PS-PO0726-8406[.]exe

resource
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll

resource
PS-PO0726-8406.exe

PS-PO0726-8406.exe

IMPHASH e2a592076b17ef8bfb48b7e03965a3fc
SHA256 a29fcd93d595590a046c3cf8272fc5cf332ece6964963160461605a9f9bf35a0
MD5 8c5259ac0a6e26f997b68c6da00a2906
SHA1 b66082973cb689030fe6796a3b8929869cf2d9c2
SHA512 c0925380e294ccd3822afd641b2162b0efa470d94376d3e86a917dcfe295777205004e269bcde78b62f3078da4d6f54fc630e7bb6a3c0340a1854376c8c21be3
SSDEEP 6144:aLsBN8xoInob4d/Opc8UgqEPDpgXZto4tlaazpBB8QdMmgw:VBSjApigqIVgXXZaazRbh
TLSH
T15D84BE5D71827592CFDA61F60A2143F9932BEDFC201A433E6A613F57F4E628021E2B47
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

cd:7d:5e:fd:0b:80:2c:f1:5f:1a:52:78:cc:ba:59:20:7c:94:52:43:dc:4c:8a:0e:e7:14:55:27:75:91:0b:90

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Fiskeredskaberne,OU=Canalising Tastede Dunbldt\ ,O=Fiskeredskaberne,C=FR

Chains

Aug 26, 2026

CN=Fiskeredskaberne,OU=Canalising Tastede Dunbldt\ ,O=Fiskeredskaberne,C=FR

PE Signature issue

Digest

7f:1d:74:ae:39:27:e6:eb:e3:3c:af:db:a8:5c:c0:e2:36:8b:06:d5

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Fiskeredskaberne,OU=Canalising Tastede Dunbldt\ ,O=Fiskeredskaberne,C=FR

Chains

Aug 26, 2026

CN=Fiskeredskaberne,OU=Canalising Tastede Dunbldt\ ,O=Fiskeredskaberne,C=FR

Minor OS version

0

Major OS version

4

Entry point

13073

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetCurrentDirectoryW GetFileAttributesW GetFullPathNameW Sleep GetTickCount GetFileSize GetModuleFileNameW MoveFileW SetFileAttributesW GetCurrentProcess ExitProcess SetEnvironmentVariableW GetWindowsDirectoryW GetTempPathW GetCommandLineW GetVersion SetErrorMode lstrlenW WaitForSingleObject CopyFileW CompareFileTime GlobalLock CreateThread GetLastError CreateDirectoryW CreateProcessW RemoveDirectoryW lstrcmpiA CreateFileW GetTempFileNameW WriteFile lstrcpyA lstrcpyW MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GlobalFree GlobalAlloc GetShortPathNameW SearchPathW lstrcmpiW SetFileTime CloseHandle ExpandEnvironmentStringsW lstrcmpW GlobalUnlock lstrcpynW GetDiskFreeSpaceW GetExitCodeProcess FindFirstFileW FindNextFileW DeleteFileW SetFilePointer ReadFile FindClose MulDiv MultiByteToWideChar lstrlenA WideCharToMultiByte GetPrivateProfileStringW WritePrivateProfileStringW FreeLibrary LoadLibraryExW GetModuleHandleW

user32

GetSystemMenu SetClassLongW IsWindowEnabled EnableMenuItem SetWindowPos GetSysColor GetWindowLongW SetCursor LoadCursorW CheckDlgButton GetMessagePos LoadBitmapW CallWindowProcW IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard wsprintfW ScreenToClient GetWindowRect GetSystemMetrics SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharPrevW CharNextA wsprintfA DispatchMessageW PeekMessageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow LoadImageW SetTimer SetWindowTextW PostQuitMessage ShowWindow GetDlgItem IsWindow SetWindowLongW FindWindowExW TrackPopupMenu AppendMenuW CreatePopupMenu DrawTextW EndPaint CreateDialogParamW SendMessageTimeoutW SetForegroundWindow

gdi32

SelectObject SetBkMode CreateFontIndirectW SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW ShellExecuteW SHFileOperationW

advapi32

RegDeleteKeyW SetFileSecurityW OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges RegOpenKeyExW RegEnumValueW RegDeleteValueW RegCloseKey RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumKeyW

comctl32

ImageList_AddMasked ord17 ImageList_Destroy ImageList_Create

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb
MD5 17ed1c86bd67e78ade4712be48a7d2bd
SHA1 1cc9fe86d6d6030b4dae45ecddce5907991c01a0
SHA512 0cbed521e7d6d1f85977b3f7d3ca7ac34e1b5495b69fd8c7bfa1a846baf53b0ecd06fe1ad02a3599082ffacaf8c71a3bb4e32dec05f8e24859d736b828092cd5
SSDEEP 192:eY24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35Ol+Sl:E8QIl975eXqlWBrz7YLOl+
TLSH
T1E3325C12135081F3E4918138C86B3A276B6A15029BF98E57DFD39546BE31BE3BD7D603
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10183

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsDialogs.dll

IMPHASH e2ee55bddad4241d619d6a8a38e2d869
SHA256 c13104552b8b553159f50f6e2ca45114493397a6fa4bf2cbb960c4a2bbd349ab
MD5 42b064366f780c1f298fa3cb3aeae260
SHA1 5b0349db73c43f35227b252b9aa6555f5ede9015
SHA512 50d8f4f7a3ff45d5854741e7c4153fa13ee1093bafbe9c2adc60712ed2fb505c9688dd420d75aaea1b696da46b6beccc232e41388bc2a16b1f9eea1832df1cd7
SSDEEP 192:o68cSzvTyl4tgi8pPjQM0PuAg0YNyoIFtSP:LBSzm+t18pZ0WAg0RoIFg
TLSH
T10A12F793E5E420B3C2D3523F35BE2B2ED7B95335B0512C0483738A897A6947A6E38347
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

7443

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Afmagredes/Achroma72

SHA256 af9af64481c4507a3230ea1fb660990277c89daeffa7d0038abe89654b3ffdc0
MD5 225ae138f898dd615a24b47e87291a2b
SHA1 d6934d2b8116a5f02193f3a2a7f85d8812eb4f3c
SHA512 48dd4023ba814f23c6b6ecc5ee80ccdcf600fd8536fe20a006f745915f760c3a0d0fba0624dcaaf8701910737d376501cb157e09b6e93b9382294d2d583972fc
SSDEEP 768:R0Ju/ncBmHbWH4Gy16SS//F8eXZqfTcuA4FQWPQ8DfCWxScQA2dNCbrl:R0Ju/9qH42F/ZkcuTY0CKvQ6rl
TLSH
T12363AF11D726CDFACC06913CD8BE7197086870129B4FA17D62B6E514D18B2F26B287EF
MD5 SHA1 SHA512 SSDEEP TLSH

Afmagredes/Dementiets70.ned

SHA256 e9caa2effaab98350dd4d08c04599a3352b0d976fe10955f9019f949e0f628b3
MD5 9a996e81e97727dca3c7b31364a65534
SHA1 c22abcc993b485f26e071c323aec54f262187014
SHA512 da8ded048ac6b4f673a11fbdaec2e2ef7194882c7c3cf3cce9f2e245926c822e520e6daff9e1731cb85389910ec1f1d2db9dc43fd717ea9be2551185233dd607
MD5 SHA1 SHA512

Afmagredes/Mervrdiafgiftslovs.til

SHA256 eacf13b423b5f6a9a514c854c9b3ab7141c48776bea2e1819db8aadd2dd037aa
MD5 b558af98de73c9b3d911a85a8a1963da
SHA1 716a563fa270a98e84a92aea43b4145d72d631bf
SHA512 5fbec504a637d1e6dc2d92db53fdb3ead67958550f11fd99c485e0a7b6366c7fd394cad5553a92bb5f40f5036de917beaa31b63ceb795519da94a21c29b78305
TLSH
T16841020755285D555CB09325F21C654CE34F34E7D51594882BB13D4BAD47177DE233B1
MD5 SHA1 SHA512 TLSH

Afmagredes/done.lan

SHA256 d0e8314245fd9e81706b128915aedf60bf2c4f31150668babbff87143b570ed8
MD5 79cb10af4fa2b0e40e4611bb0f5fb510
SHA1 944432b53eb49d11357bcdb45b23c4a3fa1e1bd3
SHA512 47ae6f501a0bff4d70929a86e559bcad08a7427911273d2040621d214ad3d92597d68ccf9127b4da7ae1a1aaf5b67fb960511d28709339c708ea9b5e87e8856e
SSDEEP 6:IiNnlnWnn4nPoknKwnc8nC6nannmn+ngnes6nB:Ii19iqgkpfJnsxEe/B
TLSH
T1E2E12344D5878848447855E1C77B46D5709C49315565431D517E66302D415544708D2F
MD5 SHA1 SHA512 SSDEEP TLSH

Afmagredes/gratialernes.kon

SHA256 71eaaec56a568dc38a441505c62a076bd6e0654e05b29994561a9bf879daa188
MD5 37f5770615ff11869ad32d3db28c5d2d
SHA1 6f95fdb5a7fe85155fe7f42f86aaace8414bc114
SHA512 4cf033f895f4205733f336daff84a5140ab14a810099eec0aaa8a525bf4b3d489354eb3fefeaae46dfd3b406bc7337b81af5f36662fb654f0e2113a200dfa5e0
SSDEEP 3:ffjfCzmb4zfhffKzFfuzyzVzfzzwKzbzzWzfxfZzfrzXWffVzYzjzXMffdzbEzb7:WihkGiKzX7KAff2zXAYz2OXd
TLSH
T1F0A12BDFC097424B3324B3C14C50C061000BA2016C018003805A0A9D1005B049A4B03B
MD5 SHA1 SHA512 SSDEEP TLSH

Afmagredes/ramosely.ins

SHA256 a84f89d676a7c255af43e8ca48b9e7d7931108637d67863c9035f7ff504ca3ae
MD5 cc801675587f6f8031062d56d7926aa6
SHA1 8d801ffb800a1b70e07ac0888af2367418bbb61f
SHA512 8745ff429b15c43c7ac8d827dd5fa160f02f27a026c3ebeb6e67e2394dd4622c12ae34de52cf5f594ea12f1b0c6113e5dbdfdb2b0e5fc6a0e275362662a164cb
TLSH
T16A41020080A08313A4B4C81494581224A60CC530C9C72C2141D020A0051122634D5058
MD5 SHA1 SHA512 TLSH

Afmagredes/tapskruer.cap

SHA256 e89d86756663803cbaa32b3729e8659fd8cb02bc78534d23e0d3f5cc603bc6af
MD5 50fd69d4a6eecb8a624389fab5150346
SHA1 5874e84165cc628cfa6e1c2adb5dfc39e75add4a
SHA512 fd8f06c49ad71ea755ad5bbece8089d2470e5ea3c7d33c307648c8407b7b9b1cb1a5de86b5d319942ef2f0ec31de819b1e805a1266137a452c4efe178649dd21
SSDEEP 6:jiWtkrmJjsuNttac5CyUA3yhHwGsYHWt/nFP4VAKY5abW/RYdWtO2WIQ:jDkrexDgQ/3CHwSHW5nqS5wWegBWd
TLSH
T19C122B3A68F4649149EB33342395E3C670140BCC44574322ADC74460D91E05E2358D37
MD5 SHA1 SHA512 SSDEEP TLSH

Jubas

SHA256 b54b4fa724ddb3caddba963a6dbb3cc8d287faf695765cc254302a0ab3b7008a
MD5 7fdf25273eb29be14eda89f00a40aaf1
SHA1 1f98d89441a30fa26661769a9f8229b352d22a2e
SHA512 7364d3e61c7d1e12d3e4a6306f968289fb01a53affe1fa402d677b91161ba1e3b04ca652f4a31f4ae2c9ad85183084438b9057a85ab9979ab8c712e08884b08c
SSDEEP 3072:C4xgOGB8UYGfXzhDqDanutCqsCUy8E0IBggqSqETp6qodd:b6zDqDaA/fXySqnFdd
TLSH
T127D3F153688DD1A0F59EDFF1EA89EF36C8329B66A18C77DD9460FE1941E6133C8105C2
MD5 SHA1 SHA512 SSDEEP TLSH

PS-PO0726-8406.exe

PE Signature issue

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

Afmagredes/Achroma72

Afmagredes/Dementiets70.ned

Afmagredes/Mervrdiafgiftslovs.til

Afmagredes/done.lan

Afmagredes/gratialernes.kon

Afmagredes/ramosely.ins

Afmagredes/tapskruer.cap

Jubas

Sharing

General

Malware Config

Signatures

File Explorer

PS-PO0726-8406.exe

PE Signature issue

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

Afmagredes/Achroma72

Afmagredes/Dementiets70.ned

Afmagredes/Mervrdiafgiftslovs.til

Afmagredes/done.lan

Afmagredes/gratialernes.kon

Afmagredes/ramosely.ins

Afmagredes/tapskruer.cap

Jubas