New_Purchase_Order_PO-2025-01001481_pdf[.]exe

resource
New_Purchase_Order_PO-2025-01001481_pdf.exe

resource
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll

New_Purchase_Order_PO-2025-01001481_pdf.exe

IMPHASH 6e7f9a29f2c85394521a08b9f31f6275
SHA256 b39eaec9267ce32916823eba57c71fbe321b9648cc8f50ee6d1a171800daa1e4
MD5 e6b2cc822ad480918e97070a62643b90
SHA1 bac01f415ab5e6e43b1fd2a6b3713bf7adb1ab1e
SHA512 4fef18ab040665cc816c570b1adf1e9bd42bf378db5d2b2aa73bc286681bd4109a823bb44f84f763279356c443d8267dcd1afa868a7a32524d62ea68545d5da3
SSDEEP 12288:OMweUzNb/QMy+P1NyRJwonnb1UB57NlBPrjkGWl:OMweUzNb/QMTtNyRJwEnh07RzjBY
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Minor OS version

0

Major OS version

4

Entry point

13455

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCreateKeyExW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken SetFileSecurityW RegOpenKeyExW RegEnumValueW

shell32

SHGetSpecialFolderLocation SHFileOperationW SHBrowseForFolderW SHGetPathFromIDListW ShellExecuteExW SHGetFileInfoW

ole32

OleInitialize OleUninitialize CoCreateInstance IIDFromString CoTaskMemFree

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

GetClientRect EndPaint DrawTextW IsWindowEnabled DispatchMessageW wsprintfA CharNextA CharPrevW MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW GetSystemMetrics FillRect AppendMenuW TrackPopupMenu OpenClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetWindowLongW GetSysColor SetWindowPos PeekMessageW SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint EmptyClipboard CreatePopupMenu

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateFontIndirectW CreateBrushIndirect DeleteObject SetTextColor SelectObject

kernel32

GetExitCodeProcess WaitForSingleObject GetModuleHandleA GetProcAddress GetSystemDirectoryW lstrcatW Sleep lstrcpyA WriteFile GetTempFileNameW CreateFileW lstrcmpiA RemoveDirectoryW CreateProcessW CreateDirectoryW GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersion GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW ExitProcess CopyFileW GetCurrentProcess GetModuleFileNameW GetFileSize GetTickCount MulDiv SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW MoveFileExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 7a9ddee34562cd3703f1502b5c70e99cd5bba15de2b6845a3555033d7f6cb2a5
MD5 564bb0373067e1785cba7e4c24aab4bf
SHA1 7c9416a01d821b10b2eef97b80899d24014d6fc1
SHA512 22c61a323cb9293d7ec5c7e7e60674d0e2f7b29d55be25eb3c128ea2cd7440a1400cee17c43896b996278007c0d247f331a9b8964e3a40a0eb1404a9596c4472
SSDEEP 192:nenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XBDIwL:n8+Qlt70Fj/lQRY/9VjjfL
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10719

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsDialogs.dll

IMPHASH 6b5c4f7d679059f68f1269aad3a5cecd
SHA256 6bf9cccd8a600f4d442efe201e8c07b49605ba35f49a4b3ab22fa2641748e156
MD5 48f3e7860e1de2b4e63ec744a5e9582a
SHA1 420c64d802a637c75a53efc8f748e1aede3d6dc6
SHA512 28716ddea580eeb23d93d1ff6ea0cf79a725e13c8f8a17ec9dfacb1fe29c7981ad84c03aed05663adc52365d63d19ec2f366762d1c685e3a9d93037570c3c583
SSDEEP 96:oFsvUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YuNqkzfS:oFsvWyNO81b8pCHFcM0PuAgkOywIFc
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

7527

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Ejerboliger.sea

SHA256 9bd0a139ce951c96a20cf47f239a45b1a830d348c820a988148b06798e735909
MD5 c5c24123a1e960a60fc47df970063c43
SHA1 3471e76851b24c1c1b1b91daa0ae5d61ec0fbd01
SHA512 b764d538bd72a3502e1085439ed3735585819f2cfc9e1718799ec426b3b0a3d9311249690da2851e792eab05bea9a739e3a77433082ce10e5a57a1b0e7412c7c
SSDEEP 384:zCU7KAoRPhi0gbBd3B4HMQV8C/WabqNdT:f7KAoR5i71NB4HBV8CRbgB
MD5 SHA1 SHA512 SSDEEP

Fuscohyaline.Hor

SHA256 078f0d7c7f6d0ae561b2bb772f6055e5ca75fc7ce397c1f5b36c6b6ab0d6e44a
MD5 8fdf17f9fdbf960f60e6a21109c84172
SHA1 508c0007cb3b87b9221f3d927c632622c6165a29
SHA512 ab86fe4964e44477048227a247393255927683f37cff8dd62bc09b3f637c54508f5527eb65c46bb1ed777275a2ac0a42fb11de1b26c80c660477eb58f96672d2
SSDEEP 6144:U76SQQWWLUrSLVUz42gYcI/hMq2iqCF3fOrsg15PDtRUqp0XttFH+G5Z9UQT:S6STNungQW5iDF3eJDDtSttVJUI
MD5 SHA1 SHA512 SSDEEP

Haandkraeft.hep

SHA256 2f2023e30c6338ffdcfada4a180a3f5363c6a4ba9a8a9995445e63866fcacdf3
MD5 c4a04968ea86ed1c54b5d2b41817665f
SHA1 27a9799605b3c7668f31d0be6912d2074a6eb3b6
SHA512 a347aa3b2a768290af8021085b39e4dc3aa475ec4ccf322083f117f2a65f4709b3d36d811fdf113c2cdd583881104a4ce8072d80d62c72dfc9756cfad00c481a
SSDEEP 384:eFxEMG5T9qnTA7Cw9Dnay7SqtfNiR4TKMXcFylEPL0khRu+nnTjmX+Gsc:QEMG5BqU7332mPTkEEPokhR/nnTLGV
MD5 SHA1 SHA512 SSDEEP

Krydsreferencer.int

SHA256 2ce4277258144db04b583e5c6ca3bd67a011b5db275aa31426847ad4b0455c5d
MD5 999be26c3c646fffbb07be2860fc0c68
SHA1 cbb7931d8bc2adee7e9a5b26d1610fba061adc9d
SHA512 665ba1166507967c68fbe3e84db3ad8cd9ba30b59df51770cc782269fcb2f28a3103bc0ef6ee67a108560f0dab53fddcc52504206ae894b7b88e253cb0400fcc
SSDEEP 384:17ULlQ1LjW89APCh/XVxxgNksirqEZ9RsWdYFq:1ClMjWpCxlsSVZt
MD5 SHA1 SHA512 SSDEEP

Okkerrensningsanlggene.pol

SHA256 fb89f04ddf9f7ef8768dadf36a79f35ce7d95ce7d4f1eb592dccfadc997c7268
MD5 79c723f3035249d8af6023118c6918de
SHA1 5f7ac742c9520c12baac119b1473ac85d2838b6a
SHA512 70bdf1c06ecdbd1a5bd3f7ce3eb0c1aa68f81ffb935db5fdc75552785659d835e60a07710079d42b3f534db25cfef7e26cdbbf88aded284da7b09f2e9ecefbab
SSDEEP 384:pTAmiNBcYzr1YLYcyx0hlqFI9ZvsNUpdtrUXS7ejj2d:p9YRmLhjaOd+uemd
MD5 SHA1 SHA512 SSDEEP

Polypsychical125.fai

SHA256 a150db4f4f0ec55067437ece412ede59781dfefd28de75b780d3e4d6537b786a
MD5 3d94a03ff41b9baed86eb585ddc4b347
SHA1 f0f6086466df186b1748c5d2b14836a61526bf3b
SHA512 f575655ca2252abe9f32fad6a3566fa97bd03a2037c0801765936c24f0f5fb2319d672299bf364843d40fac3b7ba1c951c7e912f0eb507f993abfe799c21c39a
SSDEEP 384:4TK0b8iuJb+3lgqo23I2y0ilD5zfoW+CW4i0R7cjnCOt9HaQ87KHmX:4lgTb2O2Y2y3dm46hg
MD5 SHA1 SHA512 SSDEEP

Spoilsmen.gru

SHA256 9fed0f37864001aa9c7f2a727f3dfa51ef07e59782658692ce00c5beaaa43dcd
MD5 cab7bcaabbb4eb421b49ed6628f41a64
SHA1 874658c8542de4cd171bff6b710cb9b8bb345554
SHA512 2fd7858cf22dced794586bdf94fcf8d2461ac26262c8922cf714597b2305df3ee349c9fa17820cec527da2646d4b005e0ab81070ea8ba49d616ee7c3b8e9babf
SSDEEP 96:6CUYClkM/ehu2/m1CaVF95aEjjHbMgLQBt8giE:6LYkCaFDa0NLQB9x
MD5 SHA1 SHA512 SSDEEP

Tinglysningen/Teeting.sek

SHA256 2109194d62183297cf7ca8daeef9b14e1aa909a29a0256f84a9c0a5ed2364aee
MD5 9d49938d1f8b22a9aebe4d0d83ad5ef3
SHA1 002c0f89f473d6c9a396de16fc9f18cabe41b9e6
SHA512 bda47df02f53fb183888eebf9f4331facfa6bb039695a52fb1e175f637f0768068d69c2feab42bcffc24580b864444e5bacbeb10407ede050adedff766aac0fc
SSDEEP 384:qu58ENCNX59XJKewTaFkQNZdazNDBXT/Pc:qupaX57KdOFkQ7QRRHc
MD5 SHA1 SHA512 SSDEEP

Tinglysningen/accoucheuren.dok

SHA256 015f362ee872f71a644026628d0e3b6dbe9940317532de798e7905ef125e9f52
MD5 ab0161c465dcdb797792d847696a8f44
SHA1 afb2b5a2783651f93b64f7c7c5a98e84544f2151
SHA512 f226b799f6690714d6517c04fb9ac5b32a9c4f6ef8918f5383a041bae66b25868e8a5dba291a0e65bd3acabdb97dbf1b0b514ec3f55892380c062306b5fdb114
SSDEEP 48:kbfEG0D2FRjdeU1JyVsAZheg8Zx6M7XL7PCIJMN7OKnvv2B7pdfWTV:k10mpzuR+x76MDL7P08K2D1WJ
MD5 SHA1 SHA512 SSDEEP

Tinglysningen/achromatism.res

SHA256 bfa687f8391bc7bc6fc04693ee464fd94667e7be3bb5cdcba5f0e69b43bf3d96
MD5 ad69a934bbeac5835db49e73f4558d47
SHA1 5f2086f72c61a04f8bb8c72c79bc33490d85aa1a
SHA512 9136f7f146287ccd90ad344b81f37426485d4f5dcff3944b8fe3d916075e6ee4fafbb39260c8c14331bb2eaeb82c5c59d566333571501148ea958a701a4a0716
SSDEEP 96:N8jqwLqwmCGmIUfOPa4qtsVVAp4GNRlbiXA2x5rF:eXLqwMeOqcU4SuHN
MD5 SHA1 SHA512 SSDEEP

Tinglysningen/astrofysikker.bea

SHA256 cadfb7b06f42785a1d375822256e7a1493ab6ed4d09caf2951601f4e4c1f94fd
MD5 54035ff6f311c6e5c832808ca2dd2f61
SHA1 1098ddc9f47dcbc6f82b7af017467b77a248d7d9
SHA512 7d0e28d20b9ef76d1e02e3abfaad80c22e7e8f188a36f3a29ecec21e984d5902e3e51ef3b13b27e3708985a0d85e6312a18443a960f781c0b2cd7149b260a137
SSDEEP 384:Ev/zWB1qn21c5z5CLbT9UHNbdt8c7ghLs0g/XMBDgolmgOd5rdX/rO6yb2saAH:Qzqqn21cXCLHuDt9ETgk6olAdb/6b2s
MD5 SHA1 SHA512 SSDEEP

Tinglysningen/elektrificerer.the

SHA256 5edf3bb2b4780390201a0514152636321ac8e3c88b20f44cab95e50d126cc1be
MD5 02f74e60f935e5e8873d9b6e2b414ecb
SHA1 5a6fcecdb56bd2c1867fdf8479c09324b9462183
SHA512 baf44f48490fa1657b3433bcae3b14ebaccc55ea411ad3b0c6f3a14d286d7197370f07e774d13c845efc9fe6697fbb6858effbb04b44e16c1378badbae7094ea
SSDEEP 24:AP/22L+m4L/AKU6CSG1kBVRx2RDAK9loGJHcUPaNtGC/vwbO3o:Akc7SxBbxlY9YLR8O4
MD5 SHA1 SHA512 SSDEEP

Tinglysningen/eskaperedes.pre

SHA256 dd58a757757ce818ed8cb75327b80ecbc482ef3d0db3ab074019875775f98e31
MD5 a0f190db0ef2995205a5021e6ba5c681
SHA1 9d673e1ba614ee91ee005292aa589fff437f72b5
SHA512 482c4673f0d76f03d77b7da9c2483a4dc5c95b4a9fa01a3dd94838d18dd6b4028876766731b12259056ed3f262f5824189386f98b8723066217a7cbe3b89ab18
SSDEEP 48:5PFG3kgrxMyqj6+UnhK4vVkZsB7PZtT4XG8eQo4mYiFu0flRIiwYUaWBISf7w:5PFEkYQmtvVk61twM4mq0NwF0
MD5 SHA1 SHA512 SSDEEP

Tinglysningen/forfatninger.fev

SHA256 8bbf1e337f5c65dcfb4414edd628b4829056b3e9fdd8d95f56f36f7f9c5f07f2
MD5 664586f95371b0ef11beeb16c9e0bda4
SHA1 c42574e09ecbd1d1331e19e0f9daf3f3f959b928
SHA512 53fdf2bd44357f28837bf3d08fa2be01c639c0314ab88c4c241b61fcacfe5e7f73c1e768c3900fd82b28f422fced5ff40068c35632176762fbed90759ee2dc57
SSDEEP 96:V2YjNk0aJ4yfFxJlH5A2X8BjAa5m0IfMmAsaCnkW:V2Ya0O3f8XBXpYf
MD5 SHA1 SHA512 SSDEEP

Tinglysningen/retspraksissers.omn

SHA256 39c182e4a38202911715572cb1cd4aa2adf317401f9d68add7bb5e1c239311bb
MD5 c35957fdb2e7ba3a2c970d00fe8dbad2
SHA1 fae6115f35e74ee2b4217d58fd08d4cdf49d7293
SHA512 f50b6b05ca4b59bc0a0e6a99ea6809349d3f65f0b7aa36f96f2d755c9e4dfe5a6a2c9f76182bced0d001e415bc102e7fcc476b5f1f59ddcad8decbe5416aa798
SSDEEP 384:U1S1BY+FU/MJKLI9f1fcq2EL52wMWc1VaJ:UwKMJd9hyEMf8
MD5 SHA1 SHA512 SSDEEP

Tinglysningen/svipturs.pro

SHA256 02faafcd337ec959dadf1c322ba17825127ff284f03e0859d4967d841e5192a5
MD5 d860983e22b8800905569f4de35c31b2
SHA1 2c5d2b05fc6fba9804a27bafe4c31ac23b4db60e
SHA512 040de5c765047770c0d27950e82f41fdc176f4c303ac30d3f26ac755787eb807ceec7423ad0f416bc87bf25d65d958382a3d25b8cc6d7853c058795e4c12428e
SSDEEP 192:sQfmgAvPB4NXRW9ICElQzYttngvg7oAgHtgYV2AQAgTBlHvj2ThU57qvaQ6mScoU:RfY4XgSkOLhrcNNtjLSwLmvo
MD5 SHA1 SHA512 SSDEEP

Tinglysningen/terrestrialise.mis

SHA256 5a0bd2a126e3d5c547f0962ecdaeba1d3851a0570ddc3a9145b3c9e81e06fdf4
MD5 ac19cbf07ec99fefb5c5daeec03fe5e3
SHA1 8f53ebda031353c4e7f6c25d6c845c733ed862c7
SHA512 39b06edb90e2ab9938f5f2d2874a9da0fea52fb9d266a9964575c2bf75c7ea00e53159d45238e26595dfedfa6d20028e530c045661a7c902dad7c02b79eca471
SSDEEP 192:UaMcY+GmUO0MP1+4rq8aV8H2gqZdxwp1wKD6kggcvEWckkF5SwdhNaLE01Klati9:UTcj5NQRNwTwKDaXaxb2liYxlkuGSk
MD5 SHA1 SHA512 SSDEEP

Torturofrenes.For

SHA256 bab70d647829dae3d87cbb92e37c55482c8fd145f5fea3062a3a8cbbd8f11400
MD5 f1710a2fb6bb0c3023ad7c9048dd27c6
SHA1 e7ae01a348dcd1183e6669c79f198c043666ddc3
SHA512 3dc0264ac2c3de8d50ac9eddc6819c3cf0efb0ca1900fe78ecda9296360bfcda49dccd6f61dc56299c18873ccd0670205feffbea744bba8a8471c53c8e087320
SSDEEP 384:RiIqY8gz5NAJA6DuchWV6Qn55U2bIvxt1l2EJV9hPdx/Hb51:kq8gFSS6Y6o5JbAp9Lz1
MD5 SHA1 SHA512 SSDEEP

Sharing

General

Malware Config

Signatures

File Explorer

New_Purchase_Order_PO-2025-01001481_pdf.exe

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

Ejerboliger.sea

Fuscohyaline.Hor

Haandkraeft.hep

Krydsreferencer.int

Okkerrensningsanlggene.pol

Polypsychical125.fai

Spoilsmen.gru

Tinglysningen/Teeting.sek

Tinglysningen/accoucheuren.dok

Tinglysningen/achromatism.res

Tinglysningen/astrofysikker.bea

Tinglysningen/elektrificerer.the

Tinglysningen/eskaperedes.pre

Tinglysningen/forfatninger.fev

Tinglysningen/retspraksissers.omn

Tinglysningen/svipturs.pro

Tinglysningen/terrestrialise.mis

Torturofrenes.For