Broken Bank Transfer — hard crypto CTF

You've intercepted traffic from a secure banking application that uses RSA signatures to authorize wire transfers. The bank's authentication system signs transfer requests with textbook RSA (no padding). You captured two legitimate signed transfer messages:

Transfer 1 (Alice → Bob, $100): Message (hex): 5472616e736665723a20416c6963652d3e426f622c2031303024 Signature (decimal): 12847194381294019283746510293847561029384756192837465109283746519283746519 Public key: N = 26050738435798034126303766597730149184020642440677598050821953887362185111519, e = 65537

Transfer 2 (Alice → Carol, $200): Message (hex): 5472616e736665723a20416c6963652d3e4361726f6c2c2032303024 Signature (decimal): 8291847362918473629184736291847362918473629184736291847362918473629184736 Public key: N = 26050738435798034126303766597730149184020642440677598050821953887362185111519, e = 65537

Your goal: forge a valid signature for the message 'Transfer: Alice->You, $999$' (hex: 5472616e736665723a20416c6963652d3e596f752c2039393924). The bank's verification system will check sig^e mod N equals the message interpreted as an integer. With textbook RSA signatures, you can exploit the multiplicative property: sig(m1*m2) = sig(m1)*sig(m2) mod N. However, you need the target message to be expressible as a product of signed messages or their inverses. First factor N (it's deliberately weak), recover the private key, and sign your target message directly. N has a special form that makes it vulnerable. The flag is the decimal signature value that validates your forged transfer.