JUSTIFICANTE DE PAGO[.]pdf[.]exe

resource
unpack001/$PLUGINSDIR/System.dll

resource
JUSTIFICANTE DE PAGO.pdf.exe

JUSTIFICANTE DE PAGO.pdf.exe

IMPHASH 9be4f90f50c714bc00cc8beb2e137299
SHA256 1c0794f74cd0520dfa1580112d904fa39cb7ae062c10904743f7bd0422384a4a
MD5 b0432c52007f5e213a2e22a352886728
SHA1 2a75eb493c6fb2a3ec01f40dba1f14b6eeadacfb
SHA512 363c9f3dff497a391f19ed7154a5d1011a471ed5e81d9091ca213798b4757c8cb54950741935dbe21f9cc2a8969af6b1159dbf5565235c7d215dc99afa568da3
SSDEEP 24576:3B/BhkiVEihPMkk0vz1fzF2LuA/kEUAyMxlS/F:R/bV/PMCJzF2yAaAyr
TLSH
T14855ADC2F30282E8E526CBF21E5B9071A9053EECE821594D649F776E0BF235144ABF5D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

e7:22:3a:58:7e:27:f4:1f:3a:3d:d4:1a:9d:c4:8b:da:33:e2:13:e8

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Ophthalmite,OU=Senges Underdrew Tiptipoldemoders\ ,O=Ophthalmite,C=GB

Chains

Nov 6, 2026

CN=Ophthalmite,OU=Senges Underdrew Tiptipoldemoders\ ,O=Ophthalmite,C=GB

Minor OS version

1

Major OS version

5

Entry point

17283

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegCloseKey RegCreateKeyExW RegDeleteKeyExW RegDeleteValueW RegEnumKeyW RegEnumValueW RegOpenKeyExW RegQueryValueExW RegSetValueExW

comctl32

ImageList_AddMasked ImageList_Create ImageList_Destroy InitCommonControls

gdi32

CreateBrushIndirect CreateFontIndirectW DeleteObject GetDeviceCaps SelectObject SetBkColor SetBkMode SetTextColor

kernel32

CloseHandle CompareFileTime CopyFileW CreateDirectoryW CreateFileW CreateProcessW CreateThread DeleteFileW ExitProcess ExpandEnvironmentStringsW FindClose FindFirstFileW FindNextFileW FreeLibrary GetCommandLineW GetCurrentProcess GetDiskFreeSpaceExW GetExitCodeProcess GetFileAttributesW GetFileSize GetFullPathNameW GetLastError GetLocalTime GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetPrivateProfileStringW GetProcAddress GetShortPathNameW GetSystemDirectoryW GetTempFileNameW GetTempPathW GetTickCount GetUserDefaultUILanguage GetVersionExW GetWindowsDirectoryW GlobalAlloc GlobalFree GlobalLock GlobalUnlock LoadLibraryExW MoveFileExW MoveFileW MulDiv MultiByteToWideChar ReadFile RemoveDirectoryW SearchPathW SetCurrentDirectoryW SetEnvironmentVariableW SetErrorMode SetFileAttributesW SetFilePointer SetFileTime Sleep WaitForSingleObject WideCharToMultiByte WriteFile WritePrivateProfileStringW lstrcatW lstrcmpW lstrcmpiA lstrcmpiW lstrcpynW lstrlenA lstrlenW

ole32

CoCreateInstance CoTaskMemFree OleInitialize OleUninitialize

shell32

SHBrowseForFolderW SHCLSIDFromString SHFileOperationW SHGetFileInfoW SHGetPathFromIDListW ShellExecuteExW

user32

AppendMenuW BeginPaint CallWindowProcW CharNextA CharNextW CharPrevW CheckDlgButton CloseClipboard CreateDialogParamW CreatePopupMenu CreateWindowExW DefWindowProcW DestroyWindow DialogBoxParamW DispatchMessageW DrawTextW EmptyClipboard EnableMenuItem EnableWindow EndDialog EndPaint ExitWindowsEx FillRect FindWindowExW GetAsyncKeyState GetClassInfoW GetClientRect GetDC GetDlgItem GetDlgItemTextW GetMessagePos GetSysColor GetSystemMenu GetSystemMetrics GetWindowLongPtrW GetWindowRect InvalidateRect IsDlgButtonChecked IsWindow IsWindowEnabled IsWindowVisible LoadCursorW LoadImageW MessageBoxIndirectW OpenClipboard PeekMessageW PostQuitMessage RegisterClassW ReleaseDC ScreenToClient SendMessageTimeoutW SendMessageW SetClassLongPtrW SetClipboardData SetCursor SetDlgItemTextW SetForegroundWindow SetTimer SetWindowLongPtrW SetWindowPos SetWindowTextW ShowWindow SystemParametersInfoW TrackPopupMenu wsprintfW wvsprintfW

Name

.text

Size

35KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

352B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

35KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

240KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ndata

Size

512B

Virtual Size

592KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

398KB

Virtual Size

398KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

$PLUGINSDIR/System.dll

IMPHASH cf8eee620b3371ff06e99c34f39ea84c
SHA256 14a2ba8f2ba490c1ac67551f28b859f4f07338a5fc0f291525d926ee4d973b8f
MD5 4d2a02ae55547c4a4e5a8204b895c6fb
SHA1 e7b703cae69ed8d85fd2612a85a40a43dfa2da87
SHA512 518cae04789c22d11604ae53f6610144f99a522b7bab95e664b839b6aeb021bc8a47f58944dddc5042006fa0364666b5af6865e092a79d59fcc0fe7187fa2f28
SSDEEP 384:QZ2pfUx9eVLwDKO9XYD/isN7lCEjgwMU/ktKi+R45Duwomq8pqdDvHZ1Q:Qr96YIrx7lC7vU/kaG9uLmCdb
TLSH
T1ACB24C07F38398BFC50BC17186EF5772AA72BE211B616F6F1220F5756E24E90871DA14
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

12726

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

Name

.text

Size

14KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

112B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

1024B

Virtual Size

916B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

384B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

179B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

88B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Lgeplantes186.beg

SHA256 22e1fd125e9218bbb010e97df5024a0e79d6dddf85ea4323206e31422c819fb7
MD5 d72b70f6c7b8eaf020b047c379808ad3
SHA1 7624a984260d613a37fc09a57ef40817bf646d37
SHA512 dbe4722f0372a58d8063c26f779fe7efde7fdcfa40aab7c7d770b1be1f0c70a3a0d6cf1c725f4f5d229e3112f9e83da1a23bd448518f18cad675101a0e7eb166
SSDEEP 1536:Ue8gq582MmluI3PvtyxXR95E9QMplbznb7mo8P9S7vL9UZitIYWzYARhUHfPS7s6:yWzNy8
TLSH
T1AF5613961FF15DA8DABBC86DCBC528D5AA484A44C495F78E8F5E050CE723801740FA5E
MD5 SHA1 SHA512 SSDEEP TLSH

Smrgaasbordene

SHA256 f89ebc4f7b7b910693b133f6cd0e1fb558387f501d93c80c82da413e26f7b5a6
MD5 ae8a3ed05766e141f72ecd21c7a5d85a
SHA1 fa1a9ab918d38902ed2a64fd15a1468de92cba2b
SHA512 f4f2a1b592333c7e60b7ce67b2a585e9ed8ade6941988e99069c1b2157b39c4feb35b11f53e57d3ab6361f8b625c3a034c0fef630db7a0accb7d81ed0067d53f
SSDEEP 384:tMWNy1o2DZ4UK3EnuULEN/RFChVOO2vGOV52:5U1pZ4UK3EuULEtRFGVOO2vL52
TLSH
T1E592626065C989E0F6055E88EA78FF7202333573EFCB1C922324F5018BBE6553A8D91E
MD5 SHA1 SHA512 SSDEEP TLSH

Tregetour.ini

SHA256 8a05cccd0f8770e0ab237d524efa7fdf4d5d640d90ad054064b2fbf6d4e7a841
MD5 b6dec658df5699dfa8c6a3684ad44edc
SHA1 f676acd7f944b752fa5ae79aca4af78e3a00235e
SHA512 78b9826d80277b8d726a3e610d003378e310b652c10f8c8273e1788c8319d0530ae823c8c0d54ef0bd650677370844b41a341d16e8b0410b1f37c546f56e37fa
TLSH
T132F07536D26513418F979FDA3F00B04374F7DA20B80D61E9A5C90A0A1B4001C0333416
MD5 SHA1 SHA512 TLSH

Unifiedly

SHA256 55383b24eec8524355d85492a55d7a7391fc782ae22a7589ac5c999e42ddba3f
MD5 064c13cda7b579c589458e1cb7161d4e
SHA1 164fe5aa24161fd192e28e45a72e8ea66b4afb42
SHA512 9b1ec772f4124564014c6e714f439d518b7ed9d2183af2dfb4601aa6aa8a2fed56795f197da107dd045749fb23fe774ee78db08fb7bb1c25a8a174e484416ff0
SSDEEP 12288:MrCR2SGPxhfTLZd8faYHZyfm82gRfVeK8Irs:ZolHfXyaYHZKRfV/8II
TLSH
T11B94AEB0431CD0ECE34351FA01A7F1A33BC652A8E16176A77722870B53CB5BE5AE7985
MD5 SHA1 SHA512 SSDEEP TLSH

streptothricosis/attorneydom.met

SHA256 4155f9f4c13f9dab070001ecba28793400318a516ad4a1c9a07254573ce584b2
MD5 01fa66a20cdb2edb7a9644db4ded816c
SHA1 0b97c346aa2ea96a0f33c3ee2179793568a6364a
SHA512 2927fdff20a7fef96d7e7e0f0bdd0412f3899c7e755086c8a661484bb3221ebf5763e7ce775cc0e456fb33a5c389bc3ee4b365fee48dca302ef21e8635ffda8b
SSDEEP 384:ICHQ1aSgTRevxL4YHpveWG3C8pun5SDU5HRgfjdLxK6hV7eQZj1+mDx7iDpoEYdQ:B/8MH9H+2881Pzhcq+aK
TLSH
T1698613119F4F98AB3B37339A9F4C03ED124D6A0B5954DA9A54422127DFC99E2EF0E432
MD5 SHA1 SHA512 SSDEEP TLSH

streptothricosis/exprobrate.pre

SHA256 858af44e38cb12bed30d947f8021067d8fcb78e975e3a5b1597f8f3b1ab9425a
MD5 97ae3ae5e5c204ea70a0d77fb67de414
SHA1 cc8a2a663975543fea0971bad35be67a03892e44
SHA512 772880319253b8a197fd0e1b33e9cdbd5542d9a8df0c4b8cf5ead42ca379a25f9bf4a8ed8e726a3fba1efc865826e0e57b9694eb98c6f120a7505af7b8ef015b
SSDEEP 3072:G+9tC8ZnbEmmfZZi3Pdh8onXa1nulVzr1T7ddBmrKNMU1U2NfWGfEtnHQAZQcQYp:W
TLSH
T1B2B502B85FC555E9C0ECDC8B6F8024A1C4E944C13CBAD2763842D3926FB6A2B15D7F64
MD5 SHA1 SHA512 SSDEEP TLSH

streptothricosis/forstrkertrin.txt

SHA256 cb6622bb07f89b4d60d4404d9b87cd1f44bc7b40ea75dc9819a6c80aeecc8522
MD5 0760e4403e14edb33f0e2122a787c9a5
SHA1 305a906af0e83739e93af31b4a230aa9cce1836d
SHA512 4d1e128c4015da127175f0fef08883b4f58750bd3c6473ca9c8f3fc2ee1efc6318bc638a9ed527dafeaf61a37ee085b3e7537fbe15fd3bbc67d5e77078825f96
TLSH
T10B018304974B26612C4213EA3D7134B8D23BDB92424D2066E8C1E2ABA03066CDABED31
MD5 SHA1 SHA512 TLSH

streptothricosis/impostury.ini

SHA256 e11d45be0803c9c20952b6893643b8ed3e7ea991bfc9a031ae21eb16c2f2fbdc
MD5 c3de39c4a9f35e70c153d5d1dc6534fe
SHA1 bd9e9e880bc715369482f3515afe735071518732
SHA512 4cdd269db9907cf3c895812a7ca20e575f5220d0b21257bc78a298be7d31a442db30315630fa654dc053d6621c4c4489554798bf71ded8363ab8544067cbd1c3
TLSH
T1C1D02344FC71B61D6E4AD3CD389575DF5B91922CD00445351B47312B5D15350721ED0A
MD5 SHA1 SHA512 TLSH

streptothricosis/skybruddets.ini

SHA256 19da7a21830c889d0a920b8cd8949cb3276841a6f92b6bada9c5ccead4ea9428
MD5 0b7981ffe93f7c7637aa3e18a4a5e569
SHA1 f9209d6a401378c94e8458e9ba6ff651caf40921
SHA512 745c6c25487d597abb11f42c1177dfdde3eccd11e0fc4777e9d977830bcfc18622f18d5fd141a06239a9ce658f521394e0aa2631e62e20259c3cf3f61e384332
TLSH
T186E0C018C62B104E6E501D2571C90D1900AD08A3F431A03AB02ECF1D98651ACA3F4708
MD5 SHA1 SHA512 TLSH

streptothricosis/skyldneres.jpg

SHA256 3fec698cf6add82eb026d1fda593180d4e4277a1b0aad09a2739f566264c0be2
MD5 c8f439d8df02ce8944bdaeea6ae9c5d6
SHA1 7758940b56473e935e3297c21e9fd3cea1835bbb
SHA512 f6b603275dad6b571bfa5a21fcabdad1baeccced8a95b2ef802f11098c9d4b0870f92bd87269048c38cf7cb814584ac2165732a82368a8b3022f0ef99f0b20c7
SSDEEP 768:2TdJhKTXR2Tm8+bMUO42M+AehEEjL4ERwznJUpqcG4X1EJgxMdryRnpvzOzmH2Sd:2TdJ412CJMFpAeBjL4lePygMFk1OiHbd
TLSH
T1F533022FC5EDF2344B018208979A43B7571D5ABB2E333F349E19C4DA7220C702AD99C9
MD5 SHA1 SHA512 SSDEEP TLSH

JUSTIFICANTE DE PAGO.pdf.exe

PE Signature issue

advapi32

comctl32

gdi32

kernel32

ole32

shell32

user32

generic

$PLUGINSDIR/System.dll

kernel32

msvcrt

ole32

user32

generic

Lgeplantes186.beg

Smrgaasbordene

Tregetour.ini

Unifiedly

streptothricosis/attorneydom.met

streptothricosis/exprobrate.pre

streptothricosis/forstrkertrin.txt

streptothricosis/impostury.ini

streptothricosis/skybruddets.ini

streptothricosis/skyldneres.jpg

Sharing

General

Malware Config

Signatures

File Explorer

JUSTIFICANTE DE PAGO.pdf.exe

PE Signature issue

advapi32

comctl32

gdi32

kernel32

ole32

shell32

user32

generic

$PLUGINSDIR/System.dll

kernel32

msvcrt

ole32

user32

generic

Lgeplantes186.beg

Smrgaasbordene

Tregetour.ini

Unifiedly

streptothricosis/attorneydom.met

streptothricosis/exprobrate.pre

streptothricosis/forstrkertrin.txt

streptothricosis/impostury.ini

streptothricosis/skybruddets.ini

streptothricosis/skyldneres.jpg