rFACTURA25-00897[.]exe

resource
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll

resource
rFACTURA25-00897.exe

rFACTURA25-00897.exe

IMPHASH b34f154ec913d2d2c435cbd644e91687
SHA256 966fae15977591dcc0cbb59722997dcc6093e56c4de02f5b20644c4dfe05d2ea
MD5 523bcca84b6d2aab6ccf5945b383dfe7
SHA1 a7ef1a8074bdf09f3e92ef3ea22d058b3f1891b2
SHA512 3585aa3b5a37a1efb2f2711dd1b0a919d9168cc3b0c341ac6421594d3c2b50e5f12e5f8151ebd26c9aa3f8cf6c2a2f96130091f44eb2ae1798a1b5def12ce295
SSDEEP 12288:5sGS2aCX21mFaDCigbr2QJODrTI08vP2CW9C9:57S2aCX21Qa2NbpJkT8vP2CW9C9
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned binary was signed by an untrusted entity.

PE Signature issue

Digest

5c:4f:89:84:0a:ba:5b:e9:9e:5e:82:4e:5b:5c:7c:ec:6d:c2:92:27:8b:95:70:6e:cd:bf:e3:b2:2f:1e:9d:b8

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Roripa,OU=Husdyrsygdommes Skidengule\ ,O=Roripa,L=Aristes,ST=Pennsylvania,C=US

Chains

Sep 29, 2025

PE Signature issue

Digest

7d:d7:dd:43:86:05:cd:d2:07:dd:1c:e3:13:3e:19:90:b9:2c:9b:27

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Roripa,OU=Husdyrsygdommes Skidengule\ ,O=Roripa,L=Aristes,ST=Pennsylvania,C=US

Chains

Sep 29, 2025

Minor OS version

0

Major OS version

4

Entry point

13145

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetEnvironmentVariableW SetFileAttributesW Sleep GetTickCount GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW SetCurrentDirectoryW GetFileAttributesW GetWindowsDirectoryW GetTempPathW GetCommandLineW GetVersion SetErrorMode lstrlenW lstrcpynW GetDiskFreeSpaceW ExitProcess GetShortPathNameW CreateThread GetLastError CreateDirectoryW CreateProcessW RemoveDirectoryW lstrcmpiA CreateFileW GetTempFileNameW WriteFile lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject lstrcmpiW MoveFileW GetFullPathNameW SetFileTime SearchPathW CompareFileTime lstrcmpW CloseHandle ExpandEnvironmentStringsW GlobalFree GlobalLock GlobalUnlock GlobalAlloc FindFirstFileW FindNextFileW DeleteFileW SetFilePointer ReadFile FindClose lstrlenA MulDiv MultiByteToWideChar WideCharToMultiByte GetPrivateProfileStringW WritePrivateProfileStringW FreeLibrary LoadLibraryExW GetModuleHandleW

user32

GetSystemMenu SetClassLongW EnableMenuItem IsWindowEnabled SetWindowPos GetSysColor GetWindowLongW SetCursor LoadCursorW CheckDlgButton GetMessagePos LoadBitmapW CallWindowProcW IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard ScreenToClient GetWindowRect GetDlgItem GetSystemMetrics SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharPrevW CharNextA wsprintfA DispatchMessageW PeekMessageW ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow GetDC SetTimer SetWindowTextW LoadImageW SetForegroundWindow ShowWindow IsWindow SetWindowLongW FindWindowExW TrackPopupMenu AppendMenuW CreatePopupMenu EndPaint CreateDialogParamW SendMessageTimeoutW wsprintfW PostQuitMessage

gdi32

SelectObject SetBkMode CreateFontIndirectW SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation ShellExecuteExW SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW

advapi32

AdjustTokenPrivileges RegCreateKeyExW RegOpenKeyExW SetFileSecurityW OpenProcessToken LookupPrivilegeValueW RegEnumValueW RegDeleteKeyW RegDeleteValueW RegCloseKey RegSetValueExW RegQueryValueExW RegEnumKeyW

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
MD5 0d7ad4f45dc6f5aa87f606d0331c6901
SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10643

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsDialogs.dll

IMPHASH 6b5c4f7d679059f68f1269aad3a5cecd
SHA256 1e40211af65923c2f4fd02ce021458a7745d28e2f383835e3015e96575632172
MD5 466179e1c8ee8a1ff5e4427dbb6c4a01
SHA1 eb607467009074278e4bd50c7eab400e95ae48f7
SHA512 7508a29c722d45297bfb090c8eb49bd1560ef7d4b35413f16a8aed62d3b1030a93d001a09de98c2b9fea9acf062dc99a7278786f4ece222e7436b261d14ca817
SSDEEP 192:olsHeylO012En8pqHtcE0PuAgkOyvIFc:oATI0d8pUP0WAgkBvIFc
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

7527

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Grande.Rub215

SHA256 8aa047c794cf04152845adaf50bb5f9651bd1622939522a0bb068c28c12400f3
MD5 7227676f8a8ef87aa52686f177061b23
SHA1 c37ac4b9ee08f7a72276b86a3d292420be475ae0
SHA512 6ec34e87dc560f9e90e60c50def30980afdd66dee6030a215b4fb05ff7ea82a0c889bd0f8b8d40423d6b7d6a29f1c0a9986ed2b41618cec895ce6058c58c8107
SSDEEP 6144:L0UHDYoa9QRt4h/AsjwSFYv03Po+/Ofyc20hDT19CA3DtnSL0O2yv5Xd2C:L0UHDYonq/AsjwWA0/Sf9DbD1O52Ur
MD5 SHA1 SHA512 SSDEEP

Tilraadeligste/Dagpengesatsen.Blu

SHA256 8cb5cc083a8f353c914f42daa6f672da789fef575e7e787601d75e40b24edb3a
MD5 3f493aa6ffe565e740d262e1c2789f65
SHA1 1b48ce4d2b46e5c569cc82adbac82a5cc5f9b149
SHA512 76d01b8d20d5f4927662cf8cf3aaf5e8abce26ceb4f72c85d986e31b9dfd0a0b52fb852f8a02484e8eab46147a35a05d2729085da93a951516a71708adcada93
SSDEEP 1536:HZoj5K5fPfST2BaElgiv57oT8TAwps1lFMqCD3dRyUoyoNKCkCi57ASDLzZ:a5qHSTAXg/U9nowtdPDPZ
MD5 SHA1 SHA512 SSDEEP

Tilraadeligste/Exhaustedness.rho

SHA256 97b77df8e753675798d359c3bf8873eeb189aacf71ab7dd4a865a5dc208a7143
MD5 b59271b6abf6203badbe0968059f9f66
SHA1 9743dc751216c3fd9493b4cba99cea98dc7da0c1
SHA512 7a090b7b92f4efd9bfcd1199f528d8d104569c6f5e6502de0009ef564c1f6832adb5ad0941cda2f89fb49cbf12d82edef7014d1357944c7a36d2121c7a018cc7
SSDEEP 192:sOkzE/FlAaRUPvWWAQbZyQlRE5CPfDZD/vZ1djT4O3MGkf/kGhuSWT7dA++haVAQ:B/EaR6p7RE4NDHZfbk9yhmS8MPv7
MD5 SHA1 SHA512 SSDEEP

Tilraadeligste/breezing.pol

SHA256 2862984b0d2884ccc873b2441225175c5ed6e4ff61184cb80f76eaeba93b1a64
MD5 59b55e140982aa595aaa17485b78dff0
SHA1 c677fce2497993fb45f5ef00112dae8ccf093c1c
SHA512 f92a5b47352a3fc7edf51211e0a881026a6e758d9f1e937f6077034789dfd45dcbcd9ab4bd71171e447dac493af1c740ecf515ccc7da5415bf55391e6bafb3ea
SSDEEP 384:FgPJJODSmnZ/v3rnhLwzTSi8OH7vYQTAxiPD8rc0V9Jmm55KrnUlB:F+YNpvt0TSid7vY08UIpJrDKrU/
MD5 SHA1 SHA512 SSDEEP

Tilraadeligste/ranked.mil

SHA256 d690f1b27cf68b7d2f56463ed3606e9a48bd1a8a9893b49e9c159eb53cd9a558
MD5 5882c543a65b6df2b456564784fed1d2
SHA1 b6236c1c434f81c82ba0fa04ab0ee82fd6ff05cb
SHA512 ace055d33a5aaa9f550d7e91d142f84619a7f297b07f76ba9b189833958a66306f969c1b3216c4ee24762a8e6d49f9389c82245509e33285c0cf24ba80e69002
SSDEEP 1536:uR+Aoxdv8I8X7Hqxfd19POJM3MaGwq9K3JY2Fa:uojo7KxfROoM1Y5Y2k
MD5 SHA1 SHA512 SSDEEP

Tilraadeligste/tve.kon

SHA256 e671e4b738fec88ae64c0795186b0662651777362db967d5a6f2a70db7379dca
MD5 c44dab2705ecb65fb37482145c7d8b59
SHA1 95d47e80f9924ebcef58cc6073da3904ad1c7ec7
SHA512 5670d630d397247c31c8069a79e33b274d3a12267673bd17c699d35892502f99a6493d5d661e1f7864c2434ed65351d1a2f34dee3e9ef9cfc5e54c6d1ae71962
SSDEEP 96:23KdV5q8TNZwS+8ccEa6gL7wR55aEt2boxTof+UQ:23EbB+MCae3Tof+r
MD5 SHA1 SHA512 SSDEEP

rFACTURA25-00897.exe

PE Signature issue

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

Grande.Rub215

Tilraadeligste/Dagpengesatsen.Blu

Tilraadeligste/Exhaustedness.rho

Tilraadeligste/breezing.pol

Tilraadeligste/ranked.mil

Tilraadeligste/tve.kon

Sharing

General

Malware Config

Signatures

File Explorer

rFACTURA25-00897.exe

PE Signature issue

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

Grande.Rub215

Tilraadeligste/Dagpengesatsen.Blu

Tilraadeligste/Exhaustedness.rho

Tilraadeligste/breezing.pol

Tilraadeligste/ranked.mil

Tilraadeligste/tve.kon