e15a2ca6fd23b6c08993509f4876e8bb
MD5 5cfd0235cf57409235fe5e746c9fb2e7
SHA1 4aa5d9e2fa5847908b7fc24dc6430e8a2774d4cb
SHA512 c01b2b5d93badf60a86a93cb0cf607b5b4def94b0cb37b2b5525424d968fba7ed1bb75a52801df3f235536b145db24d01e3f2a493a72f1ad3bbe804fc8a88997
SSDEEP 3072:vVouUA/9aSUMJNBdi5a17LkafXLCicYwI44+xDA6nIwEfkoO6gTODndEgXWGeq4J:RU0t31fkuCiO4+ViMofAqd9eq4J
TLSH
T1AB24E0A006FD3FB5C7C370F4B3DA95AF2E59A8ACE58DD7620651135A80DE0762B140E7
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

eb1b0429baa22c83c2d1aea6f3184c0437dfa60c858c0560a2e17b67bef455d7.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Hamada235.cat

Scoldingly/Bildks

Scoldingly/Possodie.aag

Scoldingly/adjudanturerne.prg

Scoldingly/africanist.til

Scoldingly/anacyclus.ref

Scoldingly/successionssynspunkts.stj

Spatelformede58

Sharing

General

Malware Config

Signatures

File Explorer

eb1b0429baa22c83c2d1aea6f3184c0437dfa60c858c0560a2e17b67bef455d7.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Hamada235.cat

Scoldingly/Bildks

Scoldingly/Possodie.aag

Scoldingly/adjudanturerne.prg

Scoldingly/africanist.til

Scoldingly/anacyclus.ref

Scoldingly/successionssynspunkts.stj

Spatelformede58