PO_INdllc0987633[.]exe

resource
unpack001/$PLUGINSDIR/System.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

PO_INdllc0987633.exe

IMPHASH e871f39e81b4aa977737b07cee050825
SHA256 750de2877f8d697d901df9c4de2bc68210398eb380090da102bcb7b1a2bf64cc
MD5 d5c7d0ad92f64719cf6dbb449f979b8a
SHA1 b9f096f427376b3018e37a9f22ed369a42f39bcc
SHA512 5e6d7c083e81961059869f94c238c92e98672f7190672dd2ec3a16b82e75ba8abb5297f82c9ac326db0767242ab4ab4e391d113760de529644a33c830a6b5349
SSDEEP 6144:6cYLaFTxViMdgPi+IZ0TgGxAJ+dZdqdUdiAgWheaD+IOLdQiklcCZfZOY9oDEexa:pNjF+aZ0TgXWhe/xdVk4OCtXuCfYNkmf
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

66:bf:7f:e5:28:f5:13:47:9d:90:49:5f:b1:91:c6:a4:75:ff:ba:b8:29:85:54:5f:46:b2:30:39:98:e3:f3:cc

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Onderne,OU=Kyssende Skriftlige Hjlnder\ ,O=Onderne,L=Kimper,ST=Kentucky,C=US,1.2.840.113549.1.9.1=#0c2349647269667473746e696e6765726e654046616c6c697465726b6c72696e67732e4b75

Chains

May 9, 2024

Minor OS version

1

Major OS version

5

Entry point

13518

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCloseKey RegDeleteKeyA RegDeleteValueA RegEnumKeyA RegEnumValueA RegQueryValueExA RegSetValueExA OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueA SetFileSecurityA RegCreateKeyExA RegOpenKeyExA

shell32

ShellExecuteExA SHBrowseForFolderA SHFileOperationA SHGetPathFromIDListA SHGetFileInfoA SHGetSpecialFolderLocation

ole32

OleUninitialize IIDFromString OleInitialize CoTaskMemFree CoCreateInstance

comctl32

ord17 ImageList_Destroy ImageList_AddMasked ImageList_Create

user32

SystemParametersInfoA LoadCursorA SetClassLongA GetWindowLongA ScreenToClient SetCursor GetWindowRect TrackPopupMenu AppendMenuA EnableMenuItem CreatePopupMenu GetSystemMenu GetSystemMetrics IsWindowEnabled EmptyClipboard SetClipboardData CloseClipboard OpenClipboard CheckDlgButton EndDialog DialogBoxParamA IsWindowVisible SetWindowPos CreateWindowExA GetClassInfoA RegisterClassA DispatchMessageA GetMessagePos CharNextA ExitWindowsEx SetWindowTextA SetTimer CreateDialogParamA DestroyWindow LoadImageA FindWindowExA SetWindowLongA InvalidateRect ReleaseDC GetDC SetForegroundWindow EnableWindow GetDlgItem ShowWindow IsWindow PostQuitMessage SendMessageTimeoutA SendMessageA wsprintfA FillRect GetClientRect EndPaint BeginPaint DrawTextA DefWindowProcA PeekMessageA SetDlgItemTextA MessageBoxIndirectA CharPrevA CallWindowProcA GetDlgItemTextA GetSysColor

gdi32

SetBkMode CreateBrushIndirect GetDeviceCaps SelectObject DeleteObject SetBkColor SetTextColor CreateFontIndirectA

kernel32

WriteFile GetTempFileNameA GetLastError WaitForSingleObject ReadFile CreateFileA CreateDirectoryA lstrcpynA GlobalLock GlobalUnlock CreateThread GetDiskFreeSpaceA CopyFileA lstrlenA GetVersionExA GetWindowsDirectoryA ExitProcess GetExitCodeProcess SetErrorMode GetTempPathA SetEnvironmentVariableA GetCommandLineA GetModuleFileNameA GetTickCount GetFileSize MultiByteToWideChar MoveFileA WritePrivateProfileStringA GetPrivateProfileStringA lstrcmpiA lstrcmpA MulDiv GetShortPathNameA GlobalFree GlobalAlloc LoadLibraryExA GetModuleHandleA FreeLibrary Sleep CloseHandle SetFileTime SetFilePointer SetFileAttributesA GetFullPathNameA GetFileAttributesA FindNextFileA FindFirstFileA FindClose DeleteFileA CompareFileTime SearchPathA SetCurrentDirectoryA ExpandEnvironmentStringsA RemoveDirectoryA CreateProcessA WideCharToMultiByte GetSystemDirectoryA GetProcAddress lstrcpyA lstrcatA MoveFileExA GetCurrentProcess

$PLUGINSDIR/System.dll

IMPHASH 595a3fd71239f605bb02d7a5e48fd4df
SHA256 c85142f86e1ec02f7ef8d5ba31b22031de3de9a16bce519d5482b824afb277eb
MD5 10e8921a6e7f6a74671b07dc3bde626f
SHA1 b7961066600ef193c5319dbeed3673dc60110a50
SHA512 4c19a7e3117baeec3f6a7f9a33cfab392255741137406db87fe5ac24def7f9a28b2ed0fc26f0f46c5d43ba1bb6675dea74410a797bfd265e38812b042460aa00
SSDEEP 192:Q9rQDenC9VrcK7REgSWOprANupQYLRszDDH/d9CWlXo7U6Wxf:QJQEaVAK7R9SfpjpQYLRszfH/d9CWB1j
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

6

Entry point

6599

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Forkynderne/Pantninger/pigeonholes.plo

SHA256 edc5a1b73337352b64ae252b5b1f898a51ab3717ec92d019b077925e0ffa4b46
MD5 35115870979df21036da9e4ae63051e5
SHA1 d1d171737df8a85168d116a4d842c591226afba0
SHA512 6a9e1df301a9db60ac7fe929702e025004c24de2366c67d2e1a5041146265ead714fa048b3fe5c62fadc61631232922ef3a5d69548c760c55bea6e97ab78d548
SSDEEP 48:+byiDx1JpBfxXn+dVfEDE01ENq47YayNuDMEVzGU/fqcHjcS2nvqcRVuLyLb5b:8n1zxkeEPq4l42MMVt2nCcRYc
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Forkynderne/Pantninger/sjllandsturs.bev

SHA256 81892b282b559eff609484455ba0408f1f0dd41a9e1ab009638f4c3e3e37a014
MD5 ee5271996e6bf0bddad429edbee5f501
SHA1 d169495f0f3ad70d2fb8deb779111ed7c0f92df2
SHA512 c2f0229832529684cc60c7d8fff10527b8f117bb69afad2ff60bdfa39724e0b8466a511eab7ca6f326add09e5f38b49fc5cc871a54b1c8c0778e2dd383c629fa
SSDEEP 384:IcEgZDezpbfsFjqlKp8HH9AD/k8I8RkA:AbfKqIQ92rk
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Forkynderne/Pantninger/sutskoen.coc

SHA256 8c848f825f75ce5f692b0484fc20add6c18c0afa4223e45f42f5618fb53ed8bd
MD5 e8007423a0a57dd8ebf88a98d16990d6
SHA1 65b5db07a2c93cb33abb2821e8403f71ea99ae3c
SHA512 91a97c8bc59af568dc0957c4f529323d20ab4df1a531e967c240a8b0d66491bb59861e3a6eb83aa22dfb05eb1020927a730754fcb13744ef8f2b7b051d715624
SSDEEP 48:Y1ZQsdSlIk9N2DIR55M8Vgfda1FlaA8+qQ1GXRbUA3wuDk5BI3afwltZp4kiQVBP:ERB2RT46F9GXRbbwQk5BI3TdDVVZ
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Forkynderne/Pantninger/svares.gym

SHA256 000cd7835e9d00b61a44cd3f9bd851ddcff8b62b1165316f5304fc46468c5163
MD5 8284f6d5b506fe74c34f72464652691f
SHA1 e45115eae0b30c57d5b7bcc4b264bb4913ff0223
SHA512 621b92a588c7a726ec2437ff67bc6924ab02c341da0ea6c027c89133afa8c4024c07af7f1213593604cbef390578788f9af4ee1bc3c75ace3186e037afa4a95f
SSDEEP 24:joh8vdNAt5KmUfXYd8+cVG9i/05BqBId8nPBSWvHqykJ68F+x1/1:jwKaV7yV8sBIOBSwHqy+rox1/1
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Forkynderne/Pantninger/whippings.tid

SHA256 61205352a9eee3c6ef93dbeb9e41ffd70a60e2c933b02d48f7579dd214a726c3
MD5 2785cf5cf3ef034bb443b159cd3d0209
SHA1 d780e8fbfaa5a72a0d53167c684a09a657f2e247
SHA512 dd3017ae89e723b39e645648dd6b38ca40d919a840b3f7fa94ca653bf3a5093b6b2516bca74fe08e5371a218d2e3f58da84e79ed0a6e9f55a24546429a6fcbb8
SSDEEP 48:xzkHXbPuDkUct9ZTKp/1pnBb16Cqwx5K2E+IAkchwYwCU1eVrAt62:CLPscnZuVN/l6mhXRRAt6
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Forkynderne/Stuntmenene.Ove

SHA256 874d0ae98bb238db839d8f9aaaa1f36dd2e19cc4c136dad6d20fd832ac18879c
MD5 48194738ddba56e5fe97730090a938e1
SHA1 effa5e32fbd45012b6cb21bbf18bb46752899436
SHA512 04629710e1109a54f892713d22ac41e30ace2272c2ac625a294a8c3bfea8b2c7a70ed4f994d0aae1cc5a5fd7d18cb9f31bf17a4c9bd93a44eecacba56bb5e994
SSDEEP 768:BlHZS9RzX53l/cRjx4iN90h84TPpmXol90:XU9Rzpyn4i30hL1WoY
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Forkynderne/ammocoetidae.gol

SHA256 db082203d97a90bb902d345248734a1fc39235477272e36112dd2195ef07e60d
MD5 e8ff288a93bafd84e178716c11b3e910
SHA1 44abd0d800052903ea6748671a1b6a37c8a2c40c
SHA512 e97aea81a3371d7758f8bb82886ebc3ecd97932764e1ac8fafbca2a3950a0ce1fa4d7d86dac9d307b0903ce4f9a12aed4561e83d90edfb907cf3b8739c9a7565
SSDEEP 96:jeqS+UmV27Ily3t5ZJgsxVyRViyRmsgybY73E5xK/dzUqbzb:iRmV2NTZJg4V6VzRmsgybY73EPgwq7
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Forkynderne/bdetarifferne.afh

SHA256 fa730c763f310ec241043cf3611d943a4cf7feec74956a3c6490e84828a6adef
MD5 95d53d7dd637179574527f46bc12f5c0
SHA1 8f1e6b1252c31ac31023c570cdc8df4bd6d41067
SHA512 fb31dd0596c5228c6726d4ab70b5d7cbf7391186c1975141293a59eb3971281c15b17a3f5af6a3ea385f1061e8251ff1dce88923a6a3a1bdf6c50691b0e55ff3
SSDEEP 384:JcYl3cZd41Yh9gpmFVnEtyJVpsMWWdTBdK:AwmGyHpsW
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Forkynderne/beskftigelsesinteressers.spi

SHA256 f8ce24abe82916f743bdd543ccda207f3b7e6f48fce02b7e564edd2f91a7dad2
MD5 bf86dfdcfcc019e172d8628fa9868170
SHA1 44e5b5fb2d03b937b987069b727eca2297918cd7
SHA512 87178de5d01a87652a8d12a2c3eb5a3c60b6cdbe9967787a92b19f454a4f40f3393878dd5f80b67c4831a10aafd58061846d1054fdd3749a300f9f8048e6e05a
SSDEEP 24:GN3LoAQYrm9OzlNxvKAHji8LpHSt/w4syiZXifrm/DTnBSVyp6bEQTM:LfomwTxiyz8QRXQWnBTpWE
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Forkynderne/fortykkelsen.kor

SHA256 87715c95d97e540acf5357453ccf5c32f476d0a20ca676b8736a2a557995aa3d
MD5 bb84a724b89291617f5b041be4c4cf6c
SHA1 3998859b8f0da344b42a49e42b657e255c2a8e79
SHA512 24a2c0431af9706779171c651cff6b3694a7f968ff44707e8783c7db4852b2440cdc34bdc74d278edf4664b99c2e727028e26f560ea69598ae48970d32cc1da4
SSDEEP 192:rJ+oNu/y5Xy/cUGp+hFrRKB0CZkXBhiv2:rJ+oNu/MXy/cUGp+hFrRKB0CZkXBhie
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Forligeligt79.txt

SHA256 5eeaf6790f7038d27fcb811b81caf3bdbaba8125242b5af47434b520e896f468
MD5 5830d872a36ee7a22cb784282ee20e90
SHA1 6be82925158da2c886fd3588454fa94cf34103e8
SHA512 92b724af349579ffb45e73e7ef1f78423590cb434f0d1c1c41614bbc6b32d8d484d963a35dd54645956d81ad954e4853327f88dc09e71ad90c726274f19a2da8
MD5 SHA1 SHA512

NSIS installer

installer

aareladet.Eur180

SHA256 2529e28417711eff654b86d3ed8c737bc72c712731a392d9fd57e8f33ef5c85b
MD5 a22cb4fe35cb7c77c968e80e6be5f920
SHA1 93cf77f3f9e71b7ec6f9c4ea634ada99be1b5baa
SHA512 c2eab1ee397863add18134c4a3a6689251b048234cd703044e6b846d8cd27b07498420681dc6dcc3d98295450a85d9c1dd6125399c8f3179b2c9875e0594bdbe
SSDEEP 6144:laqFz7YEefBKhIF6ngSn0RIcUS2fIb/ZBrt2p:lpzYfsOOgS0RIcUS2gp8p
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer