swift_remittance_copy_inv_30_04_2024_0000000000_pdf[.]exe

resource
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsExec.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

swift_remittance_copy_inv_30_04_2024_0000000000_pdf.exe

IMPHASH f10e4da994053bf80c20cee985b32e29
SHA256 32acc283188b9c7578a49f288c7adbc7b33a96bb25bcd03057bda02c0f003be8
MD5 819efcf6f8669243f3ac2ee6dabc9d8f
SHA1 7c14a7a4701066ec8c7e4cceba089dc0b6f3f8be
SHA512 c3b8832488e7702d917331709766bd544df0e10a7efc6aeff37b8105c092e43f4b890e9ac02449d3651b180bafacfb79f354e1651cd25abd849588577763d198
SSDEEP 3072:liFi6z/VXzAf3ocDmvQEMpvbAGrXX24tfUQsxQlseOcIWNI5FM9eYh3W/SmizUOb:UxFSbDAGrn24tAQPI5FohhISOOb
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

05:15:4a:2e:96:3d:73:85:e7:b0:1d:8d:cf:f1:7b:0a:d8:19:8e:45:79:ba:26:48:54:46:80:a5:9a:28:e2:ec

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Tyngde,OU=richardiii Pezizaceous Vildledende\ ,O=Tyngde,L=Mark,ST=England,C=GB,1.2.840.113549.1.9.1=#0c174c61746962756c697a654052617474726170732e4e6f6e

Chains

May 16, 2024

Minor OS version

0

Major OS version

4

Entry point

13516

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCreateKeyExA RegEnumKeyA RegQueryValueExA RegSetValueExA RegCloseKey RegDeleteValueA RegDeleteKeyA AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken SetFileSecurityA RegOpenKeyExA RegEnumValueA

shell32

SHGetFileInfoA SHFileOperationA SHGetPathFromIDListA ShellExecuteExA SHGetSpecialFolderLocation SHBrowseForFolderA

ole32

IIDFromString OleInitialize OleUninitialize CoCreateInstance CoTaskMemFree

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

SetClipboardData CharPrevA CallWindowProcA PeekMessageA DispatchMessageA MessageBoxIndirectA GetDlgItemTextA SetDlgItemTextA GetSystemMetrics CreatePopupMenu AppendMenuA TrackPopupMenu FillRect EmptyClipboard LoadCursorA GetMessagePos CheckDlgButton SetWindowPos SetCursor GetSysColor SetClassLongA GetWindowLongA IsWindowEnabled GetWindowRect GetSystemMenu EnableMenuItem RegisterClassA ScreenToClient EndDialog GetClassInfoA SystemParametersInfoA CreateWindowExA ExitWindowsEx DialogBoxParamA CharNextA SetTimer DestroyWindow CreateDialogParamA SetForegroundWindow SetWindowTextA PostQuitMessage SendMessageTimeoutA ShowWindow wsprintfA GetDlgItem FindWindowExA IsWindow GetDC SetWindowLongA LoadImageA InvalidateRect ReleaseDC EnableWindow BeginPaint SendMessageA DefWindowProcA DrawTextA GetClientRect EndPaint IsWindowVisible CloseClipboard OpenClipboard

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateFontIndirectA CreateBrushIndirect DeleteObject SetTextColor SelectObject

kernel32

GetExitCodeProcess WaitForSingleObject GetProcAddress GetSystemDirectoryA WideCharToMultiByte MoveFileExA GetTempFileNameA RemoveDirectoryA WriteFile CreateDirectoryA GetLastError CreateProcessA GlobalLock GlobalUnlock CreateThread lstrcpynA SetErrorMode GetDiskFreeSpaceA lstrlenA GetCommandLineA GetVersionExA GetWindowsDirectoryA SetEnvironmentVariableA GetTempPathA CopyFileA GetCurrentProcess ExitProcess GetModuleFileNameA GetFileSize ReadFile GetTickCount Sleep CreateFileA GetFileAttributesA SetCurrentDirectoryA SetFileAttributesA GetFullPathNameA GetShortPathNameA MoveFileA CompareFileTime SetFileTime SearchPathA lstrcmpiA lstrcmpA CloseHandle GlobalFree GlobalAlloc ExpandEnvironmentStringsA LoadLibraryExA FreeLibrary lstrcpyA lstrcatA FindClose MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA SetFilePointer GetModuleHandleA FindNextFileA FindFirstFileA DeleteFileA MulDiv

$PLUGINSDIR/System.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 c7a20bcaa0197aedddc8e4797bbb33fdf70d980f5e83c203d148121c2106d917
MD5 792b6f86e296d3904285b2bf67ccd7e0
SHA1 966b16f84697552747e0ddd19a4ba8ab5083af31
SHA512 97edc3410b88ca31abc0af0324258d2b59127047810947d0fb5e7e12957db34d206ffd70a0456add3a26b0546643ff0234124b08423c2c9ffe9bdec6eb210f2c
SSDEEP 192:rFiQJ771Jt17C8F1A5xjGNNvgFOiLb7lrT/L93:X71Jt48F2eNvgFF/L
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10673

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsExec.dll

IMPHASH e269b6260a93a17ceff5184b3982ded8
SHA256 10675f13abaee592f14382349aa35d82fb52aab4e27eef61d0c83dec1f6b73da
MD5 5aa38904acdcc21a2fb8a1d30a72d92f
SHA1 a9ce7d1456698921791db91347dba0489918d70c
SHA512 f04740da561d7cd0dea5e839c9e1c339d4a3e63944d3566c94c921a3d170a69918a32dff3f3b43f13d55cc25a2dbb4c21104f062c324308ac5104179766402a3
SSDEEP 96:AOBtEB2flLkatAthPZJoi9jpfW/er6cBbcB/NFyVOHd0+uHwEX:AhB2flXAVJtjf6cBbcB/N8Ved0PZ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4231

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Halvkusiner.idi

SHA256 f3d0b5dd5562dcb4a463afb050c1335c5f642d7a940cebb61cdb407f4a257b87
MD5 de4223a5b65e1d5fb8ea1641e32c73d0
SHA1 fabce1cd50b6c2fe3b5b9ebde1b8c8e0cd105c3e
SHA512 05be7bc770e05f232335a197e9f1f542afc65fa1ee6ec2775383c3f430b26db00ef25908de4cfe18940be4666e4ef0c5393adab5d6106bff5e4d50166c6ceaec
SSDEEP 96:dmc7+uDDmXdk3ySfro3+kDt1EE+gq/tAM8oKpWhFF5NOcc8O3L6Fuy7EG2+9F3fj:M1tk3yQRkUHAMdK2T/c3ex7EG2+bfA+l
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Melosa.ani

SHA256 c1d5772d0cff9856dcd4f3246ea25b1f558c893a1afd2412ad71e3dc789c2162
MD5 547e96b96767efaa91e854123dc37676
SHA1 4beca50b29a6ce59f1e91447cf5a11288b8e80b5
SHA512 84e840a570ac2b3452720267d833bc0da42d94e870021c6084a62da7eae1482ec02ef9c4e90cdb7894e18943f52e4b0dc873340507c25ccd363fedc456d48265
MD5 SHA1 SHA512

NSIS installer

installer

assuringly/Discour/Uforstandigheden.Byo

SHA256 aa84c03452bea4cb860824d7d95a3115c57da22986b0c97d3131434e44e8d938
MD5 f7d0162dd37a3770edd412379744e94f
SHA1 dcbab6b452f85ea1a05c4ea590856d445c6e1b10
SHA512 7eae50c78cfbcc825ac830620a7998e08647b8cd7726814c22a343619d41feb2a31dd12e449e4d3708abd9b6a6aedfbfe171cfe160770856213671caf32c3fc9
SSDEEP 3072:WiOJCl/nT/t404hyxrpTSuh9klacJ4kapq7NV91+5KlwY0W5gI:1KC1T/t40MyxrJkRt5Tn0S
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

tmrerblyantens.txt

SHA256 9f292a102699e79534fa89fea880eabccf136550c86ecdd3bc71d12ac06b4923
MD5 4bb0650e7ca963753e87914e350aad8f
SHA1 c2a2be7e714e07538f97493684e364fb7fe39e15
SHA512 8d8f30b6f32ac6a7dcdab6e2b71f9192718c7dd50e2ff4da289a0bdadb9faa32247b94c8d9121c4da43da7e4b85649bb5ad80290779627b3d460af3c6a1cc034
MD5 SHA1 SHA512

NSIS installer

installer