960a287cacdeeb38a29b06b0a73f6f150be8064fd414b9e050eed13c03cbe917[.]exe

resource
960a287cacdeeb38a29b06b0a73f6f150be8064fd414b9e050eed13c03cbe917.exe
unpack001/$PLUGINSDIR/System.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

960a287cacdeeb38a29b06b0a73f6f150be8064fd414b9e050eed13c03cbe917.exe

IMPHASH e871f39e81b4aa977737b07cee050825
SHA256 960a287cacdeeb38a29b06b0a73f6f150be8064fd414b9e050eed13c03cbe917
MD5 60a7e716d4096c5b2d261711efa88189
SHA1 a026c01473285adf6115954308679e626a7db7e9
SHA512 15a2c1a0651aeb37063ba307d76c45404451c709220d67af6f9f996634aca8def08dc62fa081e4b01fa316543116612b96743a5b34ac5338cc14f8ae0485b799
SSDEEP 12288:f0VN1HuZE08wTl3yItrn5F9Foy6TZK/iVHCzwHBW:MHl08wT1yIV5F9qRTZK/WC/
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

1

Major OS version

5

Entry point

13552

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCloseKey RegDeleteKeyA RegDeleteValueA RegEnumKeyA RegEnumValueA RegQueryValueExA RegSetValueExA OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueA SetFileSecurityA RegCreateKeyExA RegOpenKeyExA

shell32

ShellExecuteExA SHBrowseForFolderA SHFileOperationA SHGetPathFromIDListA SHGetFileInfoA SHGetSpecialFolderLocation

ole32

OleUninitialize IIDFromString OleInitialize CoTaskMemFree CoCreateInstance

comctl32

ord17 ImageList_Destroy ImageList_AddMasked ImageList_Create

user32

SystemParametersInfoA LoadCursorA SetClassLongA GetWindowLongA ScreenToClient SetCursor GetWindowRect TrackPopupMenu AppendMenuA EnableMenuItem CreatePopupMenu GetSystemMenu GetSystemMetrics IsWindowEnabled EmptyClipboard SetClipboardData CloseClipboard OpenClipboard CheckDlgButton EndDialog DialogBoxParamA IsWindowVisible SetWindowPos CreateWindowExA GetClassInfoA RegisterClassA DispatchMessageA GetMessagePos CharNextA ExitWindowsEx SetWindowTextA SetTimer CreateDialogParamA DestroyWindow LoadImageA FindWindowExA SetWindowLongA InvalidateRect ReleaseDC GetDC SetForegroundWindow EnableWindow GetDlgItem ShowWindow IsWindow PostQuitMessage SendMessageTimeoutA SendMessageA wsprintfA FillRect GetClientRect EndPaint BeginPaint DrawTextA DefWindowProcA PeekMessageA SetDlgItemTextA MessageBoxIndirectA CharPrevA CallWindowProcA GetDlgItemTextA GetSysColor

gdi32

SetBkMode CreateBrushIndirect GetDeviceCaps SelectObject DeleteObject SetBkColor SetTextColor CreateFontIndirectA

kernel32

WriteFile GetTempFileNameA GetLastError WaitForSingleObject ReadFile CreateFileA CreateDirectoryA lstrcpynA GlobalLock GlobalUnlock CreateThread GetDiskFreeSpaceA CopyFileA lstrlenA GetVersionExA GetWindowsDirectoryA ExitProcess GetExitCodeProcess SetErrorMode GetTempPathA SetEnvironmentVariableA GetCommandLineA GetModuleFileNameA GetTickCount GetFileSize MultiByteToWideChar MoveFileA WritePrivateProfileStringA GetPrivateProfileStringA lstrcmpiA lstrcmpA MulDiv GetShortPathNameA GlobalFree GlobalAlloc LoadLibraryExA GetModuleHandleA FreeLibrary Sleep CloseHandle SetFileTime SetFilePointer SetFileAttributesA GetFullPathNameA GetFileAttributesA FindNextFileA FindFirstFileA FindClose DeleteFileA CompareFileTime SearchPathA SetCurrentDirectoryA ExpandEnvironmentStringsA RemoveDirectoryA CreateProcessA WideCharToMultiByte GetSystemDirectoryA GetProcAddress lstrcpyA lstrcatA MoveFileExA GetCurrentProcess

$PLUGINSDIR/System.dll

IMPHASH 595a3fd71239f605bb02d7a5e48fd4df
SHA256 c85142f86e1ec02f7ef8d5ba31b22031de3de9a16bce519d5482b824afb277eb
MD5 10e8921a6e7f6a74671b07dc3bde626f
SHA1 b7961066600ef193c5319dbeed3673dc60110a50
SHA512 4c19a7e3117baeec3f6a7f9a33cfab392255741137406db87fe5ac24def7f9a28b2ed0fc26f0f46c5d43ba1bb6675dea74410a797bfd265e38812b042460aa00
SSDEEP 192:Q9rQDenC9VrcK7REgSWOprANupQYLRszDDH/d9CWlXo7U6Wxf:QJQEaVAK7R9SfpjpQYLRszfH/d9CWB1j
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

6

Entry point

6599

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Beslags/Roundtree123.txt

SHA256 b433ae6a3b78d6eb0c4f64c1ba6ccc4fbad38e509dfff0b928d5d007504bb248
MD5 dfb86376ad9524e21c345e3e5a8a5d72
SHA1 9a36c760df474c8c7932caeb451d0f1142356d34
SHA512 735ab7587c3d21b1d3f10292ad4abbe3af533331b717adfff5d8defedb881f387fce2f0cb3b22bbe79ab7e540ec6f2f046e65bd48b2275cbe4b4e45721f187cf
MD5 SHA1 SHA512

NSIS installer

installer

Beslags/ansigtsudtrykket.hne

SHA256 d418557f9f446f34dfc4af4f8cdaf1c0b2494c749719c733586c6ef3aa1b56c2
MD5 2bf6d7b1b9e37d14983df5c3c67bfefa
SHA1 a552cd4ff1ee27797967c57b2bd339e55043a2b8
SHA512 e87bba19acbb806eb6705a55c8f063e83f10cd34980bfdd636adac1dc5953d64b620b60e3a52ffc32a81ae86fc3508b9b5c95385e06ecf01b30572d979ff6a6b
SSDEEP 96:pXTC8m23UGMvoBuUNLoCxoj8sCNUjcUpt:pjC8lEGMvoAopCjI9UX
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Beslags/antitrochanter.adj

SHA256 86e301c6adaab8ba88bf20bd680236d43eebb81e82a5a873bc23176063d9e20a
MD5 cf315ed34b500578b564cffb43c2eda2
SHA1 419aa5066caf01b71b80dda79e1a5ace204f8cfc
SHA512 9839af2359b36395200c0d7632f17b00398cb3d8992375376e38f28d05cf9e4109f40dd330bee1b945ac336689bc819ec001812f9b4bc76a1392644194df7e81
SSDEEP 384:Gv7QE3ksAdkDNQYYtPemQFefXASpOQVDuaEifFD+V2:KxUZN3WmQFefQcJD5dfFDJ
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Beslags/bi.bar

SHA256 d838d9f2c1875029cdad778dab084ef92b1256692f218a2b605c13faa9cfc526
MD5 788a6fb8546b67aa58cb43c66c2fa137
SHA1 c8f2aebaf3755e4d2924cf90c19d5526406b45f4
SHA512 954b6807cf5a829d110847eb2193ce02dda014c51ad1311fe97bb54b1c9f97a74f59afd5de84feee71e2f30c6105a574fd260987a83ef43f58de8a717e382fb1
SSDEEP 96:o8SHW0UuoByjyaLuOIW8qfoCLztZWThznqXZ4Yl2OCgBgk045MHncLjS8JtvB:otXU5apf8HD9Om2Igyk045MHn98JxB
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Beslags/cavalierish.ise

SHA256 8263a84b079844da0279ae9bda82c23ffe2a52b6f15f3fb2f52289170baaac81
MD5 37450ed3139ea6c42bfe7261477df877
SHA1 6b13d7720f7ac2f36bf0bcb80aeea1f3103ecb05
SHA512 0173976be5f3a70b8a0b72536b5a690ae7e7d38e68c6de29d272be48fb72ee6208441b3bcfc63e1d38eae5093f6a720c17454b2e774c273cf7d4f787836f4897
SSDEEP 48:zRtBl/8kBirLUgWK6xWP2MAoiNEisZSrogTtnCcE7F4R5rQgT4lTAJjqpKDNsjW0:zngToxOtiTomCcE7KRq7xmgfhZCa/7
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Fragtskibene.Sta147

SHA256 4e5e8fb43d7ffe9a6489d7bb602e79a2632e0a907480333504128065a428a6d2
MD5 5accedc7625c6431263763a0db46e07e
SHA1 8077643738b602ce14854dd1cc36cac5a159da60
SHA512 48b7dd7360318916f18a75814de3ad0b788da0bae2cf61883d42e4f0b4b5b1474dfff8f2b9a187201d458c18db0b1a87dbd7ca464a19b5f543762b4a28167ad5
SSDEEP 1536:REUREIBYPv2HY62Gpf+X/3yarWiT2LpH34Tb+kWKggCG:iv2HY62Gfq3yayiaL+3+kQgCG
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Freebies/Unexotic/nonabstractedness.tav

SHA256 3f0edfe7113efd354f8cbbe352f3304ce821fe9e908ca1c5ba6b1371a345759c
MD5 32810ce14123c8949cf5201921ea554e
SHA1 d47d6a2f23fb4ee17ca9c51be94ce2fc6beddd30
SHA512 4e557f596f7daaf5701515a63145051830953fb672ec6f699a724976eae604641a7badf99b7cb48415fd874f4b12865a33178729b1649256f9820d99653cc7d4
SSDEEP 192:/Xlwa6dE9iEZeFKbuww6F3oM/gb5qkjuFU8xGjLxrH8beV/4g:/B6dCNZeFmzF31M5qddAxL1Vwg
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Freebies/Unexotic/outskipped.met

SHA256 bd5ebc0b5b76e6bb2896266d15cbaa5d3ba45614b3b3ae02df74a188fa10d430
MD5 098a9da0b53faf9ccc3c5f253098256a
SHA1 1e961966689220ed7971e0ce01eddde10b6aee68
SHA512 2e95d5110b46503008390b9657e841c6fa6271cf7774084626f603580541cc58411c3bdb8653c37eb98583b12c231e286d20c2a84f1148e3a929451584338fd9
SSDEEP 96:iMV4m0BQv7B+AtC30w3NAbbcLDhMjQrAAUqkG50cqRWnS9sfHiQj6SsEl7fa:96RByAA4x3NyxIpkG5uWE4HiQj6SsUfa
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Freebies/Unexotic/prisregulering.for

SHA256 b731920cbcadf92e90a5eac7dcb9a201fad31e1bb750b404a1268b7d3225e78f
MD5 4cf0420008426c1c0e7de04ec15702b6
SHA1 1d67c4f75b8abce8cd0c090640e3468057457dc9
SHA512 c766007cc50ba2345fe95f2eaa7fea70123009660ddbb8e30c26042235b2ddb89d26e5cf89f3326b9d499ad26b1d4a60380df84d7278de42009f530e40cd6c3a
SSDEEP 96:5oaJJQ+9HrCDwsp7g9pfX3GM846lwAWXuI/8:5oajtrCWJX3r8bQXu/
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Freebies/Unexotic/subtrude.std

SHA256 9481b398f8a9e9817431a6c67b2dca6bc2791ba08518b19f9955864b260fbc44
MD5 d8f38c52638805c550029a4dfd9c0f7a
SHA1 009c7bbc7ad68eb1c7487a384cbd12301d974df9
SHA512 5a9335ddf685a7e7e1b34a3d7c4ee55f7905989571231452b19756358df47148483b5143a48b4a6038588f9568e673bc4b591329d3b59837774712e1bf927485
SSDEEP 384:NPfydxjor1y5pGMw3vhKyTpz/CCHGu0SKF+XQOby:NPfgoRCUfhFpz/lT9K+Ax
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Freebies/Unexotic/totalindtryks.pro

SHA256 0bd3898b8aab56b0131f42eba547788b20d50fba8aa4cc493c3cbc4ff1e0d239
MD5 538169edcf478e5cb8621ea131af13fc
SHA1 d9b26438273172dff73884e4ff79ecf5e80cef92
SHA512 b4c92f9f8e242c449bec4d98cc8ec800fb077eeb44bbb53072ec04ef199b3d8287daae3d34a037a104b892d28bf378952b13dc8aa9b7a63ef5f5713472cd0950
SSDEEP 192:XDP+a2QdwWbXW7coPmsf+X7N8vEwtBfTJY3vmjUKC6ms2:Xr+KdRm7ceELN8NbfTKmjUb6ms2
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Freebies/Unexotic/trypetid.oxb

SHA256 673797bc722a5668612a5752f58fb00161dacb6ebdf2f7417c9adf1deddb18e7
MD5 6d1fdda67a68d30c2cb3c189116eba8e
SHA1 8021196d034f4fe6f1c263e773c27ccfda10b8a3
SHA512 21e428a0a8a4b58c01e6613270bbc0c1c6623db58ee9254b0b07b0d4f877ae8590c69d6c1ecb1a0b11ecbcb2c6f81ad51127d7b4286f45d03f917590cda84e0e
SSDEEP 192:jMZFhW+70Fh6lHOlKYhKq/4IfjILCrA2bjrILXjpqVTC50+LXK4XwPIydafFz04Z:jYhW+oFsHHc4drOkjpqBC5jQzEJ/1j
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Freebies/Unexotic/vicegreves.kol

SHA256 198f720b8c7a145b0759c003e4d542ca3659eb1f0dc1015313c620f523c385af
MD5 09ea63c2836740f1bbc6cb167fc55fb6
SHA1 55972b38c1d373d0dbfbcbcd664e31056b86da17
SHA512 c81e25e3363c80b05694e3ab3f93751d47a0667f6d1c79777608f9d09abf4c3a026da51e3d9cc51e347be8ed0af901085810b08b4a05380cb839ac8918247e25
SSDEEP 192:JxhWZ252z9PkfsLW+H1+RwyuzoahFtmXt3KdW+iAkbksEPv6ucdd2J:JO45A9WsL8JuzxFMtkW+f8EPiuGg
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Freebies/kludders.und

SHA256 d541eca0ef61ab5491c4084b8f55b25506b201ca401ef9f046191d7b70e5767f
MD5 b048d3e83c1099b949b07c492c60f339
SHA1 4239ebfcf3aecf2b5d9f6c7a57a9298006df053a
SHA512 88dd6aacfe8ba854eb52193d6b64e7cb4ba421210d50ef4c55ed223f08f0b490d7ff79fe8da15bae8302910fea5b4a4baf80c81c2ae9706e88f802e848c54c2c
SSDEEP 384:9NxKTSakWZg5jCYqPi+jOFsybHAwrNY2z48DjEP:pKTSZyAdqPiuyhJFDjEP
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Freebies/lnk.non

SHA256 b4a830de374e9d6426864576367f70971d96c84ac576ca181c21d3911a1cce9b
MD5 803d3a674b68bd2d9c3028f76856d323
SHA1 42a298a8aadbc3aa55de02c05a95fc68d0bc6a39
SHA512 33afac86655d5301ff3363a840f9dff4812d5e252ad6e6f12e0a1feb126bd6e592795163d9e3ca26c66aea96842a658382073b189f40a2f0afee1226c7b6c261
SSDEEP 192:yO9i/MMDB/QkQecZSFFdjMltgR0nDg7YpXkRpu76briIYXD:yuvu/vQecZ6djMrgRkg7YxkRpu+FYT
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Freebies/missilformularers.lit

SHA256 6390bd6d07a417eeb717f9dbeb799381ec7f3f6a966bfaa36b7666a6e4dae7b3
MD5 32e841c179c56e4ee16b76b6af2fe8ce
SHA1 b40bf0e72e99621a626f98a63658d93fdcf2bafc
SHA512 945ed3bb4595301f120f9b9975d363dcf4a464514eb20097eea94f48357c950ce204890521e49ca10d4dfff1c9a611e8d75d8ed497c0959adb8de7f5feebd3da
SSDEEP 192:qg1ee+qEQx6iFGSkVRpnuxE5tzmgbcgJ4KJwQGbzRyo:qgNfE5iFGNV7ntyg9VJsP
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Guldure.une

SHA256 47a82c85f8b4e3f7962094d7559888af136d4be598c6ffca1d3323a9dd92ed33
MD5 a186495010d361d8c69a28eb93e49a6c
SHA1 12a74862ef384839608de4a5c4c21c80f67c08ea
SHA512 e5aaa62da931a10287a6e02846d3b2d75d54412d1ce87ecb42eb0ed0e046fe4eb9885f79dfba8bb5e5fa47ba44e788f9e989de0303a10bdbd97d22b7b97d1849
MD5 SHA1 SHA512

NSIS installer

installer

Undemureness.Spd

SHA256 2c709130d88c97062791683b1ab14b6cb980b42689bfc8b2633ef5c2021dc5bc
MD5 3250330b0813e399e1a9ada03fb61ab3
SHA1 bc06c8e4113afb3d68a19d71aae3d58667949863
SHA512 06dd8806e960a5bd043fcf75d6f3b766edf4a87ea9f1580cbd85a06616fc32474ad3f573412b6780fe1b98378d6ad25983f859598e04f1fb8cb3982c39d11102
SSDEEP 6144:B5xCBraZqE4cEJdtXLy8dC6VvHwerAWrM/6Zg7:wraAcOtG8dC6dw7W4n7
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

960a287cacdeeb38a29b06b0a73f6f150be8064fd414b9e050eed13c03cbe917.exe

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Beslags/Roundtree123.txt

Beslags/ansigtsudtrykket.hne

Beslags/antitrochanter.adj

Beslags/bi.bar

Beslags/cavalierish.ise

Fragtskibene.Sta147

Freebies/Unexotic/nonabstractedness.tav

Freebies/Unexotic/outskipped.met

Freebies/Unexotic/prisregulering.for

Freebies/Unexotic/subtrude.std

Freebies/Unexotic/totalindtryks.pro

Freebies/Unexotic/trypetid.oxb

Freebies/Unexotic/vicegreves.kol

Freebies/kludders.und

Freebies/lnk.non

Freebies/missilformularers.lit

Guldure.une

Undemureness.Spd

Sharing

General

Malware Config

Signatures

File Explorer

960a287cacdeeb38a29b06b0a73f6f150be8064fd414b9e050eed13c03cbe917.exe

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Beslags/Roundtree123.txt

Beslags/ansigtsudtrykket.hne

Beslags/antitrochanter.adj

Beslags/bi.bar

Beslags/cavalierish.ise

Fragtskibene.Sta147

Freebies/Unexotic/nonabstractedness.tav

Freebies/Unexotic/outskipped.met

Freebies/Unexotic/prisregulering.for

Freebies/Unexotic/subtrude.std

Freebies/Unexotic/totalindtryks.pro

Freebies/Unexotic/trypetid.oxb

Freebies/Unexotic/vicegreves.kol

Freebies/kludders.und

Freebies/lnk.non

Freebies/missilformularers.lit

Guldure.une

Undemureness.Spd