b7b3831399d9a7c33cc0802783f290cb3e2bee5b5a99020a95da396e215a3e71[.]exe

resource
unpack001/$PLUGINSDIR/System.dll

resource
b7b3831399d9a7c33cc0802783f290cb3e2bee5b5a99020a95da396e215a3e71.exe

b7b3831399d9a7c33cc0802783f290cb3e2bee5b5a99020a95da396e215a3e71.exe

IMPHASH e2a592076b17ef8bfb48b7e03965a3fc
SHA256 b7b3831399d9a7c33cc0802783f290cb3e2bee5b5a99020a95da396e215a3e71
MD5 7a3950eacbbeff31ae00f4d80d56a97d
SHA1 fdaa2cc37cb37f24abbf6da7af6cdf27b6d9f9b7
SHA512 3c916c6a8674d9c0e7f4d5ac1762ac57facb07bad9e4e1586f46aa6f66d33f61b3c091acae7a689579f2f386a74b525d4c591b66b5869a0a3ebb3328789e92d4
SSDEEP 24576:UjvTizhGAfP8sV21yXvRkIPYvzQasJ6lIyh0IX:U7EUAcsVXSxvcasQlIyhV
TLSH
T1521523427790C86DE272093AC9387EFEBBA06DE9D5916E2713443D4DFC3A2D16D0D682
MD5 SHA1 SHA512 SSDEEP TLSH

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

f9:17:06:cf:74:64:ff:99:23:08:53:a7:89:a4:8d:e9:e4:18:22:ed:c8:ef:ae:62:0a:d2:ae:bc:9c:28:ce:bc:1d:bc:30:49:14:7e:5c:de:e6:a7:61:8b:d7:9a:71:1b

Digest Algorithm

sha384

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=kummerfuld,L=Niederirsen,ST=Rheinland-Pfalz,C=DE,1.2.840.113549.1.9.1=#0c1a536f6c64726167746572734041666768616e657265732e536b6f

Chains

Aug 21, 2026

CN=kummerfuld,L=Niederirsen,ST=Rheinland-Pfalz,C=DE,1.2.840.113549.1.9.1=#0c1a536f6c64726167746572734041666768616e657265732e536b6f

PE Signature issue

Digest

8e:b8:4b:2a:3f:6c:1d:68:01:9d:f8:9c:30:f7:76:1a:b5:80:bb:2a:9b:4f:04:db:98:51:db:1b:1b:c9:28:7e

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=kummerfuld,L=Niederirsen,ST=Rheinland-Pfalz,C=DE,1.2.840.113549.1.9.1=#0c1a536f6c64726167746572734041666768616e657265732e536b6f

Chains

Aug 21, 2026

CN=kummerfuld,L=Niederirsen,ST=Rheinland-Pfalz,C=DE,1.2.840.113549.1.9.1=#0c1a536f6c64726167746572734041666768616e657265732e536b6f

Minor OS version

0

Major OS version

4

Entry point

12960

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetCurrentDirectoryW GetFileAttributesW GetFullPathNameW Sleep GetTickCount GetFileSize GetModuleFileNameW MoveFileW SetFileAttributesW GetCurrentProcess ExitProcess SetEnvironmentVariableW GetWindowsDirectoryW GetTempPathW GetCommandLineW GetVersion SetErrorMode lstrlenW WaitForSingleObject CopyFileW CompareFileTime GlobalLock CreateThread GetLastError CreateDirectoryW CreateProcessW RemoveDirectoryW lstrcmpiA CreateFileW GetTempFileNameW WriteFile lstrcpyA lstrcpyW MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GlobalFree GlobalAlloc GetShortPathNameW SearchPathW lstrcmpiW SetFileTime CloseHandle ExpandEnvironmentStringsW lstrcmpW GlobalUnlock lstrcpynW GetDiskFreeSpaceW GetExitCodeProcess FindFirstFileW FindNextFileW DeleteFileW SetFilePointer ReadFile FindClose MulDiv MultiByteToWideChar lstrlenA WideCharToMultiByte GetPrivateProfileStringW WritePrivateProfileStringW FreeLibrary LoadLibraryExW GetModuleHandleW

user32

GetSystemMenu SetClassLongW IsWindowEnabled EnableMenuItem SetWindowPos GetSysColor GetWindowLongW SetCursor LoadCursorW CheckDlgButton GetMessagePos LoadBitmapW CallWindowProcW IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard wsprintfW ScreenToClient GetWindowRect GetSystemMetrics SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharPrevW CharNextA wsprintfA DispatchMessageW PeekMessageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow LoadImageW SetTimer SetWindowTextW PostQuitMessage ShowWindow GetDlgItem IsWindow SetWindowLongW FindWindowExW TrackPopupMenu AppendMenuW CreatePopupMenu DrawTextW EndPaint CreateDialogParamW SendMessageTimeoutW SetForegroundWindow

gdi32

SelectObject SetBkMode CreateFontIndirectW SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW ShellExecuteW SHFileOperationW

advapi32

RegDeleteKeyW SetFileSecurityW OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges RegOpenKeyExW RegEnumValueW RegDeleteValueW RegCloseKey RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumKeyW

comctl32

ImageList_AddMasked ord17 ImageList_Destroy ImageList_Create

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 2e226715419a5882e2e14278940ee8ef0aa648a3ef7af5b3dc252674111962bc
MD5 a4dd044bcd94e9b3370ccf095b31f896
SHA1 17c78201323ab2095bc53184aa8267c9187d5173
SHA512 87335a43b9ca13e1300c7c23e702e87c669e2bcf4f6065f0c684fc53165e9c1f091cc4d79a3eca3910f0518d3b647120ac0be1a68eaade2e75eaa64adfc92c5a
SSDEEP 192:em24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35OlESl:m8QIl975eXqlWBrz7YLOlE
TLSH
T168325C12135081F3E4918138886B3A276B6A15029BF98E57DFD39646BE21BE3BD7D603
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10183

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Chararas.dip

SHA256 191c7a113320705b57166b2f1eb267d54c5aeed97a174fa843eeb19bb2186c31
MD5 ebc262c1340e7150a01d3456853a2d71
SHA1 b4c02f5f12489ddaf1d9512ee41a07aa1e0f5d7f
SHA512 3d535b45c68bcab00f93b1a9ead6436d84f25c38d374eb75c8172fe58516e60fbf399f2beed8d2d00163a6564d07bbcf514b13e8e0eed4eeb5b4b9d8479afb4b
SSDEEP 3072:0pQ5nP8SpjtGF5qSxZtvHRbc23pT/c2pgL/lSOl6uVtFoug5ZLpSsS2ruUbbZtZC:J1
TLSH
T1D20612DF1D7A634AA9E64C3F3C4E860450D73852F08C3FD845B8227F6BAB971693064A
MD5 SHA1 SHA512 SSDEEP TLSH

Folkeafstemningers.Sys

SHA256 69dbd7cc74d5ad0f86da5e6ca8f8484fbccccff6b6ac7a8bdd5d5c5ac82bb938
MD5 fe915f881de4fd8dee2ea74d33b2e131
SHA1 2e635630bd8abe99fdb82e9e71ed55bee491222e
SHA512 ab95f2223203ef4d103d8ee9815d59dfcf37d7ec0e8d5f5c8a4878daf1be8e4c5cec8caa8ae42003525bf5daff15f9a596d3eae93b42e5f00c6d8c6d6a2e8494
SSDEEP 3072:rK/upx+EGFJQLFHwZL3udZaoX72yL4l6dhr0:rA3Fz6ZuyL4l630
TLSH
T1E9D3BF62DB56DCFBCC47C538C86D72A24D6870025B4FA4BE913B6904C18B2E357746BE
MD5 SHA1 SHA512 SSDEEP TLSH

Gpwsta.ini

SHA256 4b285b8b2f4400ad916518e0fd5142416101cd8929e4da94ad151d6b74d2b6d5
MD5 8800e338226d2efed5fc9abae05758a5
SHA1 43494df9e64040fd365ff46e02999b7acece8367
SHA512 2f05b45a00c463ae23bbf1340fda11a887dab18df23cda6165004bf4aaf8fb9382e872b72e49d8b62967850300371677c910a9fd8ca43edfdd28031162d0f50b
TLSH
T1C8E0F151D8B4A2F406B351005A010BA71BB44A1D51284FDD62C68D854407607E65E859
MD5 SHA1 SHA512 TLSH

Grundstenene.Non

SHA256 1132e6620df0e27750e246dcecac087de51091439e3ce667aee6877a4cdd4186
MD5 043c8613280ffe88567ec87240e2869b
SHA1 8dd06e72cfadda35410c6eb6bc8c40dec8e18dbe
SHA512 4983d863ecd11d04b96c9460167d5b82b14a3b996a3de47ebed53e3fdb39cb4a0463866e2e6e3bdf7a7e059caa580438bf93a93e26e21847db2ef6dfd245e45a
SSDEEP 6144:4qjgcAsXQmhgiMMz8ogcKVw5To+34WDScZvVhz:4qjYXmhdMJhc4Ko9yVB
TLSH
T1BA24E046C005C6869AEA82145A4C0BDFE0ECED6F1354F359706EBE63B72C26A7333756
MD5 SHA1 SHA512 SSDEEP TLSH

debases.mod

SHA256 95e324bc8855c42b6577087de5cb5d375ea03569348241c458e60e06762a5b61
MD5 2578b2e40803908164c82299bd0f7fd4
SHA1 a310223a1896d24789a8c31eebd38a2957174794
SHA512 5cd141c0b61ced5a40146d51711b20633684d809c029dafcdc95da2fcf0f28d3381fff7e1c4388e72a7234373cbc516c0ac5bd5ff524a19ed9ee6c97c0360ec0
SSDEEP 6144:2VxNWqf7mgymSj/Kiq24LHzX2cAuqYP+Y7L/83WWquuJ7hDqeCHgZA/mwtu4YzXs:f
TLSH
T1E8C5023367E877FD632425A6780D587FF2907A1DD9AB9C7B8F853E650B6F0011AE0290
MD5 SHA1 SHA512 SSDEEP TLSH

dissipater.ini

SHA256 5a442aeec75683c5da6ffcb60270d3715fbd301cea6af76d021e02fdb894dbbf
MD5 4efd97330faa4070046695c1372085c0
SHA1 c454dd4da1158f7d0001391337bf4fbd95f1e8a9
SHA512 fce9f9c9dac6076d88a71a142444b5940e6de88150ebb060bf6ca617bc8cc8b9dd40eef3e8b1cf4f4171a9cd0fc67f89c147b1efa32cdbf60db1ca03820e24dd
TLSH
T10DE0AB9DDC97893A0E41D5E8B9308CA04A1902E9D2820F71B1A9974D12C9681B3ADEDC
MD5 SHA1 SHA512 TLSH

dynejakkens.ini

SHA256 e9480711df067ed5f5fce61ffb41d8f0fa3463a014a23f1142581d65461562b3
MD5 3d6fb858e9548a843669d359a0101e80
SHA1 42ae1d8fd5feb040a95209f7eeaef9e9c5609ef2
SHA512 f22a2c4d73d964490aea8f46595d9425505388ac6e95007795fb86d7ade2753cdb22f7548c9d193e3cd3a1b13e137f93ed1f985b11c583e875404282d369f11b
TLSH
T11CF075108FAC627FD803B828AED0A99E7BD7C06466392C97AC530E0B45077ACD3DD311
MD5 SHA1 SHA512 TLSH

hdersmndenes.ini

SHA256 8963cb495214132f7c406af0b7e5d804d023b1974ecd42e54d1afb3b1fa876a2
MD5 43025ceeb50bdd922661f560ef48b43a
SHA1 09d6637558a6c8ee36a03bd1986c3535578a0ce8
SHA512 6a03aa32a3cdb4f0051dfb5231d6421c4fdb5c5182e724bd468e8bec41f8695fe91eb31923339bc5c69f7fe25aed55752420e29d945b4c1f10194a9149830634
TLSH
T10AD02B083BC791175FD3575E7131CD9642009524CC58016AB9561365A921E60071751D
MD5 SHA1 SHA512 TLSH

kaffesladder.txt

SHA256 b89dda0794830aff8099885143a9b7a2eaa065fe60d85834afd1ad6a57d10ccc
MD5 804acb5067f3b7e35d5be2a0d2a7ffd6
SHA1 c41a6959583e58dd51cdba6188b340d716e848c3
SHA512 f0fa0d0ab89e41c8de738c00775c1269f2e8656b293b06080b0c43ec1af3732c43540b7c40f978fe0f55afd187811259ed301dbbf8049ae8cdb4307240936b4f
TLSH
T15DE07D1CE7E034058EF76BC06ED8E9A04140245D02BE852D3CE40B28419424D8B39217
MD5 SHA1 SHA512 TLSH

nonorganically.jpg

SHA256 e998ad5f36c43471349c14fd6c37486ecc252291d295ab2e0093716a2e3d4ca6
MD5 5c0ee89d4505b66bcde5f08b7012ddca
SHA1 602c711584d1f546056cc01eaa04a964107d4966
SHA512 4a8ca72f670efd614b6deddf984a73dba18c4a2cd73ba647a9fb175a0b5d6a8c87df4f57a5259e8a40b3b464206d780af0d50e472ea15e13f40332347b8d2181
SSDEEP 768:aTh1OzSjT7kCtuD5sxeDMjO+1CY3/2V1qTB1XW4o0BzTsUAuhejMaScrjdeZ:aFLjTInlsxiQHmObXW7uMuU4aSFZ
TLSH
T1D023F19565C8A540CFA953F9E30C39D2B5F3599C0B2506E2F39DC0DB4B68C33AB5211E
MD5 SHA1 SHA512 SSDEEP TLSH

papirstrrelsen.beh

SHA256 2da47d7aa56b5ac657fb62bef789c0c66a2c88a70a169328aba605be47bf0419
MD5 9d119d8fc02c9c0435880f05bfc6bcd7
SHA1 a0a2fa878a56a5a329a5f0406add0bca1f0aa0f1
SHA512 b651bd724f66e9b8ddc2e195e05c3281ff084a058b676c05b32836de62a1b6ff29dc77646184c2a11c802a0a4b2d3d894a2ce4b4d6150339eac64d1a37f0c728
SSDEEP 6144:LZZoJWnB+edosftAVyBOhxGNhcm331j3Ixnd9c/GgjHq2BqFsLB80yYOWVbaWzSv:U
TLSH
T1B826121FADA083F4B6E180A410CE5EED72D78711E26F789275D3A1182E72C076DB3976
MD5 SHA1 SHA512 SSDEEP TLSH

rebslagerne.ast

SHA256 cb11752df9aa87af57b86f9c59e086e0927f39bb70f686475e5d7e92f3de48d0
MD5 4d035841b422b8fabde66af1b423ab51
SHA1 297362063d8f3b78e9f11a109a90e49f563292e9
SHA512 c526dfe2d7db135b1dc9939bb88010d1f7f25a05942ff5d000d413b28c81443f6ccf5d48993246aac09d0dc53e19c7f51c3df293cde99929179db9f678842b1c
SSDEEP 3072:JkiX9dmI0Ns0HiKRoConsa+h4zGMsrCJrazGkuKcDqXdK1bzxFiFpN0Lw7PgXOv0:qFhwR
TLSH
T13F1622E4494FA2B8AEC87119E9C32504DE8EDDD701D9297FCA08EE9743385A0936D3D7
MD5 SHA1 SHA512 SSDEEP TLSH

b7b3831399d9a7c33cc0802783f290cb3e2bee5b5a99020a95da396e215a3e71.exe

PE Signature issue

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Chararas.dip

Folkeafstemningers.Sys

Gpwsta.ini

Grundstenene.Non

debases.mod

dissipater.ini

dynejakkens.ini

hdersmndenes.ini

kaffesladder.txt

nonorganically.jpg

papirstrrelsen.beh

rebslagerne.ast

Sharing

General

Malware Config

Signatures

File Explorer

b7b3831399d9a7c33cc0802783f290cb3e2bee5b5a99020a95da396e215a3e71.exe

PE Signature issue

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Chararas.dip

Folkeafstemningers.Sys

Gpwsta.ini

Grundstenene.Non

debases.mod

dissipater.ini

dynejakkens.ini

hdersmndenes.ini

kaffesladder.txt

nonorganically.jpg

papirstrrelsen.beh

rebslagerne.ast