Justificante[.]exe

resource
unpack001/$PLUGINSDIR/System.dll

resource
Justificante.exe

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

Justificante.exe

IMPHASH 3abe302b6d9a1256e6a915429af4ffd2
SHA256 3bdc3b84e2970207b3e67191c3665ff676a5dfdab8331e4cd4787dee7decda82
MD5 d626ee1ad7c9abf27d97bcc0ed8d2152
SHA1 db9defd3b976c429e32d3bda89d93cecc7b6ba83
SHA512 915173d5abfeb0159e0193ea942561205f1136e7987658c7fe051d19bcb5233796f6ae9c764c42c3cbeb82adea938d7650b05eeae41c8936ed3719fec90e9277
SSDEEP 12288:ziD2LbgZ+UVAJZZcVBiB6at5W+x4sJMrZe+FoPT606:4hZTAtB6at5WKMrZeMQuv
TLSH
T1B6A4F11A2FAEDD07E5939EB80A60D33A92B41BC059BDC7069F211D23797D7D36E881C1
MD5 SHA1 SHA512 SSDEEP TLSH

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

81:78:8e:23:d6:49:01:f3:8c:04:00:dd:13:78:36:14:f8:17:30:17:55:f9:7a:9d:80:51:d5:5a:21:20:a3:83:2b:d2:b9:5e:94:c3:97:b1:a5:38:b7:8e:0b:46:14:84

Digest Algorithm

sha384

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Svinekammes,OU=Hejsendes Aryepiglottidean\ ,O=Svinekammes,C=FR

Chains

Aug 3, 2026

CN=Svinekammes,OU=Hejsendes Aryepiglottidean\ ,O=Svinekammes,C=FR

Subject

CN=Svinekammes,OU=Hejsendes Aryepiglottidean\ ,O=Svinekammes,C=FR

Serial Number

26:e3:b2:16:bf:d8:9f:57:47:93:15:76:28:60:8a:57:94:27:31:68

Issuer

CN=Svinekammes,OU=Hejsendes Aryepiglottidean\ ,O=Svinekammes,C=FR

Revocation Status

Not revoked

Timespan

Jun 26, 2026 - Jun 26, 2027

Subject

CN=DigiCert SHA384 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0c:20:43:49:f9:d0:f7:59:fb:98:2d:e4:08:1b:88:7b

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

12731

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetTempPathA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess SetEnvironmentVariableA Sleep GetTickCount GetCommandLineA lstrlenA GetVersion SetErrorMode lstrcpynA GetDiskFreeSpaceA GlobalUnlock GetWindowsDirectoryA SetCurrentDirectoryA GetLastError CreateDirectoryA CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA ReadFile WriteFile lstrcpyA MoveFileExA lstrcatA GetSystemDirectoryA GetProcAddress GetExitCodeProcess WaitForSingleObject CompareFileTime SetFileAttributesA GetFileAttributesA GetShortPathNameA MoveFileA GetFullPathNameA SetFileTime SearchPathA CloseHandle lstrcmpiA CreateThread GlobalLock lstrcmpA FindFirstFileA FindNextFileA DeleteFileA SetFilePointer GetPrivateProfileStringA FindClose MultiByteToWideChar FreeLibrary MulDiv WritePrivateProfileStringA LoadLibraryExA GetModuleHandleA GlobalAlloc GlobalFree ExpandEnvironmentStringsA

user32

ScreenToClient GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard PostQuitMessage GetWindowRect EnableMenuItem CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndDialog RegisterClassA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx GetDC CreateDialogParamA SetTimer GetDlgItem SetWindowLongA SetForegroundWindow LoadImageA IsWindow SendMessageTimeoutA FindWindowExA OpenClipboard TrackPopupMenu AppendMenuA EndPaint DestroyWindow wsprintfA ShowWindow SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation ShellExecuteExA SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA SHFileOperationA

advapi32

AdjustTokenPrivileges RegCreateKeyExA RegOpenKeyExA SetFileSecurityA OpenProcessToken LookupPrivilegeValueA RegEnumValueA RegDeleteKeyA RegDeleteValueA RegCloseKey RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/System.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 b80a5cba69d1853ed5979b0ca0352437bf368a5cfb86cb4528edadd410e11352
MD5 c9473cb90d79a374b2ba6040ca16e45c
SHA1 ab95b54f12796dce57210d65f05124a6ed81234a
SHA512 eafe7d5894622bc21f663bca4dd594392ee0f5b29270b6b56b0187093d6a3a103545464ff6398ad32d2cf15dab79b1f133218ba9ba337ddc01330b5ada804d7b
SSDEEP 192:cPtkumJX7zBE2kGwfy9S9VkPsFQ1MZ1c:N7O2k5q9wA1MZa
TLSH
T1B2324C15031086F3E1D2853D682B39AB2FB969118AF04E438FB36952FE346C7AD79352
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

9993

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Afproevningsstrategi/Rollickingly78.non

SHA256 a3d6296be6af57bf94bd5389164d9038d522d040e3116ba8a320b60e586f55b7
MD5 93d302c0bf7b9d228783886be80e437d
SHA1 1a70cf55b3ccefd00bce2a0a9b989a91fd100bf8
SHA512 6d7e544652aa0ceac0f53220b016af5460d8bae71f3b67af1850b7ba41f0bdeb99c868ab3c50526223ee92f597adc74bc398c6b686efdfa124b9bd9d0c2126bd
SSDEEP 12:kHYJqnx2QalHa1NamLCLJ3kRau9nJDZ6abdLmL0A8s6LQV3T:7+k7k1sKC5I9aUdm0/Uj
TLSH
T1FD2228975451F7FD1F4414C50B13DC500099C5236B500BE2D8FD477213D49613D0C4D1
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Afproevningsstrategi/Udviklingsafdelingens.bra

SHA256 8827d024fd582d20b5f5342f513a2d75deb67a4213577ecc241856e06f11edbb
MD5 bf86607934132c6e605cd2295d804e1b
SHA1 8b7665b04e3587702bcd18198e16cb95224114a4
SHA512 ceff2cd4f69f88227b9de83889f293b143f23a1dc0d60e39736d5ce72dbf61ab40494b22b1434e74dbef9eae35c9af253d01a86f5e558f488c83c568357717e2
SSDEEP 3:tjC2Ejt6ttxMttpttotIBt2ztEVEjEItfERttE4EjsWtUbpjoEtEnhtlEjCE/EjY:IBtky4CttXo7UTW+
TLSH
T10E912B12054334C2509F004552AC4C45ADF07A8CD22610121C3245F48DC90C0C49CF97
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Afproevningsstrategi/familiefotos.vin

SHA256 1f100fe3795566433f07f58f32a96490ba38432055766bf843527d4cd5564733
MD5 cab117fc857146746d3feaac947302a3
SHA1 a3885df53049cc6564e9802f1ab072aff7970793
SHA512 4d55bbbaad7ce920e29ba134baeb34f60f0137ecee4525fcbcb2597f8913daf55e033d812b8b31bf0fdfc453e03039128c0d9b6275e996820ad4fc3950371fd8
SSDEEP 12:cCz47wxQELcdxZE1benEWjEd7s54n7Oq8qAV/wmSEEX0FKEAVZBT/1Elz18h:MAQD55jKsSO7V/WkFK1Zjqzeh
TLSH
T198924176A12830A285BC4E5240234D018B7E90F2C124CA3427D2FE22B05262E3D11BDC
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Afproevningsstrategi/indrulledes.mic

SHA256 eb069ff53685e6d71659d8625c80aaa1a867a2f3ef825c1e1ff8d48a776c2186
MD5 f9b6c39c6493321703616b3ce23f40ff
SHA1 c1c0927ad035979623a7fb23e5c7cb589f26093d
SHA512 f3f8a999de6b18e357c6dba92d9617d7deda332b8aad1a34b86e00a4ca3fb5da527844ed55d8842134302c778691a818ca100b2462fe714ce0c673092e00e999
TLSH
T1FF411269D50540B4E60956065AC022930C1E11302F519581B03287162042A00C514040
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

Afproevningsstrategi/peberbffens.run

SHA256 b28c140ae14b9c16b83ef3a4c13d35aea5a3663f729eb2e22282fbec79cb803b
MD5 815691693ab84353ab58e754f1b6b7da
SHA1 7a19bb4c96bab3b0929d5536564e6f6d10344fb3
SHA512 842f3658188878d329c661ed891b68bc4726f8cce1cf17247f7ccccf517b1ba1df6676fb7cd1acf977f4b76b17a2e58c06787bf6d216e36338c850dcd0f60936
SSDEEP 48:ez1eqcCHhM8ychysNLLQACnZKA8ljcMnCVM:eYrCHK8dhvCQA86MnoM
TLSH
T1F19220B82A474C0791EDB60A59846C3A61E6B49F17048072021EF33CA368A5A347CA01
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Bedunces/Acronych

SHA256 a45e4f579fc86d19d18e912b4a59ba8967ee54e93f0935b036c8c44844376c29
MD5 9698b16251023ef058b5c3716a937430
SHA1 ad172a2062e185ad8eff90352854d713f118c428
SHA512 7b48ef336e08b8eb01c11b2fd11fb910eb448e33c493fe6aa207804dd9970833341e6aaf77061e92d51b22f52260edb9c68f8b396f0f6c6c56f55ce6889007b4
SSDEEP 3072:PSkm1tnPfb0ytOjNrGihUmbTJsuaNMYBOV2taen9bE:KR3PfIGcdgTy
TLSH
T17004E027F94F020ADB91F5B0DD4C9C7A6A32F516907B8487F2839D869FC9127C42D17A
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Bedunces/Aftrringens.hom

SHA256 1c61a694484e525cc7dfba5b240ee4459c1ad351b9c605c60b63152f705749a4
MD5 761bdce2eabe5787cbc1e8480a73b332
SHA1 625bbd98a4f0037f38ae48f487356cbb1103e781
SHA512 6c6ebd915a131daf2503247e5a229c5375159739e461791521007927d3bd8004b1bb0436b8437fe31f25113b2c72dec33f1389ac792a7a538e7b091177001fe2
SSDEEP 3:5nC5ni55qnI5nd6nqnnG5nMne5f551nqy5nk535nd5WnnZnjnnyn5hn956nF5l5e:AgnqnITnnGOneTCwnnZmnbHnyGnn
TLSH
T1BA912B9134280A7E15500F2F3CE7424B40831339A9CDA5C1EC3293D70C3CE0108C1F19
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Bedunces/Peptonising

SHA256 78466001b73bfc078f40fd992dcba37e02d205cd86f464f6ca07f182b5559ce4
MD5 c2538e435710938c70f4b0f6df0bb97b
SHA1 d7441064b8d79b61ffee7f05a6955f4c6cfc7d4c
SHA512 9cce57cd1122fb5a0d2d39b5254b8dce795a8cec464cd4af61dcb0b6d2f7c7393cfc9bf5a66f188b778dcb1543b0d127feb013860367d55330573ab24bec7381
SSDEEP 384:aY0zU8QjCtEN1fbb2zBuCbpkes17h5lkkSv1AOp8f/hjmQVv0W:atTQ2qnfIB1FE17hlS2OpohBVsW
TLSH
T1CC928D57D3601CBBDA098B30C1AF61E78D2C70115F0E986CB27ED825C1872E52378ABB
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Justificante.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Afproevningsstrategi/Rollickingly78.non

Afproevningsstrategi/Udviklingsafdelingens.bra

Afproevningsstrategi/familiefotos.vin

Afproevningsstrategi/indrulledes.mic

Afproevningsstrategi/peberbffens.run

Bedunces/Acronych

Bedunces/Aftrringens.hom

Bedunces/Peptonising

Sharing

General

Malware Config

Signatures

File Explorer

Justificante.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Afproevningsstrategi/Rollickingly78.non

Afproevningsstrategi/Udviklingsafdelingens.bra

Afproevningsstrategi/familiefotos.vin

Afproevningsstrategi/indrulledes.mic

Afproevningsstrategi/peberbffens.run

Bedunces/Acronych

Bedunces/Aftrringens.hom

Bedunces/Peptonising