best[.]exe | Triage™

resource
best.exe
unpack001/$PLUGINSDIR/System.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

best.exe

IMPHASH 0293eec0b5432ad092f24065016203b2
SHA256 e1be7b23cd76177220b4e03cae44abe132ab153875d64f49f82c52bfc16cae61
MD5 0e0e99a2c48c48746b45f597780256f4
SHA1 95eacaea9205b3a07c7a9a0c84c34c9702516c18
SHA512 a4ab510455a2aabc48b50238683f07a2ea7a60b8c0ddcf2da331691ec59dabba36db39e713a3494eaca7d51f5236aaf87228b802dbe88fea12cf74ab6064aa6c
SSDEEP 24576:b1xuZOWVgmqYiBLw7pAAINU/rqGGUIqpmyaXp2owCyXdIqIF:76VzCLO2xUjpmv2BCyX+
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

13527

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueA RegEnumKeyA RegQueryValueExA RegSetValueExA RegCloseKey RegDeleteValueA RegDeleteKeyA AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken RegOpenKeyExA RegCreateKeyExA

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA SHFileOperationA ShellExecuteExA

ole32

OleUninitialize OleInitialize IIDFromString CoCreateInstance CoTaskMemFree

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create

user32

SetDlgItemTextA GetSystemMetrics CreatePopupMenu AppendMenuA OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcA GetMessagePos CheckDlgButton LoadCursorA SetCursor GetSysColor SetWindowPos GetWindowLongA IsWindowEnabled SetClassLongA GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassA SystemParametersInfoA CreateWindowExA GetDlgItemTextA DialogBoxParamA CharNextA ExitWindowsEx DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow ShowWindow wsprintfA SendMessageTimeoutA FindWindowExA IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint MessageBoxIndirectA CharPrevA PeekMessageA GetClassInfoA DispatchMessageA TrackPopupMenu

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor

kernel32

CreateProcessA RemoveDirectoryA GetTempFileNameA CreateDirectoryA GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceA lstrcpynA SetErrorMode GetVersionExA lstrlenA GetCommandLineA GetTempPathA GetWindowsDirectoryA SetEnvironmentVariableA ExitProcess WriteFile GetCurrentProcess ReadFile GetModuleFileNameA GetFileSize CreateFileA GetTickCount Sleep SetFileAttributesA GetFileAttributesA SetCurrentDirectoryA MoveFileA GetFullPathNameA GetShortPathNameA SearchPathA CompareFileTime SetFileTime CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc GetModuleHandleA LoadLibraryExA FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA MulDiv lstrcpyA MoveFileExA lstrcatA WideCharToMultiByte GetSystemDirectoryA GetProcAddress GetExitCodeProcess WaitForSingleObject CopyFileA

$PLUGINSDIR/System.dll

IMPHASH 240ca92ecc1c291801c451c447e16c12
SHA256 7fb0f8d452fefaac789986b933df050f3d3e4feb8a8d9944ada995f572dcdca1
MD5 dd87a973e01c5d9f8e0fcc81a0af7c7a
SHA1 c9206ced48d1e5bc648b1d0f54cccc18bf643a14
SHA512 4910b39b1a99622ac8b3c42f173bbe7035ac2f8d40c946468e7db7e2868a2da81ea94da453857f06f39957dd690c7f1ba498936a7aaa0039975e472376f92e8f
SSDEEP 192:VFiQJ77pJp17C8F1A5xjGNxrgFOgb7lrT/993:97pJp48F2exrg5F/9
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10673

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Belemnitidae167/Polemiskes/Instinkternes/bloke/skdehundens.ent

SHA256 43ad13e0d4d4e31299615208601bae5531723cf485cdabe540bf653fca0bbc73
MD5 215ddd262ee4afe39679ee58c37f1a38
SHA1 e7f28de433af09d1122c919432a85a876728b7a7
SHA512 458128e2ba291f395dac63dabf24949a56f12a7cd4a6ea5501ac2a4d8471908a3e15d4c0b48b1bbb9f26a593b37612ca81367f9476fdc01d61c89f1574fdfabd
SSDEEP 768:rECLPgJyxgeY7OREsgmoRlJBfs2Urg+cEokmpuMVAACAm8UBnRB17kfLDab70jpy:5OGyXe
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Belemnitidae167/Polemiskes/Instinkternes/bloke/termikker.bli

SHA256 069f497aee85ba3f9b85bd88bd4cecf6553c69857f45566683ca28d87bb0e55f
MD5 a898b5fd7847461fd1c9f019c7e57a16
SHA1 1fb6d41ba1c8643fa715f2a5f3c15eac51e303fb
SHA512 44480d902c8994b4ca4a381b02569e9ec659d6e726d6c69f84ba4bf5ed82857277461c5e293d4803d2c80b7e2c770221372a2205d7d19aff807b777d8089904e
SSDEEP 768:GdiPYcntKAe5kyyPUZF/k6fvOE5c3DXAj:zPzY3P
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Belemnitidae167/Polemiskes/Instinkternes/bloke/trappegangs.abr

SHA256 4e8cacbf7a7dad29e258cec748c966ebfdc14038f346ef221e1f1530293be675
MD5 94b141e6661cb18f7f3d2220122e1002
SHA1 5ababe02f577221b7cc282a235da91c3582f0b6e
SHA512 c1de29da1529fbdab9de7be75e7ab750ee2219ad1ff53889507574ae2aec07d8ea116d261a72f74316653886c7da1b8db501e7f71dd6feecb071ba0f235b44e8
SSDEEP 768:QVi3q3FzN1rT1/J7w2i99WIW04s/CJS0Y1bkuZ9x5+rQS/6E8Xjx0/fZLq+UtkyB:MVKH16e
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Belemnitidae167/Polemiskes/Instinkternes/bloke/tuttle.sme

SHA256 1137391808a13360cad2be6859e64fa5b6ae2ba1a5b123979014a1170a5f8c2d
MD5 daf5a9b74d9c1f5e8c0d8e64c8353240
SHA1 352ee60f4fac1f490b5b1609520e0dce547bffcd
SHA512 8b25c0dfa570a885dc26acd380b1ba06f9ee0dd53db08c5c96f74116e6f715daedaabd27b0dc5478d3a0e79cc06021c70ff8f409a1f0f4840faa7931c5efcfb4
SSDEEP 768:NT5etG7dLJenagXQR0FPp7Xd8hTjMEGtglkTPU1d117nAM2mUlPMLOb059Vl10rT:ly617nN7oU
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Overblanch/Notarizes/Mousings/Strengtheners212/Chefkriminalinspektr219.Non

SHA256 53866a50d017647623c4e4f54b70a4395cc90b22e0efcca67667c099a3c4286e
MD5 f696d6fb51b7978c5f9770afe3050988
SHA1 718cf79d1b4c27844cde2c50693584dc5d1787d4
SHA512 72fc4cc2c82cbb83d5bf86c5244d290bc4bfdfc264cb001e34fea526f223317d7f5a1681768a4948ba2786dbc25bdaf2b0349fcfa724894ae21de71aef420233
SSDEEP 3072:Mcd5CB2/JIvc9A+HRtiCqRXNN4ZQSZ1CTjFPZcxzU:3CK39AMKNu6sCTjFPOU
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Overblanch/Notarizes/Mousings/Strengtheners212/Kahyt.che

SHA256 f5936b6d2afd2b107abb45f77219f195c4763ef82899b39b6fd9559dbcae1c04
MD5 d9588e7aca1461c7399bbc27d7f21345
SHA1 601ac5f3516be1f459ab9fd203b9e394b730b69c
SHA512 e6b42da4b5ee40178d67685e9dc87dfea3e55614b23b975fd320a3085a4e40ffc04a99abfe0a2ba1332a8090fc9eb97e2d719d2381a2173427a547ae9f26e9bc
SSDEEP 384:IiaG1P7UsJRj0j8JkNrHcahDnx0nZeNUWgmj1zF4eTZbMR6tQbCvPP2sdJwhYShs:+AJwjXZnmeEk1Os+sd8K7wLvwK+Dgil
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Overblanch/Notarizes/Mousings/Strengtheners212/Udsultende.tax

SHA256 2c449bd4e65998a507c067dd5e90fb354094aa363e264c5fc11571b64355eae2
MD5 b3b324d81d37f9cad55f7d891f0a020b
SHA1 da5de655cdf816db0510f79dc83713d742d567b1
SHA512 b0782f507f1116b129b256ba34f6ddceab58327f68c9d8a3c43178c11180299b4855bf457df8788a3c95edafcb604ebb46ba84ff633343cdd65930be9022ed59
SSDEEP 768:Upk80Be7LPXSUgBELT9FjvVYQDrS3HVCgnK85gNG7ANtiTuz49VibF7dN:uXH90LLRL
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Overblanch/Notarizes/Mousings/Strengtheners212/brawlers.trk

SHA256 afdd1826bbcadcc339a7bc7764e5c2deed6cda90ea6a3dc08c42e0bb205184d7
MD5 c54635332d34958dd59333dc039fd8d5
SHA1 f3b75dea6497dc77a95163a27a4da7bb46066018
SHA512 c33d6221c43dce48d84e18dc24a099796cfb259046e617ef24282661456d960b16323551fa604e7f8f8e876ba792bb7a760ff5fd5e4f66712bd4460dfb658535
SSDEEP 768:idGevgMbSVg5KHJI7nNvuZPRvS3L38JcNgu36U:i+pV
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Overblanch/Notarizes/Mousings/Strengtheners212/caressingly.sve

SHA256 b283877ad9c066a97733866fdb86cf181349dbf69eb31b8854c31ee6c58978cc
MD5 275c147e4f4b4bd16c9bfc15ede0c5a8
SHA1 8f5935ade34f7833f4f70d1bd483473d83b540b6
SHA512 822dec5d72515b0d18b7d1011069462c461e11a4f83746da1bbaf32d09427f2acfc1b541da087057a080aebe39baf86b0665ef45988327830d87510c80987740
SSDEEP 384:+ON8d0bzy6OrF6zKUYyATlCDXyWqvjhAw9SSQV0e6qOa28Q2+ben9gxdhp9zjY:hiIzyJ5m1CCDaXUSkR+B9
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Peptidases/opkaldsforsgets.txt

SHA256 dd24c92c4bcf4f9673dd2e7185d3047d2a859b72b79d96b4ff0afec5770ed3b9
MD5 3d8e9ef91ac5c3fd19cbf962907c08e1
SHA1 1645958481d461f1fb0fbc6825314cb0a270f072
SHA512 3950665dade6e569366852abbc5e7c50a30581c43acfb0b98acd44f8caa43124ef18acfb5f3273cdb18f4497e605e56793634b0d58a3eba002b778824e0a5407
MD5 SHA1 SHA512

NSIS installer

installer

afkvistningens.Mod

SHA256 7d3e8a0d6e1faf9e93bdad53a4239b212b5bc2fe16480fad20f0b1b82e5b2c79
MD5 f1d33a646fde602e180df5684d023e99
SHA1 71322e0bf74de3df2750aa40808ee9789fab07f2
SHA512 1c4018eb318cc469b03609b68613932c19668924b0ad2db96ec338f2c529f4029aa949a81b7d4d069003b425ede3a4fd2515bd90507adc3e36f6069c0adbd71e
SSDEEP 6144:qxW0pTNLpzOoCejL+DfDr1t7/mM3492zI9homvzxmzNX+BxSJ9pHfcVcQSg8c3Va:KeoCemf3RCH/twHfyVycp3JU
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

nabk/Counterindented/Loeber/kompleksiteter.duk

SHA256 20e248cbf9c5015f1599de32c9aca6a42762c88f52d44160e67acb20c4564757
MD5 38b79569625f238069ba16c3bcafc1d1
SHA1 452fd826f6ad94ba41b13352b05393f1ead91b98
SHA512 0262e1d8c31bfe76feb1df84274c4e2a5ebe34c4dad0f94c994ef21c7274d4702d0dd0d5f454162baaff72950dc6aad2e6ec9729209b6e7f8d5c87feaf46ebfe
SSDEEP 768:icexvu8ausLLPtegfaK/gVC/gEapWQ0maCxSSnCPrzzhUPiD:d0iCHc
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

nabk/Counterindented/Loeber/mellemvejs.all

SHA256 a285ecc2fb1e157da4e465714a49de2fd68d0166683cce07332921e1f9bd1f2b
MD5 3d75376ad75bbb08b7eeaba89229caf5
SHA1 2fc0d309f7f9a8a3551ad79ea9711ab3142a5a56
SHA512 f8bd0c4e1f1c8d05aea3a4b588bf32476c09e16ff63a99f41cb97477ad29cc1aca32158ad0a3bc2824912e4361ceed4d2af0d7101cfe4862c521b045eecc88d6
SSDEEP 768:vxohuCC8oSoeRK76agegVHVHguX4buwResIcYraMQIY7EkFnS2ocXquT4X+0Rhf7:AMoAqk7c9Ram
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

overlssendes/Hypotremata/Beramm/cheetah.man

SHA256 a78a5b11108ac3f3825dc74a95346fdc1ed568722ff0ebd70a15513ff306c2ac
MD5 ca25464163e5ab27a9ebb1d4917ed11a
SHA1 fec86e9472201d53dd134078144aeda4af052865
SHA512 37b22abc9827eb4490454611945420accf2e6ab6a4cd476e6b86ab9e61c54fe1ec3989cd865444ed5ccafcad81c72b04c6ea6d4eaede8707483c63c35e94ed36
SSDEEP 384:dU0dI2FFR/zWyBPPillB0hQXE1HLlU8XKy2dw7X6glwAx6U:d/9jVW5lB0hc2BUiRRx1
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

best.exe

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Belemnitidae167/Polemiskes/Instinkternes/bloke/skdehundens.ent

Belemnitidae167/Polemiskes/Instinkternes/bloke/termikker.bli

Belemnitidae167/Polemiskes/Instinkternes/bloke/trappegangs.abr

Belemnitidae167/Polemiskes/Instinkternes/bloke/tuttle.sme

Overblanch/Notarizes/Mousings/Strengtheners212/Chefkriminalinspektr219.Non

Overblanch/Notarizes/Mousings/Strengtheners212/Kahyt.che

Overblanch/Notarizes/Mousings/Strengtheners212/Udsultende.tax

Overblanch/Notarizes/Mousings/Strengtheners212/brawlers.trk

Overblanch/Notarizes/Mousings/Strengtheners212/caressingly.sve

Peptidases/opkaldsforsgets.txt

afkvistningens.Mod

nabk/Counterindented/Loeber/kompleksiteter.duk

nabk/Counterindented/Loeber/mellemvejs.all

overlssendes/Hypotremata/Beramm/cheetah.man

Sharing

General

Malware Config

Signatures

File Explorer

best.exe

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Belemnitidae167/Polemiskes/Instinkternes/bloke/skdehundens.ent

Belemnitidae167/Polemiskes/Instinkternes/bloke/termikker.bli

Belemnitidae167/Polemiskes/Instinkternes/bloke/trappegangs.abr

Belemnitidae167/Polemiskes/Instinkternes/bloke/tuttle.sme

Overblanch/Notarizes/Mousings/Strengtheners212/Chefkriminalinspektr219.Non

Overblanch/Notarizes/Mousings/Strengtheners212/Kahyt.che

Overblanch/Notarizes/Mousings/Strengtheners212/Udsultende.tax

Overblanch/Notarizes/Mousings/Strengtheners212/brawlers.trk

Overblanch/Notarizes/Mousings/Strengtheners212/caressingly.sve

Peptidases/opkaldsforsgets.txt

afkvistningens.Mod

nabk/Counterindented/Loeber/kompleksiteter.duk

nabk/Counterindented/Loeber/mellemvejs.all

overlssendes/Hypotremata/Beramm/cheetah.man