Overdue Invoices[.]exe

resource
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll

resource
Overdue Invoices.exe

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

Overdue Invoices.exe

IMPHASH e9c0657252137ac61c1eeeba4c021000
SHA256 ca56faca9cf660826fa63147d03bf21b1ea7221cee4c2fcd6e5bc49266176fef
MD5 3ddc6875fab1c8465e6c5e5481574720
SHA1 362e8143c54745ab48184ebee94fd462deb423b1
SHA512 2cf7302577dacc4eadc85c5ecdc41e8574498bc91ca271989dfba795e31123fa4df1615bd1478ac4ed7d5bc64d5936eab5b789ad188cd579d508aec11b465db6
SSDEEP 6144:G6dQC6a5KqBFftrh6pIDy6JLqbYgEh3tGOw6GE035XZJ/uvc38OENSarpWJLgjO6:JNBFftF6CDyZREhd8EiXbuRpSar0J0
TLSH
T127A40173634AACE2D65108724CB2E7A023F4BFD5495116473596FE3A2C322C79A1BDCE
MD5 SHA1 SHA512 SSDEEP TLSH

Untrusted Codesign Signers

Codesigned binary was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

9f:be:a9:ce:c7:cf:ea:e8:e5:29:f9:9d:c2:57:df:b1:a9:5d:b6:54:b5:95:15:a4:82:23:89:61:6a:f4:fe:a8:7b:45:a5:a8:f4:c6:36:23:59:a8:b8:51:8b:0b:a6:0c

Digest Algorithm

sha384

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Settimo,OU=Decemplicate Moneybag\ ,O=Settimo,C=FR

Chains

Jan 16, 2026

PE Signature issue

Digest

05:ef:db:90:68:5e:5a:df:3f:36:55:c0:c0:ba:f9:a1:80:b9:fb:59:60:08:60:e2:3c:91:15:29:3b:d4:a3:f6

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Settimo,OU=Decemplicate Moneybag\ ,O=Settimo,C=FR

Chains

Jan 16, 2026

Minor OS version

0

Major OS version

4

Entry point

12853

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetTempPathA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess SetEnvironmentVariableA Sleep GetTickCount GetCommandLineA lstrlenA GetVersion SetErrorMode lstrcpynA GetDiskFreeSpaceA GlobalUnlock GetWindowsDirectoryA SetFileAttributesA GetLastError CreateDirectoryA CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA ReadFile WriteFile lstrcpyA MoveFileExA lstrcatA GetSystemDirectoryA GetProcAddress GetExitCodeProcess WaitForSingleObject CompareFileTime SetFileTime GetFileAttributesA SetCurrentDirectoryA MoveFileA GetFullPathNameA GetShortPathNameA SearchPathA CloseHandle lstrcmpiA CreateThread GlobalLock lstrcmpA DeleteFileA FindFirstFileA FindNextFileA FindClose SetFilePointer GetPrivateProfileStringA WritePrivateProfileStringA MulDiv MultiByteToWideChar FreeLibrary LoadLibraryExA GetModuleHandleA GlobalAlloc GlobalFree ExpandEnvironmentStringsA

user32

GetSystemMenu SetClassLongA EnableMenuItem IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard ScreenToClient GetWindowRect GetDlgItem GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA GetDC ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect EndDialog RegisterClassA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx LoadImageA CreateDialogParamA SetTimer SetWindowTextA SetForegroundWindow ShowWindow SetWindowLongA SendMessageTimeoutA FindWindowExA IsWindow AppendMenuA TrackPopupMenu CreatePopupMenu DrawTextA EndPaint DestroyWindow wsprintfA PostQuitMessage

gdi32

SelectObject SetTextColor SetBkMode CreateFontIndirectA CreateBrushIndirect DeleteObject GetDeviceCaps SetBkColor

shell32

SHGetSpecialFolderLocation ShellExecuteExA SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA SHFileOperationA

advapi32

AdjustTokenPrivileges RegCreateKeyExA RegOpenKeyExA SetFileSecurityA OpenProcessToken LookupPrivilegeValueA RegEnumValueA RegDeleteKeyA RegDeleteValueA RegCloseKey RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ord17 ImageList_Destroy

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/System.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 ac9dfe3b35ea4b8932536ed7406c29a432976b685cc5322f94ef93df920fede7
MD5 0063d48afe5a0cdc02833145667b6641
SHA1 e7eb614805d183ecb1127c62decb1a6be1b4f7a8
SHA512 71cbbcaeb345e09306e368717ea0503fe8df485be2e95200febc61bcd8ba74fb4211cd263c232f148c0123f6c6f2e3fd4ea20bdecc4070f5208c35c6920240f0
SSDEEP 192:qPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4U:F7VpNo8gmOyRsVc4
TLSH
T1CB326D5503504AF3E996863C00263BBFAF796A2095F14D53CFA394C0FE2E5C9AD78352
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10529

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsDialogs.dll

IMPHASH ebc2d915841be8afc8fa1ee9f6850960
SHA256 8d4b1c275fd1cd0782a265080b56d1aec8d1c93edca5ef3b050d1d20d7b61f33
MD5 6e64e5d5f9498058a300b26b8741d9d5
SHA1 837ce28e5e02788da63a7f1d8f20207d2b0bf523
SHA512 f53514d36021d79f85df2494d403f03589b3ad848889b9224f962cc932ef740f127131a914c7171ad8136ca1ef631285ea1c80576db18ccf8ea56940eb00ea1e
SSDEEP 96:oWW4JlD3c151V1gQoE8cxM2DjDf3GEst+Nt+jvcx4P8qndYv0PLE:oWp3ggQF8REskpx8dO0PLE
TLSH
T1D11209135A4455B3C9E7223A31AA2F2ECB3CA324A0627D02C777DE162BB42166D3E355
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

7513

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Bonfire/Hjrejusterede/creamer.per

SHA256 5a04a7c59643b48034a684785e65b2e5f371c813284a8a64f2f2887f473511ed
MD5 1f4cf4bb75b6678c9d9043611767ac2b
SHA1 96cfa2b5d19f482299316ba0ed98c1b301d1e007
SHA512 b5645fb63c499e74c389c75a63307f57e9aea6978b231aa3adbc231dfb631d6b568763318560a16c7d118d06e384b8be151672a056a7252e4c1ffaf3e2de0b31
SSDEEP 12:eqQ8mUjYDKU8DS2UwEiSYLeKAfcsW4NiuyoHFqL:xQ8mUEOIBiSVKAfFWHolU
TLSH
T170F15C0CA828E3EF62CDE801D6364D4A802982CB20A33F788EC9A4B4C00202274C108B
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Bonfire/Hjrejusterede/gunvor.tau

SHA256 53a067c9413cfedeb977cdb17dfcb190728f1d9a818e4d07ee0e34379f62922f
MD5 ae09f2f06c3b0a5850c43b768fbaa157
SHA1 e707def2f42ced475e40c5dd411fed4cb5e35f14
SHA512 15a9b6434c563cbdf7ebe3b745f328e0164bbe500424fa2c25f302f49595751c23fd6ea754d42f21f03b7004a74e1a47165a3d75af5fdd9c47e218f23f4de8a7
SSDEEP 12:4p61sBXPFj/LUkjsEPRw1Qlwrn1jYi6wHwjuvCt2jh:49B/hjrPE7NTPPh
TLSH
T1D9C16A9341110D29D19F1028D4C17C07D338D44366C3C8CCC203DD3D03970D5112BED0
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Bonfire/Hjrejusterede/luxemburger.sku

SHA256 040d312ce0cdf55fb5564de562f28202cb5f4786adcd05eda25cb725b5da1252
MD5 a5d8424b50ff3b1735d76584807f647a
SHA1 8eb3bb25a6ef99a05c759c3eae4ed00dbc47d91b
SHA512 acaa1faf24292b4e723c018329b6c8426e62a98f7b84531b9d04fea991762b10c7180a30c22cc68fd80668db7ec6ad4a8cde4b133ba800419d2cc9e9c669c4e7
TLSH
T1465180D41CD5FB5E512EE4D4604C1DDF545047B55C168525D748159981C0014055D7B9
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

Bonfire/Hjrejusterede/prognosearbejderne.dat

SHA256 afedda99bd4ef117fdba16f5d0532f076953eece5c9f4b8089b702e71f13b2b9
MD5 26d111ca8d35371e8c3e1faad60cd759
SHA1 af48cc294f8676fa3bc0eaed37e5dcb96271c7e6
SHA512 fd776e73e7e601ede090c79c18f4bd7fea6dbf49ead92071bbd6f7f52297f648b6456d89e7c43942f5edacc30e217e9a1ac14b6bd3c0c0f089475919abfa4f5f
SSDEEP 6:LnnMSnnGnm+0UnjnMncMmCnnnqe+8nens8gnan87sn2nKwCnn2nWnOnganCnynQY:TntwfgFnEsTs8InC9kChk50gvBGlnh/
TLSH
T187A17DC92760B8684137F50D4720ACDC8C0D3D2AA5571CA5583E0D890107A808657989
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Bonfire/Hjrejusterede/weam.oak

SHA256 a7931adb4820879b4b7a195d9a2607a6836c83931e42b76ac6f2d1613f1651e0
MD5 3f5f15f8599a7a03a3cead6b9ed2a28e
SHA1 0881e9e552c76425f3c5ed123ec206a8352d6250
SHA512 64688856da7b23e998c0730da1cff4e0b22ce73049b732d727a18e847e42375b80f77260ab125c270441de9c53d60e915f47118e888c8d978fc4e7f6474c2cad
SSDEEP 24:axyhkXLmPmmqQgBD2uTeLzBoWZtxEX3rT1TX/sLj6+G7i/:pkbmPmIgxpeOOtxEX7ZTX/sLlG7i/
TLSH
T1A61283607CB08F4B8774C04EC328054A0202C976E8D4BC6894D0B8C07E024BC83B29BB
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Bonfire/Lehayim.Pul182

SHA256 267517c1d90a87cc668e45c30758509894015ee8a0371890264fea2931848655
MD5 be1ecb4eb3077097f91620ecb783f36e
SHA1 34c2f5b5fdb0a3085e0a381395a081456757327f
SHA512 02140a104de97e9d3030616d1b861df2ab58d595a6bacda90e3a555a78dca0aa672a96889ad32de46f62a2975f4f2ce353b5be77b9fcc420136083a00388b8e1
SSDEEP 1536:OwVqU0zmCMdR1si3dEo1pyCNBascjDHaMYulxM7njdNEQN3lZ+oqOxjpT5IpyJbF:Owzw5MdR1sit9/FFeE0klRDb
TLSH
T192E3BF63DB56CDFFDC07C938C46D21A6487870155B4FE4BEA136B924C18B2E367206AE
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Bonfire/Personalechefer219.gan

SHA256 cabbd0422326dd38ba725dd7da775619f83cce235d534d620e383f5ef258d554
MD5 b5f5e49c2dd3fab6ab7b2ee31c24022a
SHA1 6ff068f9e3b75b646ae8852dd549faf66d06c810
SHA512 69aa56e35bfcf80004c33adcfd393641f615aac01ca73ad20ddded092cf00fa08feee4531ad4655e39c2078295d8cc4620d77d53340066a21ea8e6e2304cdfee
SSDEEP 12:dL/SObxLGcf3Nciclccn5ioLaxcMP4l20IlQHJRHydvL3LwoS8:h6mGIu5h/MP4l5XIdTbwJ8
TLSH
T101F1DC82C8B661007BA3BBAD8A86888F215014CC7D07E2428ECF2D36011058CAC44596
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Bonfire/cinderman.ste

SHA256 772152794fa73885b5cd4f746eb9eaf4b3b9b8731963752625eabc114e24c61b
MD5 53c872ca6edce9f3e611309bb78d55d8
SHA1 ae25a627706724c45dca0460eb46df073f6677c9
SHA512 c0b16596f4f99d3f537368fd74dd022409d8873be8cea316a6ee0408c72fe95509545b5589cfb9c57aa2e42f3349b98a129ca51709d9ee68db7c139a2cc0b3a4
SSDEEP 12:Lk4QyLiJqkCFuiORkvHYnJiKuiEc07LOWosOI:Lk49WPCz+sW+vfO1I
TLSH
T166C1C0B4AD2A1A950B3A0B067134494B40DF798D1F11B07A1A701C3A3BD401361D0778
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Cosmogonist255.ele

SHA256 74bd1112d23b3734a4452f53b3e4e66536acff89a29103e7f18ece544434fcff
MD5 4ca4aabe7382458c3fe11a371cc9d48e
SHA1 ad4b117790e1c41f8cd5b510803c4fe8b210f130
SHA512 796cca7fb37b72024ec0f3d716151ab6c4fb3d61feca9fb66a9e1372e0a4bc14b153f62feefd80a4f93873872fc85b786cd266b6f8cfd8842663edaa4871bea0
SSDEEP 6:2fAKzkgjeM8AfkCjkUGfaffjSfm/0fHzRfMzUj4fqz2suEka:KltJ8Afkg8+ym+ZMQj44jue
TLSH
T149917DE0EE514B13D4C43E4D4D650DAB910B85329062CA19D70D1B15BFF50030C309B4
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Sutras.Rum

SHA256 e5a67e57ad01ddf9b53ee7192b4bc7b84f09a50f2cf4e4628117163d421dfb8e
MD5 0589beeb4fc0d4925c7852ec54790f9c
SHA1 64818e4708480ce591813a7d21e26a636ce48838
SHA512 6798b14ff362a5de106d496e953b21cf7a19ac4716cbd3c87b4e66b73410381fb5e20b7cb30f5955363793284edcf8385c68c91a4fdf3018f923184bfbe2a18a
SSDEEP 6144:K1O6NRggtit3Z3p4ibhdKpZp1Qtm4wqUM:cNR78tJ54itdKpH1E7wqL
TLSH
T16D44DF9A1B9D8249C2D06473C860DD2D237AFCAD0D36C01BA611D6F70D6B7D80EF985E
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Overdue Invoices.exe

PE Signature issue

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

Bonfire/Hjrejusterede/creamer.per

Bonfire/Hjrejusterede/gunvor.tau

Bonfire/Hjrejusterede/luxemburger.sku

Bonfire/Hjrejusterede/prognosearbejderne.dat

Bonfire/Hjrejusterede/weam.oak

Bonfire/Lehayim.Pul182

Bonfire/Personalechefer219.gan

Bonfire/cinderman.ste

Cosmogonist255.ele

Sutras.Rum

Sharing

General

Malware Config

Signatures

File Explorer

Overdue Invoices.exe

PE Signature issue

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

Bonfire/Hjrejusterede/creamer.per

Bonfire/Hjrejusterede/gunvor.tau

Bonfire/Hjrejusterede/luxemburger.sku

Bonfire/Hjrejusterede/prognosearbejderne.dat

Bonfire/Hjrejusterede/weam.oak

Bonfire/Lehayim.Pul182

Bonfire/Personalechefer219.gan

Bonfire/cinderman.ste

Cosmogonist255.ele

Sutras.Rum