19a44c6e458f1bca508092d90aadbdc85fde6e03a7c08e3b0f5df88ba0b08843[.]exe

resource
unpack001/$PLUGINSDIR/System.dll

resource
19a44c6e458f1bca508092d90aadbdc85fde6e03a7c08e3b0f5df88ba0b08843.exe

19a44c6e458f1bca508092d90aadbdc85fde6e03a7c08e3b0f5df88ba0b08843.exe

IMPHASH 573bb7b41bc641bd95c0f5eec13c233b
SHA256 19a44c6e458f1bca508092d90aadbdc85fde6e03a7c08e3b0f5df88ba0b08843
MD5 f6d78a1ac2c6aff57ddc30a78901af5a
SHA1 888f8aaa5f9d80034df9ee8f644ee89d4e6ef6d9
SHA512 5bc3f0627bfacf842d8d1122b5c5e07b0f6a61d538f9db8c971c3b0b93f40d798c053d93f777b7b8db224dd58555e2a22ebb3d829741b2306e94d23fc8ae3d8f
SSDEEP 6144:W+MvoJmBR53WWQmGS2PeoVxmmejLybhWWsR:W+9nmG3ZmnAo
TLSH
T1FC74014176D0DCE7D826323C7ABAC6B1DBBABD122A115B573785BB0F3D33241881B195
MD5 SHA1 SHA512 SSDEEP TLSH

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

be:ce:52:00:9d:53:f2:57:17:48:b7:a1:75:89:31:4e:cf:d2:67:b9:61:f8:f1:5a:2c:e1:63:ce:73:e2:3f:32:a9:ed:38:b1:40:bc:a2:ce:9e:20:5c:d5:3e:96:5a:23

Digest Algorithm

sha384

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Chokedamp,OU=Vandforsyningsplan Unleisuredness mandshj\ ,O=Chokedamp,C=FR

Chains

Oct 2, 2026

CN=Chokedamp,OU=Vandforsyningsplan Unleisuredness mandshj\ ,O=Chokedamp,C=FR

Subject

CN=Chokedamp,OU=Vandforsyningsplan Unleisuredness mandshj\ ,O=Chokedamp,C=FR

Serial Number

7c:ed:a7:b5:54:3e:de:46:c9:31:b0:f3:e8:9c:17:28:e7:3a:da:56

Issuer

CN=Chokedamp,OU=Vandforsyningsplan Unleisuredness mandshj\ ,O=Chokedamp,C=FR

Revocation Status

Not revoked

Timespan

Aug 17, 2026 - Aug 17, 2027

Subject

CN=DigiCert SHA384 RSA4096 Timestamp Responder 2026 1,O=DigiCert\, Inc.,C=US

Serial Number

0e:1e:bb:32:2b:5c:8a:75:3e:12:3f:21:ce:d0:f2:d9

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 5, 2026 - Nov 4, 2037

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

13655

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegOpenKeyExW RegCreateKeyExW

shell32

SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW ShellExecuteExW

ole32

CoCreateInstance OleUninitialize OleInitialize IIDFromString CoTaskMemFree

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create

user32

MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW CreatePopupMenu AppendMenuW TrackPopupMenu OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW IsWindowEnabled SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CharPrevW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint CharNextA wsprintfA DispatchMessageW CreateWindowExW PeekMessageW GetSystemMetrics

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor

kernel32

lstrcmpiA CreateFileW GetTempFileNameW RemoveDirectoryW CreateProcessW CreateDirectoryW CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW WriteFile ExitProcess GetCurrentProcess GetModuleFileNameW GetLastError GetFileSize GetTickCount Sleep SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW MulDiv lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject CopyFileW

$PLUGINSDIR/System.dll

IMPHASH 509a34b3a68a773e0afb4259e68f9f82
SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
TLSH
T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Spunsendes/Cluttery

SHA256 daf37754f235e319740faf101693de6b21c62c24b076ba346cdb9f3e4b03bc3b
MD5 686a47e22309749b03156de0cd7c0776
SHA1 6061d6bda50f672c0474eed7b101169ddd796b64
SHA512 fd0dee163d092e125b70ec629b73e1bded3c609a1d359d265375d8d593c02645b090e35203f50f7b4dbe722ab1ca58be096192eb1bc6d19af5169a1fc6235ec0
SSDEEP 3072:/HD2MnlO3NgqNCi6KTtA3ss1DJlxA5E97rIlObBY/jC/TQYFTABFKfFz2Sva:/HdnodgmZNTi8GDxA5EVI6BYmTQtEF2t
TLSH
T15414E1341AFFB3A5B88E1CEB0E3836524515B892272D9ED6CC931DB3CF0452AD6425DE
MD5 SHA1 SHA512 SSDEEP TLSH

Spunsendes/Morgue.abe

SHA256 64bfe70f23792ecb8c7b7d20d41f60f1510d99fcd26eb92cc19edc7c106c3335
MD5 0555663464cb3abd29df4edc7318e36f
SHA1 d76304517eefe6cddcd0040d7815aaaa43c8e9e5
SHA512 d71e1fb293c475051df123d7a595e5d1a95f5dcfbe99eae6ee59eaaf3fb213d1019146a1a40a74d87bb280664e7a850f9a77dc2543fffd26870079681684854d
SSDEEP 24:aC0Rl4s5qdVB8Hn0ugont36E+iJk8fAJJvps1heSt8d106/8t:XK0L8HGodMh8wps3eVU6/8t
TLSH
T18643EBBA44A3D1C0E6DE35823AED1B8430508FFD94EFA5F7F49E45812C4483526C06D1
MD5 SHA1 SHA512 SSDEEP TLSH

Spunsendes/Sekundrkommunernes254.sax

SHA256 d0754db9ae7ab51de58df0399f3e819dbcfeb750f6451801749190cbd3d6c311
MD5 e0b4971d3035c35a87da29d233e1acfd
SHA1 0426d344cdeb5b711337356a141b865b65f01ceb
SHA512 e7fc1a31c13c90c420029870d138f36b9df514c3959e0fd9a4333bb87d720263ce7469e34b1f7dac375d32f820a9ce7c43c220bc0f79311f1a3bc7d6c960e082
SSDEEP 96:B72DHoP7eLhw1+0rKwjl5QQIpfAwmcePn5KyXbtdI/x:BenG1nKwZm1ePnjXbsZ
TLSH
T10A633C55A8D9DF8B4E1F9E21EC770E0D79483C17385485ACAF7F596B073273B4410195
MD5 SHA1 SHA512 SSDEEP TLSH

Spunsendes/Studsendes214.tub

SHA256 740732d813ec94259782b7d96919ba9e09a477b020dd5931d1abd13d0a0249e2
MD5 ee3c5c789ab83efdbcbad8dbc9e8e506
SHA1 96335620aa49a1141a82d5eea9862886c59c87ac
SHA512 18ac814e7cc65d055c2954994960fa36de3cd30ac4df882fda05dfde359aca84f39b312863672a035d54397316167b836622361a24d8e691cf47a625ce6268f1
SSDEEP 12:ToylN9m+TDY4TlXHpgITHTdTenlBhWLm2TaWTy1YeTaRoaM:Eq3rc4lJg8NuWX+6yb3aM
TLSH
T11B8259EF4FCE20267A5BDDF43E49D05F7A8BD407A31D4154523E9A298840AB3659C847
MD5 SHA1 SHA512 SSDEEP TLSH

Spunsendes/amphion

SHA256 9162f97e7fb6a2b9a45766490f87d07b5a3511d07d7c2ca3d719f73c96e11081
MD5 57bf737440d8f5758e8f224108d11f4c
SHA1 1b9f56408fe39a7ec4b0c2d20a6cc35eb38cb0f3
SHA512 8f994b406f818a82d21fa1064dab28aaab7d260c7c6bad784bfd4b7ebbc5136720335570f59cd612ad075a1da51418035b21445310192b9cbc9799d4ff346532
SSDEEP 384:suuDwhURfzdkJeLA3OLS8lc7AQVBcN5F2RN0TgkYaE0WhKAkt:Cwq/c3qc7AQVBrN630O
TLSH
T17BB29E66877A7DB1C81AC23CC8A636F34CDCB022154FF479617A6919C0D31C6A274BEA
MD5 SHA1 SHA512 SSDEEP TLSH

Spunsendes/eulogisers.bef

SHA256 08136bb0fae636add0f79c4477c10b3080440f72dfeebda5dd047e35f83812e9
MD5 e5db6d419cfe5bc79ad4458e86856a12
SHA1 edfcd8fb70702f4019710c0674971ea8df1de0f2
SHA512 a01611be12e94ca4c183ffb48be96387a5eb234571ac444539cea7fe5d8caa7b75baf218c2bbf8c6de9feb201bd2e3238e3f36ad13204dc36a8058b02be66b37
SSDEEP 96:IcxXH7diN5pvXLu3uwJeYTjdf9qAWsM/eZLh2k:IcBbdiN5pvXLu+wJeYTjdf9LpM/eZLhT
TLSH
T11A7339837060D94268C2F8A3E8B88203966984AFB8B3349BF258CB700063D07C965A89
MD5 SHA1 SHA512 SSDEEP TLSH

19a44c6e458f1bca508092d90aadbdc85fde6e03a7c08e3b0f5df88ba0b08843.exe

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Spunsendes/Cluttery

Spunsendes/Morgue.abe

Spunsendes/Sekundrkommunernes254.sax

Spunsendes/Studsendes214.tub

Spunsendes/amphion

Spunsendes/eulogisers.bef

Sharing

General

Malware Config

Signatures

File Explorer

19a44c6e458f1bca508092d90aadbdc85fde6e03a7c08e3b0f5df88ba0b08843.exe

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Spunsendes/Cluttery

Spunsendes/Morgue.abe

Spunsendes/Sekundrkommunernes254.sax

Spunsendes/Studsendes214.tub

Spunsendes/amphion

Spunsendes/eulogisers.bef