6000507958[.]exe | Triage™

resource
6000507958.exe
unpack001/$PLUGINSDIR/nsExec.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

6000507958.exe

IMPHASH 5f0c714c36e6cc016b3a1f4bc86559e4
SHA256 1ae1583b2be5c21f228a0e925652c9f5013bddf699548ca39b02670576325010
MD5 e0d35d2fe887cbe0b4de87f1be7d7a17
SHA1 b37f59b0ec54d6c40645837dbb3a18c954346601
SHA512 9d20fd479a57ccf51c02830744f095b5dfa98707777a8f24968aa0f0e9ac2a4de4ae348831a001b00cae9d750b9372a85248fdd15570a44ca52b90f8cf451256
SSDEEP 12288:8stfWr2z5t/dtpQBEd6XT9Pi8RzDm+EYRfT7d+:8st+r2z5J9Pd6XT9Pi85REYpT7d+
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

13235

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCreateKeyExA RegEnumKeyA RegQueryValueExA RegSetValueExA RegCloseKey RegDeleteValueA RegDeleteKeyA AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken SetFileSecurityA RegOpenKeyExA RegEnumValueA

shell32

SHGetFileInfoA SHFileOperationA SHGetPathFromIDListA ShellExecuteExA SHGetSpecialFolderLocation SHBrowseForFolderA

ole32

IIDFromString OleInitialize OleUninitialize CoCreateInstance CoTaskMemFree

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

SetClipboardData CharPrevA CallWindowProcA PeekMessageA DispatchMessageA MessageBoxIndirectA GetDlgItemTextA SetDlgItemTextA GetSystemMetrics CreatePopupMenu AppendMenuA TrackPopupMenu FillRect EmptyClipboard LoadCursorA GetMessagePos CheckDlgButton SetWindowPos SetCursor GetSysColor SetClassLongA GetWindowLongA IsWindowEnabled GetWindowRect GetSystemMenu EnableMenuItem RegisterClassA ScreenToClient EndDialog GetClassInfoA SystemParametersInfoA CreateWindowExA ExitWindowsEx DialogBoxParamA CharNextA SetTimer DestroyWindow CreateDialogParamA SetForegroundWindow SetWindowTextA PostQuitMessage SendMessageTimeoutA ShowWindow wsprintfA GetDlgItem FindWindowExA IsWindow GetDC SetWindowLongA LoadImageA InvalidateRect ReleaseDC EnableWindow BeginPaint SendMessageA DefWindowProcA DrawTextA GetClientRect EndPaint IsWindowVisible CloseClipboard OpenClipboard

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateFontIndirectA CreateBrushIndirect DeleteObject SetTextColor SelectObject

kernel32

GetExitCodeProcess WaitForSingleObject GetProcAddress GetSystemDirectoryA WideCharToMultiByte MoveFileExA ReadFile GetTempFileNameA WriteFile RemoveDirectoryA CreateProcessA CreateFileA GetLastError CreateThread CreateDirectoryA GlobalUnlock GetDiskFreeSpaceA GlobalLock SetErrorMode GetVersionExA lstrcpynA GetCommandLineA GetTempPathA lstrlenA SetEnvironmentVariableA ExitProcess GetWindowsDirectoryA GetCurrentProcess GetModuleFileNameA CopyFileA GetTickCount Sleep GetFileSize GetFileAttributesA SetCurrentDirectoryA SetFileAttributesA GetFullPathNameA GetShortPathNameA MoveFileA CompareFileTime SetFileTime SearchPathA lstrcmpiA lstrcmpA CloseHandle GlobalFree GlobalAlloc ExpandEnvironmentStringsA LoadLibraryExA FreeLibrary lstrcpyA lstrcatA FindClose MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA SetFilePointer GetModuleHandleA FindNextFileA FindFirstFileA DeleteFileA MulDiv

$PLUGINSDIR/nsExec.dll

IMPHASH e269b6260a93a17ceff5184b3982ded8
SHA256 10675f13abaee592f14382349aa35d82fb52aab4e27eef61d0c83dec1f6b73da
MD5 5aa38904acdcc21a2fb8a1d30a72d92f
SHA1 a9ce7d1456698921791db91347dba0489918d70c
SHA512 f04740da561d7cd0dea5e839c9e1c339d4a3e63944d3566c94c921a3d170a69918a32dff3f3b43f13d55cc25a2dbb4c21104f062c324308ac5104179766402a3
SSDEEP 96:AOBtEB2flLkatAthPZJoi9jpfW/er6cBbcB/NFyVOHd0+uHwEX:AhB2flXAVJtjf6cBbcB/N8Ved0PZ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4231

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Devenustate/Accorder/Uncoincidental/Incurvity.eft

SHA256 02e8b4c4053f7f4352c533a46471ab963a86a8156267cdffeb74c0374d2c4c79
MD5 465454d4effb2dd4458e8032988455d0
SHA1 3afe548209cfe0721b65fbd2b4b6019354d0d59f
SHA512 c4a6031758908fe6b48046ab25f88a8983e63c95a6d94542a4e8812d172009f72020a842ee92f42742f15665eaed3e20cd6cf3cd2f166b7ceb2306ffbcceef3d
SSDEEP 1536:cbcsE1JLvUbYpjrIG+BeyZkMnLf8GvkVCG4Sn47Nqjd8FQ4X6g+0M4vY5ByetfAs:cb41xvGYBhKNZkMn7bvkYG4UE76gA5BT
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Overenstemmelse/Conferree/Emption/Metropolis/indhuggene.sex

SHA256 b71330891ecc7e46ae3bff434dcc8659b106415d0efc2c4d6e61811ac9f58d2f
MD5 f4ce6c53ffb5533a5dab605e98eb4067
SHA1 2d1a46b2cf7c902bdc6b5d6fda59e5ea899949ee
SHA512 c47ba80c126da2a527cd090322786c3f0b58fb6c6f285275e60d0b95fae8804559c242ce8f35cf7a23753624f994b0ddcaf2dc19203b7237da3b0c45cf6934a9
MD5 SHA1 SHA512

NSIS installer

installer

Overenstemmelse/Conferree/Emption/Metropolis/syringitis.sei

SHA256 75b6002232106fa6ba35b5554270461e0431d11eea7d67adbad2651d19790a20
MD5 65afa39b0e2935fd0f0eaae9934a09ec
SHA1 6d7c896c9825809046862695877eb88c3248c6f8
SHA512 732a14fcab8e7845b239930fdc3cc1bef2b08ab06b740d6931cdc2f352c7505bd5e26f6db820771089664bdd2ae9347b20e1bb769abb5c60a472b1240d35df6a
MD5 SHA1 SHA512

NSIS installer

installer

Radiologist/Heptarchist/Microtine76.txt

SHA256 d70b7e5a8fdc7ac864455470d282565fe41a3f0937d8f89a85d30bbb93b59f12
MD5 7cb24dded50a9f89bb5d62f961802f20
SHA1 2f21f643fa1501a90b01ce1702e53c32c0ef56fc
SHA512 ef7758a566578eeabe3ad92047f01fbd4d38549d505d943ab1a2ae73bb5a077f53e9a36ab1d0bdd795f560d89ac86eb3aa3ba881aff1d942bb308ba5217f1675
MD5 SHA1 SHA512

NSIS installer

installer

Ringspinderne.Eks

SHA256 698751c6b65fa692eace874966db90257c8166210c739be6d00a35053a30f2fa
MD5 3295c50e6679be9cda4405ea4aece7bb
SHA1 6361360fef5d23ee39c4ea42ea48d00e5952ad9a
SHA512 b21f13cecb5c481ca1d951847a4b54881b37c868ada0d54b39d2e784a7fc8acac7d56be1063c2090a053400fe0f149b5450d5afa840153f234ff3f08770bdcf6
SSDEEP 6144:ZeChrURjiUMHwYlPDUqL+OOm+zYxwYmGjUTWdsDxu+DT:L2jiUGw2RLnS/Y5gWeE+/
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

6000507958.exe

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/nsExec.dll

advapi32

user32

kernel32

generic

Devenustate/Accorder/Uncoincidental/Incurvity.eft

Overenstemmelse/Conferree/Emption/Metropolis/indhuggene.sex

Overenstemmelse/Conferree/Emption/Metropolis/syringitis.sei

Radiologist/Heptarchist/Microtine76.txt

Ringspinderne.Eks

Sharing

General

Malware Config

Signatures

File Explorer

6000507958.exe

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/nsExec.dll

advapi32

user32

kernel32

generic

Devenustate/Accorder/Uncoincidental/Incurvity.eft

Overenstemmelse/Conferree/Emption/Metropolis/indhuggene.sex

Overenstemmelse/Conferree/Emption/Metropolis/syringitis.sei

Radiologist/Heptarchist/Microtine76.txt

Ringspinderne.Eks