Bordbns[.]exe | Triage™

resource
unpack001/$PLUGINSDIR/System.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

Bordbns.exe

IMPHASH b78ecf47c0a3e24a6f4af114e2d1f5de
SHA256 b1ab36e342ada65f2ba8ebc069b3e6ab1c51c0a092e09addb8f3408cf8fbdf8a
MD5 fb5601dbb8729e3c028897e81f8a6561
SHA1 6c8f48c6fa37b84c11f477dfc1699e1f4d19cc08
SHA512 c412e4d4ed38459b2ba3a7a01b15825c0dc5b7e7b230b1bff4f279183b72ec8bd3b73de0e256ddc6b1251afee8bdb626b49d6e24ca56efeb1390be0bca946870
SSDEEP 6144:nyINO+ZYJH4Zbnqd5+yDKi9h8jRp7UWTvr3+KgerLQ82MbB7FPpHJkx:3FCJH4N9yD9hMvUWTvr3+KgALQ8/NJi
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

e1:5f:71:4a:74:18:79:ef:94:b1:de:f1:1c:1b:38:d5:97:c4:04:e2:f7:c9:ea:b7:72:f4:47:33:b7:fc:66:f2

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Libelist,OU=Usufruit Juleller\ ,O=Libelist,L=Struthers,ST=Scotland,C=GB,1.2.840.113549.1.9.1=#0c1c4f766572656c6567616e7440436f6e7465726d696e6f75732e536b61

Chains

May 3, 2024

PE Signature issue

Digest

01:01:17:eb:d6:82:c1:bf:28:0f:5e:a5:15:a1:71:ae:7b:23:7e:70

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Libelist,OU=Usufruit Juleller\ ,O=Libelist,L=Struthers,ST=Scotland,C=GB,1.2.840.113549.1.9.1=#0c1c4f766572656c6567616e7440436f6e7465726d696e6f75732e536b61

Chains

May 3, 2024

Minor OS version

0

Major OS version

4

Entry point

12672

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetEnvironmentVariableA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA GetFileAttributesA SetFileAttributesA GetWindowsDirectoryA GetTempPathA GetCommandLineA lstrlenA GetVersion SetErrorMode lstrcpynA ExitProcess GetFullPathNameA GlobalLock CreateThread GetLastError CreateDirectoryA CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA ReadFile WriteFile lstrcpyA MoveFileExA lstrcatA GetSystemDirectoryA GetProcAddress CloseHandle SetCurrentDirectoryA MoveFileA CompareFileTime GetShortPathNameA SearchPathA lstrcmpiA SetFileTime lstrcmpA ExpandEnvironmentStringsA GlobalUnlock GetDiskFreeSpaceA GlobalFree FindFirstFileA FindNextFileA DeleteFileA SetFilePointer GetPrivateProfileStringA FindClose MultiByteToWideChar FreeLibrary MulDiv WritePrivateProfileStringA LoadLibraryExA GetModuleHandleA GetExitCodeProcess WaitForSingleObject GlobalAlloc

user32

ScreenToClient GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard PostQuitMessage GetWindowRect EnableMenuItem CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndDialog RegisterClassA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx GetDC CreateDialogParamA SetTimer GetDlgItem SetWindowLongA SetForegroundWindow LoadImageA IsWindow SendMessageTimeoutA FindWindowExA OpenClipboard TrackPopupMenu AppendMenuA EndPaint DestroyWindow wsprintfA ShowWindow SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA

advapi32

RegDeleteKeyA SetFileSecurityA OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges RegOpenKeyExA RegEnumValueA RegDeleteValueA RegCloseKey RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/System.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 fa4ab1d6f79fd677433a31ada7806373a789d34328da46ccb0449bbf347bd73e
MD5 3f176d1ee13b0d7d6bd92e1c7a0b9bae
SHA1 fe582246792774c2c9dd15639ffa0aca90d6fd0b
SHA512 0a69124819b7568d0dea4e9e85ce8fe61c7ba697c934e3a95e2dcfb9f252b1d9da7faf8774b6e8efd614885507acc94987733eba09a2f5e7098b774dfc8524b6
SSDEEP 192:OPtkumJX7zB22kGwfy0mtVgkCPOsX1un:/702k5qpdsXQn
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

9995

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Aragonspath.txt

SHA256 2e56dc8612cc97bf7a6bf4efc14480cdbc3d56af2ed8df18ef54e0882509701c
MD5 85496a03852e001a8373b1c949de3801
SHA1 10fc15070efe0bf4461bb8c95ccc5a5a4c2fcb44
SHA512 71cc130461ede5ac09fe3fb610e8041aca99ff8906180e7759909901ca13858289472806cbde1e6eb7808b7939189790b2b6882dc2c72155f022df6cd88d944e
MD5 SHA1 SHA512

NSIS installer

installer

Tandemmernes.Sma

SHA256 932aa39fcfe7d945cb1b7c21c615e6778b0f1f48c429b86a2cd2df3274a74212
MD5 1f24705daee8603b8d60f276e0cc1be0
SHA1 7b6d90df02d15368478466efbc07266d2165b8c8
SHA512 94c707d078caa464eac8a7f8d93e215d5f258840f4ee4560dab5bb1b3de19b34b13a6d2881c54a3ec050f0bc238bdc0ac50cab62f764d22ef91d9c40d906660d
SSDEEP 3072:1v8KG9Veq8JF7xmyHEG4gOPJEE3ECZqiOXFfTPwWBQSjpkNFeJl0HngqdWTSZ9Vf:1zeVF83xEEKMiOXFTpBm19RXW2
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

cambrics.reb

SHA256 bc1d9684c776ca490944b1df273d09de2f6d14739f43de15697d4641ef276332
MD5 2d6feaa1f83349c9528084b0e5349256
SHA1 96d29af9d634c59317c822572e169e553e0d4631
SHA512 bdfc7b7d08b23c5577da19cfdc97ca84cef11aad9f2bb1491b6ff98316c3c37c743396a8b793d03782a1e2605741f3c266165b1ce316fbd695e07101b7120ccd
MD5 SHA1 SHA512

NSIS installer

installer

fodboldbanernes.Kor

SHA256 04f069845642ae2f81c1ed669c4ab7f466f716e0ac22e6ee7ad937ee2dd8f273
MD5 713622e9b625f807905ceab21f3d19a1
SHA1 47d7bf8c2575a24410cef93b618b651d67a940d0
SHA512 1a68897ed3f7a73a2e5559594fe0323c4ab41ef65451800a9c492808efdb8ca73fe6ffa0bd5bc5fecb6f6b73f5d32f08eb8aed70b732e37e3ab365003f0c1c8a
SSDEEP 3072:oLGaMdQFcbmdiLDua4LPLEYpzp+pbxteO:oiSO2wwLxlpeeO
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

formuerettens.twa

SHA256 032d9f554a3029d2f4c6608bac49da736e7a52912abd276028aa374916cb1a8c
MD5 033211c6a4f10b0bcb249bd30770cb7d
SHA1 f772d9a75adee19d7034f28e24afca26cb1e1651
SHA512 ccba8d95418e8cf75857b980c563b2e72e719062c8fc2945d22cda8d612004176c6193a0f51972176a23a25a4f8d69ba048e32c3ffcd99a06187b114ed9ddcb9
MD5 SHA1 SHA512

NSIS installer

installer

gudfars.tat

SHA256 31536a7279bd7499597ba2385da73b67b01a1647f3ba994ba25cd7cfb532452d
MD5 fed717d3cb21adadeeef1b60f1b5845c
SHA1 b6d6ce948f482d740586dfcddf316aebd8a6ed1b
SHA512 8e05fe41eaef107283f2d7fb5575db9876a5f85c3a8a304ce916fbab2212378b8ec88f2bdf91c897939eae7e1eca9ad6468aca5c33379e2d03f65175e1dc9ec0
MD5 SHA1 SHA512

NSIS installer

installer

instructors.cha

SHA256 8829e429c8de49c9ffb86988fd7cdf1d179c095ff3a0013ea5af03e46e73b36d
MD5 15ebbe8429b9e4c21920657e4c322fa9
SHA1 ca3160a9a01997d88dcc89c2dfb4cda1333a05ee
SHA512 dd3be3b88f42f1693c7a7c7dd07f9613b3d81368b988b7bf79696d102fc86c5dd49d1534ce77e394c634e01277f398b353543147ab78e9176c4b7126bba52390
MD5 SHA1 SHA512

NSIS installer

installer

librettoerne.ven

SHA256 7ec9a8e2c37a4402f3e35d63821bd7676345ae7ece2adeb9f4494f6645608d68
MD5 fdeb16a9c3a30711f900ffdafbe10b00
SHA1 7cdbfaa23bb48f829e4acebc225e703392204c00
SHA512 f0124fb6aaeb61ce2e89f20cc229f743cbbfcab72b4e7623f465bbbe8c0eb28e9522a9abb78af3ab0f1141f4798e642a5f1a17f0b024baff730907f0f0889a2c
MD5 SHA1 SHA512

NSIS installer

installer

Bordbns.exe

PE Signature issue

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Aragonspath.txt

Tandemmernes.Sma

cambrics.reb

fodboldbanernes.Kor

formuerettens.twa

gudfars.tat

instructors.cha

librettoerne.ven

Sharing

General

Malware Config

Signatures

File Explorer

Bordbns.exe

PE Signature issue

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Aragonspath.txt

Tandemmernes.Sma

cambrics.reb

fodboldbanernes.Kor

formuerettens.twa

gudfars.tat

instructors.cha

librettoerne.ven