JUSTIFICANTA_PAGO_FRA[.]_20250154[.]exe

resource
unpack001/$PLUGINSDIR/System.dll

resource
JUSTIFICANTA_PAGO_FRA._20250154.exe

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

JUSTIFICANTA_PAGO_FRA._20250154.exe

IMPHASH ea4e67a31ace1a72683a99b80cf37830
SHA256 5f83b031b02dec728cd86fd22521b98e91222dedb800653d6193435fc4cedb2a
MD5 2fed0fcaf0c6513328378f6202efb195
SHA1 6545407a40b56ae388751b25dc6d089a0133771b
SHA512 aec5d700510cf24830f0556908d3b49f967928a49215a557d1fe09a02f9013edae5646202189a57530b1305af949be91aea2363f4b816382eba5f3a029dedec1
SSDEEP 24576:pxuZXKeXQbcns6REgbvHZ4fdafQOCVF83pJLLl/BXo3:TuxLAonNEgHek4OCc33B/BXo3
TLSH
T15435233A0921DD86F769CC7082769E348D4BEC7B5051B5437BCA3F46FA60FE2194B892
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

3d:57:13:1b:41:34:2f:fb:cd:36:b5:d7:84:f1:4c:81:51:cd:69:15:46:28:7b:94:0d:8e:73:be:13:81:26:af

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=citronellol,OU=Dyssegaarden Gldssaneringsinstitutterne\ ,O=citronellol,C=FR,1.2.840.113549.1.9.1=#0c1a456c6566616e7473404d656e6e65736b656b726c6967652e4269

Chains

May 20, 2026

CN=citronellol,OU=Dyssegaarden Gldssaneringsinstitutterne\ ,O=citronellol,C=FR,1.2.840.113549.1.9.1=#0c1a456c6566616e7473404d656e6e65736b656b726c6967652e4269

PE Signature issue

Digest

b6:4e:ef:dd:6f:93:e3:b4:f8:f8:24:72:4e:05:8c:33:99:ee:66:b8

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=citronellol,OU=Dyssegaarden Gldssaneringsinstitutterne\ ,O=citronellol,C=FR,1.2.840.113549.1.9.1=#0c1a456c6566616e7473404d656e6e65736b656b726c6967652e4269

Chains

May 20, 2026

CN=citronellol,OU=Dyssegaarden Gldssaneringsinstitutterne\ ,O=citronellol,C=FR,1.2.840.113549.1.9.1=#0c1a456c6566616e7473404d656e6e65736b656b726c6967652e4269

Minor OS version

0

Major OS version

4

Entry point

13409

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCreateKeyExA RegEnumKeyA RegQueryValueExA RegSetValueExA RegCloseKey RegDeleteValueA RegDeleteKeyA AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken SetFileSecurityA RegOpenKeyExA RegEnumValueA

shell32

SHGetFileInfoA SHFileOperationA SHGetPathFromIDListA ShellExecuteExA SHGetSpecialFolderLocation SHBrowseForFolderA

ole32

IIDFromString OleInitialize OleUninitialize CoCreateInstance CoTaskMemFree

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

SetClipboardData CharPrevA CallWindowProcA PeekMessageA DispatchMessageA MessageBoxIndirectA GetDlgItemTextA SetDlgItemTextA GetSystemMetrics CreatePopupMenu AppendMenuA TrackPopupMenu FillRect EmptyClipboard LoadCursorA GetMessagePos CheckDlgButton GetSysColor SetCursor GetWindowLongA SetClassLongA SetWindowPos IsWindowEnabled GetWindowRect GetSystemMenu EnableMenuItem RegisterClassA ScreenToClient EndDialog GetClassInfoA SystemParametersInfoA CreateWindowExA ExitWindowsEx DialogBoxParamA CharNextA SetTimer DestroyWindow CreateDialogParamA SetForegroundWindow SetWindowTextA PostQuitMessage SendMessageTimeoutA ShowWindow wsprintfA GetDlgItem FindWindowExA IsWindow GetDC SetWindowLongA LoadImageA InvalidateRect ReleaseDC EnableWindow BeginPaint SendMessageA DefWindowProcA DrawTextA GetClientRect EndPaint IsWindowVisible CloseClipboard OpenClipboard

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateFontIndirectA CreateBrushIndirect DeleteObject SetTextColor SelectObject

kernel32

GetExitCodeProcess WaitForSingleObject GetProcAddress GetSystemDirectoryA WideCharToMultiByte MoveFileExA GetTempFileNameA RemoveDirectoryA WriteFile CreateDirectoryA GetLastError CreateProcessA GlobalLock GlobalUnlock CreateThread lstrcpynA SetErrorMode GetDiskFreeSpaceA lstrlenA GetCommandLineA GetVersion GetWindowsDirectoryA SetEnvironmentVariableA GetTempPathA CopyFileA GetCurrentProcess ExitProcess GetModuleFileNameA GetFileSize ReadFile GetTickCount Sleep CreateFileA GetFileAttributesA SetCurrentDirectoryA SetFileAttributesA GetFullPathNameA GetShortPathNameA MoveFileA CompareFileTime SetFileTime SearchPathA lstrcmpiA lstrcmpA CloseHandle GlobalFree GlobalAlloc ExpandEnvironmentStringsA LoadLibraryExA FreeLibrary lstrcpyA lstrcatA FindClose MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA SetFilePointer GetModuleHandleA FindNextFileA FindFirstFileA DeleteFileA MulDiv

$PLUGINSDIR/System.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 6fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e
MD5 fccff8cb7a1067e23fd2e2b63971a8e1
SHA1 30e2a9e137c1223a78a0f7b0bf96a1c361976d91
SHA512 f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c
SSDEEP 192:xPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4v:g7VpNo8gmOyRsVc4
TLSH
T116326D5503504AF3E996863C00263B7FAF796A2095F14D53CFA394C0FE2E5C9AD38352
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10529

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Antidetonating.res

SHA256 62ef9cda59c7cc671cf62b708543a2fec566d3f5764b9e63d0c3fd3b1948b639
MD5 540cded5d393d944a8999482e1589b42
SHA1 3677382b95e0de8667cbf57ec62b118fe713abdf
SHA512 639ab0c80a3c01715878f4a81130f3916eb9cdb1cfbda407829bf942f41ce3ba4cb2a43a284f35d9ada556ef097c01d5210190ac70c0d5a4c0813df355889b09
SSDEEP 384:byLhhVz6K+ASdXiUg+K9raGSw/8A8EtxKmy8Jz1E/PZB:Az1/4I+I9Sw/TVtxKRI2/PZB
TLSH
T17D9622A00C2177A72BDD13886A516E8A3A244B1E7FE637183E633CF895B535581D3EF4
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Laborables/Unmastered/hideling.ini

SHA256 cb120b8c598c5bfb5347429529035706b2f61ab2707f723c7e6db31bb5bcb41f
MD5 f927ef6c2112bf6f3cb24422d031d701
SHA1 1061787a1f1c7eddfc78f5a1d1a14a725ea6a210
SHA512 8223d3d5917d0695f87ccc102b1ade8a979a120b25a1155c8903d120861c97aaf6effdeb1ca2a95ec8183a2c5ba08f04ab182fcb5c111e52046ad272476abe78
TLSH
T195E0F11CEC1162068F53E583ED2074E4E8EB995406151D4D60DDEF4B972A8FED2B5713
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

Laborables/Unmastered/kontrolkortets.txt

SHA256 9ab1b7c749073f2c3233022cc455c60e65363648215ea85d40e89ee6c36583ff
MD5 fc5376325a8349ef5f046c29720b5863
SHA1 7d364290861461dc28bac434b047e94fcb9ed1cb
SHA512 0d1de1c763613b3d1c3c65de7c4da4e79d92bce05e8c22a3930585fa40def6e66e414499e89e3391e78364b9c867aa3b77733ee3ba90c81ce1f6bce1679532e4
TLSH
T1FFE0A3E194F0114A5637636D4DC3098F00EE5535CCD05954F2CA5A1A50535187575E9C
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

Laborables/Unmastered/lyricising.txt

SHA256 9c1e70f842823c7856b1456c77417c0f1e64511810c1b19aeb48a6d6bc99949f
MD5 2575aec05b73041da03e2fb56dbaa2cd
SHA1 8f805dacd858625042ca364514cb7f61a9f92282
SHA512 09267c100ac46969986a2838d11cc64b8da472b2eaa15c1174e5c002b16139bcb68b419191bda14b61cc62da65e0bd4aa1f039ab3a692e260f59902bbbd57b89
TLSH
T16FF02344C8C594A0154F28D0F53A3D61504E6A193A1BF0B0F045F3F8104704CBB17E17
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

Laborables/Unmastered/rekalkulerede.txt

SHA256 5d2909caa60ceeb19e00d247b369f170e6c01eae173dfaa15ccdf1e4dcf07af1
MD5 790ef5de2c768e6e9a059ed9c7f07739
SHA1 06ee1e937c7dffb1c82a6a9ae3d717dfa2849023
SHA512 16142fd3e8037f697d16e7f385e717652162f0ccdbbc1de1ecccb38a2701774c0af10a7b3f1ecbef052589a7c1bbfd930bc26e6098e2cad0533a4332efa656f4
TLSH
T126E02332ACC335B74CD2A3A069400F21C33C7D29023C42AA72A1821C921AA0C902CB04
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

Laborables/Unmastered/shahernes.jpg

SHA256 71e77d078565b2fe2260efed84737fc9c5fddf06d032e34a166acf64597326ee
MD5 8ea3b4a028639b0f9783c72c20330ae9
SHA1 10c8b3ed29e332862b6dac41133f1a241e186a33
SHA512 f011fe1969b2c3b30a381d54094535d6398b061c0043c706d393ff37d90fa2c4f0df70960b1a4cdb455a8a343c4f99ea1d186802127cdf3b540aae5a3b5f0266
SSDEEP 384:1M4uVf3tJWgFiy1MyO3eAuFAXbPPJIacSZW38kxFZRgZOLIzVGlM:1813D7FiaMnxuqXbHaCZ8/VqZOHW
TLSH
T1E192D107DB09D8D92FF040EAE6716B2A108286D738497F3EF1A3671C476793AF091CA5
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Laborables/grut.ini

SHA256 3968e6095a3e3a95cec6757ac096e33ce2cb6f6497e38a776e4719b57d84d396
MD5 cd6183dbda90bba7b05ff2bdbc54e9a5
SHA1 20dd5e4ca98f0003d2e3b33d24c7a2a5f8220844
SHA512 1a2237b9fe2cd8f6ee6f61ee0ccd518274283752e5b99a191d8a660604c39f494eca97ccdb771249f338e2cbe78b03d9cb1e63957968aa6e8c7e53612f510a1f
TLSH
T18EF00E74ACA14A38C803C35FD425024F450960295C37439CB780025C8289654EF3F41D
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

Laborables/heartblock.sug

SHA256 3c40dad053a9886ee604b77eacaa262b3857b8361ef868c62d62af677e00e59a
MD5 353b6b38bad99850b7bf9b9cb0e8cfbf
SHA1 748b019187a84e4c7bda181b8995a97636dd0622
SHA512 323868da7d10b3c7f00fbc4d4e1cb1fb3613407570039cae30e52a39800e0cfa221e2a4e4bfb63b942b804fdb3e2703b0bc1129f8be7297944d6f24fd2404eba
SSDEEP 3072:Q01dGlIFQwyZU9cBI6gTcgNdqesCa2JosSt1LtrRO5bHKjDBI4VI8LnYJgHiTiLC:8o5
TLSH
T1877622E49257DFA7F9869B77E690A002B7896503883ED1DE3C4214C02B935B86E3BCC5
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Laborables/hematinic.jpg

SHA256 4f31ab9fd65f23e02ce962555130226937175a261165ad4de99d23b5cf73abb0
MD5 1565ba65a28c62784731bcb99d284be7
SHA1 4330b76e4a620d36ee8afbf58f9a05ef06074fc5
SHA512 aab33554d4bb861aa69f9129392fe98c4c1057a71025071bbb84f6b06f3c56d2cce36cb63829eb79dac1eafe2cdcd330c33968503827417e8d84a038a5231708
SSDEEP 384:cY/ZyNGKcZCf4TGoYI6sNPPmv1TrmXlNLFJoyZ1:cYkNVyTGIxPmv1nmPv1
TLSH
T11152C08B27D36B982B1117B6044C21B3D3CE9D27158586771BB202E06C8CE39E6BA73D
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Liddens

SHA256 f7854dd25d8bbd2d7036798789ad6006b52879e28fec617bb7089d4faa44c449
MD5 326b6ded55db797ff227e1a8aafd17f9
SHA1 ba72822e7c7800597bbf8f36bf9c703bb7ee5520
SHA512 d5d3c55153d1ddf8f226d42cc5e44fb640a33e986689c29bb7dd5001fda827b0ccb630927926e97a12288bd1fcd388ef15a258cfa8648e84987170fa72d7d967
SSDEEP 3072:IQitNZmkwFZsCVarGdq3fbz4Vnkdy/3zuds76upjK+5cO:IQihWZDaydq3zcJk0P6uhpjKaz
TLSH
T1F604E0D0788699EBD16115F8CEA4C2ECE10A9C723E1DA6FB53A2F2DF007F58DD092654
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Resgld/Blodunderlbnes.txt

SHA256 8b06f1eb47bffab0acd93750136ea04214da0f6cc62b4fbf584e116d414099d6
MD5 c23f9e14f1a71ab3eaba2493197689ae
SHA1 52ee3834845e612743fc287865efc460a7792edf
SHA512 aad4ddad05928abe22dd671059f98379e8e66f6bcf0eb40cd5b786f42ddb27f5244bac4b29284829de0d3fe157b78751c47f0ee4708b9f8b16a7b120f213c2bc
TLSH
T1A7E0204D9AC22A230F4B624C2D130F94605E55DDCB2D941E76779745B3CB44C239A43D
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

Resgld/Indissoluble222.txt

SHA256 9dae88dcd2fc6ce8272f1c6364b72d643b5c8255b5222fd431e3aae66c7cdc47
MD5 d206430eeb2cb32fe9c9c8c81e885b6f
SHA1 22263773bc7147268b3051b2c168f97a52672bb6
SHA512 8446c6e1c3b67ef578581cab84cf9f6eb65216f38c8c2627dfddd03f4523001dc655ad23cb58fe099cee9ad0c71054c8122cb564f7beb12b506b021dcfe00271
TLSH
T172E0C00CF45F2465A34317DDE8347D72221EAAC760A3282BB2F308951412D01547C9DA
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

Resgld/bjergstammes.ini

SHA256 5438c747ac9e0e00332f13062eb7c8e083021666d970acd76d05392b8e52c01c
MD5 4d5fa2ffa9f2134e8c3e3c77a037a867
SHA1 e30e5c9dca2622354c01e5844b15c14abc503bc8
SHA512 d32a5638fc3a6ecf4daf99d47e8a7d50da1b46084063366f77cba39d0cae7a4493e58ec5e6b23a991b38eb396c6af76006bb24170d25949f88c58ba47776a2c7
TLSH
T170E0C0B8E44744A1039B159951D125259030E041F4111CA83505031E33C679EB3AB39F
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

Resgld/cracked.fet

SHA256 190bfc17870b7c4277471c60af752bdcc4d3921506cf0a66c9713f43591adbbc
MD5 4b6e1b3c128f2e33e083c9cee317572e
SHA1 79771f44713fae047595a0a4f2850361d53dfb3d
SHA512 d9d768ed4c8f4d7663ae7bebcc6f3e32d27b8aa93444c824318ea05743bbd0f63066688a0d4fa0cc3a9fc5cfaac265954b47beffcba133243f6e477dd666960a
SSDEEP 1536:7wr6jTQcfip69KygSdv7gokGta/tqRyqLJ6B7:c
TLSH
T1D735F1DBD54B62310B9641403A2BC3E075FD900AEC3DAADF5A15FE7E28FED205687902
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Resgld/gallinuline.alu

SHA256 842d608a3fb7f313e7e1ced1aa3bf66870ace725468f731d7a3823deaed2d3ce
MD5 c3fb2d168ffc757fbc08ea9b404a3429
SHA1 d84f33a0b6fa34cf2187b6319574c5e6a015814d
SHA512 37d97e83c617f8c1c8f27e1462cfdad7bd5425aeb3d675455aa6ca89199f2b032ff7b9b2e9d7a18cf736f7396d6e1b566573bca99c4ddac040ad0f569de100c6
SSDEEP 6144:B1mgpcz6jwYndj2noxL2qaTWKRenZenoAZVw8GFmCfjDiRmnSFZAF3dw5ICYE6Ea:LNT
TLSH
T1603612873817C7A73E9F380CE0E02695572A8466F85D71BC28AE9CBF187F051C4B985E
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Svineheldenes

SHA256 95ea54313977cb8e5282090cc3487972f98a192819bfc49bdc5b2f61097fd58c
MD5 b97a74bc12ab212e7aded9a16a052e41
SHA1 ef45dda04f7b625c42801592b0762c896583790f
SHA512 33198165689cebe57615676ae1b8a240dc345b52dfa7fd0bd8207f655444babd4ceaf47ec48a20675bb55341e3a9f31bf71d812f51467ed997be2aca508749d2
SSDEEP 3072:guG8b0fVPOXxIpevNzz1du6fpos24oqqp:rqkXxIpevNzZdu6xo94xK
TLSH
T1C2943C5075CD8AE0F61A5984EA78FFB211733973AFCA1CD22324F5004ABE5513A8DA5F
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

JUSTIFICANTA_PAGO_FRA._20250154.exe

PE Signature issue

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Antidetonating.res

Laborables/Unmastered/hideling.ini

Laborables/Unmastered/kontrolkortets.txt

Laborables/Unmastered/lyricising.txt

Laborables/Unmastered/rekalkulerede.txt

Laborables/Unmastered/shahernes.jpg

Laborables/grut.ini

Laborables/heartblock.sug

Laborables/hematinic.jpg

Liddens

Resgld/Blodunderlbnes.txt

Resgld/Indissoluble222.txt

Resgld/bjergstammes.ini

Resgld/cracked.fet

Resgld/gallinuline.alu

Svineheldenes

Sharing

General

Malware Config

Signatures

File Explorer

JUSTIFICANTA_PAGO_FRA._20250154.exe

PE Signature issue

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Antidetonating.res

Laborables/Unmastered/hideling.ini

Laborables/Unmastered/kontrolkortets.txt

Laborables/Unmastered/lyricising.txt

Laborables/Unmastered/rekalkulerede.txt

Laborables/Unmastered/shahernes.jpg

Laborables/grut.ini

Laborables/heartblock.sug

Laborables/hematinic.jpg

Liddens

Resgld/Blodunderlbnes.txt

Resgld/Indissoluble222.txt

Resgld/bjergstammes.ini

Resgld/cracked.fet

Resgld/gallinuline.alu

Svineheldenes