3.gz
- SHA256 76ad562030026b0847ffe2ffd91713a828fa924e5a9c74550ed206b0c134dd12
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Paymeanto14082600008976.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
Paymeanto14082600008976.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target 3.gz
- Size 187KB
- Sample260814-kv1cbage73
- SHA256 76ad562030026b0847ffe2ffd91713a828fa924e5a9c74550ed206b0c134dd12
- MD5 2a0f306f4f14fb4c41c85ecb405ffaa0
- SHA1 cd33fa0ae4a9c03cb69feaa70ec5fbd119c2ee44
- SHA512 d986a153415ebf35b6687efea54a08acee84aedc9c68caa99969cd6c7ad079b20005473a9ff17feb6fe00ea5ffcb11abf59225c6360994c910c8ef774555ffdc
- SSDEEP 3072:g+dJ9O4eUOXxFNAy6x6Q0jKNrDutkCXHo+LrLZtIC36hGRpPOqhkR:9J9qFIx6Q/futC+LrTzzpLK
- TLSH T15214232DB3A5048DD03913D153DEECEDE2D4080AA2B7CB66C2307653701D927EF979A9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack002/$PLUGINSDIR/System.dll unpack002/$PLUGINSDIR/nsDialogs.dll - Untrusted Codesign Signers 1 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/Paymeanto14082600008976.exe
File Explorer
-
3.gz.gz 187KB
-
Paymeanto14082600008976.exe.exe 258KB
-
$PLUGINSDIR/System.dll.dll 12KB
-
$PLUGINSDIR/nsDialogs.dll.dll 9KB
-
Contemplation129KB
-
Madsteds41KB
-
minglers.kon36KB
-
signorina.ren21KB
Paymeanto14082600008976.exe
- IMPHASH c05041e01f84e1ccca9c4451f3b6a383
- SHA256 0e0bca2b782fb3d91cfe6c3dd55a59226f1b6b4e20453aebc34db216c5c0a81a
- MD5 c5a32a7a16d32f960b7387fc25ee7372
- SHA1 f7f9b71363f3ba30282cf093141164710a991463
- SHA512 466f929b4506a60cb93cc50387349c04d24ee5091f164c163b86d81ba798ff646005f44904192bd16c33d25f142476b92b5fda43253ed351e0f618541ab189e8
- SSDEEP 6144:ZgORaeCymGj9G8aZdy3mmEf0tq+RrZ3zpIs0:Zgquy3mmEfyqurZ1d0
- TLSH T10444BE1631008296E82844F2C017C9B65B627C7615A74D8B32B1FF6F797F6A2FA27D13
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
79:d6:b2:66:28:e3:d3:f3:52:a8:56:ed:d8:76:8f:7b:01:d6:62:6d:f6:c8:7e:33:1f:a3:1b:9f:e8:d4:5d:4d
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=jerahmeel,OU=Jomfrurejsens Sillibub\ ,O=jerahmeel,C=FR
Chains
Aug 6, 2026
CN=jerahmeel,OU=Jomfrurejsens Sillibub\ ,O=jerahmeel,C=FR
Subject
CN=jerahmeel,OU=Jomfrurejsens Sillibub\ ,O=jerahmeel,C=FR
Serial Number
0b:f2:e7:21:d9:ca:8f:84:e5:2c:27:85:a5:ca:0d:3b:e8:b4:68:80
Issuer
CN=jerahmeel,OU=Jomfrurejsens Sillibub\ ,O=jerahmeel,C=FR
Revocation Status
Not revoked
Timespan
Jun 27, 2026 - Jun 27, 2027
Minor OS version
0
Major OS version
4
Entry point
13784
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
advapi32
RegCreateKeyExW
RegEnumKeyW
RegQueryValueExW
RegSetValueExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
SetFileSecurityW
RegOpenKeyExW
RegEnumValueW
shell32
SHGetSpecialFolderLocation
SHFileOperationW
SHBrowseForFolderW
SHGetPathFromIDListW
ShellExecuteExW
SHGetFileInfoW
ole32
OleInitialize
OleUninitialize
CoCreateInstance
IIDFromString
CoTaskMemFree
comctl32
ord17
ImageList_Create
ImageList_Destroy
ImageList_AddMasked
user32
GetClientRect
EndPaint
DrawTextW
IsWindowEnabled
DispatchMessageW
wsprintfA
CharNextA
CharPrevW
MessageBoxIndirectW
GetDlgItemTextW
SetDlgItemTextW
GetSystemMetrics
FillRect
AppendMenuW
TrackPopupMenu
OpenClipboard
SetClipboardData
CloseClipboard
IsWindowVisible
CallWindowProcW
GetMessagePos
CheckDlgButton
LoadCursorW
SetCursor
GetWindowLongW
GetSysColor
SetWindowPos
PeekMessageW
SetClassLongW
GetSystemMenu
EnableMenuItem
GetWindowRect
ScreenToClient
EndDialog
RegisterClassW
SystemParametersInfoW
CreateWindowExW
GetClassInfoW
DialogBoxParamW
CharNextW
ExitWindowsEx
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
FindWindowExW
IsWindow
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
ReleaseDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
EmptyClipboard
CreatePopupMenu
gdi32
SetBkMode
SetBkColor
GetDeviceCaps
CreateFontIndirectW
CreateBrushIndirect
DeleteObject
SetTextColor
SelectObject
kernel32
GetExitCodeProcess
WaitForSingleObject
GetModuleHandleA
GetProcAddress
GetSystemDirectoryW
lstrcatW
Sleep
lstrcpyA
WriteFile
GetTempFileNameW
lstrcmpiA
RemoveDirectoryW
CreateProcessW
CreateDirectoryW
GetLastError
CreateThread
GlobalLock
GlobalUnlock
GetDiskFreeSpaceW
WideCharToMultiByte
lstrcpynW
lstrlenW
SetErrorMode
GetVersion
GetCommandLineW
GetTempPathW
GetWindowsDirectoryW
SetEnvironmentVariableW
ExitProcess
CopyFileW
GetCurrentProcess
GetModuleFileNameW
GetFileSize
CreateFileW
GetTickCount
MulDiv
SetFileAttributesW
GetFileAttributesW
SetCurrentDirectoryW
MoveFileW
GetFullPathNameW
GetShortPathNameW
SearchPathW
CompareFileTime
SetFileTime
CloseHandle
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalFree
GlobalAlloc
GetModuleHandleW
LoadLibraryExW
MoveFileExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
lstrlenA
MultiByteToWideChar
ReadFile
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW
Name
.text
Size
25KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
128KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
152KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
93KB
Virtual Size
93KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=165, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
$PLUGINSDIR/System.dll
- IMPHASH fc0224e99e736751432961db63a41b76
- SHA256 acf90ab6f4edc687e94aaf604d05e16e6cfb5e35873783b50c66f307a35c6506
- MD5 6e55a6e7c3fdbd244042eb15cb1ec739
- SHA1 070ea80e2192abc42f358d47b276990b5fa285a9
- SHA512 2d504b74da38edc967e3859733a2a9cacd885db82f0ca69bfb66872e882707314c54238344d45945dc98bae85772aceef71a741787922d640627d3c8ae8f1c35
- SSDEEP 192:MenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XBaIwL:M8+Qlt70Fj/lQRY/9VjjgL
- TLSH T1BE428D1193B089F2F590593805A67F2A6FBEAC5C27E44A63CFE345853D702DFA47A243
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
10719
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetModuleHandleW
GlobalFree
GlobalSize
lstrcpynW
lstrcpyW
GetProcAddress
WideCharToMultiByte
VirtualFree
FreeLibrary
lstrlenW
LoadLibraryW
GlobalAlloc
MultiByteToWideChar
VirtualAlloc
VirtualProtect
GetLastError
user32
wsprintfW
ole32
StringFromGUID2
CLSIDFromString
Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc
Name
.text
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
867B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
120B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1024B
Virtual Size
648B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=14, version=7299,
count=20, id=1, productName=Unmarked objects,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=4, id=48, version=9044,
count=1, id=42, version=8803,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
$PLUGINSDIR/nsDialogs.dll
- IMPHASH 6b5c4f7d679059f68f1269aad3a5cecd
- SHA256 c719697d5ced17d97bbc48662327339ccec7e03f6552aa1d5c248f6fa5f16324
- MD5 ca5bb0ee2b698869c41c087c9854487c
- SHA1 4a8abbb2544f1a9555e57a142a147dfeb40c4ca4
- SHA512 363a80843d7601ba119bc981c4346188f490b388e3ed390a0667aaf5138b885eec6c69d4e7f60f93b069d6550277f4c926bd0f37bc893928111dc62494124770
- SSDEEP 96:ojsvUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3Y/NqkzfS:ojsvWyNO81b8pCHFcM0PuAgkOyhIFc
- TLSH T1FE12F892E5A450B3C5D6533A35AA2F2DCBBD5329B0926C00C7738E4D39395BA6E38353
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
7527
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetFileAttributesW
lstrcpyW
MulDiv
lstrlenW
HeapFree
GetCurrentDirectoryW
lstrcmpiW
GetProcessHeap
HeapReAlloc
GlobalFree
lstrcpynW
GlobalAlloc
SetCurrentDirectoryW
HeapAlloc
user32
DestroyWindow
CallWindowProcW
SetCursor
LoadCursorW
GetPropW
CharPrevW
DrawFocusRect
GetWindowLongW
DrawTextW
GetClientRect
SetWindowLongW
GetDlgItem
GetSysColor
SetWindowPos
CreateDialogParamW
MapDialogRect
GetWindowRect
SetPropW
CreateWindowExW
IsWindow
SetTimer
KillTimer
DispatchMessageW
TranslateMessage
GetMessageW
IsDialogMessageW
ShowWindow
wsprintfW
CharNextW
SendMessageW
MapWindowPoints
RemovePropW
GetWindowTextW
gdi32
SetTextColor
shell32
SHBrowseForFolderW
SHGetPathFromIDListW
comdlg32
GetSaveFileNameW
GetOpenFileNameW
CommDlgExtendedError
ole32
CoTaskMemFree
Create
CreateControl
CreateItem
CreateTimer
GetUserData
KillTimer
OnBack
OnChange
OnClick
OnNotify
SelectFileDialog
SelectFolderDialog
SetRTL
SetUserData
Show
Name
.text
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
152B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
638B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=56, id=1, productName=Unmarked objects,
count=13, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=5, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
Contemplation
- SHA256 1a80a66083e487842e355466e7c817c41d0f88449d6a2bff73c320a7a647f4fb
- MD5 3b3d839d7e6cd7a2edeb6678dc7342b7
- SHA1 b8c5ac4382daea58a23784a919e00c0580e5325c
- SHA512 8e3288caf79104a9b27aab947ec6d9a8e90bb77a5cca06eb73b34858697453ed39b5acbf486a77a4fda9aa72f1f923b4654d333ad8c8d949e7eaeda732a578db
- SSDEEP 3072:o1v9i8lf8vYNLhrrgq/Mbm3yG4Se3YU0iNb:69nfnNdnFkIy7SeLbNb
- TLSH T1BBD3E1B127D60CB6EC1EC774C9B5B18E97D27D1A550658BC41BABCB153B7AF200B3888
- MD5 SHA1 SHA512 SSDEEP TLSH
Madsteds
- SHA256 9456fbef6369926d411c78bfa74d9bf3715a329d5190f5138036e3660d5b7bb2
- MD5 b39f1c97210f8eb1e166efb75298a135
- SHA1 9c0aed70eecff5289afb4e12fababc205eaa67c5
- SHA512 0b0c4cd5c5e386837a8e43d98aedd1a3d17461e7432f6ceeaa46d58c978cab759a89a95b79b24864a85bbf282eb7e8a9d2626e163fca86ea91db34a05afeb7d6
- SSDEEP 768:9sXpHoXwePkTBu0STGomBUA02ZQGiuhov:q5HOi6TQ0YQ9im
- TLSH T13513C092CB2BDCFEDE2B9938C1E464ED48A97014494FE46DB1B6996AC0030E7237C55F
- MD5 SHA1 SHA512 SSDEEP TLSH
minglers.kon
- SHA256 b943f7cfbf1ff4b3e2fff939ba39021c06fd58756c7db0e45a97a31c541b545a
- MD5 2f9b99ead518cb46c3633469817eef06
- SHA1 5efa349636c491d66bce7577793d8f3c9c0ffdae
- SHA512 afe8c70a3e781f4ad81848ed785f8c8cdbca4dd21c548bb4bbcd08794a03a94b8df21bf6d8742cb5ea7298d7a1cc10499ecc446ba59d9398084398bd7f1aac74
- SSDEEP 24:j/yMYGmaJkusI1f5dhtNO2a2eAUELIlK8Rov0ZRaGQKCmstMZJ:DbihI1fpqm+lYSaGQVK
- TLSH T1AAF2827C4F1508D52F64AEC633AFB349429CF2DA60E89B727C16AF2611361A29D92980
- MD5 SHA1 SHA512 SSDEEP TLSH
signorina.ren
- SHA256 e1934e6761238578a34cd690f73fce8784ebd1c13383bd91d32a69702eb60d28
- MD5 dded759c911b209f434011513e597550
- SHA1 1c6bf3b3d8551a4da4360a1c35ebac3a5d0b9e3f
- SHA512 5934e1187f1dae5b5b6a96e56f412d19662cdeaaf36c80d6e99d803d855f7b45ab9f3a6b433b82bbc26213cd219f1bdd55969e4323e26267d8a3fafb77aad03f
- SSDEEP 24:pLKdFC8b1aAqmUw+U8Uei2rWb0ybCNwMkEoF1q6sAB/3ZYcL9KqKSOv:pednb1aAqy89rgRbCmhEoJs0ScLcpSOv
- TLSH T183A268E1B3095925D5156D08176C03328117C80887ACF4EC24DDDA0F644E1D154606C4
- MD5 SHA1 SHA512 SSDEEP TLSH