b7d46522ee8c0ffe6de6103eb3f98950[.]exe

resource
unpack001/$PLUGINSDIR/System.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

b7d46522ee8c0ffe6de6103eb3f98950.exe

IMPHASH 4f67aeda01a0484282e8c59006b0b352
SHA256 85d8e92aabc31f9bfb79a57bd4b7a7c49f26f696915e92608ead565b0dbf61d7
MD5 b7d46522ee8c0ffe6de6103eb3f98950
SHA1 58bd25f469df7077cdf091b17bcc150e98d9c9d3
SHA512 2efe5cffff0470419f8bff166280dae6f22db4777f34ac12b96ed04960e7fd8f3d16133f2608ba5d115ad01de09bd27be966904e297d2f7e58b924fda323f72d
SSDEEP 12288:go5vFoWiZBqQsQ7NKGxfq1dj+iyEOqETzqv:gojQgQsQ7NKGxfAdj+iyEOqPv
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

13:6e:2b:0f:d8:9e:52:98:5a:16:b9:35:67:c7:ce:d3:cd:4e:28:d1:98:9b:17:f4:4c:f7:e9:c5:3b:54:28:58

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Degenerately,OU=Bandboxes Convivialise Bdninger\ ,O=Degenerately,L=Roissy Charles-de-Gaulle,ST=Île-de-France,C=FR,1.2.840.113549.1.9.1=#0c12626c7265734043756973736172642e506172

Chains

Mar 21, 2024

PE Signature issue

Digest

a1:e7:1a:ba:fb:08:a4:f3:3c:7b:93:58:f0:f4:c6:19:7e:0f:7d:e3

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Degenerately,OU=Bandboxes Convivialise Bdninger\ ,O=Degenerately,L=Roissy Charles-de-Gaulle,ST=Île-de-France,C=FR,1.2.840.113549.1.9.1=#0c12626c7265734043756973736172642e506172

Chains

Mar 21, 2024

Minor OS version

0

Major OS version

4

Entry point

12991

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CopyFileA Sleep GetTickCount CreateFileA GetFileSize GetModuleFileNameA ReadFile GetFileAttributesA SetFileAttributesA ExitProcess SetEnvironmentVariableA GetWindowsDirectoryA GetTempPathA GetCommandLineA lstrlenA GetVersion GetCurrentProcess GetFullPathNameA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread GetLastError CreateDirectoryA CreateProcessA RemoveDirectoryA GetTempFileNameA WriteFile lstrcpyA MoveFileExA lstrcatA GetSystemDirectoryA GetProcAddress CloseHandle SetCurrentDirectoryA MoveFileA CompareFileTime GetShortPathNameA SearchPathA lstrcmpiA SetFileTime lstrcmpA ExpandEnvironmentStringsA lstrcpynA SetErrorMode GlobalFree FindFirstFileA FindNextFileA DeleteFileA SetFilePointer GetPrivateProfileStringA FindClose MultiByteToWideChar FreeLibrary MulDiv WritePrivateProfileStringA LoadLibraryExA GetModuleHandleA GetExitCodeProcess WaitForSingleObject GlobalAlloc

user32

ScreenToClient GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard PostQuitMessage GetWindowRect EnableMenuItem CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndDialog RegisterClassA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx GetDC CreateDialogParamA SetTimer GetDlgItem SetWindowLongA SetForegroundWindow LoadImageA IsWindow SendMessageTimeoutA FindWindowExA OpenClipboard TrackPopupMenu AppendMenuA EndPaint DestroyWindow wsprintfA ShowWindow SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA

advapi32

RegDeleteKeyA SetFileSecurityA OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges RegOpenKeyExA RegEnumValueA RegDeleteValueA RegCloseKey RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/System.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 fa4ab1d6f79fd677433a31ada7806373a789d34328da46ccb0449bbf347bd73e
MD5 3f176d1ee13b0d7d6bd92e1c7a0b9bae
SHA1 fe582246792774c2c9dd15639ffa0aca90d6fd0b
SHA512 0a69124819b7568d0dea4e9e85ce8fe61c7ba697c934e3a95e2dcfb9f252b1d9da7faf8774b6e8efd614885507acc94987733eba09a2f5e7098b774dfc8524b6
SSDEEP 192:OPtkumJX7zB22kGwfy0mtVgkCPOsX1un:/702k5qpdsXQn
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

9995

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Bagvrks/Preadoption/Bookmen/actinomycestal.cat

SHA256 b9d631a0fb356897d5449abcb9bfd2c123a9e41ee026357b2810c1106a2df851
MD5 81f99fade2b0f4c351b6064318378fd0
SHA1 838a64968505531c341af1ba5f7e3829a610a629
SHA512 55d264c2883bc3a3105c14f57a53a0c0b52568e043929971b1061bcf20813373a774480583c436defff260fb2faaa1f37863ac981f47a4e744ac39ad05411622
SSDEEP 768:CLwlLI3FJq9RFke59+q/eUC4ZRxcehvqSkTA2UpYTPAb37pMTMr7ntZx7HMJkIZL:Lj+AZo
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Enfierce/assimilationen/Tilsjoflings/stormomsuset.txt

SHA256 644e31c366983d46522f01384455733b7338cf074dddc18aa1c409fcc8bc33ce
MD5 75c85ba200f306a7ae73816a8a4f4837
SHA1 48fbe97390f84960e6b82180db76283804027cfe
SHA512 5d2cf8412b94ce6115302c1797f46bdcea4903b1478d022c35665ac582fdf66a7f22554c10f439752b8d683a392bc78868c847b1dc9620c5e35d477f6c70aef5
MD5 SHA1 SHA512

NSIS installer

installer

Slatterne199/Superciliousness245/Urigtigheds/Postterminalen.Kry

SHA256 1b03fbd86a5e43efb8aa7fe948b600af8f013758c1e3810df91f80815d6e529f
MD5 427681e37c40200536ac2baf239412da
SHA1 be7198ac4a9a4a8a0ff938ad2387f3de2aa3ca44
SHA512 490a4adae4795a8736b45897d2471983f4a195ebb7a602faf5aa51f9e1334cb4a2a2041eee76a7c9270b1b4e13e32ec727eea9414ff06e98c992fd4fd34ba598
SSDEEP 3072:SvNn8sYNxH7DrL94CrD23TIkRxaTp4jLo6//CMY87KB8F:UHAbDt4iiIkRxaCE6/zYIK2
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

amusiskes/Haikal/afvisers/Admiral/Teleslynger14.Pho

SHA256 018a04e1165497c75d7983e8a27988cc306eabd728f095bd1265a9f0dabef50e
MD5 12ebaddc6e48b4f653b1a4d8ed7010c2
SHA1 5864626fdee5d6a40b186777f16768f09a92d56e
SHA512 5cbf27908706e2265b30a33f6801f4cc1f46e1ac28cbf68bdfca24287fa70ef57d2e02b0db436ec022bd503cd97e3c896935c9b1e7a7c95567ee47825afbdce5
SSDEEP 3072:jqk9K0sjXKxz7wFJ4+kYm2Z39AilZCujRNzSD2UpdetBxTzxYq/cQ4Ct:jqk9KW7wF6CTNASCujPS6UpIxJb/V4E
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

amusiskes/Haikal/afvisers/Admiral/Tjenerne0.vin

SHA256 20ca4da3ae873ff168549fbac290f9bf112b2d3591e81f903e37f181eafe1876
MD5 07b957bd110c638ed905fd2041e2b35f
SHA1 2a052dc803d5f35a06c80a7eecd29c1fe43de04d
SHA512 b7a56f6e3f64f4cd9ce2029631d69de8c61c64c3d60b1a6417d0963c94ed1a78f548e8da253e15f9ce65390a45457bc7fde3cf710ef750b5f99346512442e3c0
SSDEEP 768:12nkTSH71kzl0uyvTYaITWstxKXvYioLLigr65RTaQ:LMP
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

microsporic/Nonfertility183/befalingernes.har

SHA256 5339680e9a8e9652deac14fd14b642dced15833900b3e352e5a9888006f5f081
MD5 4a03c5273b70bd69176df1d397135f59
SHA1 dbc60a0533426d25c5de7d32a83946f2a3ebcb13
SHA512 bcb059a4838f33de4433bacbdd6d5eb661e638be9a78e897e8a39166fb2591570d2d6d2383d66a06485aebb233a7d7a75216238c513598bde301b62eceec8fcc
SSDEEP 768:MF7I8gvUV6e3kY1NKRjIzwGpcG2H10jagHGbRAoLGkIREve0zg2VmNkNWLWGtJdg:ppQzZ
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

b7d46522ee8c0ffe6de6103eb3f98950.exe

PE Signature issue

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Bagvrks/Preadoption/Bookmen/actinomycestal.cat

Enfierce/assimilationen/Tilsjoflings/stormomsuset.txt

Slatterne199/Superciliousness245/Urigtigheds/Postterminalen.Kry

amusiskes/Haikal/afvisers/Admiral/Teleslynger14.Pho

amusiskes/Haikal/afvisers/Admiral/Tjenerne0.vin

microsporic/Nonfertility183/befalingernes.har

Sharing

General

Malware Config

Signatures

File Explorer

b7d46522ee8c0ffe6de6103eb3f98950.exe

PE Signature issue

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Bagvrks/Preadoption/Bookmen/actinomycestal.cat

Enfierce/assimilationen/Tilsjoflings/stormomsuset.txt

Slatterne199/Superciliousness245/Urigtigheds/Postterminalen.Kry

amusiskes/Haikal/afvisers/Admiral/Teleslynger14.Pho

amusiskes/Haikal/afvisers/Admiral/Tjenerne0.vin

microsporic/Nonfertility183/befalingernes.har