69568a88abae198f5ab9ae1578383cc2[.]exe

resource
unpack001/$PLUGINSDIR/System.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

69568a88abae198f5ab9ae1578383cc2.exe

IMPHASH e160ef8e55bb9d162da4e266afd9eef3
SHA256 06ec46f6d1f609aeafb8e8f5be8d12f8874902661394ce04094249558237c29d
MD5 69568a88abae198f5ab9ae1578383cc2
SHA1 8465bb8304fcc90bc1fd0dd3da28d959258f4107
SHA512 1bfaf5241bc2c16dd1d75363c6437b526f7d59066ab7fe88734c04e17e3fc5555a2732476586814dc131aa7cfee630597587a66ff08d1a2c67b8b6b43beca3f7
SSDEEP 12288:Xn0A1rjiXSUyo10AOwpn8GcqxKGghasb6j8/:EAkXLgG5K15Wjg
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

06:38:93:5b:8d:3b:a4:0b:02:b1:d7:ac:c9:c3:fd:a7:4f:86:22:b8:9b:98:e6:c1:ca:54:f9:a0:44:a3:87:58

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Forpremierens,OU=Skoldet Forordnings Sizzling\ ,O=Forpremierens,L=Saint-Sardos,ST=Nouvelle-Aquitaine,C=FR,1.2.840.113549.1.9.1=#0c186b6f6e746f727469646572404f7069756d68756c652e4d65

Chains

May 7, 2024

PE Signature issue

Digest

94:95:9a:ff:99:e7:3e:64:9d:a0:03:73:ac:ad:da:56:50:b5:3d:ba

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Forpremierens,OU=Skoldet Forordnings Sizzling\ ,O=Forpremierens,L=Saint-Sardos,ST=Nouvelle-Aquitaine,C=FR,1.2.840.113549.1.9.1=#0c186b6f6e746f727469646572404f7069756d68756c652e4d65

Chains

May 3, 2024

Subject

CN=Forpremierens,OU=Skoldet Forordnings Sizzling\ ,O=Forpremierens,L=Saint-Sardos,ST=Nouvelle-Aquitaine,C=FR,1.2.840.113549.1.9.1=#0c186b6f6e746f727469646572404f7069756d68756c652e4d65

Serial Number

42:61:96:3b:7c:fe:3c:c2:f0:1d:d9:7d:c8:06:3b:bc:72:20:0f:09

Issuer

CN=Forpremierens,OU=Skoldet Forordnings Sizzling\ ,O=Forpremierens,L=Saint-Sardos,ST=Nouvelle-Aquitaine,C=FR,1.2.840.113549.1.9.1=#0c186b6f6e746f727469646572404f7069756d68756c652e4d65

Timespan

Jul 5, 2023 - Jul 4, 2026

Subject

CN=Forpremierens,OU=Skoldet Forordnings Sizzling\ ,O=Forpremierens,L=Saint-Sardos,ST=Nouvelle-Aquitaine,C=FR,1.2.840.113549.1.9.1=#0c186b6f6e746f727469646572404f7069756d68756c652e4d65

Serial Number

42:61:96:3b:7c:fe:3c:c2:f0:1d:d9:7d:c8:06:3b:bc:72:20:0f:09

Issuer

CN=Forpremierens,OU=Skoldet Forordnings Sizzling\ ,O=Forpremierens,L=Saint-Sardos,ST=Nouvelle-Aquitaine,C=FR,1.2.840.113549.1.9.1=#0c186b6f6e746f727469646572404f7069756d68756c652e4d65

Timespan

Jul 5, 2023 - Jul 4, 2026

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 23, 2017 - Mar 22, 2029

Minor OS version

0

Major OS version

4

Entry point

12470

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetTickCount GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA SearchPathA GetShortPathNameA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess SetEnvironmentVariableA GetWindowsDirectoryA GetTempPathA Sleep CloseHandle LoadLibraryA lstrlenA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA ReadFile lstrcpyA lstrcatA GetSystemDirectoryA GetVersion GetProcAddress GlobalAlloc CompareFileTime SetFileTime ExpandEnvironmentStringsA lstrcmpiA lstrcmpA WaitForSingleObject GlobalFree GetExitCodeProcess GetModuleHandleA SetErrorMode GetCommandLineA LoadLibraryExA FindFirstFileA FindNextFileA DeleteFileA SetFilePointer WriteFile FindClose WritePrivateProfileStringA MultiByteToWideChar MulDiv GetPrivateProfileStringA FreeLibrary

user32

CreateWindowExA EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard GetDC SystemParametersInfoA RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx DestroyWindow CreateDialogParamA SetTimer GetDlgItem wsprintfA SetForegroundWindow ShowWindow IsWindow LoadImageA SetWindowLongA SetClipboardData EmptyClipboard OpenClipboard EndPaint PostQuitMessage FindWindowExA SendMessageTimeoutA SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA

advapi32

RegCloseKey RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegEnumValueA RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

CoCreateInstance CoTaskMemFree OleInitialize OleUninitialize

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/System.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 44e5dfd551b38e886214bd6b9c8ee913c4c4d1f085a6575d97c3e892b925da82
MD5 883eff06ac96966270731e4e22817e11
SHA1 523c87c98236cbc04430e87ec19b977595092ac8
SHA512 60333253342476911c84bbc1d9bf8a29f811207787fdd6107dce8d2b6e031669303f28133ffc811971ed7792087fe90fb1faabc0af4e91c298ba51e28109a390
SSDEEP 96:UPDYcJ+nx4vVp76JX7zBlkCg21Fxz4THxtrqw1at0JgwLEjo+OB3yUVCdl/wNj+l:UPtkuWJX7zB3kGwfy0nyUVsxCjOMb1u
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

9999

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Angrebskrigene63.leg

SHA256 978d87cd2376a93729c1071873e326a76d419f13a6038adacab1a5244829b722
MD5 5483e48bef2acd0b0163fe33ac1addf1
SHA1 fc3c7bbd5f11ca8c6d97c34a042bfde64a7ab8f8
SHA512 6dd9a763f43147d0647ed361390e05c40fbada0e0cf85a05e9316c890b6a5e0b19cffe5245064f51ddd74f6eba11e112156f40692d758c062ae701b9c4693e42
SSDEEP 48:yAngJHD6h5aAb0NII3ckjd2LEEAm5xhRGSFXbESnGqU46OZ6gm:yHtDCIAbwII33JslH/hPEiPU4RZ
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Coheirs27/alarmklokkes.jer

SHA256 3d4c9ba31df5c052f577b96e48b11c0bbc8f650830e0ecae606c78b72252819b
MD5 2aab720d8d16bfc48d6d43d0c9fccc72
SHA1 37ddfd4bbb1134fe1f6ec7ce44ce065002b0b85a
SHA512 631e3f3f66a9b53167bc5517910b3ed37c33aae0d9f4be94d8e63ae70a394654f80dc3ee5a7c8d4e52758efd786bc3e0b19496ce992fc728286373ecd6001b86
SSDEEP 48:SGaMXQ7bZiX0BHy938FBox3uLbnLVAZtdWV3EhSE8wwg74m:dAi2S93ouun6ZtdWVp+p4m
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Coheirs27/bespeckled.afr

SHA256 9f6250da5464501a422fa10813fa3c43cdf5127d612fe4f0b2d6e2214dd475ed
MD5 a78de64e51fffdf88c0bfe835f5c64aa
SHA1 2b7032dffe66fe586eb66cfdbc5c0a4baf0706b2
SHA512 ebf1960bb0241963b3d5a191406bc7234cff073eafc379c72f83ebd1d6eb1ddc756b5f2cd7278e8b778e3f633134682c12cc8680e08de56b447219eb8b7b398e
SSDEEP 48:69oRroFiG/RCoNHotqQ0Tfp7uim6dbURbxwiej6j+X4X:fRro0Y03tqQ0TZuOBURbv+X
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Coheirs27/beyer.txt

SHA256 cd2a470db3cef5ccc31fa4714fa136eafaddc6301bd07ad26b1b30a6f54fa07f
MD5 0564ff28c6a36d8ae6d6f0e680eb2f79
SHA1 45fee55d7de1da952825e048c4ea90906cee16b4
SHA512 759acc9f8f38f7f33669357c384a1c31b7737da1680615cc9faf846636f8826af647d39b3b59557385ef4ccf534ac2a4935942bbbb713c28cbdeb4f886beee5a
MD5 SHA1 SHA512

NSIS installer

installer

Coheirs27/commemorate.sce

SHA256 a0ae3b5dce771009e9c783dd27ab08e7b66315c38814fb75ad45d2391b2c769f
MD5 64080db8a71340558adb299b991cf46a
SHA1 945c836654eb605031aa87830c551327bd15e0b8
SHA512 baef864b302856dc85a18e376fa796cc6299a7b1d7aac22ea8a36e160e7adc6465df29eac5168a8735f94080b7f1c74953955cce8585f9becd2b1f94d97ef06b
SSDEEP 384:NVQniRVceBumsFxqGQYTy5Hn1ex1gkvxuwnHylsFVXD47RhAdl:Nyij9MxqGnTFHyks7RGl
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Coheirs27/eiresione.bak

SHA256 50e85a8582a2dba847ce491fc507904be4d34303ed24e51c773c7d514f5ec20e
MD5 732f0460915bfea5997cf7f189088b8f
SHA1 ffa5364ed4e187e4dd6e99fffef0d3ad9ca88dce
SHA512 c1418b403e29749ba1caaede0bb63a0abf296a52f459e97c0cdfafe69f41bd43097e5f6f09e27c7c24c9489714c36ac0f630d27d9118e4f66454527218d68efb
SSDEEP 24:jF1MnLN81tZayBKWuPZnpj1ztZKarl3iJsA24mdLa98G/lQvm:jF7nZaSap1/3csdZa//lG
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Coheirs27/maanedlige.snl

SHA256 db4b00e756bdb1bc020a026a56984ad85585ba178e06ac3fdab69d7c5d0797a1
MD5 65e923cc6c3cfc70ac751edc74a5c981
SHA1 9411558dce93aa96474e686cff28817744c65608
SHA512 381de8a80190bb3c5d7dd98cadbf577e4106f467c07851b1e19ea5c5bdb11840613698108535a460f53271c83dfa2fb7811f99be56bd260478ddc191e68322f9
SSDEEP 96:UriWxCt2vovznF1IL3ma32qNWOPxONy+47QLBi:8i4Ct2qF1IL3x32q4OPxONy+4ULBi
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Coheirs27/naphthylic.til

SHA256 d99e0b0deee7cb0d6fc4d7869dfcad569f81fda55aa7bcda86151c7212106c27
MD5 cec468c6eb8225e58bf6a5a849046d01
SHA1 6f40ba94dd8cf19ad86febbf772c6c2ca741f681
SHA512 91e7f4b40790271be2266ba2c6902bcf872737e8d01ebf230d188dbf2d79bdd33bb16ddf4d1a2de564a213b2cdbaea103a0970a122ea7a386ac3233dc290f501
SSDEEP 384:H2YqEpZ8IMkoL0BtfPYe+U2Nx05E/sJ1/YYmuUJ50qNK7U:Fqs+tuPLxE4
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Coheirs27/officiating.tov

SHA256 3ee3ddd1bace2031475af19071f11f9dd03a93b0aab4afc4293632671a8342fc
MD5 e58834ddbd81421159c4cac9d2db16ee
SHA1 3fd6addcb565109f569cd2091f3f69ee37413f46
SHA512 0b371dc9f845ae9ea0cfc468c4814ee4ef4bdea1f5ea842d1ed58b4d5c631ea4aae5a862b4ff4ba3c4d5b137c972ee951eab6f8bdbc59551f5de45e8814ad0f3
SSDEEP 24:VXzRXMCWACBWRp1p8lMaEtcBPJfW2SotmoQOzntz2gtMSSylsY0k89eXf773gNi/:VXz5XWMpwMwB1SFoQO5ztPT1Bj7Qi
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Livfuld.leu

SHA256 239ba4edc920dab9190c5ed708673efa797f36ac3e88b31957c12a40aa13b9a0
MD5 002952180d313b687c23c551057d8ff5
SHA1 3ec8a7ec4252f95c93345928907c18b028b77149
SHA512 53a645459922c41c12c0c708ca7c0a18e1d9069ce0c882f55fd33f908ce14a7a35fc0bc79bb43d173177f54e2a414326b95f7d2689a597c95c3f247c58a30bf6
SSDEEP 3072:f/yO8kFrGuXxZXpZ6z9y1vvwIs9/z87v:f/bLGuXxZZhvV6/z
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

jokergevinst.Sae

SHA256 5753f19f875a5db0198c9b10e199eca9f2a1c197e73d4e6195bf443cf6c38e37
MD5 3186b171938836f4fa56f91fcaf5c3fc
SHA1 61120978e7296f9e7c14bdb9113d96405a92ccd1
SHA512 ff25220165b645dcf2750d476e6691b26cbea50c2801abf076b4e4f47d914856a62a5e39a754ed856e1047805e6a4eadfff3cb931ac089e4ec2fed692ba7b3ed
SSDEEP 6144:NO8/3b7gzFRcqCcz5UOqyTsneFPLKdTXwRbz9/WPDj:H//gFaK5RdCgGJQbAj
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

69568a88abae198f5ab9ae1578383cc2.exe

PE Signature issue

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Angrebskrigene63.leg

Coheirs27/alarmklokkes.jer

Coheirs27/bespeckled.afr

Coheirs27/beyer.txt

Coheirs27/commemorate.sce

Coheirs27/eiresione.bak

Coheirs27/maanedlige.snl

Coheirs27/naphthylic.til

Coheirs27/officiating.tov

Livfuld.leu

jokergevinst.Sae

Sharing

General

Malware Config

Signatures

File Explorer

69568a88abae198f5ab9ae1578383cc2.exe

PE Signature issue

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Angrebskrigene63.leg

Coheirs27/alarmklokkes.jer

Coheirs27/bespeckled.afr

Coheirs27/beyer.txt

Coheirs27/commemorate.sce

Coheirs27/eiresione.bak

Coheirs27/maanedlige.snl

Coheirs27/naphthylic.til

Coheirs27/officiating.tov

Livfuld.leu

jokergevinst.Sae