982ba92eff55877f6eda5e5a4f4e730a001f84ed736200e8ddea822cfb660b04[.]exe

resource
unpack001/$PLUGINSDIR/System.dll

resource
982ba92eff55877f6eda5e5a4f4e730a001f84ed736200e8ddea822cfb660b04.exe

982ba92eff55877f6eda5e5a4f4e730a001f84ed736200e8ddea822cfb660b04.exe

IMPHASH 573bb7b41bc641bd95c0f5eec13c233b
SHA256 982ba92eff55877f6eda5e5a4f4e730a001f84ed736200e8ddea822cfb660b04
MD5 b47978b3cc825d9597de564d9028b115
SHA1 5d5d34a88b46baa8fcab0060355f21e8e0eac3c3
SHA512 ef16fa2d38ba2d2874466779e452169891730aa98ef6aa868a50de709516fd073aa7b13e7e6d002592da090d7d04c87016b4cd64c3b40343031091d85f46787d
SSDEEP 12288:pwfHI3pxTfXb2eNjHW9qcFSVBR7cui8bb4Jl5i4o8yya+c0ED:pwfHI3pxTvb2eHYlF0BB00Y5U5
TLSH
T1A0E4235174F5C0E7EEB30F72BB665AEBA8AC674146256B4E2311AEAC7D311C14C2C48E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

8f:47:04:00:f1:f6:dc:bf:36:ac:57:a4:b6:bf:b3:47:38:3f:2c:49:c7:dd:f6:f8:2a:04:d0:5d:24:84:00:61

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Pornoshowet,OU=Byrindets Skolestarten Fdrelandshistorierne\ ,O=Pornoshowet,C=DE,1.2.840.113549.1.9.1=#0c1750726f766973696f6e657273405072616e6765732e556e

Chains

Aug 21, 2026

CN=Pornoshowet,OU=Byrindets Skolestarten Fdrelandshistorierne\ ,O=Pornoshowet,C=DE,1.2.840.113549.1.9.1=#0c1750726f766973696f6e657273405072616e6765732e556e

PE Signature issue

Digest

72:c9:bc:26:c5:b1:ce:1e:c9:ef:ff:cc:2b:e3:a5:91:93:2a:3a:54

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Pornoshowet,OU=Byrindets Skolestarten Fdrelandshistorierne\ ,O=Pornoshowet,C=DE,1.2.840.113549.1.9.1=#0c1750726f766973696f6e657273405072616e6765732e556e

Chains

Aug 21, 2026

CN=Pornoshowet,OU=Byrindets Skolestarten Fdrelandshistorierne\ ,O=Pornoshowet,C=DE,1.2.840.113549.1.9.1=#0c1750726f766973696f6e657273405072616e6765732e556e

Minor OS version

0

Major OS version

4

Entry point

13655

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegOpenKeyExW RegCreateKeyExW

shell32

SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW ShellExecuteExW

ole32

CoCreateInstance OleUninitialize OleInitialize IIDFromString CoTaskMemFree

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create

user32

MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW CreatePopupMenu AppendMenuW TrackPopupMenu OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW IsWindowEnabled SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CharPrevW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint CharNextA wsprintfA DispatchMessageW CreateWindowExW PeekMessageW GetSystemMetrics

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor

kernel32

lstrcmpiA CreateFileW GetTempFileNameW RemoveDirectoryW CreateProcessW CreateDirectoryW CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW WriteFile ExitProcess GetCurrentProcess GetModuleFileNameW GetLastError GetFileSize GetTickCount Sleep SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW MulDiv lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject CopyFileW

$PLUGINSDIR/System.dll

IMPHASH 509a34b3a68a773e0afb4259e68f9f82
SHA256 996645d7f16a6294babb6da83478062aed7b72318d7a51b66e90ab5d3edc51a5
MD5 6d08f0d5503bb100b8429fefaad163a6
SHA1 2a79aac2d3b715326c3dcd3c5cf2e33de3632a0a
SHA512 e259b1aff39c533e3e31cf4eb323c8eb22b2beeb5d8ce2c929de30702a6d8ab8076aeacc983d724b05d7d99a6de8c4d239bd159642c7e75fb86faef683360a1f
SSDEEP 192:cjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZr0QPi:s/Qlt7wiij/lMRv/9V4brr
TLSH
T1A9427C1297B089F2F151093819667F2A6FBEAC5C23F405A3CFE304C63D212CB9879243
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Franchisers

SHA256 02ab576119d8440a9dafc3e62632d840fba68224c7eb61b408aa4a3a9aa75cd7
MD5 18c08a268f87a1fbc59e2deeb63dd83f
SHA1 9e7210d4325f88c760b4804fb34ac7e31824145d
SHA512 067da29679391b90151903c6329e7ea0b6e82945812eac010d3920a4515425bb57725e8f6054e59eb6458712d85ba36999479c8bbd19dff59131b686a33f31ec
SSDEEP 1536:4ahsPcO6OoyErhVmf5M1QxuGHbGwKWv4apLkOYybpweXMRQoKnoeOZzxWX8niA2r:dqM040O5mgSAG0JRr3BuQHZ06T6tl+g1
TLSH
T105A43D5075C98AE0F61A5984EA78FFB211733973AFCA1CD22324F6004BBE9513A4D95F
MD5 SHA1 SHA512 SSDEEP TLSH

Omfavnelsen

SHA256 63d2d8657f1940d22d93e8370da8a6216f5fcf10092de420830485b6a23ce6b3
MD5 8e396dee285cf80f26df12806457e466
SHA1 b46f1ae18dc6a310d7c9170b4a64cea394e156dd
SHA512 102cd23b74d8926f01f1cd79676ded6487879aa2903da7bbc86e821d9b2310f60c2394d64d09013ab3f3fb5c09aa5a121464d98c4baa2d42ea383ebe073d9a89
SSDEEP 3072:9vup19HPaYlt6xUPoNv+6dOtWU4mh+AFtpEOXQjQkF9b16:9Q9HN6xtv+6wtFNw0O6
TLSH
T127D3F16E91266CA6DCA116344E7FA2E938F960F2C51FC97E98FA1232415C1F453DCB34
MD5 SHA1 SHA512 SSDEEP TLSH

laxiflorous.jpg

SHA256 2fe3d0e5893c44c46c0eeb13483614f6e61970c25a2cec4e1447daf6fcdf16da
MD5 db84352557d55f584ecfceefc5829fd5
SHA1 86bfc8cf5569119577212a0d9196ec83faf2c38c
SHA512 782300d171398a95606c02c69f16e6d888777c718ac28fea0ed8a8c73c9cbe5664b5ef7dda15b00fcf532de40df09f364bb80e337dc273a68cddb09509e34e2f
SSDEEP 768:qWA0ctsqu+vkt0UTvcgM4P2C4PdTqN3BRtfWjXTUwgLnytSf33v1xt6+xr:qWJctsb8kt0kcYP2TqxBbWjsLCS/f1x9
TLSH
T1AB03029B3A7F471AF9025956BF2B57BE53103F0217BEE6F804A0A505E1F2C82F22552D
MD5 SHA1 SHA512 SSDEEP TLSH

nonregeneratively.vas

SHA256 855129b3bb96f09cd6cee03c0c3af457798d051f0fa8aeb626b32410fcd89867
MD5 6f7af82f76fe836b287b8a9a2929c168
SHA1 fc027b3a9ee20ea6f8cd5a2ac66a89b8301c52b4
SHA512 30a98252f24c594b56775ef94225f703286861dfaed5656624663601fa46cfcccd8fe27c823c8024bed8724ea80358ee76955415c79504818d19f6686600a0fb
SSDEEP 768:LQ1V7d6uz9nmw4ZSuXrhtW2XVgMSa27o5cN/Z+v381F4AX0kAEshstgeD2S3nvnI:grIj
TLSH
T1774612D832620F99DFC1ED38C3A39ED808A5DF089063D549E357B5A37F2D919520A4ED
MD5 SHA1 SHA512 SSDEEP TLSH

occidentalsk.con

SHA256 616e859774abea6049e4459a900ad8734ea6e80b8a84f318d669bc1ed9dcf131
MD5 6288b3a1558fa970feffabeeef864336
SHA1 29fe40e6f16dfd7cb3240a2acfa32ba11884a890
SHA512 ac9cedbe200554dc2f68d14dcb0ebd69c99a7bd0b6e9e3d1df5ac8724f4f03c2a0e9ccb867fb803f439cb8810c9b94067bec09697a7d603ba2ef5a1ef0b8ea4e
SSDEEP 768:3a7XAf+L+cNnMT27ZLdf04Avj28d/TUwDV8+fjnEAlDA94aU4UlKqhrZXUX9C+a0:b3uFll
TLSH
T1FF46231430882FA5DBC67D7347CAD59DA040EA0E322C8BBFAC4E71DA5ED03F99065359
MD5 SHA1 SHA512 SSDEEP TLSH

poliovaccinationen.txt

SHA256 57e35b65340c53c8ee45901ff94244f98bdc05b141d847c5814eacb25efd8d0c
MD5 b3eafafa94fd96c0f3d7bff8b0fba060
SHA1 b09c914f73b79490a00bc2fdca647000865c425b
SHA512 341f0fbae77c7bd13622695c2ace957735416c65face386cef7750da97d61ff8047781fa2e81cdb19d4aca2033d40f2c1d664e4456f8eb08f058e94751d810a7
TLSH
T107E0231AEA0335070B4F2DB71CC418198129837C8B178475F2D48707080792C86F9A1C
MD5 SHA1 SHA512 TLSH

982ba92eff55877f6eda5e5a4f4e730a001f84ed736200e8ddea822cfb660b04.exe

PE Signature issue

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Franchisers

Omfavnelsen

laxiflorous.jpg

nonregeneratively.vas

occidentalsk.con

poliovaccinationen.txt

Sharing

General

Malware Config

Signatures

File Explorer

982ba92eff55877f6eda5e5a4f4e730a001f84ed736200e8ddea822cfb660b04.exe

PE Signature issue

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Franchisers

Omfavnelsen

laxiflorous.jpg

nonregeneratively.vas

occidentalsk.con

poliovaccinationen.txt