jpgcamscanner_20240521_0072345_JPEG[.]bat[.]exe

resource
jpgcamscanner_20240521_0072345_JPEG.bat.exe
unpack001/$PLUGINSDIR/BgImage.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

jpgcamscanner_20240521_0072345_JPEG.bat.exe

IMPHASH 3abe302b6d9a1256e6a915429af4ffd2
SHA256 05df6f3430171cb7db9fa5f6782b8f67b14079b6e1dffbb013c33ca91b1ad5d3
MD5 18776562551c3adcdc9f49c013772fbd
SHA1 ee124b7cd0296b4e524454ab12059b8be60bc002
SHA512 c16b5c1c7822af0bee4d5f9707e00a4513e00b0925844fa3c8ba8afbaf7172d2b185dfaf8b1bc1fdce00c6a44d62d34d5bf611c0a2219de0a030ea2f64767364
SSDEEP 6144:MDGIRuoQiOd9kyzCiY1vJ/BnA+XCzW8w3hRTMiZ4rbcevq:zItQiOdCyzItA+XLRQiZWC
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12758

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetTempPathA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess SetEnvironmentVariableA Sleep GetTickCount GetCommandLineA lstrlenA GetVersion SetErrorMode lstrcpynA GetDiskFreeSpaceA GlobalUnlock GetWindowsDirectoryA SetCurrentDirectoryA GetLastError CreateDirectoryA CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA ReadFile WriteFile lstrcpyA MoveFileExA lstrcatA GetSystemDirectoryA GetProcAddress GetExitCodeProcess WaitForSingleObject CompareFileTime SetFileAttributesA GetFileAttributesA GetShortPathNameA MoveFileA GetFullPathNameA SetFileTime SearchPathA CloseHandle lstrcmpiA CreateThread GlobalLock lstrcmpA FindFirstFileA FindNextFileA DeleteFileA SetFilePointer GetPrivateProfileStringA FindClose MultiByteToWideChar FreeLibrary MulDiv WritePrivateProfileStringA LoadLibraryExA GetModuleHandleA GlobalAlloc GlobalFree ExpandEnvironmentStringsA

user32

ScreenToClient GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard PostQuitMessage GetWindowRect EnableMenuItem CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndDialog RegisterClassA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx GetDC CreateDialogParamA SetTimer GetDlgItem SetWindowLongA SetForegroundWindow LoadImageA IsWindow SendMessageTimeoutA FindWindowExA OpenClipboard TrackPopupMenu AppendMenuA EndPaint DestroyWindow wsprintfA ShowWindow SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation ShellExecuteExA SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA SHFileOperationA

advapi32

AdjustTokenPrivileges RegCreateKeyExA RegOpenKeyExA SetFileSecurityA OpenProcessToken LookupPrivilegeValueA RegEnumValueA RegDeleteKeyA RegDeleteValueA RegCloseKey RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/BgImage.dll

IMPHASH bdcecc8b26871abb93996c6c18e09c94
SHA256 8920afae5d9c06f6ba1f254a1e32ac2acfb0fdb11ab2158cfe880a191045e3d7
MD5 143c1b18ccd1ab2ceed02caf0e06ef8a
SHA1 b59d780e0a85f816b41aa657d4a643d77bd20a99
SHA512 91bd09610679224a7774044b16054721567385d3faa241e72b51f27ef660870f7282e887016df492d5b3ab3b6d9c130e036258c4f27d5ca4cc3a12b76ff71b39
SSDEEP 96:8eS0AKTIfv7QCUsthvNL85s4lk38Eb3CDfvEh8uLzqk5nLiEQjJ3KxkP:t8BfjbUA/85q3wEh8uLmcLpmP
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

7198

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 a0cac4cf4852895619bc7743ebeb89f9e4927ccdb9e66b1bcd92a4136d0f9c77
MD5 b0c77267f13b2f87c084fd86ef51ccfc
SHA1 f7543f9e9b4f04386dfbf33c38cbed1bf205afb3
SHA512 f2b57a2eea00f52a3c7080f4b5f2bb85a7a9b9f16d12da8f8ff673824556c62a0f742b72be0fd82a2612a4b6dbd7e0fdc27065212da703c2f7e28d199696f66e
SSDEEP 192:4PtkiQJr7jHYT87RfwXQ6YSYtOuVDi7IsFW14Ll8CO:H78TQIgGCDp14LGC
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10469

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsDialogs.dll

IMPHASH ddbd50fe6279559edf7d1f1d89b42c2c
SHA256 062c75ad650548750564ffd7aef8cd553773b5c26cae7f25a5749b13165194e3
MD5 eac1c3707970fe7c71b2d760c34763fa
SHA1 f275e659ad7798994361f6ccb1481050aba30ff8
SHA512 3415bd555cf47407c0ae62be0dbcba7173d2b33a371bf083ce908fc901811adb888b7787d11eb9d99a1a739cbd9d1c66e565db6cd678bdadaf753fbda14ffd09
SSDEEP 96:oXHqZ4zC5RH3cXX1LlYlRowycxM2DjDf3GEst+Nt+jvDYx4AqndYHnxss:oXHq+CP3uKrpyREs06YxcdGn
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

7429

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Grundtvigianerens.Unr

SHA256 0c6f40da67227c6ca67f37ad0ff5b204b6011a5435d2adb59db33775bf6dc89a
MD5 36edccf96af1480036761b7767424e1b
SHA1 1bd5d438646c81199cb2aa817cfb42a6e63afffa
SHA512 52a7e1ee71c85303172fed4f7d06d7a4e9a88749813cf2c94bc6c4886939ff1aca1bbd5f4ab340477867951d7d5e7ca2b684cc68315f67c7d56d1043fc972a35
SSDEEP 3072:fyTCKnlTj+w9D/mJol3Al2PWQPec5TsLhAbdfh+Ye+/PN3bVuh2q:fiYw9rUolwl2uARhBfwYH/1C2q
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Handrailing.cir

SHA256 3a3553c3de7351416fd2c35b039e6abfb5b5ea770b0f9679c8125bb4e8354815
MD5 da8899543efce0a7d85a682c55ac28a0
SHA1 5858844e1cd504de8dcb57096ab853066cc0f4ff
SHA512 b08ac2ee6dd769eefe8934e744eda3b890dc84c12508f1c8ff5a4aebd890705a68c4e4775d9507e3fa63cd35e7118ec686b20a7e64b73a36fe31aa5905bdc675
MD5 SHA1 SHA512

NSIS installer

installer

Schweiziskes/Nonstationaries.pai

SHA256 da902025b32bc72a666904243cabbf238ef1e71c4caefe5d68359703819e670b
MD5 bd115698051cba72973b3db7ca9f334d
SHA1 ffa16db0b0866eae1a4ed3651ceecf9403c8a934
SHA512 fd08adb340f3d802cb58405ba7543fa68821750e019fd9b1ec8ba687f7ec2a2954499e405c2044ce91bca2139f1e636e863994217596b02e9ebc8f6134402cdc
MD5 SHA1 SHA512

NSIS installer

installer

Schweiziskes/Warmakers.fal

SHA256 2df354893105aff58c03983a228c91c9696973462fa7c4845ad8ee673e9df0b1
MD5 6d178c394e50ea2084b340781537ab0b
SHA1 8cf0d7a7f60ecacb2c70f51cbec6b5665b80902e
SHA512 35005c5aeb4b82e9d92cc87421692feeb64ab5f9b1a4ad3f39ca9c24159d501bc85193fadb79d37cb9ca432b0d3bb47535d37ae8bdf9504867ab766fd0777483
MD5 SHA1 SHA512

NSIS installer

installer

Schweiziskes/aniara.uns

SHA256 7fc48c493ce04fe888b92a0f2c8cf0a562e58f9a0da4ac25045ecb5102f236d9
MD5 f43c725b0e21ddd2a5a3d446c6adebe3
SHA1 5db786bef95c4f000fb8c960adb17f52e111f437
SHA512 3db634bb4ab41611634a4a1e26fb05634337a9b98678d40f9ebb14fa18c676d694828d8458c8ff734b684ac364864266573957f727c1421f3fc92d6bb9da2e85
MD5 SHA1 SHA512

NSIS installer

installer

Schweiziskes/bekendelsesskriften.pro

SHA256 44886489a819c10ad5e77992ee636ffad2060a1f5c4189b15d9c7b3c1e9bdd24
MD5 c5d99d8ffce5f740ec0737f7c049eaa6
SHA1 74a7fc0da11e1e5926eb0db764de970c13560665
SHA512 d83d201f9ca9f1cb70cdaf3ebe4548009ff9c8db0f71f075572eb3587ca1c7538f4dd9dc6ccd17177c9ed9c9f70832b363a97d207858d130c045b77c5e62f750
MD5 SHA1 SHA512

NSIS installer

installer

Schweiziskes/databehandlingsforeningers.sky

SHA256 759c6001a1a18f56ea122de86368114000c48fb0a46b2187e8fbd1e846cc1ad1
MD5 580afdb7f940780a0e82df3ebeb3f8f0
SHA1 4f32c82222ef7b9937aa35f7e82a758c5fe29ec1
SHA512 6f201b231e84289259792eea7cd3a69a6d2252a9a672fcb089ba9f44352aa4dc9150b0c5cb6b0b63925e731e535b2874a26c397c8ec07a9511f939b5e6989f0e
SSDEEP 96:Z1/SWPInqKKFFprwmLQjUn3kouc4PN+gUG+S5yF6oqV/v4h+x:Z1KcInqtxLQwn3kRnN+f3yolqVm+x
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Schweiziskes/tsetseflues/electrohomeopathies.txt

SHA256 c9dd8f7abcca4612692f22abf80e54ca814f9e5743cd877965e77192d42a1901
MD5 f69098ff568805be8cf1b8b8efa38119
SHA1 1fa8719408bfeac133f70550a9bd5972042c5b9f
SHA512 2dcd46e31f7d6d93bc6e65ee77df2f8f374e7a020d62889f2f25347f7286c99ced4f473cfa65a35b7e19ec5308d0a5293bb91016a69b12eee65bf4c6c4cbfc38
MD5 SHA1 SHA512

NSIS installer

installer

Shamponeringers/mildewy.jam

SHA256 7210161b773b11604540ad72baa54a0cd9c530841ef8c6de8fbe06ec7fbf2779
MD5 f91ed47adc9a9df27d912e158b8506ea
SHA1 19792128c34c254d6e1bdf521b60accbad4222ff
SHA512 cc9b8c186f300dd4f9202419fc8fbd7db452d35352590ec5ee49e9e54cf9032abd1da6d9502535a260004459bb57aefd4c90607f8b93f65e5b33ef65a7fb467b
MD5 SHA1 SHA512

NSIS installer

installer

Shamponeringers/natans.sma

SHA256 3a5ba38af3df1e8155785933c4924a145f6759915f37cfd07d5edee0d300227e
MD5 477dab1b6549de2d9023d8f9cf05042b
SHA1 d96b04b86450b9546e06d12219bcb0c0437cc447
SHA512 6d2bf1cc55829f058781a3586338d2a00f0c359ff68f3b0a4a72617a8f1d3bad61ca274285f2ff6bef887835694edf28f00e6d4db957bf65336b9dcc87e89f53
MD5 SHA1 SHA512

NSIS installer

installer

Shamponeringers/ovest.tho

SHA256 b0f6c977cfe459fc79de98fa6b606f43a1a22f3e1f02f8e369c98023e451739f
MD5 12a53c34c5fa929682f2db62752880b9
SHA1 6c60c458120aee4603528266710b2ac66f3c24e1
SHA512 c86dc338dbda83f7c1a180152190a083cd2f7be4ed11794c2319ee34bc10e9a896f580e23e8a06b4a4903094f018c8c7faf5264fea1fdcfa24b11f0e8fec4511
MD5 SHA1 SHA512

NSIS installer

installer

Shamponeringers/paksks.pre

SHA256 1b84a4738fbcd4ca7d9a7fa44783094c780cbfaf6f323703487750b2bb38aad4
MD5 6a4165aa3ef3bb0b85129b53c8fc1c51
SHA1 6ccbcb4c740f34a7c3dce4e406c3a2485bb690e2
SHA512 83ca086a38d431e070b8e73f4e142b81c3dc419782defe15e95bfa345aea05dca3be6ca2b6bb4acf5e0a5e597d3ad6aa4d0007c0319e4a0a468a9a7ffa3d61d7
MD5 SHA1 SHA512

NSIS installer

installer

Shamponeringers/stttepartiets.mis

SHA256 534322dae0eade3b303508f2e035cd74da3d0fdb7948e518fcf48cad2b39432b
MD5 0cd5495c2aabc33e1ca835c7ec70ae67
SHA1 8ab470057a59dca68ecd1821ca21c0e9c7083d6d
SHA512 c94721165b8b25b7bf68c91e4d7719bf30d91d3d02e91c0ad62ee5211bac26c5d759fd730fbbd0ab894efe55a36698d3a876f8f15670cbec5f84f6d509e57bc6
MD5 SHA1 SHA512

NSIS installer

installer

Shamponeringers/utilidors.lok

SHA256 63d26c32cf8e3ffa695cef2baed6d5780f597169ee32100a90ce4e9881d66aa4
MD5 a9a4218b4fcc915f7dece680632b49e7
SHA1 a9ea694a6e3b8dab614079881104a48feee4b4b1
SHA512 1e48c1dd6306aa614b06a4cfd2a29692771e73072a9edde69db64a86260b6e8c7967ee8262469f3339b676001956f4aca4da5ae52a7d6ecf8f4dfa5beb72af8e
MD5 SHA1 SHA512

NSIS installer

installer

Shamponeringers/xenonet.mul

SHA256 75f8686efe42827de0cfaf648d5b222400200da3ef22c2df00764cab7f6e500e
MD5 20b88329e76e4aa925ad7d36061295ad
SHA1 0e5bfd4a2dfd6149caad7801c5318139cbb9bfd5
SHA512 4e47eb1e98eec1873628dab77e75532fbd9c51be5fba8ab05b69e25500ae873be1e36c84854f8d4384a3088a95dc0251b1d6342542837f9211949b8840743e60
MD5 SHA1 SHA512

NSIS installer

installer

Sharing

General

Malware Config

Signatures

File Explorer

jpgcamscanner_20240521_0072345_JPEG.bat.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/BgImage.dll

kernel32

user32

gdi32

winmm

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

Grundtvigianerens.Unr

Handrailing.cir

Schweiziskes/Nonstationaries.pai

Schweiziskes/Warmakers.fal

Schweiziskes/aniara.uns

Schweiziskes/bekendelsesskriften.pro

Schweiziskes/databehandlingsforeningers.sky

Schweiziskes/tsetseflues/electrohomeopathies.txt

Shamponeringers/mildewy.jam

Shamponeringers/natans.sma

Shamponeringers/ovest.tho

Shamponeringers/paksks.pre

Shamponeringers/stttepartiets.mis

Shamponeringers/utilidors.lok

Shamponeringers/xenonet.mul