nJUSTIFICANTE_DE_PAGO.tar
- SHA256 68b8ae15a169fba054353a40400f3085f638004b0388e08c6f8094d05bc16daf
Static task
static1
Behavioral task
behavioral1
Sample
JUSTIFICANTE DE PAGO.exe
Resource
win10v2004-20250502-en
windows10-2004-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
JUSTIFICANTE DE PAGO.exe
Resource
win11-20250619-en
windows11-21h2-x64
22 signatures
150 seconds
Behavioral task
behavioral3
Sample
Insculping/Anormaliteters.ps1
Resource
win10v2004-20250619-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral4
Sample
Insculping/Anormaliteters.ps1
Resource
win11-20250619-en
windows11-21h2-x64
16 signatures
150 seconds
General
- Target nJUSTIFICANTE_DE_PAGO.tar
- Size 698KB
- Sample250702-d9fswssms5
- SHA256 68b8ae15a169fba054353a40400f3085f638004b0388e08c6f8094d05bc16daf
- MD5 f715a1fb596949103a16904f5c537733
- SHA1 53e2c9ad44278c966728dec0f4a5dfc8722ca542
- SHA512 fe3322f5d4d77e681449b5a3a4d7ff4bbdc0e9697e1647f18788551a2b8de63aa3d72b26183df27c250f3585991e3dc70ef0014faff07a61fa28a989a5fc06d9
- SSDEEP 12288:ltmfguMe/Nqn5OKY/+o+4mYo4ZvldcAb8YxY+kthCaG782X732JVSd:/mjNo5Q/+o+4mYo4Z9Pb8YVkjE8Y2JV8
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
File Explorer
-
nJUSTIFICANTE_DE_PAGO.tar.tar 698KB
-
JUSTIFICANTE DE PAGO.exe.exe 696KB
-
Insculping/Anormaliteters.Lbe.ps1 49KB
-
Insculping/Bagtalelsernes.ini374B
-
Insculping/Lnsomstes/uhaandgribelighed.res3.3MB
-
Insculping/Subspherically.Mal484KB
-
Insculping/delsystemet.ini910B
-
Insculping/fascisticize.txt519B
-
Insculping/innage.pro808KB
-
Insculping/katrinka.jpg.jpg 12KB
-
Insculping/kollokviums.fib130KB
-
Insculping/ringworm.ini634B
-
Insculping/storeslemmernes.oph1.3MB
-
Insculping/ticca.sle4.4MB
JUSTIFICANTE DE PAGO.exe
- IMPHASH b34f154ec913d2d2c435cbd644e91687
- SHA256 d487d18dcda397acab625d17fa3cea49f5ee428ab3dfe0c45921c3cdae715e5c
- MD5 b218b6344b277aefbc7196d34e964473
- SHA1 9dd4cb4b9b4c7e51fc753b3b2e88613b813bf604
- SHA512 2ce7b3a84d356d08ac934f3d7dc396af63be66a79315799d43f8871df9283960a2808f149e16481756bf5858d0d05e00be9f5c58b1586213770cd233d8608af7
- SSDEEP 12288:btmfguMe/Nqn5OKY/+o+4mYo4ZvldcAb8YxY+kthCaG782X732JVSd5:JmjNo5Q/+o+4mYo4Z9Pb8YVkjE8Y2JV0
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
N/A
Digest Algorithm
N/A
PE Digests Matches
Not matched
Trusted
Not trusted
Subject
CN=abdikationens,L=Hardanges,ST=Pays de la Loire,C=FR,1.2.840.113549.1.9.1=#0c17507265736e696e677340466c7567746e696e672e457572
Serial Number
77:9d:3f:e7:24:31:75:3f:45:07:7d:ea:f8:1f:21:20:92:2e:62:0a
Issuer
CN=abdikationens,L=Hardanges,ST=Pays de la Loire,C=FR,1.2.840.113549.1.9.1=#0c17507265736e696e677340466c7567746e696e672e457572
Timespan
Jul 14, 2024 - Jul 14, 2025
Minor OS version
0
Major OS version
4
Entry point
13136
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
SetEnvironmentVariableW
SetFileAttributesW
Sleep
GetTickCount
GetFileSize
GetModuleFileNameW
GetCurrentProcess
CopyFileW
SetCurrentDirectoryW
GetFileAttributesW
GetWindowsDirectoryW
GetTempPathW
GetCommandLineW
GetVersion
SetErrorMode
lstrlenW
lstrcpynW
GetDiskFreeSpaceW
ExitProcess
GetShortPathNameW
CreateThread
GetLastError
CreateDirectoryW
CreateProcessW
RemoveDirectoryW
lstrcmpiA
CreateFileW
GetTempFileNameW
WriteFile
lstrcpyA
MoveFileExW
lstrcatW
GetSystemDirectoryW
GetProcAddress
GetModuleHandleA
GetExitCodeProcess
WaitForSingleObject
lstrcmpiW
MoveFileW
GetFullPathNameW
SetFileTime
SearchPathW
CompareFileTime
lstrcmpW
CloseHandle
ExpandEnvironmentStringsW
GlobalFree
GlobalLock
GlobalUnlock
GlobalAlloc
FindFirstFileW
FindNextFileW
DeleteFileW
SetFilePointer
ReadFile
FindClose
lstrlenA
MulDiv
MultiByteToWideChar
WideCharToMultiByte
GetPrivateProfileStringW
WritePrivateProfileStringW
FreeLibrary
LoadLibraryExW
GetModuleHandleW
user32
GetSystemMenu
SetClassLongW
EnableMenuItem
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongW
SetCursor
LoadCursorW
CheckDlgButton
GetMessagePos
LoadBitmapW
CallWindowProcW
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
ScreenToClient
GetWindowRect
GetDlgItem
GetSystemMetrics
SetDlgItemTextW
GetDlgItemTextW
MessageBoxIndirectW
CharPrevW
CharNextA
wsprintfA
DispatchMessageW
PeekMessageW
ReleaseDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
GetClientRect
FillRect
DrawTextW
EndDialog
RegisterClassW
SystemParametersInfoW
CreateWindowExW
GetClassInfoW
DialogBoxParamW
CharNextW
ExitWindowsEx
DestroyWindow
GetDC
SetTimer
SetWindowTextW
LoadImageW
SetForegroundWindow
ShowWindow
IsWindow
SetWindowLongW
FindWindowExW
TrackPopupMenu
AppendMenuW
CreatePopupMenu
EndPaint
CreateDialogParamW
SendMessageTimeoutW
wsprintfW
PostQuitMessage
gdi32
SelectObject
SetBkMode
CreateFontIndirectW
SetTextColor
DeleteObject
GetDeviceCaps
CreateBrushIndirect
SetBkColor
shell32
SHGetSpecialFolderLocation
ShellExecuteExW
SHGetPathFromIDListW
SHBrowseForFolderW
SHGetFileInfoW
SHFileOperationW
advapi32
AdjustTokenPrivileges
RegCreateKeyExW
RegOpenKeyExW
SetFileSecurityW
OpenProcessToken
LookupPrivilegeValueW
RegEnumValueW
RegDeleteKeyW
RegDeleteValueW
RegCloseKey
RegSetValueExW
RegQueryValueExW
RegEnumKeyW
comctl32
ImageList_Create
ImageList_AddMasked
ImageList_Destroy
ord17
ole32
OleUninitialize
OleInitialize
CoTaskMemFree
CoCreateInstance
Name
.text
Size
25KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
3.6MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
184KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
35KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=165, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=12, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
Insculping/Anormaliteters.Lbe
- SHA256 1e82f77b530d7f343affd910d06130f436ff32c05d74dd0e66b41850dd623682
- MD5 3d73d264c54f1590e7c44734386dec50
- SHA1 7eef5e0330e3357b548c334c4bd4eda6600e8257
- SHA512 e2f6f3e71adf6e0019a5eed739d28d632023b4fb771c4d642a3c50efccbd6fced32af65a259a0e8890e45d5d9ce31c63333322fe9d9beb7655daee529b5552ca
- SSDEEP 1536:K1gsAsWubmbeFA9uh/QjRqPcKCR9/8fDpL:4gsAVwseFQuF6Z0ft
- MD5 SHA1 SHA512 SSDEEP
Insculping/Bagtalelsernes.ini
- SHA256 8b407676c9a6a2166026c932e18a5eb67018297cb9cfc6ef3e01839a369b2420
- MD5 91f079a9357131b62bc38e03b293915d
- SHA1 15186f4ed2bcb3ab11e9629afcf9119516735461
- SHA512 18153176e680ae642e27f71ba246651c8b33c5b53dc585c854172a5b780733c4aad22734a91f9f8bdd380d51348047393372f413738cc6defa6a072df5263288
- MD5 SHA1 SHA512
Insculping/Lnsomstes/uhaandgribelighed.res
- SHA256 652b1365671f1e1fa35d22d4517352cad1797b3e3a889f2278f0109c7b69d010
- MD5 aa302e8deddfada0b44d76a325a66548
- SHA1 4ef4bf662303c1d156bd854d281a1085c164f500
- SHA512 71a5213f6edc3587f50cdd659c1a2057da83ac4ffe06076582af59b95dc8f88eae5d827b9a3dee24b2e05f547c2a0271d0b418f5d91e7ac3eb87c685d51bff14
- SSDEEP 192:fMm6exW2ZMp1X7bmDdbltPYMxQY/EsFFdCP8OwRWSugofH/PR2UKIR3+EKF/E8kc:RAkKj43VKFw/aLZO
- MD5 SHA1 SHA512 SSDEEP
Insculping/Subspherically.Mal
- SHA256 a095101b94c46e3eb6a1bcb96a9041f6c22bbde8d88b9efc0e4190b0903df9f2
- MD5 07face8373a6e721b2ef92a6365f4935
- SHA1 21f4736e806c8557b260027576a9e3d376b96380
- SHA512 b5210ef5f64304a2a466805caf88f765b507e6d639265e6e4635fcd316626848e282cc5365294a675eff17cd1f1a421402e530ada537e10b926654bfed042024
- SSDEEP 12288:lvryMOmtASHK91bpRcbvE0GnwHhPsBROwFJ:leFjGQWHhUb/
- MD5 SHA1 SHA512 SSDEEP
Insculping/delsystemet.ini
- SHA256 4f0a8bdae27e9bcd4a846dead50c5a65304878c533aef567d99df10dc2b7c5cc
- MD5 985fb81233ab3d27e98e6731ce7c65dc
- SHA1 7d8bdbe994c061df8ccfa40b1d372ef7383896a5
- SHA512 0a59045cc6e7ae71fbe15e4abbb020692d2d7eb9aaf39522cd46a036634fa2731ae0e612e7ef0946355862934bcf057707bcbb8598eb2a90a516fbc92baeb208
- MD5 SHA1 SHA512
Insculping/fascisticize.txt
- SHA256 f2b3e1db86eba4ff7370624e1409de8eb75127744e3c94b0763f3d2735562508
- MD5 65aa94f7638b22b3b3e48493177fed1f
- SHA1 845d2b663e233496a9db2e5a91013427d17de9e9
- SHA512 5a195bb3d6c158a3c78508803ae10837252149f3dde4a4b213d63f156c89f3b958dca41804cba903e395ef2d02037b90846dedcc863cef9d826bfb2b21463106
- MD5 SHA1 SHA512
Insculping/innage.pro
- SHA256 6458c28a785baab98918dd51d3b92bd8d22dfc3f3ee3ceb1de46f2f946bf0f3f
- MD5 de5e50bb373923e2d8c6e7f083cd802e
- SHA1 ba94c324bbe7237d6cbea6c79b798699d82a068c
- SHA512 e9cde6b6b47ab95f63c0d5cf5135c773781571e6d2b0dc51e77348dcca291709a0b748c0f50cf645eef74b66dd87b90afc00de77bca4dafea3fef74799b5af85
- SSDEEP 768:N9AYVTyaJB4DTdq3Ac76bwfeLsQrNxs6lb5O3YCoWW7t8UVJeWr:N9AYVTTGTQ76bT9rTKYzLK3Wr
- MD5 SHA1 SHA512 SSDEEP
Insculping/katrinka.jpg
- SHA256 0818d97b7d1ad05e418d2f292604b76a9a7d6a2cba44e752789dedfdd55499bf
- MD5 22f4a02a4a45fefde866a6f8bebbb8f2
- SHA1 c8ad98a2990ddb7e332ce386a8b51025feb82a9f
- SHA512 2afc0a82d2af4a747fb853da0a5b71a58573763de8a8a5718843c4e81baf8f7424b33da00925dd4dc57f8579b5778b722af05317003db2da56c0a8e61d11910d
- SSDEEP 384:z6zGM6L2m3yhzIU4s4ejpgZxZYo0d8uKmxmiyt52rAfn:ezGMO2mChzJhXpYS48sXP
- MD5 SHA1 SHA512 SSDEEP
Insculping/kollokviums.fib
- SHA256 0e40cb962b115f702a4af620fad8c86c16bdffb7d556f5e97b0a0ee84f8aa6fc
- MD5 3b9b3748564ae033f8ecb964f6474359
- SHA1 bafabce6de1b38a255c7330cc440a41da55d7a02
- SHA512 a714a130b62a82a3a01485dff8a0c2b152d4837ba23f97509a13750ac74f8df2e5f3503e482c870e884e9d60582b34fc73d78963923271615f96f484266b127b
- SSDEEP 48:WO/s5zRArrc733IQHDbIeKBQv3u90V+yICjBKYn0Riw3PEPsYpAf6yrX0b9NovH:oFSr04QHfIeK6vu90V+yRMU4i8es14M
- MD5 SHA1 SHA512 SSDEEP
Insculping/ringworm.ini
- SHA256 3e59919852e82ea1672835466c705bd3be72dda34400c42a064c3a3ea7f457a9
- MD5 6f35e5cf0e8399e4343a01ff541959ec
- SHA1 151606b33ca5a20e2569ea6642adad5eebefc244
- SHA512 a9be833477d6a7021b47f6a90453a88b3096b329ccc5cfe9897d2e05fc7f71fe5c7286667e219945e74c8cca4bc143571bbc47f5c59bdad716646b96cb553606
- MD5 SHA1 SHA512
Insculping/storeslemmernes.oph
- SHA256 595bd7f382329496c19d553e1717c2dc7d2b07126e08493fa4260baee61eb779
- MD5 86d2d2707b9ee8944bb56acd36466195
- SHA1 e13e97db685e1edfdea885fe0e80f478a58cf75e
- SHA512 323b939e2e5e70ee68e81a125bc74388e396fd530793e141a0699b813c05c02cf6d7da9e23df7b1894c57c5caadce3fca31d685961cef7dd30064c8c22dcf22b
- SSDEEP 3072:t2g7Byzdg2xLxaj9vV9tULGBK2oiIQPh61TDmI5NqyKTavMsU5tTYrzCel:2
- MD5 SHA1 SHA512 SSDEEP
Insculping/ticca.sle
- SHA256 adb99b275dcd4d657735380ccf7a23318aec8b097b9fb72a4f6f76faa282e4d4
- MD5 52b2d6d01f08f75ebc1c5cb49655389d
- SHA1 a7d4798265d7d69d268df8c18aedbfc7b371898d
- SHA512 e431c8bb2f92c98219920e800c85a38f0ca22337a8e3f7f743f292726b5bf4bb9a440357c07827dfb4c1def954e4b772f10a4f7b9ccc36b293e68b129a3db6c8
- SSDEEP 1536:nZEKQzQ26bppj70WaC9f8D4k4i9anQwdxtTWM2DHroHHYOOYHe7gYfjoFlC7SFpH:ipE7
- MD5 SHA1 SHA512 SSDEEP