d5c2c232447f0e59930b03dfb417815c61fa857d6ed61237554a947e598a08f1[.]exe

resource
unpack001/$PLUGINSDIR/System.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

d5c2c232447f0e59930b03dfb417815c61fa857d6ed61237554a947e598a08f1.exe

IMPHASH ea4e67a31ace1a72683a99b80cf37830
SHA256 d5c2c232447f0e59930b03dfb417815c61fa857d6ed61237554a947e598a08f1
MD5 d4f137b8bf2f0d40d41191c8be541821
SHA1 ce050c34d79421adb074de782e0ea52c736c1e86
SHA512 4837970ca6401dba707f15fdc793ba98b9b70af4299b8f9b9f49914b149745f428a85fd15613692e8549cf9d70089c3fb3738d6dc77d1f030b6d68a2e36584dc
SSDEEP 12288:gKdQYPhiCUSyZsnY40EfLBUc4unPZAKCBHVE3L6440vaP/SS/LZi:gJYHUS9F0ETBUqREI6VpSSE
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

ca:c5:be:dc:ab:8d:18:19:92:e6:0b:82:ec:ff:df:41:d6:0a:f6:b7:5b:44:6f:af:d1:9f:50:52:b9:b9:d0:fb

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=bengnaveriernes,OU=Madgldens Svmnings\ ,O=bengnaveriernes,L=Crockett Mills,ST=Tennessee,C=US,1.2.840.113549.1.9.1=#0c1a506f737476696e6475657240486f6c6c6f77666f6f742e466f72

Chains

May 16, 2024

PE Signature issue

Digest

86:97:2a:77:fe:42:66:9e:82:bc:3e:5d:31:d6:87:08:83:28:62:ae

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=bengnaveriernes,OU=Madgldens Svmnings\ ,O=bengnaveriernes,L=Crockett Mills,ST=Tennessee,C=US,1.2.840.113549.1.9.1=#0c1a506f737476696e6475657240486f6c6c6f77666f6f742e466f72

Chains

May 16, 2024

Subject

CN=bengnaveriernes,OU=Madgldens Svmnings\ ,O=bengnaveriernes,L=Crockett Mills,ST=Tennessee,C=US,1.2.840.113549.1.9.1=#0c1a506f737476696e6475657240486f6c6c6f77666f6f742e466f72

Serial Number

4f:6e:e4:7f:03:86:4d:38:64:9e:60:82:69:d6:77:c4:32:4c:4c:ef

Issuer

CN=bengnaveriernes,OU=Madgldens Svmnings\ ,O=bengnaveriernes,L=Crockett Mills,ST=Tennessee,C=US,1.2.840.113549.1.9.1=#0c1a506f737476696e6475657240486f6c6c6f77666f6f742e466f72

Timespan

Jun 14, 2023 - Jun 13, 2026

Subject

CN=bengnaveriernes,OU=Madgldens Svmnings\ ,O=bengnaveriernes,L=Crockett Mills,ST=Tennessee,C=US,1.2.840.113549.1.9.1=#0c1a506f737476696e6475657240486f6c6c6f77666f6f742e466f72

Serial Number

4f:6e:e4:7f:03:86:4d:38:64:9e:60:82:69:d6:77:c4:32:4c:4c:ef

Issuer

CN=bengnaveriernes,OU=Madgldens Svmnings\ ,O=bengnaveriernes,L=Crockett Mills,ST=Tennessee,C=US,1.2.840.113549.1.9.1=#0c1a506f737476696e6475657240486f6c6c6f77666f6f742e466f72

Timespan

Jun 14, 2023 - Jun 13, 2026

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 23, 2017 - Mar 22, 2029

Minor OS version

0

Major OS version

4

Entry point

13409

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCreateKeyExA RegEnumKeyA RegQueryValueExA RegSetValueExA RegCloseKey RegDeleteValueA RegDeleteKeyA AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken SetFileSecurityA RegOpenKeyExA RegEnumValueA

shell32

SHGetFileInfoA SHFileOperationA SHGetPathFromIDListA ShellExecuteExA SHGetSpecialFolderLocation SHBrowseForFolderA

ole32

IIDFromString OleInitialize OleUninitialize CoCreateInstance CoTaskMemFree

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

SetClipboardData CharPrevA CallWindowProcA PeekMessageA DispatchMessageA MessageBoxIndirectA GetDlgItemTextA SetDlgItemTextA GetSystemMetrics CreatePopupMenu AppendMenuA TrackPopupMenu FillRect EmptyClipboard LoadCursorA GetMessagePos CheckDlgButton GetSysColor SetCursor GetWindowLongA SetClassLongA SetWindowPos IsWindowEnabled GetWindowRect GetSystemMenu EnableMenuItem RegisterClassA ScreenToClient EndDialog GetClassInfoA SystemParametersInfoA CreateWindowExA ExitWindowsEx DialogBoxParamA CharNextA SetTimer DestroyWindow CreateDialogParamA SetForegroundWindow SetWindowTextA PostQuitMessage SendMessageTimeoutA ShowWindow wsprintfA GetDlgItem FindWindowExA IsWindow GetDC SetWindowLongA LoadImageA InvalidateRect ReleaseDC EnableWindow BeginPaint SendMessageA DefWindowProcA DrawTextA GetClientRect EndPaint IsWindowVisible CloseClipboard OpenClipboard

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateFontIndirectA CreateBrushIndirect DeleteObject SetTextColor SelectObject

kernel32

GetExitCodeProcess WaitForSingleObject GetProcAddress GetSystemDirectoryA WideCharToMultiByte MoveFileExA GetTempFileNameA RemoveDirectoryA WriteFile CreateDirectoryA GetLastError CreateProcessA GlobalLock GlobalUnlock CreateThread lstrcpynA SetErrorMode GetDiskFreeSpaceA lstrlenA GetCommandLineA GetVersion GetWindowsDirectoryA SetEnvironmentVariableA GetTempPathA CopyFileA GetCurrentProcess ExitProcess GetModuleFileNameA GetFileSize ReadFile GetTickCount Sleep CreateFileA GetFileAttributesA SetCurrentDirectoryA SetFileAttributesA GetFullPathNameA GetShortPathNameA MoveFileA CompareFileTime SetFileTime SearchPathA lstrcmpiA lstrcmpA CloseHandle GlobalFree GlobalAlloc ExpandEnvironmentStringsA LoadLibraryExA FreeLibrary lstrcpyA lstrcatA FindClose MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA SetFilePointer GetModuleHandleA FindNextFileA FindFirstFileA DeleteFileA MulDiv

$PLUGINSDIR/System.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 269d232712c86983336badb40b9e55e80052d8389ed095ebf9214964d43b6bb1
MD5 34442e1e0c2870341df55e1b7b3cccdc
SHA1 99b2fa21aead4b6ccd8ff2f6d3d3453a51d9c70c
SHA512 4a8c57fb12997438b488b862f3fc9dc0f236e07bb47b2bce6053dcb03ac7ad171842f02ac749f02dda4719c681d186330524cd2953d33cb50854844e74b33d51
SSDEEP 192:jPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4I:u7VpNo8gmOyRsVc4
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10529

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Bucchero22/Postkassen/ceroline.cha

SHA256 972585795998ed370226cd33e37eb4555433d0cb4951391b31734745ae09b4f9
MD5 b00c3ade5a3fee1ee05e9db640968e32
SHA1 27cec838b372c5928368a75f0c01537e195c389a
SHA512 83ca34db3cc535b0931dce440abad14c62bd68cd54f640f141caee1e50300da88384d5f02b482ff69f9691f4ce3e11932bb7d324a09a3ed66260f541cbbb8605
SSDEEP 384:11ugUjZibER15ke6IxuP/cVb9i1iHdB53C:1RU7RfoMbzdB
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Bucchero22/Postkassen/obducerendes.myt

SHA256 b9333ade5f3cf5592638b06b7f1071bac50111f961a12cefb1e1b696a9200e0c
MD5 1b5551fe88dddde0d83953971068683a
SHA1 4f2f426c09607d0e678c9bfa9ae044382ff29ced
SHA512 c1d80003ccff409b221d84f26ed81f8ba7152c8230db79a6c87de2a1ad35cbadff020fdc0e694134be689dc1406b2db1ea654a07a283513c9e6b90dda14871fe
SSDEEP 48:10aTGDGYsLAdqInPf7Cur/X9331L8UWWEUI+on3MFN:/GN3OSN331L/WWEr+uG
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Bucchero22/Postkassen/predeserving.bed

SHA256 3301548551758f829bad9a57f63f46e1e81909a6e7668ca5148983e3196130b2
MD5 18c77508bd1e3e6325956f6bb0b75911
SHA1 d78a51d5b4b2821d3a9d7c8662235b1972e546ff
SHA512 5da9291ef4953318f5ac3e0b359e88ff612a8a00d2bf3e569cb38288e7f0682011293e92a06f90d98a95cbb7606e48b4dd4d8613f3753fe88877bd426e1f51ea
SSDEEP 48:u8qJbVPRpWe4fETsm01MICZ8GxaN5O/BrQYq:f+rpWTETJICZ8GxaN5gBrQr
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Bucchero22/Postkassen/strany.for

SHA256 aace0f67e37ef79fd7a66bd0ac0dd0289e5221463d4abb82651f07365cea202b
MD5 f73c6d062c028740aa41e7f22b0fe7e5
SHA1 52a6780e9e999fa82c9a5242a4f8b306b31eb85b
SHA512 62ecf91b0a65f51ccceb60b90dff68ded1eda816a3a4846ac3fce8b38c092dfdd95cd29508434c16a6dd2459dcbbee8693a4ae8ab957058ae866db1057867f5b
SSDEEP 384:IXGuBicePZhDHFUE3pCjxVnmBTXGxNwqoHb8:ISzOH7Nw
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Bucchero22/carcoon.txt

SHA256 63038d32fb5157052435ec5ae2d7a28606e8f801c86f2dec187ce2b9e1be59b4
MD5 9d56caa657c499242cee0d4ca31ba2a0
SHA1 99392b3fe07311d468fe038f31dcb020417891d7
SHA512 36c1b3f8a63b5f1b45f6304cd6f5a3492539d7501feb1d02c55e7569deb5f608a612dcdd7985977e22318b8cb4f8f060443741099c28d8ca42d03da24dea9357
MD5 SHA1 SHA512

NSIS installer

installer

Unalphabetical.nuc

SHA256 95a06839df03661c732e7517b624c5091ff5ece1a10f20171e776e1bfb07a100
MD5 1b2b32f1b9664f6618a7086851bb5dcb
SHA1 48a0f959c4cad08f3ea25f23d3cebd853277b7e7
SHA512 43f6d34205d7e32bda9086c274e64ba4463f98d21635661d70016e8f78f25a2837370fe1cce2dfdef662bf8c6d8cfb574c2cc8a1f62d5a75198721ec635e288c
SSDEEP 24:GiG5VCiil9xzkWFAgoIPlSOAakga+4dCaLnvCCaZCoXIgytMMzm:A5Ti5gW4clSOGgaJMvnpXIgzMz
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

trichotillomania.Ste

SHA256 eda517303f010e20be5ec7db93979142569a69fe400ebfd3095e2ee827ea73e1
MD5 22fb05c1d6ed1ab508b6359854bce2c3
SHA1 ac0a21b2d04da88c7afe94c6ae384c83bf8bfa3e
SHA512 3579626e6f4ef7fdc7ee563989e832c1e02247c5ba7a2fa52af5b0732b8cabaafc0ff978121e785840e7f8f9b5addeb666204b5ec382eb21b73579518ec3581c
SSDEEP 6144:Wu7ozpZrDnUwjuUOVypRBuWNmF4GVeiy2v5jeeNLbQO1bkej8mFvpBAZ:wzTDnUw7jBuzFteiy21eemwhfFvW
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

d5c2c232447f0e59930b03dfb417815c61fa857d6ed61237554a947e598a08f1.exe

PE Signature issue

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Bucchero22/Postkassen/ceroline.cha

Bucchero22/Postkassen/obducerendes.myt

Bucchero22/Postkassen/predeserving.bed

Bucchero22/Postkassen/strany.for

Bucchero22/carcoon.txt

Unalphabetical.nuc

trichotillomania.Ste

Sharing

General

Malware Config

Signatures

File Explorer

d5c2c232447f0e59930b03dfb417815c61fa857d6ed61237554a947e598a08f1.exe

PE Signature issue

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Bucchero22/Postkassen/ceroline.cha

Bucchero22/Postkassen/obducerendes.myt

Bucchero22/Postkassen/predeserving.bed

Bucchero22/Postkassen/strany.for

Bucchero22/carcoon.txt

Unalphabetical.nuc

trichotillomania.Ste