8e27b488a1e9ba920c1e7427ad51a5e9[.]exe

resource
8e27b488a1e9ba920c1e7427ad51a5e9.exe
unpack001/$PLUGINSDIR/System.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

8e27b488a1e9ba920c1e7427ad51a5e9.exe

IMPHASH b78ecf47c0a3e24a6f4af114e2d1f5de
SHA256 c5663a58153d79aeb1ed3cfcc7f87bddaa1952dfe536507eb95c0920b484742e
MD5 8e27b488a1e9ba920c1e7427ad51a5e9
SHA1 1db1fa1bdb5b6827522a09a2c368d15681fc5d66
SHA512 28015e1052cbe2da6abb8465e92d6af712cc61225e007ef61c914251b7af8c5ebcb2cc366e3a48b4bf9a5869783592277a3b7e595ab85f6a6c5ccaad05b788ca
SSDEEP 12288:47Y6YuDReX/2G28jR0vUrosU5iUXIIQkAsg:486YyReZjKvyU5fYIQkU
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12707

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetEnvironmentVariableA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA GetFileAttributesA SetFileAttributesA GetWindowsDirectoryA GetTempPathA GetCommandLineA lstrlenA GetVersion SetErrorMode lstrcpynA ExitProcess GetFullPathNameA GlobalLock CreateThread GetLastError CreateDirectoryA CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA ReadFile WriteFile lstrcpyA MoveFileExA lstrcatA GetSystemDirectoryA GetProcAddress CloseHandle SetCurrentDirectoryA MoveFileA CompareFileTime GetShortPathNameA SearchPathA lstrcmpiA SetFileTime lstrcmpA ExpandEnvironmentStringsA GlobalUnlock GetDiskFreeSpaceA GlobalFree FindFirstFileA FindNextFileA DeleteFileA SetFilePointer GetPrivateProfileStringA FindClose MultiByteToWideChar FreeLibrary MulDiv WritePrivateProfileStringA LoadLibraryExA GetModuleHandleA GetExitCodeProcess WaitForSingleObject GlobalAlloc

user32

ScreenToClient GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard PostQuitMessage GetWindowRect EnableMenuItem CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndDialog RegisterClassA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx GetDC CreateDialogParamA SetTimer GetDlgItem SetWindowLongA SetForegroundWindow LoadImageA IsWindow SendMessageTimeoutA FindWindowExA OpenClipboard TrackPopupMenu AppendMenuA EndPaint DestroyWindow wsprintfA ShowWindow SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA

advapi32

RegDeleteKeyA SetFileSecurityA OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges RegOpenKeyExA RegEnumValueA RegDeleteValueA RegCloseKey RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/System.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 fa4ab1d6f79fd677433a31ada7806373a789d34328da46ccb0449bbf347bd73e
MD5 3f176d1ee13b0d7d6bd92e1c7a0b9bae
SHA1 fe582246792774c2c9dd15639ffa0aca90d6fd0b
SHA512 0a69124819b7568d0dea4e9e85ce8fe61c7ba697c934e3a95e2dcfb9f252b1d9da7faf8774b6e8efd614885507acc94987733eba09a2f5e7098b774dfc8524b6
SSDEEP 192:OPtkumJX7zB22kGwfy0mtVgkCPOsX1un:/702k5qpdsXQn
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

9995

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Baadvogn/Philomelian182/Fortryl/plasmoma/Arbejdsformidlinger.Trs

SHA256 d9558d0abd9a8926b2a8ef04d38020d0057305cf58d122e8e90bc28a96aed24f
MD5 b1aaf506c8423060b607ac511bde29b1
SHA1 4a9071acf580b8f23bf9603d8d205fd4d1bf4560
SHA512 4c6b16e29b81fba5036f38646fb3dea6a26370a39a2fc75b9f5e17a74cacf34d6c47e3ce095b14e7e6f73f2eb6404e84529e24de2d7cf1d8c1383fc942ad1d30
SSDEEP 3072:prr5MJS88ep4MtMDtLOSabaN36x/qfPHEL0v4wwasflvjhTCC783T:vMS88eGMtGLOSaSqEEIt9mlbhuW83T
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

halvtredsende/Ambry38.ber

SHA256 04263a2cd5938d754e330e68f481aff266c840d0567b4e877f7f01213f575fff
MD5 c3d7de75a73dcb8b116c721493abe5b8
SHA1 01adc685dbbeb75a7e2df527e6411c54ff057c09
SHA512 325772a12793ee1150692700f071af9b843f2ad24218bbd836dc8cd448bc46320e0d734911ee30fff40a19b3aedbb7e8beb3d26685881eed20255ba99e10614e
SSDEEP 768:zDAO+rLt/7jx62DEgUosKRhahEonfnPQK/0mykfmCyetCONrbo7+5CZom:laLt/7jxFogU6q6oXQKsmykRCgrPRm
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

halvtredsende/Oft.Eft

SHA256 3b6f8c2b3c4c75bdf10823c621a7afda06038bf6cb0e5b968a79e9486f7280a0
MD5 87fd70b138250bfe2891ed976adcb30a
SHA1 a97c46344a289cc8d371547365b4e3fa5b10ba48
SHA512 724b00c5959b97ff74c2494bfbf927e849b64773df16e6cf42d36019ec7ef38aa242c821c22eda9a651e6f434cdc3b36ccf03a30ab0c227b5a95ca4318b6beb4
SSDEEP 1536:WIz9/8eBkS/SxkSFGK5S81ZQaojzZl8nqH/Zl0:Fh/8kk/3FGK5DGaojzZmnqRl0
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

swills.lvh

SHA256 df5ec22357e2e7a106a71d2ff5f353796683f71a8538a1028c3475905be51685
MD5 4a3d50bce4c63a0de1cad1e763da453c
SHA1 abf8ca2071742f4b6794166df3d4df612ab8468b
SHA512 04ac7c8c39bd752da4349e44b9897a1b4713926df31806c5299e1c732db410e635ded459b6642ea34e6d147814a9b67d9fb604daa279b79fae852dbbbe7c0281
SSDEEP 1536:vwIu8rxhRxOMORkpQa5oo8F0xwWrv4DTYbKAZq9/wg5x1a4z+l:vwIuaxOMORkR5NxwWrA34B6/n5m4Kl
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

tavser.txt

SHA256 e2a3d50c5394893aa367caaa7b4ae1a9eedf2394a0977125480adace01d5901f
MD5 bf2c1406598fb70a08d35a68e0aeca22
SHA1 defece00445e4f47f259bee48452819ceaf682dd
SHA512 ca9f89877b80afa621dfdf4d69528a09882e8394a743b279a2445ec6088e769eb4f716383b6d6a08537c5ac7777afbdee97f1a4c1e0ecbdac947198e0d18b62c
MD5 SHA1 SHA512

NSIS installer

installer