Transferencia realizada -7665565645-8778.tar
- SHA256 ddd12603f4a646c1ddf7976ca5c629b4cdce006ee193c82c5f7ecca9a3316584
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Transferencia realizada -7665565645-8778.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
Transferencia realizada -7665565645-8778.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
15 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target Transferencia realizada -7665565645-8778.tar
- Size 617KB
- Sample260916-13q2lsgj5x
- SHA256 ddd12603f4a646c1ddf7976ca5c629b4cdce006ee193c82c5f7ecca9a3316584
- MD5 0a9235bcaf784527d8da56ffdce26ed6
- SHA1 cf5e727e278eaeae22365116628a212ca4e09e48
- SHA512 46577e641a51dd363f0028103fcb927fba2f37b4842c7cbc94906f79b43ac80dd46aaace813afd692ca72ef2053899702d322acbeb6889dfff8446a6b14caaaf
- SSDEEP 12288:tOhbnL6QAsPcC4LDNdbdF5/a9BpzSpZH3k35FRdD/vI:tanY9r0pG7H0jvI
- TLSH T12DD42339FE308A3A605DDC6E24AC8D286DA34D30CBF9995B815497C70187BBD1BA0DF5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/$PLUGINSDIR/System.dll - Untrusted Codesign Signers 1 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/Transferencia realizada -7665565645-8778.exe
File Explorer
-
Transferencia realizada -7665565645-8778.tar.rar 617KB
-
Transferencia realizada -7665565645-8778.exe.exe 752KB
-
$PLUGINSDIR/System.dll.dll 12KB
-
Bourbon44.for6.3MB
-
Gleg24KB
-
Hovedmenusystemets180KB
-
Inspicerings.ini569B
-
brillerendes.jpg.jpg 28KB
-
komiteers.txt370B
-
kultursammenstdets.udf4.3MB
-
overpublicize.ini143B
-
recirkuleres.ini169B
-
rostrolateral.ini205B
-
uddeliggres.ini596B
Transferencia realizada -7665565645-8778.exe
- IMPHASH f4639a0b3116c2cfc71144b88a929cfd
- SHA256 9095ca093e24e0aa01d5436165dcca8774f72375140dd424a0a02a15b51924b7
- MD5 0f8529aafd724904c63e634b90a560b9
- SHA1 6e0dff42f4183d52bb99aa001cfa92248d3abb7c
- SHA512 c434e7f92f9eb81fe2d6ff1cb450305613bd274b0ce312d0cbc6f4a40ad037263b2367fd7d88472f23282f12f95a20f9d21d3a433cf7896bdcf6ffd9625a7235
- SSDEEP 12288:bfYu3EzNpkiyre4nt7leCPMXRGr1iZFom7zAgZpM4lRDA0LSvHio6iWGRdo:bfYTar9nt7xPMhGr1gum7zRnMIOvHi/P
- TLSH T19CF41223B600CA83E96442B0D473DB7860B2BD6996D25A1B73CD7E2FB8F2363141B715
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
ab:51:87:d0:af:eb:8e:d9:dd:4a:53:a7:5c:bd:76:eb:33:b9:ba:25:49:e0:70:5b:66:6a:c6:78:82:db:84:2d:b3:79:43:97:73:c8:94:45:4c:b6:71:04:9d:33:ab:60
Digest Algorithm
sha384
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=selvpensioner,OU=Revne Subsumptive\ ,O=selvpensioner,C=DE
Chains
Aug 19, 2026
CN=selvpensioner,OU=Revne Subsumptive\ ,O=selvpensioner,C=DE
Subject
CN=selvpensioner,OU=Revne Subsumptive\ ,O=selvpensioner,C=DE
Serial Number
23:c4:c8:82:55:cf:c9:25:86:3a:ba:34:1a:44:b5:02:c9:df:a1:78
Issuer
CN=selvpensioner,OU=Revne Subsumptive\ ,O=selvpensioner,C=DE
Revocation Status
Not revoked
Timespan
Jul 10, 2026 - Jul 10, 2027
Subject
CN=DigiCert SHA384 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US
Serial Number
0c:20:43:49:f9:d0:f7:59:fb:98:2d:e4:08:1b:88:7b
Issuer
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jun 4, 2025 - Sep 3, 2036
Subject
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Serial Number
0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 7, 2025 - Jan 14, 2038
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
13650
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
advapi32
RegEnumValueW
RegEnumKeyW
RegQueryValueExW
RegSetValueExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
RegOpenKeyExW
RegCreateKeyExW
shell32
SHGetPathFromIDListW
SHBrowseForFolderW
SHGetFileInfoW
SHFileOperationW
ShellExecuteExW
ole32
CoCreateInstance
OleUninitialize
OleInitialize
IIDFromString
CoTaskMemFree
comctl32
ImageList_Destroy
ord17
ImageList_AddMasked
ImageList_Create
user32
MessageBoxIndirectW
GetDlgItemTextW
SetDlgItemTextW
CreatePopupMenu
AppendMenuW
TrackPopupMenu
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
IsWindowVisible
CallWindowProcW
GetMessagePos
CheckDlgButton
LoadCursorW
SetCursor
GetSysColor
SetWindowPos
GetWindowLongW
IsWindowEnabled
SetClassLongW
GetSystemMenu
EnableMenuItem
GetWindowRect
ScreenToClient
EndDialog
RegisterClassW
SystemParametersInfoW
CharPrevW
GetClassInfoW
DialogBoxParamW
CharNextW
ExitWindowsEx
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
FindWindowExW
IsWindow
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
ReleaseDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
GetClientRect
FillRect
DrawTextW
EndPaint
CharNextA
wsprintfA
DispatchMessageW
CreateWindowExW
PeekMessageW
GetSystemMetrics
gdi32
GetDeviceCaps
SetBkColor
SelectObject
DeleteObject
CreateBrushIndirect
CreateFontIndirectW
SetBkMode
SetTextColor
kernel32
lstrcmpiA
CreateFileW
GetTempFileNameW
RemoveDirectoryW
CreateProcessW
CreateDirectoryW
GetLastError
CreateThread
GlobalLock
GlobalUnlock
GetDiskFreeSpaceW
WideCharToMultiByte
lstrcpynW
lstrlenW
SetErrorMode
GetVersionExW
GetCommandLineW
GetTempPathW
GetWindowsDirectoryW
WriteFile
CopyFileW
ExitProcess
GetCurrentProcess
GetModuleFileNameW
GetFileSize
GetTickCount
Sleep
SetFileAttributesW
GetFileAttributesW
SetCurrentDirectoryW
MoveFileW
GetFullPathNameW
GetShortPathNameW
SearchPathW
CompareFileTime
SetFileTime
CloseHandle
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalFree
GlobalAlloc
GetModuleHandleW
LoadLibraryExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
lstrlenA
MultiByteToWideChar
ReadFile
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW
MulDiv
lstrcpyA
MoveFileExW
lstrcatW
GetSystemDirectoryW
GetProcAddress
GetModuleHandleA
GetExitCodeProcess
WaitForSingleObject
SetEnvironmentVariableW
Name
.text
Size
26KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
170KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
212KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
164KB
Virtual Size
163KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=163, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
$PLUGINSDIR/System.dll
- IMPHASH 509a34b3a68a773e0afb4259e68f9f82
- SHA256 23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6
- MD5 192639861e3dc2dc5c08bb8f8c7260d5
- SHA1 58d30e460609e22fa0098bc27d928b689ef9af78
- SHA512 6e573d8b2ef6ed719e271fd0b2fd9cd451f61fc9a9459330108d6d7a65a0f64016303318cad787aa1d5334ba670d8f1c7c13074e1be550b4a316963ecc465cdc
- SSDEEP 192:ljHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZqE0QPi:R/Qlt7wiij/lMRv/9V4bfr
- TLSH T1B1427C1297B089F2F551493419667F2A6FBEAC5C13F405A3CFE304C63D212CB9839243
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
10879
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GlobalAlloc
GlobalFree
GlobalSize
lstrcpynW
lstrcpyW
GetProcAddress
WideCharToMultiByte
VirtualFree
FreeLibrary
lstrlenW
LoadLibraryW
GetModuleHandleW
MultiByteToWideChar
VirtualAlloc
VirtualProtect
GetLastError
user32
wsprintfW
ole32
StringFromGUID2
CLSIDFromString
Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc
Name
.text
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
867B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
120B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1024B
Virtual Size
662B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=14, version=7299,
count=20, id=1, productName=Unmarked objects,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=4, id=48, version=9044,
count=1, id=42, version=8803,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
Bourbon44.for
- SHA256 7a7d0e125514f1a6b3a58a1f237fa99d6cc9720ed2c443dc6bd84d5e0ff7e61f
- MD5 ab2f365f73fb5516bab0d928aedff3cb
- SHA1 ef526174d3fe676dfd87e110f9e755e50a4a61a6
- SHA512 ccb4e4373782366edb1176f2d39b09c2fd6dddc08de0fb9f0a6f071e584f16866d619a774d969b029c6d6aa1bd526f87c6cc24edf97f4bd6731839d61ed16baf
- SSDEEP 384:Fn2ilYPY9kWJkjwjIsbWy6jJFqvrvAB51MrfyDIgtwop8NuZrm49QpA0fg4X49AE:Z+0c+nbYc0hKeJf
- TLSH T1E0662267205C3B281477D9E7CB661927FC52B01EF96E748E95D1182A0A8C3CB32F2B4D
- MD5 SHA1 SHA512 SSDEEP TLSH
Gleg
- SHA256 26d6902e0e41b54402db39f5322e0820821f7e8b0590a1e7d903349cbefddf3e
- MD5 c678baa47a73e88f64178da2437abfb3
- SHA1 0c6e2bb6635a149d3103d5681cd55f33f5c88303
- SHA512 31642a0ee9a2895129fae6060ad993726a7f5bb189549767128cdbcf74515e222aa70f2877588f10d5ac4805b309e196b52c5994458b35f573d2cbca6b5a0af5
- SSDEEP 384:sz1TWhJAd/jBEPQ1meNHQylJEtDx6VoaZ0dga49DWWNXX3cBP1:sQhJAjWeNwyTE1x6zGcDNHs3
- TLSH T126B29ED5DB77CCBEC8698538C06DD1A75C647009A90FC0BF31A7984742A72E27B640BE
- MD5 SHA1 SHA512 SSDEEP TLSH
Hovedmenusystemets
- SHA256 43cc4c243c7993d9ab1182265a49bb3b8b5579377a9078770032ece7a8ca064b
- MD5 a489c3e763195080f848bcab64adf9a4
- SHA1 8ce2195f88eb6095ceec01d32ca231f77796bc59
- SHA512 47385c82a9f3470664e4cbde46783b324e00940642a67881f3c1966e3af15bcc033ccd754af91065e2d6ff2ea85763b62b47672f3634ca36cb83ad68cafeac25
- SSDEEP 3072:0QbSq1dmur61xdTyg3e4DiE0PaRiVPxcF66SMJ+0u93Ix/dzgusAwwwwwwwwuIJ:0QV1djAZqyiVP+Cp0u9YTns1IJ
- TLSH T16804E17E4B1C584CD81340C7ACF23D662A6559170838C7FEA355FF44AB274A4EEB2E68
- MD5 SHA1 SHA512 SSDEEP TLSH
Inspicerings.ini
- SHA256 d1b600c65c0262b5bfadb9812fa4418bd70ebd46d9500b2fe7f2ebeab889be02
- MD5 86eada7e1014feb788cb7ed5ea06f915
- SHA1 3e63e49c834efabd25633e815798273f9c491c34
- SHA512 b571daed63c27bc2eef328c489ecdc496a838a2e621d775cfb765b8e30d7102621647078adf818e2922f49a23df9a5737f5a26be307d01be2284a8d62f1666af
- TLSH T1A5F0EB32814397082AE68E5268E2A65E8A785494580DF0D30E9467AE7D484AEEC56F27
- MD5 SHA1 SHA512 TLSH
brillerendes.jpg
- SHA256 b476c0db3a24bc0c14333063d83805901d932bc4cacde24f42c71bc98034b1a5
- MD5 42de20133f8ceddd59e53cca616b541f
- SHA1 7de6ff843a940b6243c69a0b8000ec8a9841a294
- SHA512 3769ad91bbbabd13bb2284dd04603d38f6d35903c1c962242dcb6f5c0d28a56cba6a7d5a0028c8756e33ef0669ec6767f56708d531f93873b7bf1cd0924e6305
- SSDEEP 768:dMA/uKgHDC/8n/YfbieppMbYgpbW8FhFt2rv83mDBkumOPtt:dhG1jCH2Ip4Ygg87Ftk82Dmi1t
- TLSH T141D2E16E9882674514110EAA1532183A70FAAD17C6075BB36A70B6CDF30ACB5E0B7F9D
- MD5 SHA1 SHA512 SSDEEP TLSH
komiteers.txt
- SHA256 14d6cbdb9aacaa52cff223bd203f5643ead68fa3c4a1df9bb11a57f4ca9a80bb
- MD5 0b7488e775911366d566b2eea6821ba6
- SHA1 8e565ed3e73bb96f4cb7c8e4b6c8efbded65f910
- SHA512 20f1c7746d34acefd441ee6462448078b61ef04c054db2350fd57eb9813eb0bafc236327150f95cfeabcb63d866bad3819c4e1283907f7919cda22ba3ec2b6de
- TLSH T100E0F1F0F9149E905DD11293FC04064431769700CC039706F18A131C2203BD9A26F500
- MD5 SHA1 SHA512 TLSH
kultursammenstdets.udf
- SHA256 2ac635d1406513939bf98d9d0c0ae23e6e5e2f259b661c6a47f9c2877a70d1f1
- MD5 387c8048bae382600907c0ce3fa5a5e1
- SHA1 c31662070462d1b473a045038853029b97c89d81
- SHA512 e3d9494b631f505b7fd63ec33a47aa3cb4049c34ea5fa6e48b01fa6643790cb9cfbc7581b89116b9f31f3ffe63f977b3553d4df6fb35d17779a039d88510b373
- SSDEEP 768:2cmeJcNH/wI1jRcc6kIcXf1VgTwRlPVI7UFbbqLzqQwATLPqOuoEwTA8B8Ifug4d:4if2FeBIKy
- TLSH T1EE26125243E6361E76D59778AA0DB90838B7BBC9BC99383017D93477B2010889A4F6DF
- MD5 SHA1 SHA512 SSDEEP TLSH
overpublicize.ini
- SHA256 24e2aa0e082fc468c1633be49e25bcadb0da6238b9496ab534cb02c8b94bbfb7
- MD5 b1c61b40180ccfbbdd16c82038df9d37
- SHA1 4b6ca050999b44128df26e273bf8b72d0280f352
- SHA512 42597f52ec55b311bf061faa2c34aa8366702865a6a4b3eda8ff74854f30264dda460b15ea383e000b8c0a4f2e09c02c534e90bbec1d1a3e5d509567ebb2a07d
- TLSH T153C08CAD2C278A16A71106C61704283CEE54813C8C02A14B380E4A2081028A8013802D
- MD5 SHA1 SHA512 TLSH
recirkuleres.ini
- SHA256 d15cf39fba2c0462725562e7a869bb53aa74dc0f32e7481edc1a67a4879f9bd1
- MD5 2a58ed802023b61d48a30969bac2ba4b
- SHA1 39a2cb244a31cb4b99774d7d314b543c0bd92c32
- SHA512 5d8b98e43af5d0ce4a40ef9ac998948f4758da4c53a416587f6e92a68fb741caac0ae14bf7d57aa4125920d531d584200340da21a29832136a0cac14b9b06a97
- TLSH T191C0C0161C9734452FE4D71441500D8221F00B61E6F3812230B38321D200320006202F
- MD5 SHA1 SHA512 TLSH
rostrolateral.ini
- SHA256 1fa7d7c8d95907591298d8b470d233a6cedfc40f3317f948a735c3e14eb13dcb
- MD5 b91f64f24ab6b3833c2495a16ae63598
- SHA1 1d305aaf5e1b4fb75e3fa0e485e0caac9632151c
- SHA512 3d44c3527e93c8b453f3cdaa55f0bc52e045bcac6bd8cf238ac7ee87dadbd3d154225eafa0319eb4bea9ca2ec6a61ec5486849df54acbe9a57dc5ab27676d80d
- TLSH T1BFD022A18EA3AA2C020A2441FA841271B3AC80D181A08A993EF3A7098402848CBB81B6
- MD5 SHA1 SHA512 TLSH
uddeliggres.ini
- SHA256 0949ddda1833c8ed902246c20ee5dd81ba6961eabbc5c9df814d069d2849d7af
- MD5 dc81ab0d264a077979b4fdf6509a012f
- SHA1 40147de809cfbab96850d7959c1be68e1fd643e2
- SHA512 7b052a0a57632f26d4b666b1d4493025a4f86cfef2dc0d885653d2142d29a63345c6c747339b5837a39316478ff8a2d860ccbe53950a900bb0cbaffd2f665283
- TLSH T144F04778CC8B782674C123257E759D328167800483391D7FF3D40E0D47885B8D9E4A18
- MD5 SHA1 SHA512 TLSH