F24-005880[.]exe | Triage™

resource
unpack001/$PLUGINSDIR/System.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

F24-005880.exe

IMPHASH ea4e67a31ace1a72683a99b80cf37830
SHA256 086da7bd75ae9d4bc710b5b00b0ec4f53b2d66d3cb623989c22ab603d6da2b31
MD5 2e8ce9f298737e4b340e75e01ca21d56
SHA1 171c6727efd94c1cde5a3e0c3572740557516f94
SHA512 d823e98b3723837070d4200a3f8b23e61bd5becdfd2ade6936fcee91dbc78165106cb26fff059f20a0110c4fa4cf65a9c05952c6b23bf8c67a5ae720dae9e1c7
SSDEEP 12288:EKdQYPhiCUSyZsnY40EfLBIPKzeE5bWrs0l8Kxb2hjtQQncBHe:EJYHUS9F0ETBIPKzeUbqmKJ2h5QQnN
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

c6:05:10:59:c9:80:ec:e0:19:6e:b2:97:eb:bd:7f:d8:90:23:f1:dd:6f:ff:03:f8:57:a6:25:2e:d3:c3:a0:fe

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Koderen,OU=Augmentive Modeords\ ,O=Koderen,L=Indian Springs,ST=Nevada,C=US,1.2.840.113549.1.9.1=#0c1550656374656e4042726f6b616465726e65732e4b61

Chains

May 16, 2024

PE Signature issue

Digest

7e:7f:4d:ae:9d:1a:e8:43:9a:90:e4:8c:b6:ff:d8:69:56:13:31:db

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Koderen,OU=Augmentive Modeords\ ,O=Koderen,L=Indian Springs,ST=Nevada,C=US,1.2.840.113549.1.9.1=#0c1550656374656e4042726f6b616465726e65732e4b61

Chains

May 15, 2024

Subject

CN=Koderen,OU=Augmentive Modeords\ ,O=Koderen,L=Indian Springs,ST=Nevada,C=US,1.2.840.113549.1.9.1=#0c1550656374656e4042726f6b616465726e65732e4b61

Serial Number

7f:d3:d0:6c:03:8c:ba:75:db:19:34:d8:2e:07:ce:1b:04:02:4a:3c

Issuer

CN=Koderen,OU=Augmentive Modeords\ ,O=Koderen,L=Indian Springs,ST=Nevada,C=US,1.2.840.113549.1.9.1=#0c1550656374656e4042726f6b616465726e65732e4b61

Timespan

Jan 22, 2024 - Jan 21, 2027

Subject

CN=Koderen,OU=Augmentive Modeords\ ,O=Koderen,L=Indian Springs,ST=Nevada,C=US,1.2.840.113549.1.9.1=#0c1550656374656e4042726f6b616465726e65732e4b61

Serial Number

7f:d3:d0:6c:03:8c:ba:75:db:19:34:d8:2e:07:ce:1b:04:02:4a:3c

Issuer

CN=Koderen,OU=Augmentive Modeords\ ,O=Koderen,L=Indian Springs,ST=Nevada,C=US,1.2.840.113549.1.9.1=#0c1550656374656e4042726f6b616465726e65732e4b61

Timespan

Jan 22, 2024 - Jan 21, 2027

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 23, 2017 - Mar 22, 2029

Minor OS version

0

Major OS version

4

Entry point

13409

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCreateKeyExA RegEnumKeyA RegQueryValueExA RegSetValueExA RegCloseKey RegDeleteValueA RegDeleteKeyA AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken SetFileSecurityA RegOpenKeyExA RegEnumValueA

shell32

SHGetFileInfoA SHFileOperationA SHGetPathFromIDListA ShellExecuteExA SHGetSpecialFolderLocation SHBrowseForFolderA

ole32

IIDFromString OleInitialize OleUninitialize CoCreateInstance CoTaskMemFree

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

SetClipboardData CharPrevA CallWindowProcA PeekMessageA DispatchMessageA MessageBoxIndirectA GetDlgItemTextA SetDlgItemTextA GetSystemMetrics CreatePopupMenu AppendMenuA TrackPopupMenu FillRect EmptyClipboard LoadCursorA GetMessagePos CheckDlgButton GetSysColor SetCursor GetWindowLongA SetClassLongA SetWindowPos IsWindowEnabled GetWindowRect GetSystemMenu EnableMenuItem RegisterClassA ScreenToClient EndDialog GetClassInfoA SystemParametersInfoA CreateWindowExA ExitWindowsEx DialogBoxParamA CharNextA SetTimer DestroyWindow CreateDialogParamA SetForegroundWindow SetWindowTextA PostQuitMessage SendMessageTimeoutA ShowWindow wsprintfA GetDlgItem FindWindowExA IsWindow GetDC SetWindowLongA LoadImageA InvalidateRect ReleaseDC EnableWindow BeginPaint SendMessageA DefWindowProcA DrawTextA GetClientRect EndPaint IsWindowVisible CloseClipboard OpenClipboard

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateFontIndirectA CreateBrushIndirect DeleteObject SetTextColor SelectObject

kernel32

GetExitCodeProcess WaitForSingleObject GetProcAddress GetSystemDirectoryA WideCharToMultiByte MoveFileExA GetTempFileNameA RemoveDirectoryA WriteFile CreateDirectoryA GetLastError CreateProcessA GlobalLock GlobalUnlock CreateThread lstrcpynA SetErrorMode GetDiskFreeSpaceA lstrlenA GetCommandLineA GetVersion GetWindowsDirectoryA SetEnvironmentVariableA GetTempPathA CopyFileA GetCurrentProcess ExitProcess GetModuleFileNameA GetFileSize ReadFile GetTickCount Sleep CreateFileA GetFileAttributesA SetCurrentDirectoryA SetFileAttributesA GetFullPathNameA GetShortPathNameA MoveFileA CompareFileTime SetFileTime SearchPathA lstrcmpiA lstrcmpA CloseHandle GlobalFree GlobalAlloc ExpandEnvironmentStringsA LoadLibraryExA FreeLibrary lstrcpyA lstrcatA FindClose MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA SetFilePointer GetModuleHandleA FindNextFileA FindFirstFileA DeleteFileA MulDiv

$PLUGINSDIR/System.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 269d232712c86983336badb40b9e55e80052d8389ed095ebf9214964d43b6bb1
MD5 34442e1e0c2870341df55e1b7b3cccdc
SHA1 99b2fa21aead4b6ccd8ff2f6d3d3453a51d9c70c
SHA512 4a8c57fb12997438b488b862f3fc9dc0f236e07bb47b2bce6053dcb03ac7ad171842f02ac749f02dda4719c681d186330524cd2953d33cb50854844e74b33d51
SSDEEP 192:jPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4I:u7VpNo8gmOyRsVc4
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10529

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Unalphabetical.nuc

SHA256 95a06839df03661c732e7517b624c5091ff5ece1a10f20171e776e1bfb07a100
MD5 1b2b32f1b9664f6618a7086851bb5dcb
SHA1 48a0f959c4cad08f3ea25f23d3cebd853277b7e7
SHA512 43f6d34205d7e32bda9086c274e64ba4463f98d21635661d70016e8f78f25a2837370fe1cce2dfdef662bf8c6d8cfb574c2cc8a1f62d5a75198721ec635e288c
SSDEEP 24:GiG5VCiil9xzkWFAgoIPlSOAakga+4dCaLnvCCaZCoXIgytMMzm:A5Ti5gW4clSOGgaJMvnpXIgzMz
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

anopla.Fla

SHA256 f488c5e01baa712ce66e1dea5fc69d083d1a7594896fb697cc3d5c817ca638bb
MD5 12b9e5ef71150296fd86569826adda53
SHA1 88493cbd19926ecb23b27ba8aaefeab515e0fc72
SHA512 2297cc5d5571f9d4537e78ce3ae200bd88ba7c5b0d92d229698760511cd927875eb15d43fed37034c4ffe6b2ed48519e5b6ac6ecec0eaa8ef019fdfdd8626d91
SSDEEP 6144:Cs1t4D2o/Sb+eBfJbdloYkHa23JefdY8CYqX+xN+VYFyRfvWDL/MePqmnHfLB4Lg:0B/SSef97323JidlqqNwRW8wq6HVKif5
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

carcoon.txt

SHA256 63038d32fb5157052435ec5ae2d7a28606e8f801c86f2dec187ce2b9e1be59b4
MD5 9d56caa657c499242cee0d4ca31ba2a0
SHA1 99392b3fe07311d468fe038f31dcb020417891d7
SHA512 36c1b3f8a63b5f1b45f6304cd6f5a3492539d7501feb1d02c55e7569deb5f608a612dcdd7985977e22318b8cb4f8f060443741099c28d8ca42d03da24dea9357
MD5 SHA1 SHA512

NSIS installer

installer

ceroline.cha

SHA256 972585795998ed370226cd33e37eb4555433d0cb4951391b31734745ae09b4f9
MD5 b00c3ade5a3fee1ee05e9db640968e32
SHA1 27cec838b372c5928368a75f0c01537e195c389a
SHA512 83ca34db3cc535b0931dce440abad14c62bd68cd54f640f141caee1e50300da88384d5f02b482ff69f9691f4ce3e11932bb7d324a09a3ed66260f541cbbb8605
SSDEEP 384:11ugUjZibER15ke6IxuP/cVb9i1iHdB53C:1RU7RfoMbzdB
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

obducerendes.myt

SHA256 b9333ade5f3cf5592638b06b7f1071bac50111f961a12cefb1e1b696a9200e0c
MD5 1b5551fe88dddde0d83953971068683a
SHA1 4f2f426c09607d0e678c9bfa9ae044382ff29ced
SHA512 c1d80003ccff409b221d84f26ed81f8ba7152c8230db79a6c87de2a1ad35cbadff020fdc0e694134be689dc1406b2db1ea654a07a283513c9e6b90dda14871fe
SSDEEP 48:10aTGDGYsLAdqInPf7Cur/X9331L8UWWEUI+on3MFN:/GN3OSN331L/WWEr+uG
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

predeserving.bed

SHA256 3301548551758f829bad9a57f63f46e1e81909a6e7668ca5148983e3196130b2
MD5 18c77508bd1e3e6325956f6bb0b75911
SHA1 d78a51d5b4b2821d3a9d7c8662235b1972e546ff
SHA512 5da9291ef4953318f5ac3e0b359e88ff612a8a00d2bf3e569cb38288e7f0682011293e92a06f90d98a95cbb7606e48b4dd4d8613f3753fe88877bd426e1f51ea
SSDEEP 48:u8qJbVPRpWe4fETsm01MICZ8GxaN5O/BrQYq:f+rpWTETJICZ8GxaN5gBrQr
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

strany.for

SHA256 aace0f67e37ef79fd7a66bd0ac0dd0289e5221463d4abb82651f07365cea202b
MD5 f73c6d062c028740aa41e7f22b0fe7e5
SHA1 52a6780e9e999fa82c9a5242a4f8b306b31eb85b
SHA512 62ecf91b0a65f51ccceb60b90dff68ded1eda816a3a4846ac3fce8b38c092dfdd95cd29508434c16a6dd2459dcbbee8693a4ae8ab957058ae866db1057867f5b
SSDEEP 384:IXGuBicePZhDHFUE3pCjxVnmBTXGxNwqoHb8:ISzOH7Nw
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

F24-005880.exe

PE Signature issue

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Unalphabetical.nuc

anopla.Fla

carcoon.txt

ceroline.cha

obducerendes.myt

predeserving.bed

strany.for

Sharing

General

Malware Config

Signatures

File Explorer

F24-005880.exe

PE Signature issue

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Unalphabetical.nuc

anopla.Fla

carcoon.txt

ceroline.cha

obducerendes.myt

predeserving.bed

strany.for