TRANSFERENCIA[.]exe

resource
unpack001/$PLUGINSDIR/System.dll

resource
TRANSFERENCIA.exe

TRANSFERENCIA.exe

IMPHASH b34f154ec913d2d2c435cbd644e91687
SHA256 cc43eab382b61385c874129270e17c76912eb94c2ea5158ba1175c6689bbec38
MD5 d1ddfba00d3dfb405c29575b2903d156
SHA1 013d1dfd117f350632b68bdfdde45581dffea1cb
SHA512 88bc63849b4be1dc02fdd3b2dc5e7f2089f73fa9bb5f898c65010fd0098adde694d50abe5d2fe9e6952874cdfebb235a3591ecd8da0053e471842c60a0a92764
SSDEEP 12288:MrMfyflXO6Ut9jeQ5UawozoPIPZ5JDe7ndedXFCF3yct7P31:kMfulXM7F5jzQIPZX9dXF+ikPF
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned binary was signed by an untrusted entity.

PE Signature issue

Digest

02:be:f5:76:89:5e:0a:e2:dd:1f:f0:56:a5:ed:d5:4f:d4:59:2a:ea:84:f3:c5:29:1e:37:61:b3:3d:6b:3f:7f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Rivieraens,OU=Brostenen tudskraal\ ,O=Rivieraens,C=FR

Chains

Jan 5, 2026

Minor OS version

0

Major OS version

4

Entry point

13136

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetEnvironmentVariableW SetFileAttributesW Sleep GetTickCount GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW SetCurrentDirectoryW GetFileAttributesW GetWindowsDirectoryW GetTempPathW GetCommandLineW GetVersion SetErrorMode lstrlenW lstrcpynW GetDiskFreeSpaceW ExitProcess GetShortPathNameW CreateThread GetLastError CreateDirectoryW CreateProcessW RemoveDirectoryW lstrcmpiA CreateFileW GetTempFileNameW WriteFile lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject lstrcmpiW MoveFileW GetFullPathNameW SetFileTime SearchPathW CompareFileTime lstrcmpW CloseHandle ExpandEnvironmentStringsW GlobalFree GlobalLock GlobalUnlock GlobalAlloc FindFirstFileW FindNextFileW DeleteFileW SetFilePointer ReadFile FindClose lstrlenA MulDiv MultiByteToWideChar WideCharToMultiByte GetPrivateProfileStringW WritePrivateProfileStringW FreeLibrary LoadLibraryExW GetModuleHandleW

user32

GetSystemMenu SetClassLongW EnableMenuItem IsWindowEnabled SetWindowPos GetSysColor GetWindowLongW SetCursor LoadCursorW CheckDlgButton GetMessagePos LoadBitmapW CallWindowProcW IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard ScreenToClient GetWindowRect GetDlgItem GetSystemMetrics SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharPrevW CharNextA wsprintfA DispatchMessageW PeekMessageW ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow GetDC SetTimer SetWindowTextW LoadImageW SetForegroundWindow ShowWindow IsWindow SetWindowLongW FindWindowExW TrackPopupMenu AppendMenuW CreatePopupMenu EndPaint CreateDialogParamW SendMessageTimeoutW wsprintfW PostQuitMessage

gdi32

SelectObject SetBkMode CreateFontIndirectW SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation ShellExecuteExW SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW

advapi32

AdjustTokenPrivileges RegCreateKeyExW RegOpenKeyExW SetFileSecurityW OpenProcessToken LookupPrivilegeValueW RegEnumValueW RegDeleteKeyW RegDeleteValueW RegCloseKey RegSetValueExW RegQueryValueExW RegEnumKeyW

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 c2f405d7402f815d0c3fadd9a50f0bbbb1bab9aa38fe347823478a2587299448
MD5 9625d5b1754bc4ff29281d415d27a0fd
SHA1 80e85afc5cccd4c0a3775edbb90595a1a59f5ce0
SHA512 dce52b640897c2e8dbfd0a1472d5377fa91fb9cf1aeff62604d014bccbe5b56af1378f173132abeb0edd18c225b9f8f5e3d3e72434aed946661e036c779f165b
SSDEEP 192:eX24sihno00Wfl97nH6BenXwWobpWBTtvShJ5omi7dJWjOlqSlS:D8QIl972eXqlWBFSt273YOlqz
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10178

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Enmandsbetjents/dentist.pse

SHA256 8ab1cb04590e53d0d64c05048452e422b81a8ae8273d059388029a7db684d220
MD5 cc764b3f6abc74807f28a0cf380b3115
SHA1 435d2791b720d9d7109a8d929d8ae5f9b1657af5
SHA512 204938e26fedd246894718c4cfff8a4eeaa19c6419ec7424e0ff3064a850c6771aa852fabd8c393f504b26ce7495c0c204ed8199d271fbfd85962a9ef8bb1aa7
SSDEEP 192:TTT8Vw/IPzGbZtPvOoQ5SOb6QpHt4OENhOxUFqGHeAxFGmVlMJ2P/5w175OaVhaw:TN/acbNxMEvIv
MD5 SHA1 SHA512 SSDEEP

Enmandsbetjents/didaktikeres.tin

SHA256 c159bb12f04147f06823d4840ebfb79077286f7e22981b3eceb8d0fe37041026
MD5 2a30c6e6c24f30af2fed009ed4c30132
SHA1 ec56cd3448fba2f2853eb3c5dcbb889a634c0643
SHA512 47f3e40614dd524c455aac78d43ea0c63e3e86e67559cb56d8237ea6aaf34f13f1a492e831f88dd49d5bdc0042950caf5285467a4505c5050155f6ff2b52f753
SSDEEP 768:8QfyZtf7iOxz1yMV6Vkn9yJ3jkuafK8qcZJABcUvNPcRLQzdQtsDEHNam:O
MD5 SHA1 SHA512 SSDEEP

Enmandsbetjents/exude.sol

SHA256 9326decb54b127ce64d374976abd5b2acd216fb7d75d176fca8a953c5c01f83e
MD5 ec4b34863e8caab57892a26447f47d67
SHA1 51440f6d58153b4221ad329c61be4546eb5eaac2
SHA512 435380747d75849420b7264820a972f2253e79287dee785e33acfccfa0b0706be6c9f85f3fe8d5ddc81d1844b7bab282c549168f7be494bea9c2b6208d7921c9
SSDEEP 768:1mj1A+Q9TOEDI3xEIdsJaV9Rt64ySwBTcfH9Xy43eel/nfpMlJyDoeTs:S1o9kVd0493VydBTcP9XyKBpRMPGs
MD5 SHA1 SHA512 SSDEEP

Enmandsbetjents/finansielt.poe

SHA256 cd6983992aa8d0fafca9aed594f7ac61c3f73ecea3b4629a1fc427bd0e34ce6e
MD5 df1524b9658616d92917b79ed34cf56e
SHA1 6eb009de7b0235a2f140ab07dd18ca68163c3b2d
SHA512 dc77c79262f6cef87de6df84251231f92563552e1f0ef9829b2ef2c82129a1fd6311beb5952209069750fc86ba3bbea88373c6a6bc5d24d4eed7ec160f3c5caf
SSDEEP 768:q3xDxjp3a7HETxHFhjg5RqkMlFDwdtDxW:q3Nq4T1N
MD5 SHA1 SHA512 SSDEEP

Enmandsbetjents/logarithmomancy.jpg

SHA256 8ce72e3c012f0c894b3803ad0bb0fdb2bc81aa4660426db7a868bf761b0bd02e
MD5 19f4f3fd6fa86ff980b524c15c06b26b
SHA1 b69be4c9c52199500b2c3af36e14d81238cde0b4
SHA512 d06bf82ef2be02596f771eb9ab748e896f419ac35e8229f034d506ec6931eb4c32f196418443b8a4c562755fcc1b91df6e86f7b0a5b88f6b19385049612dd715
SSDEEP 384:RBKPP0rPpYouWE1vFryFD5A8RvsHlOfRlPTbfWFiGS7+2yrN7snmW40:R0PsGdWMxyD5AIUFOfHPvfrGSijM
MD5 SHA1 SHA512 SSDEEP

Enmandsbetjents/overexpanding.beb

SHA256 491d464857903980cdeeceac6cea4c5807f515f0384d1d7e63329f452e3f20b1
MD5 26ae37c6bf9906c1b8d6722d7a26a082
SHA1 b726fc995b33dda49e29ce31f5029a3caa8bd38b
SHA512 a6c936b8293848183a814c0c380e388a2a8dda012e328430b7b49e79b05ea8729cd20167007f9618f306d91173a99cd6316d3eb38688a231c230ac2d1e331324
SSDEEP 48:AlmTdjxDpsLZ5+ZFcBXaCsXI0/XVzQRLs5Yk2:AlmTdjxDy+bchQ/XNQZn3
MD5 SHA1 SHA512 SSDEEP

Enmandsbetjents/overskyggende.ent

SHA256 54ed11906550a54771e56ceebae878d1bb6616408b21a67c0cad28e190537c39
MD5 ee232dba6c02aaab33d9159098b29d99
SHA1 abdd21ffa2e28a67556b20e8bc70e6da88f458b2
SHA512 1c438d9a2e55ca32c586776337b5ae0771ba985aad15951d338fd6ed697013cab6e2fff3f09764e76d2cf795e69cc2de984552e2611ffd55bb3d1a28f9530331
SSDEEP 384:CwLM6YDhtqvWY07T2gH5X7Tqb7Lv+LoXs:CwM6+TgKC0Xoc
MD5 SHA1 SHA512 SSDEEP

Fungere/requienia.arb

SHA256 b8dcb5ec27e2cf545b21716da2243a8d16a59b979766b70c1e5e9e4ce820fc5e
MD5 dab537fd05bd03083f0f6e2f4171ba03
SHA1 eaa10be6c09cf7f00b69c21a6ea44a117b417c18
SHA512 c77393ae6d92026b5d3d0288c1095cdafc261100504a74fe606330ea357b7bfe2e0772a75c725ea1d722a9b464c81264fa2a23757fff86968662c3b5fddedf5c
SSDEEP 192:DcVdFnriOBqJLOHZINnkxZIt6vXDIk+Js3:DsFW2qJLO5IpkZIYvXDIkf3
MD5 SHA1 SHA512 SSDEEP

Gasbeholders.wod

SHA256 cd328a0a9925f0fc5ec3fc49bd3504e235406dd17c514d5d2929e3602bf50849
MD5 d518bb5f7b2351d8639942441df689c0
SHA1 1c8041851a716be98038c3059a36de686242f9e7
SHA512 837dde31fe3c4fb841a0a676f22c4a9ddd56d21a74a6a5db854dc071c47f0b3104510e42368ba206d764bbb74df0d3677d45c8d10c8b5e7808ea0ac5e5335f9f
SSDEEP 96:dGmmDS03Eu6R2txUkl8l0qUMxb9QTsh7AHHnUZT4P+AqN:vmYu7txUZ0qUMLQTsA4cGh
MD5 SHA1 SHA512 SSDEEP

Indsmigrendes.Kal

SHA256 77d640b66dfab6d4c9f5de4156a3c009ca5cd5ee61bbeab8b1951330ffb4308f
MD5 fdc7ea654d9d8de6d12da515e7e2a5fe
SHA1 bcc1ea5e81049ba252c6cba677b8fc9f4df78e56
SHA512 b8ffa51128d500ba614cf39da94fe8babc3b9335561b1635ac84969cd84b1487d350cbfb6b330f13abb3ed6d1d0c2048d14a3c5780d43d5ed998aef5b4b7bbc0
SSDEEP 6144:kvvSy2POPggF/jznxMOoTnQYbL8SBXQnbzuMemheyw7B92xwVoLZlZ:MKy2mPggF/jznSBTnXL8SNuX+mheyw7a
MD5 SHA1 SHA512 SSDEEP

Rkeenglens.txt

SHA256 ca22dc9cfa9e01682d6314584624c44eb73f035a8415a8f5df22c80239b464ff
MD5 2265ed75d702cb9c79abd75490349cf5
SHA1 732cabd29040411b6ab02ed704a4d2e083d52dd8
SHA512 758f0b4911f8e1e82274ed84be24022e7823ab6b2cf73262593644f34b18158d74b36aa91e09160e9776e299857370a1b91b167d5e415e05cfdad4ba8fe09887
MD5 SHA1 SHA512

Tropeskovs213.txt

SHA256 45e34034d2e660a604c180635a5dedc299192afd36dbf280ec3a85fec1a93b56
MD5 989c59b23aa3be4f91b75f24e69e9aa4
SHA1 f4a803f5fa59cfd2954f096cd1bac75b123c5be4
SHA512 6ce440131eefdcc566f2d7a406cdbfc9654a043f1f1e3adbadc043284fec1b4e4447af2f3375c00ef0a22ac463aff1f6a957e41391758ddf446aa25bf3e8faa1
MD5 SHA1 SHA512

basophils.jpg

SHA256 9908d967a1042115c4437bdc14fc2b8ae42d2b33dea6b8bbe44dfdf229168386
MD5 c783f6d45d78c84c6c7df0ba3e8dc3b3
SHA1 c7d9fdb50caeba3716b934c745570a215f37f2d8
SHA512 196d946c73ffadf6eeb9b7652a9187f64e8504433fa0d8850d5286df92891b84c2576b97041e36f47a3ac50700a19ae490a5d68437da4ef7dc82d5cc23c106e0
SSDEEP 768:4j36kvPhLMWoK56u36gc/DguEaEYQKbOiELAlqaV0cbZtKCC8plVNAR63QPUTX5Y:4OIJID0xcr2LKbblH0cbZtKOjVIRGWKm
MD5 SHA1 SHA512 SSDEEP

carborundum.afs

SHA256 0360bc47437bebe98bd4a68bca19b51da5edf9e274287b2147a51048ecf4ac19
MD5 571c57817a5ebc02504b79b25ca61950
SHA1 8cab49f21c09c1b3a7c2c27aa3926ebe923f84dd
SHA512 029f6a961f9c0e66376043fd37ce36fc51ed1cedd25fb93db9e4372fed2d2d7cd88f103eada4e771d0355d449b0cdc011e9c9c73b2ef901bfc16c63afd70beaa
SSDEEP 192:bpSmix/IBcxNpo8EDebQRB5afNM23Ha80gQmVpy8UFtuWTrXEVWwVT4mgncfYAPo:bRA4o68v9VpKRwVJfmJkrItX+EOq
MD5 SHA1 SHA512 SSDEEP

carlcorey.sha

SHA256 cbee6a241d04a4a047b51d2d2adeeeae9097f3328b19ef71cc46032fc6fd8733
MD5 2b5b9172d4585ce3d0d4de676baa7b28
SHA1 847e7ee461ee2df68b9bdbb6d57a8b7056c8a23d
SHA512 0ce7026a4f83a6e68d3f4fd6952965e4ed98e2e55bd549ec43e80f7e996a8dfa22c1ec79f58aaae04ffbea4c178a0656689eaf229012fca5b630a83f73ddb5ea
SSDEEP 384:+fJNlWN1CQ+swnpVDhnYd7TYoccOfAuuN3P8c:+fjQN1xAGMAfp
MD5 SHA1 SHA512 SSDEEP

carlos.tro

SHA256 c3cd39e29e06f9a91111673696de4d4dda1b32b28f2764ce6a84d7156749c07c
MD5 aa02ade9fc223b0d063160c14ae76557
SHA1 280c557c7a5d6305ff1875c5614e2a5fd536e6eb
SHA512 497d219af8f1a6f4ce6f6f36effcfe0b64fd7c286ddd5a79ff694311012935ba813514acce0e60891e5783db97574eae7520588e4ade7058529b35be777be679
SSDEEP 384:aWScToTeh69EiQgg+zcvQLstoM8WKr0Xfyg:arc4eYqipzc6stoM8WKrqyg
MD5 SHA1 SHA512 SSDEEP

TRANSFERENCIA.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Enmandsbetjents/dentist.pse

Enmandsbetjents/didaktikeres.tin

Enmandsbetjents/exude.sol

Enmandsbetjents/finansielt.poe

Enmandsbetjents/logarithmomancy.jpg

Enmandsbetjents/overexpanding.beb

Enmandsbetjents/overskyggende.ent

Fungere/requienia.arb

Gasbeholders.wod

Indsmigrendes.Kal

Rkeenglens.txt

Tropeskovs213.txt

basophils.jpg

carborundum.afs

carlcorey.sha

carlos.tro

Sharing

General

Malware Config

Signatures

File Explorer

TRANSFERENCIA.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Enmandsbetjents/dentist.pse

Enmandsbetjents/didaktikeres.tin

Enmandsbetjents/exude.sol

Enmandsbetjents/finansielt.poe

Enmandsbetjents/logarithmomancy.jpg

Enmandsbetjents/overexpanding.beb

Enmandsbetjents/overskyggende.ent

Fungere/requienia.arb

Gasbeholders.wod

Indsmigrendes.Kal

Rkeenglens.txt

Tropeskovs213.txt

basophils.jpg

carborundum.afs

carlcorey.sha

carlos.tro