DHL INTERNATIONAL AWB#87355432189 PDF[.]exe

resource
unpack001/$PLUGINSDIR/System.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

DHL INTERNATIONAL AWB#87355432189 PDF.exe

IMPHASH b78ecf47c0a3e24a6f4af114e2d1f5de
SHA256 d4965c645437bdfb5eaf7eed2175fe89501fd437bede13cc91de0f36a3c745cd
MD5 56be22ccd46d1f1ea43ff693729eced3
SHA1 875df1a72db7bdab88e38d240b62cefd6683203d
SHA512 cad055009f45da6f2b2181786c2e36d12686c9904e38a8e0e81bf134f6f51659e320f3b5da225f5c670c95c56a4784e565235520d128ec4e4d2f2a6310acfadb
SSDEEP 24576:3tqRLCyDRdM0SwcSYVPnthjXokXNcdE4q:dqRrDRbv8/tKZd+
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

df:bb:ab:33:1c:4e:c1:5f:ff:d5:95:b9:b3:a5:34:2c:5e:78:40:b1:17:29:b1:4a:b2:c8:68:ef:5a:bf:1f:20

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Ernringsprofessor,OU=Stereoen Islttene thorunns\ ,O=Ernringsprofessor,L=Mc Gregor,ST=Texas,C=US,1.2.840.113549.1.9.1=#0c27466f7273616d6c696e677366726968656465726e654052616e646f6d69736174696f6e2e546e6b

Chains

Feb 7, 2024

Minor OS version

0

Major OS version

4

Entry point

12653

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetEnvironmentVariableA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA GetFileAttributesA SetFileAttributesA GetWindowsDirectoryA GetTempPathA GetCommandLineA lstrlenA GetVersion SetErrorMode lstrcpynA ExitProcess GetFullPathNameA GlobalLock CreateThread GetLastError CreateDirectoryA CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA ReadFile WriteFile lstrcpyA MoveFileExA lstrcatA GetSystemDirectoryA GetProcAddress CloseHandle SetCurrentDirectoryA MoveFileA CompareFileTime GetShortPathNameA SearchPathA lstrcmpiA SetFileTime lstrcmpA ExpandEnvironmentStringsA GlobalUnlock GetDiskFreeSpaceA GlobalFree FindFirstFileA FindNextFileA DeleteFileA SetFilePointer GetPrivateProfileStringA FindClose MultiByteToWideChar FreeLibrary MulDiv WritePrivateProfileStringA LoadLibraryExA GetModuleHandleA GetExitCodeProcess WaitForSingleObject GlobalAlloc

user32

ScreenToClient GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard PostQuitMessage GetWindowRect EnableMenuItem CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndDialog RegisterClassA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx GetDC CreateDialogParamA SetTimer GetDlgItem SetWindowLongA SetForegroundWindow LoadImageA IsWindow SendMessageTimeoutA FindWindowExA OpenClipboard TrackPopupMenu AppendMenuA EndPaint DestroyWindow wsprintfA ShowWindow SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA

advapi32

RegDeleteKeyA SetFileSecurityA OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges RegOpenKeyExA RegEnumValueA RegDeleteValueA RegCloseKey RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/System.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 fa4ab1d6f79fd677433a31ada7806373a789d34328da46ccb0449bbf347bd73e
MD5 3f176d1ee13b0d7d6bd92e1c7a0b9bae
SHA1 fe582246792774c2c9dd15639ffa0aca90d6fd0b
SHA512 0a69124819b7568d0dea4e9e85ce8fe61c7ba697c934e3a95e2dcfb9f252b1d9da7faf8774b6e8efd614885507acc94987733eba09a2f5e7098b774dfc8524b6
SSDEEP 192:OPtkumJX7zB22kGwfy0mtVgkCPOsX1un:/702k5qpdsXQn
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

9995

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Mataco/Fatamorganaernes/Cheap/Attributed.Dis

SHA256 4b80842c32911b047b8b680e7bfea7853726b5f1f04bbcc1cf7bd312c1b57ac8
MD5 45a0a017ff6c2af46f5b897e866e585f
SHA1 c4365c268782b0bc646f27e131c3c95e91335ff7
SHA512 a15a0adab80bdaf2ea7e85d4b81cb41014156cfa583f326ce29126495280c05b1adb7663f86976dfe282d2daefe7a06ea71d62a0af0c4ad35ad3f0ad4ecb03a6
SSDEEP 3072:tGJEyDzPZqVclUQBrJV/J7e9pluKgrGMd8IR4aEV2HCMsKVd8mXn:tuEu9EE7/hCpl5uxao2V21f3
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Mataco/Fatamorganaernes/Cheap/Unpropagandistic.uno

SHA256 255dbfdcbc55156482cfe58a6dca6da57c25db8c7df3cb4294dbc2de4df1b553
MD5 6f7c5f3ff4bb80dd1c676727e001f429
SHA1 0796a9af31f18fdd38a1ea87509fce154847dc65
SHA512 6b0f3094b4efe9fd5c65cc5c7994956ebb767c64cb61e6367b967d91fafa8cd4ad255f71d4a6ddc5495713d2c19570175a24ea3734e07034c1000eb10f4c9924
SSDEEP 6144:GtqgTWglCid3EPaN+URJSBGcsppGmb7FhD7oRStTqHVl2PNMQv7iLZJhhk:0tBlCid3PNTf/sCqDkiLI
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Mataco/Fatamorganaernes/Cheap/diple.txt

SHA256 3bb2f3c6825c05af7e5452eaa8858323e0ac1bc1469179713825868702b6375d
MD5 80f325e0a3335981a0cd21515b1d169a
SHA1 50f06178ffcb2f84d55b3c873d028144974d75eb
SHA512 8e5544fa2c568c7afd2fc831f957095197438661f8c42d982c431ec98d73b33110afc3bacd675283b19a19a2b24752cdc9cc70830c8e74324136393b81d2302e
MD5 SHA1 SHA512

NSIS installer

installer

Mataco/Fatamorganaernes/Cheap/kraka.gea

SHA256 78b6e0f7c0622bcbe10175b24b7564f85d4a2c1287edcc7c3a29a6163da6bddd
MD5 3e45efedc4588ab6c71597f5cd684147
SHA1 0f0942a7b219745b4fabc58f1a9f173ed060cfe4
SHA512 87dd8807489dae8438105824212feef16c6d768f270c272a1c3d61ba15029cc40fe2ef9f3d6cf5e22c1d6442055095ef0ff971e8c3f204b9523b31197270437e
SSDEEP 3072:kSM1O7CgXuSxkbuDtheIQhfPT4Nw50xTN:kSIO7CMkSRxQhfcDTN
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Stenalderbopladser/Toffee/voltzine.eft

SHA256 0a80ab3ae1e0c181d54d6d2badf86d5de8a99ac5d53e66a79bd8c1b4d822156e
MD5 ac902aff7576c77c0a8aa4da6af56340
SHA1 8fa154800a638a20553b33293d1ae1777f2c4063
SHA512 94454316ed179881a8dfafd7c0e1e3cd9b8f6612e924c0434c42fb931a1b0082c06a0fc8c1824d003a10788785fab883af6190480dcc3ff0b2d05bf792edcf00
SSDEEP 6144:B9/PNNVl1Dalh4LjWu2ZagiT1b9jNGR1rjAdtMw0VQt7NI3Gv8PC25kn:X/VAGjWu/vNyCGVQrkK2g
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

DHL INTERNATIONAL AWB#87355432189 PDF.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Mataco/Fatamorganaernes/Cheap/Attributed.Dis

Mataco/Fatamorganaernes/Cheap/Unpropagandistic.uno

Mataco/Fatamorganaernes/Cheap/diple.txt

Mataco/Fatamorganaernes/Cheap/kraka.gea

Stenalderbopladser/Toffee/voltzine.eft

Sharing

General

Malware Config

Signatures

File Explorer

DHL INTERNATIONAL AWB#87355432189 PDF.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Mataco/Fatamorganaernes/Cheap/Attributed.Dis

Mataco/Fatamorganaernes/Cheap/Unpropagandistic.uno

Mataco/Fatamorganaernes/Cheap/diple.txt

Mataco/Fatamorganaernes/Cheap/kraka.gea

Stenalderbopladser/Toffee/voltzine.eft