PO_3N086_2F587[.]exe

resource
unpack001/$PLUGINSDIR/System.dll

resource
PO_3N086_2F587.exe

PO_3N086_2F587.exe

IMPHASH f4639a0b3116c2cfc71144b88a929cfd
SHA256 475b7002fe1981c7acd3d420fead8bd384b6140ce84478fa9774f7dbd4be868e
MD5 a0fb265c528e52e920fbd14cc9ad7ada
SHA1 2056630fe4f6ac0dddd4041e00f3e4f490b5b19d
SHA512 929cf16f57a8e4ee46fcbcc5ecaa24d4d90252b446fb2c5de347ced011adc3e2b79d3065e5d8713c14ba9b2cb1295a1225895df2ed01360bdd148230f66a3dd9
SSDEEP 6144:aXFKo5bhdG5A1rhV7zKv+h25twai6owN+MnaczN+SwZHcDcqlTMbWs3jmmes:aX5zr/K2Q5twaiXQRaenIHWlTMbVjmO
TLSH
T1DBA4E00A7750C907C3A866B84FB6E33853B8DD989E224B0326E07D6F7DAD7437D06295
MD5 SHA1 SHA512 SSDEEP TLSH

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

b2:b4:26:00:fe:eb:e0:c5:51:78:06:40:2e:6e:3f:7d:26:61:b1:f2:02:dc:ea:c6:fe:51:09:09:3b:ec:24:36:91:82:da:32:07:e6:57:75:0a:e9:6e:00:6b:51:e8:7c

Digest Algorithm

sha384

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Skidded,OU=Omlastningen Ecos Udmnstrings\ ,O=Skidded,C=GB

Chains

Nov 6, 2026

CN=Skidded,OU=Omlastningen Ecos Udmnstrings\ ,O=Skidded,C=GB

PE Signature issue

Digest

cf:25:51:99:8f:90:3f:45:05:da:88:86:e5:38:1b:79:b6:f8:25:2a:d0:1a:b4:8e:f1:c5:51:a5:77:6d:97:07

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Skidded,OU=Omlastningen Ecos Udmnstrings\ ,O=Skidded,C=GB

Chains

Nov 6, 2026

CN=Skidded,OU=Omlastningen Ecos Udmnstrings\ ,O=Skidded,C=GB

Minor OS version

0

Major OS version

4

Entry point

13564

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegOpenKeyExW RegCreateKeyExW

shell32

SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW ShellExecuteExW

ole32

CoCreateInstance OleUninitialize OleInitialize IIDFromString CoTaskMemFree

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create

user32

MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW CreatePopupMenu AppendMenuW TrackPopupMenu OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW IsWindowEnabled SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CharPrevW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint CharNextA wsprintfA DispatchMessageW CreateWindowExW PeekMessageW GetSystemMetrics

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor

kernel32

lstrcmpiA CreateFileW GetTempFileNameW RemoveDirectoryW CreateProcessW CreateDirectoryW GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW WriteFile CopyFileW ExitProcess GetCurrentProcess GetModuleFileNameW GetFileSize GetTickCount Sleep SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW MulDiv lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject SetEnvironmentVariableW

$PLUGINSDIR/System.dll

IMPHASH 509a34b3a68a773e0afb4259e68f9f82
SHA256 9111099efe9d5c9b391dc132b2faf0a3851a760d4106d5368e30ac744eb42706
MD5 4add245d4ba34b04f213409bfe504c07
SHA1 ef756d6581d70e87d58cc4982e3f4d18e0ea5b09
SHA512 1bd260cabe5ea3cefbbc675162f30092ab157893510f45a1b571489e03ebb2903c55f64f89812754d3fe03c8f10012b8078d1261a7e73ac1f87c82f714bce03d
SSDEEP 192:VjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZv0QPi:B/Qlt7wiij/lMRv/9V4bvr
TLSH
T188426C1297B089F2F551493419667F2A6FBEAC5D27F405A3CFE304C63D212DBA879243
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Abortkvotient/Clotter/Psychosociology

SHA256 8641ae2433478e69b81e6a42f81993292999ac6c3ef873baa6088839b62eea2f
MD5 726ff10764df4b0127aa98b83c0c497c
SHA1 977e57db4ba1af8e2c3cb414b50765d1bcd9aa61
SHA512 f1da801a0fad4eef1ec49c17e8fb0cdea262ae80c29f3ae3153eb53ee49cb279fe719ccacc05c826f1f8ac8d4892e504bbd2cafc31eaf81a161935f85a76c73b
SSDEEP 1536:ZFCygLG2Ur4kfXboUU8ZN3yJNhjVgzsqthnFT3iDBXzA:Z/0GFJfq8fOg1nFT2BX8
TLSH
T1CF73A093EB60CCFBCC01853CC66D61994D29B0169F0FD47EB139B904C25B6E653286BE
MD5 SHA1 SHA512 SSDEEP TLSH

Abortkvotient/Clotter/forsgskanins.jpg

SHA256 e7d3a81abc9c8fe560a737fb2aee566e794fa30e20343ebb8b4ad8faed5be001
MD5 c801c7abf6de94c24b61ba2ff855755d
SHA1 56875459b6ffa722ab8dcab015e4294fe00b68e1
SHA512 047818d701640ce0664a6ae3c666128aeabdb03570e8c4de4968de6e513130538fbe3c49fa25c978eddecb6815cd6750c60f8f4ac5ea6b983abcfc425f0b25a7
SSDEEP 192:L6SYk7DB+x6co/Q2W9vobcj9j14fb+KUs5hO8l61w1WzX/xDoS22c:uGox6ccCvz/SbLhO8l61w8zXJsS2t
TLSH
T11942CF38DB8A923A1740A51A8B0A5DBEC63F7C5E8804D73D89225CE5541EDF25E8C2E9
MD5 SHA1 SHA512 SSDEEP TLSH

Abortkvotient/Clotter/maselin.dra

SHA256 2e54a2a67ba079e1092abb7a745856cda052667e44a97fbd9d60b45427d917ef
MD5 36c719b43ddc62ef220370c32f87969c
SHA1 196f102028c244ce414bf937c5fb40ee418f3976
SHA512 51c8a939b7b2f7de461a2b605a6ae450e5edf1cb0687c5bb5db068ba307ae2cba14477bd890e20582eabdb3541f43f7187e65388ab148eb354e9b10ee3e23125
SSDEEP 12288:HnHLi2IxFRNiISbl4MAp5UHJe+XTUJ3KNBgb3kGmUglTnHt99+b1CqmSt4yj/mmI:CvO
TLSH
T178F512407625E440F89E2E397297517E1F6F721C8D72B9E232289CC51183A2E31FAED5
MD5 SHA1 SHA512 SSDEEP TLSH

Abortkvotient/Reguide.ini

SHA256 929cc04a9933447a3576252654fee2c4aae31e4f96464f2266e9116fc6565896
MD5 22bdb24decdf56f7b1a3c794b079f923
SHA1 ea4d30b36fe7b8a67f5da3967ad207c4187d12e9
SHA512 a2ec5e5b6ef2aa758467e22a7d8fc40132a28410963fda9b1cc0648e2521983470d980234aa36954e952c26b54a640287a222e34819a3795a7bc7c99e9f255b8
TLSH
T131F00510B1DA781585038A06E84031D18C34E5138A011ED4266B978E064015A7DBF873
MD5 SHA1 SHA512 TLSH

Lowlights

SHA256 ea1ea44438b36e21c11bc32755bef5eae5054d85534928f37f9d22c7f2181117
MD5 9caef67087218bc1df2d0d50458f8319
SHA1 ab170997aec258bbd8510d1e40bf341b68ee5123
SHA512 4d850e3497ebf5736b243a86b75d28a97afb24b64df3019c2e65c591df498c23072d2d38c0087c21f7dbf0c3579ceb8ff270256507927954502355089a94cf14
SSDEEP 3072:Xdb8APRBpEn7lZ4kI/j5xVz6GZRXjdDd2l2HxoVS+7EDHukC:tb1PVE7IjlaARXj/xHxoV0up
TLSH
T17D44AE698A76B0BFC87A795670113F80EA16BD081F4B1F445B380F8CA6D52DF0A78677
MD5 SHA1 SHA512 SSDEEP TLSH

PO_3N086_2F587.exe

PE Signature issue

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Abortkvotient/Clotter/Psychosociology

Abortkvotient/Clotter/forsgskanins.jpg

Abortkvotient/Clotter/maselin.dra

Abortkvotient/Reguide.ini

Lowlights

Sharing

General

Malware Config

Signatures

File Explorer

PO_3N086_2F587.exe

PE Signature issue

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Abortkvotient/Clotter/Psychosociology

Abortkvotient/Clotter/forsgskanins.jpg

Abortkvotient/Clotter/maselin.dra

Abortkvotient/Reguide.ini

Lowlights