9f2830a19edaacf690e6626e58b201d747a5a510777e5e92acf42a4efd28ddb6[.]exe

resource
unpack001/$PLUGINSDIR/nsExec.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

9f2830a19edaacf690e6626e58b201d747a5a510777e5e92acf42a4efd28ddb6.exe

IMPHASH e160ef8e55bb9d162da4e266afd9eef3
SHA256 9f2830a19edaacf690e6626e58b201d747a5a510777e5e92acf42a4efd28ddb6
MD5 02afc0eb91235f176b47b0ed15f67400
SHA1 9c8acd9adc953a945289009712cb089ce58a3ed0
SHA512 bdfb8bdaf58df9a5f280e98c73778c61bc0f88c27b44eb5d2a510382e5b76bd902ecc5664363a38b96871e897f3c7cb045d85ed6157f762a7dba37e86175bce4
SSDEEP 12288:bi9a8F9k3rDCkCQ6mAuy5+IQUoCmGJZxGZVmn4yCa:R8F9cvbX6QGtGZEnf
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

a4:2b:07:60:14:6f:91:bf:36:4b:20:96:e1:4f:1d:70:5c:fb:54:04:d4:ed:59:bf:54:bf:d5:dd:dc:72:8f:35

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Unchloridised,OU=Billys Nitrolamine\ ,O=Unchloridised,L=Dechy,ST=Hauts-de-France,C=FR,1.2.840.113549.1.9.1=#0c1441676c65616640416c626572746973742e446961

Chains

Feb 29, 2024

Minor OS version

0

Major OS version

4

Entry point

12470

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetTickCount GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA SearchPathA GetShortPathNameA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess SetEnvironmentVariableA GetWindowsDirectoryA GetTempPathA Sleep CloseHandle LoadLibraryA lstrlenA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA ReadFile lstrcpyA lstrcatA GetSystemDirectoryA GetVersion GetProcAddress GlobalAlloc CompareFileTime SetFileTime ExpandEnvironmentStringsA lstrcmpiA lstrcmpA WaitForSingleObject GlobalFree GetExitCodeProcess GetModuleHandleA SetErrorMode GetCommandLineA LoadLibraryExA FindFirstFileA FindNextFileA DeleteFileA SetFilePointer WriteFile FindClose WritePrivateProfileStringA MultiByteToWideChar MulDiv GetPrivateProfileStringA FreeLibrary

user32

CreateWindowExA EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard GetDC SystemParametersInfoA RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx DestroyWindow CreateDialogParamA SetTimer GetDlgItem wsprintfA SetForegroundWindow ShowWindow IsWindow LoadImageA SetWindowLongA SetClipboardData EmptyClipboard OpenClipboard EndPaint PostQuitMessage FindWindowExA SendMessageTimeoutA SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA

advapi32

RegCloseKey RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegEnumValueA RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

CoCreateInstance CoTaskMemFree OleInitialize OleUninitialize

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/nsExec.dll

IMPHASH 6b7d154c806f1e47db325229c300c6df
SHA256 030bcfa82e3bb424835a5fa53a3ff17ab08557d3bbeea4815313036fc4bdafe1
MD5 14f5984b926208de2aafb55dd9971d4a
SHA1 e5afe0b80568135d3e259c73f93947d758a7b980
SHA512 e9ec97dd57ead871789d49ed38d9fde5f31d3cb2547810cae49a736e06b9f9b28cf8efea825eb83c3e07d880ee798abfb9069c6957416d5973c83e4531814e27
SSDEEP 96:k7GUaYNwCLuGFctpiKFlYJ8hH4RVHpwdEeY3kRlDr6dMqqyVgNJ38:Wygp3FcHi0xhYMR8dMqJVgN
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4231

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Begribelsen/Epipastic/Barbarised/Chevaline/Future.Flo

SHA256 09b8f34e5abe29c9d70156565e5d51a56f19c274bdca6665206913c84cb31cf1
MD5 e98a9f283fd7e776968858c6a4bc056a
SHA1 1ca41075f63005639941cfed3b590728083a9cde
SHA512 0faf2457a691bea75edadb460ffc7cf683eb91bdbe4a16c247630837d204be7b6e773fee970480b233d27bc5340481643cca38b0a52837e322285c905ff46bfb
SSDEEP 6144:IU+fCX7Jl2ZMrsp7tgK1TBNxM+Hf6+GquYu2mdrovPSfVd9QZtT:IUEO/2RNhL4Yf3UovqfVd9QZd
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Seychelliske/brandbar/Choktilstandens.Max

SHA256 ef2884aa50d62da1aae7a8822741cfe349d6a2fbead3af48698b5a75f0984842
MD5 24331b1a54b51979a5d15264c3e8ce92
SHA1 b59076231f0c495f0588d8aa5c9c2af74428a23d
SHA512 5a909fe7b46c97b16e99b979de89f7ba3986b96f6e20daef0cb89f39a7e8b4dd2e3829de91f06ef2900d1b5021d23c80407bb41903cac1700dc1690d52738616
SSDEEP 768:3anLEjThLL+4z+2ImC+8OCJirt+IDxIFdP/I6zmhQo6O8NbvQpCCwifW1IAxpwU:3aLEnh5c+o2tTVIw6zpBO8NspLf0L
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Tegltkkedes/Eventuate.fal

SHA256 1208680b59c4f0728109be49f80ab8c7af95a003422ccfdd245414ca0cc9d875
MD5 ccc2c62fb147ca7948bff7639d3a3596
SHA1 092923785259525ed71f9b5e4210a22ff9e07253
SHA512 ee3504a5b463afe4e2eefec7ed237d5908635bba2da72c6e2d3ca2057d0a5bf8717f62bb77a8b1ae3c0b47097dd94ef350664b3a875c68e0141c23c675d3b462
SSDEEP 3072:MSaQOg8zBGmDfuJr+SLyq4yzi4KnWWJvfvC0LTSSV:Gg8zB5uJrhyq4yG4KXvfa0LmG
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Tegltkkedes/Ju93.uds

SHA256 da1673384a48932de1dd4bae02cb297efcbb7d50eda732b80ce2196a14aac1f3
MD5 c29c563a6ec8b832276c1dc772f1133e
SHA1 20f668ab8d9ea06b82c0da7af9647b63c601a6bb
SHA512 ad96faf3dbeaaa1c01d5928ea9507eb131f2ba27ddc2429bdb2d093e3bc248dc2fadd984325f0c6f58911a56ee4b61f632beb66538818bff0b606ba14810b224
SSDEEP 768:2YUOIhRUk3iVNOzI9sgaKvVcqAtBORlhT1Jz3MiDpeFKXn4RmeMK1c+7gBWaEVy:2YXIhRUUcsPKqqmBCFZiOsm5RCgBWaEg
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Tegltkkedes/udtappedes.txt

SHA256 1d55b088170dd0d0aa6e0d699655770436f41ee8784d29f2efbf501c33685b32
MD5 cf99ec22e9d9a7448356db7c87bacdda
SHA1 b6221645399e1034bbb4a592d1f365248522000b
SHA512 8ae088bd4dc005ad400185fa5a14312d29baede495a5eb2591254dbe3df5574ed8167e42f0e651b2522912e43943aeb239d5426dc3ef885e13eb83eb72426342
MD5 SHA1 SHA512

NSIS installer

installer

unbarb.upf

SHA256 f4b9aac7528a3c7dbfc3c01aa8d8003757ebb8b9e68eeedd84a832d9eb1e5704
MD5 ca647f553fad20280a7e6850686c0816
SHA1 f1156a24bf63a3ed50b5d8df903aa2b3beeb6f82
SHA512 1ed1339a344d8268efe7ecd89f472ed1763237fc6327d2d4bb837bcf69785ff61ea1ff5bd02d2b818256ba71ccb38691a4c635fd6d79e1a64675bdd46b74ba9c
SSDEEP 768:1S5J1pOsR4FvFMXc13/GvCOFJlLINjaZvIXMJ4U23U6yNnqT:1cJ1M1A41OTl8E6DUKU9NnqT
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

9f2830a19edaacf690e6626e58b201d747a5a510777e5e92acf42a4efd28ddb6.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/nsExec.dll

kernel32

user32

advapi32

generic

Begribelsen/Epipastic/Barbarised/Chevaline/Future.Flo

Seychelliske/brandbar/Choktilstandens.Max

Tegltkkedes/Eventuate.fal

Tegltkkedes/Ju93.uds

Tegltkkedes/udtappedes.txt

unbarb.upf

Sharing

General

Malware Config

Signatures

File Explorer

9f2830a19edaacf690e6626e58b201d747a5a510777e5e92acf42a4efd28ddb6.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/nsExec.dll

kernel32

user32

advapi32

generic

Begribelsen/Epipastic/Barbarised/Chevaline/Future.Flo

Seychelliske/brandbar/Choktilstandens.Max

Tegltkkedes/Eventuate.fal

Tegltkkedes/Ju93.uds

Tegltkkedes/udtappedes.txt

unbarb.upf