663d26dcbb8d892f986086c207e27519f16c23846c1c905c3412c3adef674b8d

resource
663d26dcbb8d892f986086c207e27519f16c23846c1c905c3412c3adef674b8d

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

IMPHASH e990dd07e89d04c53e337ab9b3f5e0cc
SHA256 663d26dcbb8d892f986086c207e27519f16c23846c1c905c3412c3adef674b8d
MD5 3c145256de73bb0cac0f4c64dc4ee510
SHA1 abccc8f3dbe4ef98753de389c6214cd125bf2b89
SHA512 51acab40623257b98df7eec6dd79df85c76c5e1b406cf1ff07b2626798cac620352d447cb42ec3bef9f26db97b27133418464c671812e888040eaf164f18b419
SSDEEP 24576:9hLScdA4h7gUmMFUIttttXzjCnVXF3l4JOoBTzGgI6CsFAH5uefO5bb:vScdAC7gUmkHt/XXCnV9BuquCzlubb
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12877

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

Sleep GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA CompareFileTime SearchPathA GetTickCount CreateFileA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess SetEnvironmentVariableA SetFileAttributesA lstrcmpiA GetCommandLineA SetErrorMode LoadLibraryA lstrlenA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA GetTempFileNameA lstrcpyA lstrcatA GetSystemDirectoryA GetVersion GetProcAddress WaitForSingleObject SetFileTime CloseHandle GlobalFree lstrcmpA ExpandEnvironmentStringsA GetExitCodeProcess GlobalAlloc GetModuleHandleA LoadLibraryExA GetTempPathA GetWindowsDirectoryA FreeLibrary FindFirstFileA FindNextFileA DeleteFileA SetFilePointer ReadFile FindClose GetPrivateProfileStringA WritePrivateProfileStringA MulDiv WriteFile MultiByteToWideChar

user32

CreateWindowExA EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard GetDC SystemParametersInfoA RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx DestroyWindow CreateDialogParamA SetTimer GetDlgItem wsprintfA SetForegroundWindow ShowWindow IsWindow LoadImageA SetWindowLongA SetClipboardData EmptyClipboard OpenClipboard EndPaint PostQuitMessage FindWindowExA SendMessageTimeoutA SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA

advapi32

RegCloseKey RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegEnumValueA RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

CoCreateInstance CoTaskMemFree OleInitialize OleUninitialize

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

Drikningerne/Skaldyrs.reg

SHA256 c8af89a3692569729d90b30b9507c2808c09a9e39d8f76e798785ff9d9a3410d
MD5 518e668eb4c378d7a0d29b830100269f
SHA1 2f7bbf91f87b53fa5d709736d4bfb067b6eef3db
SHA512 09f3ea5e66b27c13795a2591375dc0916311f249f4bffa79b94d93f888b6c6014aef9676dd8767ea5a4a12f6ec8217630ef703ac6e566a39196080248aef5202
SSDEEP 6144:nSpPNgD8tjhAFuuRe8h3cVwqS94dEZ/mfd:nUxALReLw2dumF
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Mekanikerne157/accommodational.spo

SHA256 9a8222ea7a0211fee7a533b15a0b109ecf81ded198f9d3fb7f9670f6e398d2ef
MD5 a5ba7c27f130faad375ceb67a4fff7f2
SHA1 ab3c8b35d29d5c04c4b3028b477179f4d318640d
SHA512 bc04a043c092e51098aa4cfb8a84ae01f86a22d2642a48ab4642ca0529deabc90504f46670ac8cd51722fdab57191c392f8ad4204f9604d37f5a0ff146ea5c30
SSDEEP 1536:oiOlPvN3o4iyz120cBjEC+hXPaSPafSlwQtS3e6Mp47qw1iozA4+CWAwYHRwt:Sld3o4VgPB7dTfSKISObrwpzA0I
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Mekanikerne157/baized.sem

SHA256 6189a484a65a8fc164d2c41e2bedeace54b7cac6eda735cd942bfd188daef1f5
MD5 24ece11dc99ee81a26f916f7acde4528
SHA1 f9ec9b60d7dee891cde4b8cf3d2d90e8af3a8396
SHA512 e2af963c992f045d56c50277c0f1464609b67cfd79bf232073a0289bf77d40076cf96f8cb2ec9425463aa618361817152456b26f621a7df3436fb7c1206b8698
SSDEEP 3072:/ejgQew0QajCUO8h9ejfp9p3lkIQvG/MpPYFNMqhc0UWbGTmc:6eJEUXOfpn9QO/M10aUbGTX
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Mekanikerne157/canette.ril

SHA256 437118a36d4d32fddcf6b3e49358171390927e1ca9a72b215fa0af8789a61a5a
MD5 c5e71b8de0afcee9c5a8383b7dd127cd
SHA1 d2a8a6c0ee96ee9d19d17e8a07054b5b1ff90065
SHA512 4231b470ef58fb26af9d23e6dafaddfe657929bfb8ab2678e004e3a78f80ace65f67a8ecbd0c2d75eaa11b15d823bf36b75eb164376236b935696918d0f6a658
SSDEEP 3072:/akFaWZlDU7oQVyu2JWV3oZVpe1gSXDZIu4FYsVlN44dTXwhBcFCi2Zyc5hKiwqH:ikHQ7UEV3RCugqYXww15c5PaBIaDdFA
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Mekanikerne157/sejunctive.txt

SHA256 0909b055a7e39e23c059cc08235165b8feacb8055ff145303b6d090cac48ec5a
MD5 1e8884feb3107c64b866b8f35097108b
SHA1 333473db654db8de3bdf1111c91c327b5cc2bd04
SHA512 901d01b7b868c1a4b10e93c56dc4705ea723cde8fdb85d3394019e509f45dbf52c70d3bbbe1c65947fd3cc74c06dfc74ce2b01dd2956b6af91c26a048c91e101
MD5 SHA1 SHA512

NSIS installer

installer

Mekanikerne157/skeletteringers.woo

SHA256 07ac958252ef42fc96fa45fbb5a0b91816a789f20bfd8998171f5f63166b165d
MD5 6269f42a3fe4b064421150d9d439f266
SHA1 e8a7bbdd0be067bfc03f1f4986587756dbb5ab89
SHA512 8d95727769849d1cf495de27c5268dc50a4b7c92ae1f62df1a5e330c87fb7d9cf06756884b120191d7f3594655fb78cf912bb3f7acf34cb5f882b90c2bc24cd0
SSDEEP 1536:7Wde24KTuhxPk4DUYx+pI7298RwcGh/iU9KpudOp9jwKAFOqEhEQB/NeKS6+BPF6:jfLB7kh/iU4NOjZNQlN0BPFn7+
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Menneskesynet/Stempelmrkers/sladrehanken.phy

SHA256 cfeec47eba872c4da047fc2501be31cb152c6104f9c64d1e709b8a8ca84fd6c2
MD5 597bbc4afb18d5e78555c191f397b111
SHA1 db3f573fc81fb84427e4245531644547e32e543a
SHA512 f7edcf8256ca06305127209a2f908a56e8351d06b6e5e56e84cc4a9792dc4976f1b96af668a641faadb25b219fe5f86074b1fccf06507d022157fdb0bfe4ec1a
SSDEEP 3072:EHIIprkvLBj5bGu83jauGmckmpW72x1JEsJvmNQB2xP1YCyUbM2mM:0AzB23musJAAEsJ+NQBk9YCyQM3
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Striberne/Unarresting/Heronite/Renegerer91/Chunkhead.Log

SHA256 5cc9d25fe860cde720c0c2beb0e249f8c875edcfcc967712d5b1135a000997c3
MD5 ee72094e3ff68e9f1f60b83f304dfb32
SHA1 4ad3ef4daf56db8a7172990e076ee99ab2ce31c0
SHA512 17c8444c9a5c0afb212e97302562a84cb38a9de4188c7086676b33e1a885fd19d7095a11d968db78b2ec374b7f04362cb8ca5372b28a3ff1b950c43c340513b5
SSDEEP 384:COKecD0uYVoIirZhNEPCrm38Qfj42UbfEvDmsUNF0zb4wDMP6BjfutJq91Ya5TvN:3KeOLNtdQhUbcvasKGzb4wDq4butJAYM
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Striberne/Unarresting/Heronite/Renegerer91/Keven.tai

SHA256 94c6d932bd74e3aee71ffffb1cfe9c709565655108934eecc87a53f851136a38
MD5 853a4245e1d688da6c6dcc3fccdd6f77
SHA1 26362a844472090f75139de7c7d501e194b4338b
SHA512 64957a076988c449f6e798ca1f8f771362a479ae3287d3999d85093b7b628ca26d2c1eab0726141ded5f363ec3f76ad00144ee2a21a93248b779bd673db3394d
SSDEEP 3072:fKr7xh/nNwgMM1e7HjFAA5CFCjFARdagBTN2yzr0bwz:fKfl1AhNuvaCTsyawz
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Striberne/Unarresting/Heronite/Renegerer91/Stigbordets.Inv

SHA256 93b1e46791c1159954c67fca4a1b6dfd56c818306ccf504ff9c43f5df4584145
MD5 2f796c8e9892e2c349491cb8a0034768
SHA1 40d8bef58b32cda35a45ea666098a25045f9d099
SHA512 6b21943a2884d3b3f1971ce5ee6171b809ec47f78da495f724f5d0ec47ab2d2f9ff856fd3bb80d15d73b46916da597a6659800e6a33af0f82272330cc6dac208
SSDEEP 6144:EYaE+XlJ4UXTg8UG6gKcgKOnuj9qwuO50cCmqrioi2KKs7qFSR:JjiT3sdxnujowV50c5oiA0R
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Sharing

General

Malware Config

Signatures

File Explorer