e778a38b56eb28c4ec4b89c3ae79ba0b0465b60184a828f63a06ec0de13181fb[.]exe

resource
unpack001/$PLUGINSDIR/System.dll

resource
e778a38b56eb28c4ec4b89c3ae79ba0b0465b60184a828f63a06ec0de13181fb.exe

e778a38b56eb28c4ec4b89c3ae79ba0b0465b60184a828f63a06ec0de13181fb.exe

IMPHASH 6e7f9a29f2c85394521a08b9f31f6275
SHA256 e778a38b56eb28c4ec4b89c3ae79ba0b0465b60184a828f63a06ec0de13181fb
MD5 04ac7d7b11d6dcbab12d48081a6da955
SHA1 b91b94837be3c3606cec877adad38fb8ab87bc06
SHA512 25d167ffdecb34c5a6b1bb5b98baf91e629fb0ccf124f6f465953795f5f16f49fbeff5e7aa9c3e0eb81fd1de05025ef8f4fbea49021727c9cabd873f6ac4f0d3
SSDEEP 6144:fMm4CCBMgsreEqBf8ebErVGwi2nuAoFXTT6OLFE:fMwNg/XU7GwvuAUXTT7LFE
TLSH
T12934010066E1D4A6E5555571CE279FF81AE0FE22CE60878723C87F0E3839BC1E91E74A
MD5 SHA1 SHA512 SSDEEP TLSH

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

d4:dd:ac:ff:ea:24:25:56:7d:99:0f:f6:04:0b:20:9e:d9:71:09:64:7a:81:a4:b0:30:70:be:65:ea:68:99:1f:e4:94:91:39:2c:40:42:97:3d:43:69:8f:db:56:e1:c5

Digest Algorithm

sha384

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=kursusmodulet,OU=Velartikuleretheden Talstrkeres Disshadow\ ,O=kursusmodulet,C=US,1.2.840.113549.1.9.1=#0c114b7576736572404d61676d6165742e5573

Chains

Jun 22, 2026

CN=kursusmodulet,OU=Velartikuleretheden Talstrkeres Disshadow\ ,O=kursusmodulet,C=US,1.2.840.113549.1.9.1=#0c114b7576736572404d61676d6165742e5573

Subject

CN=kursusmodulet,OU=Velartikuleretheden Talstrkeres Disshadow\ ,O=kursusmodulet,C=US,1.2.840.113549.1.9.1=#0c114b7576736572404d61676d6165742e5573

Serial Number

17:3d:cc:91:5c:7f:bc:7a:62:20:82:55:f0:b1:48:9b:0e:79:f4:ce

Issuer

CN=kursusmodulet,OU=Velartikuleretheden Talstrkeres Disshadow\ ,O=kursusmodulet,C=US,1.2.840.113549.1.9.1=#0c114b7576736572404d61676d6165742e5573

Revocation Status

Not revoked

Timespan

Jun 12, 2026 - Jun 12, 2027

Subject

CN=DigiCert SHA384 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0c:20:43:49:f9:d0:f7:59:fb:98:2d:e4:08:1b:88:7b

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

13455

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCreateKeyExW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken SetFileSecurityW RegOpenKeyExW RegEnumValueW

shell32

SHGetSpecialFolderLocation SHFileOperationW SHBrowseForFolderW SHGetPathFromIDListW ShellExecuteExW SHGetFileInfoW

ole32

OleInitialize OleUninitialize CoCreateInstance IIDFromString CoTaskMemFree

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

GetClientRect EndPaint DrawTextW IsWindowEnabled DispatchMessageW wsprintfA CharNextA CharPrevW MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW GetSystemMetrics FillRect AppendMenuW TrackPopupMenu OpenClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetWindowLongW GetSysColor SetWindowPos PeekMessageW SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint EmptyClipboard CreatePopupMenu

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateFontIndirectW CreateBrushIndirect DeleteObject SetTextColor SelectObject

kernel32

GetExitCodeProcess WaitForSingleObject GetModuleHandleA GetProcAddress GetSystemDirectoryW lstrcatW Sleep lstrcpyA WriteFile GetTempFileNameW CreateFileW lstrcmpiA RemoveDirectoryW CreateProcessW CreateDirectoryW GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersion GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW ExitProcess CopyFileW GetCurrentProcess GetModuleFileNameW GetFileSize GetTickCount MulDiv SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW MoveFileExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 acf90ab6f4edc687e94aaf604d05e16e6cfb5e35873783b50c66f307a35c6506
MD5 6e55a6e7c3fdbd244042eb15cb1ec739
SHA1 070ea80e2192abc42f358d47b276990b5fa285a9
SHA512 2d504b74da38edc967e3859733a2a9cacd885db82f0ca69bfb66872e882707314c54238344d45945dc98bae85772aceef71a741787922d640627d3c8ae8f1c35
SSDEEP 192:MenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XBaIwL:M8+Qlt70Fj/lQRY/9VjjgL
TLSH
T1BE428D1193B089F2F590593805A67F2A6FBEAC5C27E44A63CFE345853D702DFA47A243
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10719

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Droh

SHA256 75b7ea910abf9efb1b178e4f65e451a3ad7717349c16ab53e0f9fdee12776163
MD5 76df96068322254608d9c26c7d2ef7f4
SHA1 99f73f6d8b9f0dd301554b50f762a7df1dffa7ad
SHA512 ba50fceee85329c1e6b7ba0c5f86577065cbe2536fe495231e72699c0275a31744f23a56c2dd8a6936d383ea05dbacf6b53cd152809387676f1d6c3330cf0f31
SSDEEP 3072:SqoU0NEsuLCGZIkkomF6pm9bKcJU5PL+epoJLbqEzivfz/ZQNKlwAg77jRXyOej:hYNEsuLCaIkkochbKv2JLbLCaNKi73RM
TLSH
T17F04E1DAAEE3C097DC85167EE0125488D353E194B40815B4C2F46ABB1D47386EFC7EAB
MD5 SHA1 SHA512 SSDEEP TLSH

Gallowsmaker.per

SHA256 2dc4da53e2ef0ba94c6cdd905acbd7d3b0ee2f267c9cf77bc7408a4f93be9ebd
MD5 6229909d5792f5aaf174b90e2416fcd7
SHA1 63842027c5e11fb055caa8c8136c4445b876c767
SHA512 e338e42770c72d482fa17fa23f3ab17d8a0322beda77479574b793ddf14e4d1bcbc2395a1fbef7a73a1fd04ee3ccd87564cfdf6aad23838c7acc340f5267985a
SSDEEP 3:rfA4AGfcDhDjrrIknfbDArJnDDcfDfvffarLFD8Dr0fUffDQr2ffa6PrDfv:U4AGfcykYerfCGXnffMKffa6f
TLSH
T1059112295B03485C0D50A908705E401C4172194ADE78083060850416606128803735C4
MD5 SHA1 SHA512 SSDEEP TLSH

Psychopathist

SHA256 6a3bc507f6453d8715accc03e63ab6342e3e5f01278779bd7a6730582bc01bba
MD5 f7402c2459ecb1741f7befd7a57a78c2
SHA1 c19ef5bdd1953051abfda44f5d5e5774f7733454
SHA512 e5465836ab6b5945b75ab6acc1ae6354ffe3bf7237122fd67e4efc8d648bd3d670a3667293fce1bf57cab52f3573870b504c90b493b8035a851202c2ea117c5d
SSDEEP 384:K0ZN2glwM12FYz5P5qhB+Aznrsi6TI7IE6IvtChS755e55oV:K0ZggSM4mzen+Abrsi3EE6yghsF
TLSH
T1D4A27C86C7938CFBCC1291B8D5AA36964C7C6017570FA5BBA9397825C1422A737343EF
MD5 SHA1 SHA512 SSDEEP TLSH

Rddikens24.sam

SHA256 eb03bf57bc7e00ab80e22abf7a4599c5c422652c2e94199451d86a393c1ce180
MD5 a5afa0b8b1dc7320df829d2f7eef5747
SHA1 af87601ad9fd7611b1583362f397ebabdf10c327
SHA512 bc48e3c0592be5a61d7d87bdea05339cd73e4b86e6a62dcc3b102562ecb9584f24292a3ee69a76f44dba2e5eb6c5d2ac2eed80cb72b80e33e31efbb1344865b2
SSDEEP 48:XxPfpXdIk6MR66xQF7YqfGUCtp8ATxBSthMBMNiNMhvyyWxbqlMCzqPz:N4kxRTbXdd4yZtPz
TLSH
T1DE93FB9E11573F903FC5C796CE46D8366F620E84C2273A005A89F3B17A093A557B5467
MD5 SHA1 SHA512 SSDEEP TLSH

Speechfulness176.sky

SHA256 31f4d4a4f38f5a841031830ceb7b161c6610e54c6fabd283647ba58021969196
MD5 bb9c062ad79336dbd754dd30964ea5be
SHA1 3d51a28699aead47a8ce9757cbc6c761e1666c65
SHA512 7dda8c14d44fc0ed9344b9cb936910be0affeb299601387cdafd262171c7499694f2a738cff7f7c73cc239b13740919f86600f1e5098251c905e00caeb19a71a
SSDEEP 48:IivLjKKNnYWawddoOdDdz1LkdCqcATNJRWCK:9vLtdMedoOdDdz1QYqcATNGCK
TLSH
T1DF030AAC232933A0A93A3E771FC94C6119A157FF476D1BCB808800FEB498C1863520D1
MD5 SHA1 SHA512 SSDEEP TLSH

Trolst.eze

SHA256 82b5997341ee5bd0f07da9181af85f9cb771b3980c2097adf00e01ebf08ef4a5
MD5 318ee2aaca3338437ba83a013a004f6c
SHA1 19aa0fed293e6cd43681c3fc5ca9e008fef79782
SHA512 7d17255f4c5ec1e6acd36c23918251020e1059cdd527571ba5fe8f0c7c1a43eb3eabde9e452a8b0909160fb6f88177c0650c115e87f472852aba10bb5d3a2c72
SSDEEP 48:PTY95MkG6XoaC2MX7gB89SkXdmKygqonuvmHM6T1zhVkRCeO:Pk95DXo72MrykpYznvmHFhVkRCeO
TLSH
T164632C61C99A4FCF590EA1309522C5050B04CF726AA0C2FEBAB095B29170CFD3F5AADD
MD5 SHA1 SHA512 SSDEEP TLSH

aerolit.mad

SHA256 bc5632828ef94586de48be37689c2b79acc243284188c7d70a260bbfd6bace1e
MD5 fd4f2c81cb4ed68a17f6b215ab8d18f4
SHA1 118e52e249bc5ae6d3bf027f3f33c5e03181e02b
SHA512 99351267019edebb84512274e4e6c576430e7a20b19c973e398a971c9ee02d67776665f438aa9b3f50ef73884499f87d86276b020aabb78d33f39403aed64178
SSDEEP 48:ymFpBUnGiKep+1ZtYfU4A0D/iAoDmgP+S2vWCcYleWO4Cnpfa1yx:9leQ1HYMW/irmN/hwaYx
TLSH
T1F603D7551F2CB0A4002D779CBB8ED2EF50D88A681D767A7BEB961BEF0191106A326611
MD5 SHA1 SHA512 SSDEEP TLSH

dijudicated.dig

SHA256 74f068aee32c42fc484d12346252087c2c9337fe0186103d21a85927b8d43897
MD5 12c154d6e90073d07f8d2859ca79ef9f
SHA1 0d22118c706f5ac1d90295e60ba725c861dafb45
SHA512 8e578abb72b0ab3f983ddbd5503ea479679c329ef80f992edefd9e4104abc8e796b1e06db39d43abd26d5e5f92176b21964aaf528bffe281dc290d262dc9b682
SSDEEP 24:CkTT2W5TUjq/EkiktC4Rk3bX6urPLc9dh6OxnaW7XB3yOyF5dzYtZKQYqNO:xWSTUjUCL3gcOl9+FiXRO
TLSH
T15F03D7743A8CA49C0FB44060C12B8CC2555BCC30F86EAD7069CF9FCDABB86D51B06966
MD5 SHA1 SHA512 SSDEEP TLSH

enkeltstaaende.mil

SHA256 941a31d8b67b85d327e5559272b9c37a46e47d8298015ad931084c3c973f4a2b
MD5 dafab4d298356032c822e3520cc2ea28
SHA1 409b99ff2dbe2da3b0278fd9d1d787c34482427c
SHA512 f868e5251c72d05ee79bab060cd7bf254dad5e29eb29110c40e8adafa9591580af09f2861d58fb9fabee6b9b163deedc3aab09d67b6e524794e45d0098821e35
SSDEEP 48:Y+G4f+CavWO1FP6GzXfojPGC35zzSP2e7Q3y4DoKwZF:Y94f+CQf1NFfoLGCJvSP2MMjVwv
TLSH
T16F33F8D2AEEE4018E0CC045BC4ACB190E690434B73A5EC95375B6C4A803F5184D9AC58
MD5 SHA1 SHA512 SSDEEP TLSH

podzol.ela

SHA256 a6074e8798ed7dcbd2b697fee987d0c75c196b34e53c6b85a744aea16238ed03
MD5 f2ebc029309f1369d6ca0bc63ea3ebac
SHA1 098e33ad100b58e711c0829b77cbd0cc7e13c4f0
SHA512 dea6ab85f58631f5f95dfb5aa902e6d008ab728835b3f5fb0725a28b9cab903e4f11175f9443228a8b79028fb80bb7e5b61db05e11241f3e34bc574f82cf8030
SSDEEP 96:nrcbLQrrjfUfldtO4/3k/MzlQWvHwDAZkVIPxtBa8TrTGQwQT8Kxnr:r7zUf9O4fm0B6/Vexna8/CQwQT8Mnr
TLSH
T157632BC076BCB7412B3AC7D3B76435F4C862128AC398A89AE08662544ACD436CE0A129
MD5 SHA1 SHA512 SSDEEP TLSH

sprjter.gal

SHA256 073a6ab62d518397224e36d2efb6a3c550cd1083ee588b452f6ed0542005af07
MD5 a55627cb17164c9ef59ea010a2bf76d2
SHA1 b57b27e476f21fa5b5241f4f88725cca339a6b2a
SHA512 268059025e6c317377abba1bacff6c3bd28f74b550a4414e943f8a0cdc30a8849ce24f38acd9f3521d048d5eec8848b3ccae2e99b6e84b1817fce3fb574a9dc8
SSDEEP 24:8jpL4u6NYgFlcbPqIqO4aYzvy/MbkbC4bZpKIxrSOd4FaOCK36LH:8V0XqgFlCUnxkuCL1ZShKj
TLSH
T10803F9CD102988CEDF9545B3D4AD334A11532B695D6A0B8BCB8DC1183004F470DBF61D
MD5 SHA1 SHA512 SSDEEP TLSH

valgdato.god

SHA256 4dbe16d4641687a58f1f831a40733c0d6bf63506ca63af70ce0f479a12b64b83
MD5 50b8ba6da8fbb669757957627d205229
SHA1 7ab9f52ac993f846fe92461a48bbba4917341092
SHA512 1b224a2332109308be25eedcfe50e7cf5e474740463bc54bfae027b30d4de404887caed84764c475ee0c99ca17ad6a7124c5cccd30025bf5c5f5036d1a44ccd4
SSDEEP 48:ixZQ56dI8QxozAMz37R+uon9HX44TajbZPJyaovwMU/0xFd3ha5XBA2lTjBZ7llq:628QOT37R+uoO4TcTQWI3c5XG2blU
TLSH
T12433E8EB07E5CF895A0CCA898D4C2762269602DE5EE4527263D8D9D481988879D3D7F0
MD5 SHA1 SHA512 SSDEEP TLSH

e778a38b56eb28c4ec4b89c3ae79ba0b0465b60184a828f63a06ec0de13181fb.exe

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Droh

Gallowsmaker.per

Psychopathist

Rddikens24.sam

Speechfulness176.sky

Trolst.eze

aerolit.mad

dijudicated.dig

enkeltstaaende.mil

podzol.ela

sprjter.gal

valgdato.god

Sharing

General

Malware Config

Signatures

File Explorer

e778a38b56eb28c4ec4b89c3ae79ba0b0465b60184a828f63a06ec0de13181fb.exe

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Droh

Gallowsmaker.per

Psychopathist

Rddikens24.sam

Speechfulness176.sky

Trolst.eze

aerolit.mad

dijudicated.dig

enkeltstaaende.mil

podzol.ela

sprjter.gal

valgdato.god