053d7833c4436e4fa234438f53a2f0db804142a66ba3f23c637f8a827e94d93d[.]exe

resource
unpack001/$PLUGINSDIR/System.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

053d7833c4436e4fa234438f53a2f0db804142a66ba3f23c637f8a827e94d93d.exe

IMPHASH ea4e67a31ace1a72683a99b80cf37830
SHA256 053d7833c4436e4fa234438f53a2f0db804142a66ba3f23c637f8a827e94d93d
MD5 54efa13ed23ecdd7d55b0b7147b8908c
SHA1 c8d5bcd9ef15f6a6f66aa77f51caec9870bf9c10
SHA512 438146bfde4449fa796365ae9fd56b67cd8b8d3edf3cd91c40a9f3dbc45db06ddbf688a7231e9fe04920e1c4536332bbb724ce77708892d894af03067b40d1e2
SSDEEP 12288:tKdQYPhiCUSyZsnY40EfLBFvyNFoaXYtt+IocH1A9aNwCjLzHiN:tJYHUS9F0ETBiFI+9SwC+N
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

0c:44:bb:93:48:81:e0:d5:35:20:d0:00:8d:8a:59:90:de:a0:5e:ff:f3:f5:03:24:6b:12:4e:9d:4f:fc:dc:9c

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Reformerings,OU=Miminypiminy Kastesm\ ,O=Reformerings,L=Bubenreuth,ST=Bayern,C=DE,1.2.840.113549.1.9.1=#0c244665696e7363686d65636b6572656e7340537461636b686f75736961636561652e46756c

Chains

May 16, 2024

PE Signature issue

Digest

55:a6:85:c2:85:3a:a9:47:d7:08:99:e4:f3:d9:fc:5b:cc:8b:dc:5c

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Reformerings,OU=Miminypiminy Kastesm\ ,O=Reformerings,L=Bubenreuth,ST=Bayern,C=DE,1.2.840.113549.1.9.1=#0c244665696e7363686d65636b6572656e7340537461636b686f75736961636561652e46756c

Chains

May 16, 2024

Subject

CN=Reformerings,OU=Miminypiminy Kastesm\ ,O=Reformerings,L=Bubenreuth,ST=Bayern,C=DE,1.2.840.113549.1.9.1=#0c244665696e7363686d65636b6572656e7340537461636b686f75736961636561652e46756c

Serial Number

6d:09:23:df:a0:ec:48:b1:e4:1a:9b:06:f1:50:a0:83:50:19:d8:ea

Issuer

CN=Reformerings,OU=Miminypiminy Kastesm\ ,O=Reformerings,L=Bubenreuth,ST=Bayern,C=DE,1.2.840.113549.1.9.1=#0c244665696e7363686d65636b6572656e7340537461636b686f75736961636561652e46756c

Timespan

Jun 24, 2023 - Jun 23, 2026

Subject

CN=Reformerings,OU=Miminypiminy Kastesm\ ,O=Reformerings,L=Bubenreuth,ST=Bayern,C=DE,1.2.840.113549.1.9.1=#0c244665696e7363686d65636b6572656e7340537461636b686f75736961636561652e46756c

Serial Number

6d:09:23:df:a0:ec:48:b1:e4:1a:9b:06:f1:50:a0:83:50:19:d8:ea

Issuer

CN=Reformerings,OU=Miminypiminy Kastesm\ ,O=Reformerings,L=Bubenreuth,ST=Bayern,C=DE,1.2.840.113549.1.9.1=#0c244665696e7363686d65636b6572656e7340537461636b686f75736961636561652e46756c

Timespan

Jun 24, 2023 - Jun 23, 2026

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 23, 2017 - Mar 22, 2029

Minor OS version

0

Major OS version

4

Entry point

13409

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCreateKeyExA RegEnumKeyA RegQueryValueExA RegSetValueExA RegCloseKey RegDeleteValueA RegDeleteKeyA AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken SetFileSecurityA RegOpenKeyExA RegEnumValueA

shell32

SHGetFileInfoA SHFileOperationA SHGetPathFromIDListA ShellExecuteExA SHGetSpecialFolderLocation SHBrowseForFolderA

ole32

IIDFromString OleInitialize OleUninitialize CoCreateInstance CoTaskMemFree

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

SetClipboardData CharPrevA CallWindowProcA PeekMessageA DispatchMessageA MessageBoxIndirectA GetDlgItemTextA SetDlgItemTextA GetSystemMetrics CreatePopupMenu AppendMenuA TrackPopupMenu FillRect EmptyClipboard LoadCursorA GetMessagePos CheckDlgButton GetSysColor SetCursor GetWindowLongA SetClassLongA SetWindowPos IsWindowEnabled GetWindowRect GetSystemMenu EnableMenuItem RegisterClassA ScreenToClient EndDialog GetClassInfoA SystemParametersInfoA CreateWindowExA ExitWindowsEx DialogBoxParamA CharNextA SetTimer DestroyWindow CreateDialogParamA SetForegroundWindow SetWindowTextA PostQuitMessage SendMessageTimeoutA ShowWindow wsprintfA GetDlgItem FindWindowExA IsWindow GetDC SetWindowLongA LoadImageA InvalidateRect ReleaseDC EnableWindow BeginPaint SendMessageA DefWindowProcA DrawTextA GetClientRect EndPaint IsWindowVisible CloseClipboard OpenClipboard

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateFontIndirectA CreateBrushIndirect DeleteObject SetTextColor SelectObject

kernel32

GetExitCodeProcess WaitForSingleObject GetProcAddress GetSystemDirectoryA WideCharToMultiByte MoveFileExA GetTempFileNameA RemoveDirectoryA WriteFile CreateDirectoryA GetLastError CreateProcessA GlobalLock GlobalUnlock CreateThread lstrcpynA SetErrorMode GetDiskFreeSpaceA lstrlenA GetCommandLineA GetVersion GetWindowsDirectoryA SetEnvironmentVariableA GetTempPathA CopyFileA GetCurrentProcess ExitProcess GetModuleFileNameA GetFileSize ReadFile GetTickCount Sleep CreateFileA GetFileAttributesA SetCurrentDirectoryA SetFileAttributesA GetFullPathNameA GetShortPathNameA MoveFileA CompareFileTime SetFileTime SearchPathA lstrcmpiA lstrcmpA CloseHandle GlobalFree GlobalAlloc ExpandEnvironmentStringsA LoadLibraryExA FreeLibrary lstrcpyA lstrcatA FindClose MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA SetFilePointer GetModuleHandleA FindNextFileA FindFirstFileA DeleteFileA MulDiv

$PLUGINSDIR/System.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 269d232712c86983336badb40b9e55e80052d8389ed095ebf9214964d43b6bb1
MD5 34442e1e0c2870341df55e1b7b3cccdc
SHA1 99b2fa21aead4b6ccd8ff2f6d3d3453a51d9c70c
SHA512 4a8c57fb12997438b488b862f3fc9dc0f236e07bb47b2bce6053dcb03ac7ad171842f02ac749f02dda4719c681d186330524cd2953d33cb50854844e74b33d51
SSDEEP 192:jPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4I:u7VpNo8gmOyRsVc4
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10529

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Bomstrk.Nul

SHA256 d1aeab95b2173e778a06dc3b9d27f8a7da5b8c15f46607c7301987ff32def540
MD5 86825dbeeaf993e775c9acfe8ce84d98
SHA1 ccd8d3918db308a99eb7b6f18b6ba76346d69a9c
SHA512 d829e202c182bb71b3c4ee9272ae69a9ff65ed8716848ca03bfde8fffb3965cde06ef515188d7191a2fe2a5e769884b7747009c9c26606e5a9f5da6dba3680b1
SSDEEP 6144:3d2/CYq2u2WGvaL49CIfmhFUc47OFysuowKKYZRwZiO0SGQI0psc4OGb1WWsU:NaHu2WGi8CIfWZ4CAsIK9ZFO0SVF4OG8
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Unalphabetical.nuc

SHA256 95a06839df03661c732e7517b624c5091ff5ece1a10f20171e776e1bfb07a100
MD5 1b2b32f1b9664f6618a7086851bb5dcb
SHA1 48a0f959c4cad08f3ea25f23d3cebd853277b7e7
SHA512 43f6d34205d7e32bda9086c274e64ba4463f98d21635661d70016e8f78f25a2837370fe1cce2dfdef662bf8c6d8cfb574c2cc8a1f62d5a75198721ec635e288c
SSDEEP 24:GiG5VCiil9xzkWFAgoIPlSOAakga+4dCaLnvCCaZCoXIgytMMzm:A5Ti5gW4clSOGgaJMvnpXIgzMz
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

carcoon.txt

SHA256 63038d32fb5157052435ec5ae2d7a28606e8f801c86f2dec187ce2b9e1be59b4
MD5 9d56caa657c499242cee0d4ca31ba2a0
SHA1 99392b3fe07311d468fe038f31dcb020417891d7
SHA512 36c1b3f8a63b5f1b45f6304cd6f5a3492539d7501feb1d02c55e7569deb5f608a612dcdd7985977e22318b8cb4f8f060443741099c28d8ca42d03da24dea9357
MD5 SHA1 SHA512

NSIS installer

installer

ceroline.cha

SHA256 972585795998ed370226cd33e37eb4555433d0cb4951391b31734745ae09b4f9
MD5 b00c3ade5a3fee1ee05e9db640968e32
SHA1 27cec838b372c5928368a75f0c01537e195c389a
SHA512 83ca34db3cc535b0931dce440abad14c62bd68cd54f640f141caee1e50300da88384d5f02b482ff69f9691f4ce3e11932bb7d324a09a3ed66260f541cbbb8605
SSDEEP 384:11ugUjZibER15ke6IxuP/cVb9i1iHdB53C:1RU7RfoMbzdB
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

hog/strany.for

SHA256 aace0f67e37ef79fd7a66bd0ac0dd0289e5221463d4abb82651f07365cea202b
MD5 f73c6d062c028740aa41e7f22b0fe7e5
SHA1 52a6780e9e999fa82c9a5242a4f8b306b31eb85b
SHA512 62ecf91b0a65f51ccceb60b90dff68ded1eda816a3a4846ac3fce8b38c092dfdd95cd29508434c16a6dd2459dcbbee8693a4ae8ab957058ae866db1057867f5b
SSDEEP 384:IXGuBicePZhDHFUE3pCjxVnmBTXGxNwqoHb8:ISzOH7Nw
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

obducerendes.myt

SHA256 b9333ade5f3cf5592638b06b7f1071bac50111f961a12cefb1e1b696a9200e0c
MD5 1b5551fe88dddde0d83953971068683a
SHA1 4f2f426c09607d0e678c9bfa9ae044382ff29ced
SHA512 c1d80003ccff409b221d84f26ed81f8ba7152c8230db79a6c87de2a1ad35cbadff020fdc0e694134be689dc1406b2db1ea654a07a283513c9e6b90dda14871fe
SSDEEP 48:10aTGDGYsLAdqInPf7Cur/X9331L8UWWEUI+on3MFN:/GN3OSN331L/WWEr+uG
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

predeserving.bed

SHA256 3301548551758f829bad9a57f63f46e1e81909a6e7668ca5148983e3196130b2
MD5 18c77508bd1e3e6325956f6bb0b75911
SHA1 d78a51d5b4b2821d3a9d7c8662235b1972e546ff
SHA512 5da9291ef4953318f5ac3e0b359e88ff612a8a00d2bf3e569cb38288e7f0682011293e92a06f90d98a95cbb7606e48b4dd4d8613f3753fe88877bd426e1f51ea
SSDEEP 48:u8qJbVPRpWe4fETsm01MICZ8GxaN5O/BrQYq:f+rpWTETJICZ8GxaN5gBrQr
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

053d7833c4436e4fa234438f53a2f0db804142a66ba3f23c637f8a827e94d93d.exe

PE Signature issue

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Bomstrk.Nul

Unalphabetical.nuc

carcoon.txt

ceroline.cha

hog/strany.for

obducerendes.myt

predeserving.bed

Sharing

General

Malware Config

Signatures

File Explorer

053d7833c4436e4fa234438f53a2f0db804142a66ba3f23c637f8a827e94d93d.exe

PE Signature issue

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Bomstrk.Nul

Unalphabetical.nuc

carcoon.txt

ceroline.cha

hog/strany.for

obducerendes.myt

predeserving.bed