b4834413f9bedbc2d64ba07d1401e4d1eb44a54adbca90bb79fc67bf03fa4ab5[.]exe

resource
b4834413f9bedbc2d64ba07d1401e4d1eb44a54adbca90bb79fc67bf03fa4ab5.exe
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/UserInfo.dll
unpack001/$PLUGINSDIR/nsDialogs.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

b4834413f9bedbc2d64ba07d1401e4d1eb44a54adbca90bb79fc67bf03fa4ab5.exe

IMPHASH ced282d9b261d1462772017fe2f6972b
SHA256 b4834413f9bedbc2d64ba07d1401e4d1eb44a54adbca90bb79fc67bf03fa4ab5
MD5 86a0fbc943d577f93faf00394997bb22
SHA1 bc1bd20d88ce7f659dbab2752d670f8cce3ff8e3
SHA512 c047b8a78a8513fa37a4147d45dfe92c3534693ab5394ee96d50090d71cd28097da09b409e4d00c0e5d6ef1451d29119156c80bd227d7eb5172ea8c7c3713c72
SSDEEP 6144:A9X0GAbjQDWloo891UylPBX6xuY6RzWBw39tASqEHSVI9AWKw133:G0t/looK1UABXTUI9/Kw133
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

13128

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCreateKeyExA RegEnumKeyA RegQueryValueExA RegSetValueExA RegCloseKey RegDeleteValueA RegDeleteKeyA AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken SetFileSecurityA RegOpenKeyExA RegEnumValueA

shell32

SHGetFileInfoA SHFileOperationA SHGetPathFromIDListA ShellExecuteExA SHGetSpecialFolderLocation SHBrowseForFolderA

ole32

IIDFromString OleInitialize OleUninitialize CoCreateInstance CoTaskMemFree

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

SetClipboardData CharPrevA CallWindowProcA PeekMessageA DispatchMessageA MessageBoxIndirectA GetDlgItemTextA SetDlgItemTextA GetSystemMetrics CreatePopupMenu AppendMenuA TrackPopupMenu FillRect EmptyClipboard LoadCursorA GetMessagePos CheckDlgButton GetSysColor SetCursor GetWindowLongA SetClassLongA SetWindowPos IsWindowEnabled GetWindowRect GetSystemMenu EnableMenuItem RegisterClassA ScreenToClient EndDialog GetClassInfoA SystemParametersInfoA CreateWindowExA ExitWindowsEx DialogBoxParamA CharNextA SetTimer DestroyWindow CreateDialogParamA SetForegroundWindow SetWindowTextA PostQuitMessage SendMessageTimeoutA ShowWindow wsprintfA GetDlgItem FindWindowExA IsWindow GetDC SetWindowLongA LoadImageA InvalidateRect ReleaseDC EnableWindow BeginPaint SendMessageA DefWindowProcA DrawTextA GetClientRect EndPaint IsWindowVisible CloseClipboard OpenClipboard

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateFontIndirectA CreateBrushIndirect DeleteObject SetTextColor SelectObject

kernel32

GetExitCodeProcess WaitForSingleObject GetProcAddress GetSystemDirectoryA WideCharToMultiByte MoveFileExA ReadFile GetTempFileNameA WriteFile RemoveDirectoryA CreateProcessA CreateFileA GetLastError CreateThread CreateDirectoryA GlobalUnlock GetDiskFreeSpaceA GlobalLock SetErrorMode GetVersion lstrcpynA GetCommandLineA GetTempPathA lstrlenA SetEnvironmentVariableA ExitProcess GetWindowsDirectoryA GetCurrentProcess GetModuleFileNameA CopyFileA GetTickCount Sleep GetFileSize GetFileAttributesA SetCurrentDirectoryA SetFileAttributesA GetFullPathNameA GetShortPathNameA MoveFileA CompareFileTime SetFileTime SearchPathA lstrcmpiA lstrcmpA CloseHandle GlobalFree GlobalAlloc ExpandEnvironmentStringsA LoadLibraryExA FreeLibrary lstrcpyA lstrcatA FindClose MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA SetFilePointer GetModuleHandleA FindNextFileA FindFirstFileA DeleteFileA MulDiv

$PLUGINSDIR/System.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 d09a8b3ade4ba4b7292c0b3da1bcb4b6c6e2012e0ccfd5e029a54af73a9e1b57
MD5 4ca4fd3fbefa2f6e87e6e9ee87d1c0b3
SHA1 7cdbeb5ff2b14b86af04e075d0ca651183ea5df4
SHA512 cf0f415a97fdc74568297fed4f1295d0d2aef487a308141144ef8d5f04c669ef4795c273e745b81065429adde113fcdedf4c22717a7aeef60fdcd8d4d46f97f8
SSDEEP 192:EPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4W:j7VpNo8gmOyRsVc4
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10529

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/UserInfo.dll

IMPHASH d576645bcd8a66d2fe678a075f4cc6e0
SHA256 26fa900e3426b4dd272707e1aaf428b5ee06bdc2cc2bbaecdab6b54f11f38f27
MD5 035bdb470a6807313bd005bd98341ffc
SHA1 5017d1e5a23f1c64594f737e6fccd519729c3b3e
SHA512 f888baed5267b05b13722e839634254393aa99b2adf1a2ae6e799d3a901665e7ebda0fa1202db20a6765a8aff58e2ed6f4e822028be426db732eb10ec783aa05
MD5 SHA1 SHA512

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4732

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsDialogs.dll

IMPHASH ebc2d915841be8afc8fa1ee9f6850960
SHA256 d253ca5aba34b925796777893f114cc741b015af7868022ab1db2341288c55ed
MD5 eb2c74e05b30b29887b3219f4ea3fdab
SHA1 91173d46b34e7bae57acabdbd239111b5bcc4d9e
SHA512 1bb035260223ec585170f891c2624b9ae98671f225e74b913b40bb77b66e3b9c2016037bc8e4b0ae16367d82590a60a0a3bd95d05139ea2454f02020d1b54dae
SSDEEP 96:oVDlD3cd51V1zL7xqEscxM2DjDf3GEst+Nt+jvcx488qndYv0PLE:oVp34z/x3sREskpxjdO0PLE
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

7513

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Improvisatorens/Laparocolpohysterotomy162.fra

SHA256 fe85d7b25a41ee93f1a172f4f8f0489a83c24d03a0ac59066e79a1f58f9c5382
MD5 623272435de8395e801abf39701074a3
SHA1 5e234e9270efab606464277fabe18436fd92e6bd
SHA512 c80fd2086fca97387c41ae647801f4f0a991a2fc38e05a6488d069a3d222927b658038e76e05e71183a47372ee38180d9c0a43cce63149955f1578869cf33a71
MD5 SHA1 SHA512

NSIS installer

installer

Improvisatorens/Lrketr160.bel

SHA256 47c9fa08e1fdb45ff4b68936e127bef728df2558b79cea6f9cf812e7a06580e5
MD5 556c42ad236f523422a8d33c7e01d769
SHA1 86ad2ee8fad51e33c3d316083fe427e7d59f8ba2
SHA512 b50d36a5839ae51badc821764fc93c7409f62cb97a7677c0c759e06217c48d58ec3aa4554746ca8efdf23e37b2e8a4b4c629b34e91c50f611578a8d3a58b2042
MD5 SHA1 SHA512

NSIS installer

installer

Improvisatorens/Misdefine.vil

SHA256 02a443f69d7695afb9b48bfa4f79d2820c1f5c0ed7747effdc5cdc7e5da04747
MD5 bc7edbfcef64a6c616650e2d9a5a7245
SHA1 a87d7bd6a4174fa5bf293be370c4c08b319a144b
SHA512 6df4ffc0cc1835e34c3d22282b6bf1502e852eb861ad5521c826945afe8af52347e34f32bf8ea5905431f1b42e3407d05e6d8e5352e63d018cfb1005ffd9f35e
MD5 SHA1 SHA512

NSIS installer

installer

Improvisatorens/Taino.Tan3

SHA256 78b1099c045a7e1f8d3fc37177ac87ebc93ad1ffe082a705a1daeb27be55ff74
MD5 0214ee3b483b2bd30009dbc109b33f4d
SHA1 79fdef32d664a5ed7e377d8a8127bd91f4455d8f
SHA512 a0d605b7f8bf37e29383f73c19194184a64e24b59a522a97a07defa68c4504761ff38e29ed6822a7c8c688cc9d57891d93982787c9c9ea4d6148e4a3c2a3c8cc
SSDEEP 3072:q+8rS1buYkoN9ES40H7yLYaJdwjOOENofevKwuMPANozwxOZpNksY:J8rKKYhT40HKglaSgXwQpU
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Improvisatorens/Tgernes.sub

SHA256 daf8ac46ee15628fe4834408de7feb876f87e5625a205b85cb230b11cd41a3de
MD5 d6ecec90ddd9777c15163fe9f5346807
SHA1 1ffddbb693f9f12ecff3e68b8806a257fedd9dde
SHA512 f491f1d279356c1a3b284c360cde80cd274c94237255d7ad9a03ac64dd0eacb57e59c3f50e2c7ceb28a0d897537a40f54721e2c1d4d67b4c844e15998b1b5a28
SSDEEP 192:6Xxh02zP8OAqkOKzLp2aBip254kSSwBFiqdwDbiK1+JDirLPA0Hd2fE:6Xxi2z0ntzN22ip44BniqifiK05H08fE
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Improvisatorens/sphagnaceae/Stuepigen.hor

SHA256 d15fd3d370057160c77a483d9659cf6e79b3892665e0d87d9ef8859e4be1ae59
MD5 6968cfe66311ae9bb0ded77de8492562
SHA1 b2991e4b0427e879ad2abda54d94624b2d0eac1e
SHA512 111ef26e9dd6a1be84c80faec57a6c144db84a36cdc157e905f91985a221f91148b2b1ed92c2bf740458f959f495f8c559665c49a9e941399f3520139c3e4be2
MD5 SHA1 SHA512

NSIS installer

installer

Improvisatorens/sphagnaceae/Talbehandlings88.uve

SHA256 241c8e953f55ce7b68983303e62dd43663dcad2d32482318a0c9e13a59e37fff
MD5 aaefd238ca955b45bc68d442fb059d5b
SHA1 71fa1ca71cd483235e0121cb39c34f81511f975b
SHA512 6c9eaad76da058b89ac9413064605ccb4195eebd477697d167f9ede06dedf6dd3a3723081317e4ee9dfccee5ce1aa27ffec9ac5b9d21d3bf5b99d9ef752d6f6e
MD5 SHA1 SHA512

NSIS installer

installer

Improvisatorens/sphagnaceae/Thunderhead118.dop

SHA256 6ce8e19eaf50df4811f04535695c2146c0d9664e70428e27da844d99fe8dca7e
MD5 6c88a30b4d494fecb6b1364f0e591b9b
SHA1 962c04c3d1a5df4aa609af206c3c351e25c8ed52
SHA512 5bb08d4b7111285d0ab31e5a102cb7de12ffd14edaef6023fd42106a500b7d89179a373488d89fc9a561295446b9ac8890390d46f45bc40fbf4f8f986dc298b9
SSDEEP 96:7S/jcLYcx/3Ii+AtAfS/hjHek1U0C1Duo9uPsfY6cKZci/5NeysyBm:7SbKnxFpAfSFHnU0C16o9tYuNeYm
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Improvisatorens/sphagnaceae/advancing.fol

SHA256 477003dcdb6bfbc409e90bb3e12bf4de2437fc37e3944609b6d1563e0b4119f0
MD5 7fea240209f8b573defe77af303502e9
SHA1 fb010e47dab492098e2b596afcdae259aab5491f
SHA512 60c18b95c470130a1613700c098f3f57bafe80dbd9875cfdf7d023e847182428287f5beddf54a64a58869360019697c2e23e2cf02fc121f0365b2f0336efdfc7
MD5 SHA1 SHA512

NSIS installer

installer

Improvisatorens/sphagnaceae/bepepper.txt

SHA256 2967ebeb5e16e9fb16ceb5f2770cc1718c9085d5188dec59f45a9b97640b926a
MD5 ae6051f666a4be61fee72e82be9472ff
SHA1 75e78487542eb4829cbec88dea748b7f83d6d93e
SHA512 4f4948ceb6320514c801951af1a8ed746d8a28d9520dcecb96802415d1c083327b2d8d0a24299c72d78c70a7b4c1d8a4c1286ab20257841aad72d6192981ee72
MD5 SHA1 SHA512

NSIS installer

installer

Spadestrens/bjrneskindenes.gal

SHA256 28958123b65f320945bf723d1c61d73c3a8eb8312564074cb35e322facb0dbec
MD5 2f948404ea3c59278e0d9bfcbe8d4c40
SHA1 5378d5d2b0fc0d0b8b966b5d902eb1bc7e6d779d
SHA512 b808f7fa33194c57581de9e6d7db8a8a5db275c005894b69d150d26fcb4b3a412bb2ac52a13c0d55a0e62eeddbc6ae6f19b2ccb19ce23290e7e035c335134b0c
MD5 SHA1 SHA512

NSIS installer

installer

Spadestrens/modalities.ali

SHA256 03822e3b8d5042bbc7751babf9a2510e4c41f75aabaef9d7317dafed5c2da04d
MD5 a8c0b0fd25b502dc728c818b01c4705e
SHA1 83c8f134624d964b0946e634229c09262b786358
SHA512 c945703ca4a7f28900a0929d4a6bbd4e2fffe3323e574c5e4f8ce4d3a5a9fbad948ea106ba030e66a66f52aaefe957578a8fbabab7fe3a42d0eddae095c285fd
SSDEEP 96:To5JpHQbnj0h4vYskWqKXYDC0zNo4/UdvwQI3m8mNly7wDXcNLZc:gHmnwh4gaoDC0zNfUPeVm3pXclc
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Spadestrens/parkere.lov

SHA256 82b86d8fb42303ae132dc37792151fde087070b9ae5dd01bbc2d77b5762942f5
MD5 9add6ad16f4e7b71089d9807757a8b85
SHA1 0127249edc98852b4afc12b17d8c00ea4bde8519
SHA512 0d52f35b9ac792e909da465ff72b1c089515ee936e9a1ddcba076d719431f43ac9c4e93b2c3c33bcf6a94a7638bcb543399f8d235301cedd34d6a16ca543edea
SSDEEP 96:PCiBr5RPnr9McV1tvyZvDmRvNBlcF/XiEwyeivw:PVRPpMcftqZyRvHUXkbr
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Spadestrens/retouchr.app

SHA256 38da1491f6996d1bd6c41949bb0ee04431d1f26991849be89b3a4fae488b76b1
MD5 78c3f9caadc9005059318c41af371f53
SHA1 47427be3d4d5c20b10ebe761d44fc3c6dd82b92f
SHA512 250acfc789595818403a27198c930a3dbe006336de9dec2c8c1e097c575d8cd1e2960a5b163975324fdc24b5cc9ce251fa28505cae48a1fe8a9676bc17906120
SSDEEP 96:2JZjKAUt4rE5yHGP/tmB4/cLodXL6FYYVtiCOfKRjY:iZjKAUt4Mh0CkenYQCRjY
MD5 SHA1 SHA512 SSDEEP

macos

NSIS installer

installer

Spadestrens/serendipitously.int

SHA256 8a0a214e24b244b5482ba9b064199ea53bc3975c89f70c04e8cf3021ea49fe56
MD5 66fe8032945556e76d24c01f08aa618b
SHA1 2d1c5646dd4de7be749ca66729962dbdab1ad4d6
SHA512 01b1b5e568e90c4f0c303f743f6e8288a3cc82bfdccbb8e5c95125a74f9531bc7a24831ffdafe95678161aa41a793a092e52c44e0ae625150fd24bb84b469a79
MD5 SHA1 SHA512

NSIS installer

installer

Spadestrens/skonnertbrig.pan

SHA256 b2b861402ecf76335d00df2551817ef8d8b1307d8d3e0a1349149779b26eb40a
MD5 2a94c01e0fec66a108816a0758176aad
SHA1 e13323600b9250de1eb773d897d4278f57adc5c4
SHA512 2081eb47cfabfd269d1708641d61fdb6d1ad0f402821cce808fdd404f7382f8b36726590cbde17a2f1fad29f5160b99b21c24df27842e5d433a76de1670b109c
MD5 SHA1 SHA512

NSIS installer

installer

Sharing

General

Malware Config

Signatures

File Explorer

b4834413f9bedbc2d64ba07d1401e4d1eb44a54adbca90bb79fc67bf03fa4ab5.exe

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/UserInfo.dll

advapi32

kernel32

generic

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

Improvisatorens/Laparocolpohysterotomy162.fra

Improvisatorens/Lrketr160.bel

Improvisatorens/Misdefine.vil

Improvisatorens/Taino.Tan3

Improvisatorens/Tgernes.sub

Improvisatorens/sphagnaceae/Stuepigen.hor

Improvisatorens/sphagnaceae/Talbehandlings88.uve

Improvisatorens/sphagnaceae/Thunderhead118.dop

Improvisatorens/sphagnaceae/advancing.fol

Improvisatorens/sphagnaceae/bepepper.txt

Spadestrens/bjrneskindenes.gal

Spadestrens/modalities.ali

Spadestrens/parkere.lov

Spadestrens/retouchr.app

Spadestrens/serendipitously.int

Spadestrens/skonnertbrig.pan