82940860d0091481df6eb2a273504bd2066f83649ffd87dffe03582440a938cc[.]exe

resource
82940860d0091481df6eb2a273504bd2066f83649ffd87dffe03582440a938cc.exe
unpack001/$PLUGINSDIR/System.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

82940860d0091481df6eb2a273504bd2066f83649ffd87dffe03582440a938cc.exe

IMPHASH 59a4a44a250c4cf4f2d9de2b3fe5d95f
SHA256 82940860d0091481df6eb2a273504bd2066f83649ffd87dffe03582440a938cc
MD5 0cb5485c0840cf976767bc45fb0b45d4
SHA1 3eee45faada0a0ee309065cc279b6c38e6dd809b
SHA512 dc7a88850a94809beeaccee769b580d6a99af3ac7b53b4720856cb341c3b57144480eca4b0ed00c791fc84d9a8544f255289b479ab97df407f1caaf9dbad9d56
SSDEEP 12288:2K9/JmMgq+TiZFJVsTej4jsLhzBMiMMx8cjDBlDvvK1adEMNqn5+:tj+Tirqej1RRx8O/vPdE1nQ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12823

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetTickCount GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA SearchPathA GetShortPathNameA CreateFileA GetFileSize GetModuleFileNameA ReadFile GetCurrentProcess CopyFileA ExitProcess SetEnvironmentVariableA Sleep CloseHandle GetCommandLineA SetErrorMode LoadLibraryA lstrlenA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA GetTempFileNameA lstrcpyA lstrcatA GetSystemDirectoryA GetVersion GetProcAddress GlobalAlloc CompareFileTime SetFileTime ExpandEnvironmentStringsA lstrcmpiA lstrcmpA WaitForSingleObject GlobalFree GetExitCodeProcess GetModuleHandleA GetTempPathA GetWindowsDirectoryA LoadLibraryExA FindFirstFileA FindNextFileA DeleteFileA SetFilePointer WriteFile FindClose WritePrivateProfileStringA MultiByteToWideChar MulDiv GetPrivateProfileStringA FreeLibrary

user32

CreateWindowExA EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard GetDC SystemParametersInfoA RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx DestroyWindow CreateDialogParamA SetTimer GetDlgItem wsprintfA SetForegroundWindow ShowWindow IsWindow LoadImageA SetWindowLongA SetClipboardData EmptyClipboard OpenClipboard EndPaint PostQuitMessage FindWindowExA SendMessageTimeoutA SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA

advapi32

RegCloseKey RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegEnumValueA RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

CoCreateInstance CoTaskMemFree OleInitialize OleUninitialize

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/System.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 b7ccb923387cc346731471b20fc3df1ead13ec8c2e3147353c71bb0bd59bc8b1
MD5 6f5257c0b8c0ef4d440f4f4fce85fb1b
SHA1 b6ac111dfb0d1fc75ad09c56bde7830232395785
SHA512 a3cc27f1efb52fb8ecda54a7c36ada39cefeabb7b16f2112303ea463b0e1a4d745198d413eebb3551e012c84a20dcdf4359e511e51bc3f1a60b13f1e3bad1aa8
SSDEEP 96:zPDYcJ+nx4vVp76JX7zBlkCg21Fxz4THxtrqw1at0JgwLEjo+OB3yUVCdl/wNj+y:zPtkuWJX7zB3kGwfy0nyUVsxCjOM61u
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

9999

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Blevins126.for

SHA256 d214b61bcc0a292df774aed4655752af5acb44e880bd82082ab716ae34dcedbf
MD5 63fe645623536fba3e2331e03cc60a1c
SHA1 236afe8b9ce94209890c73329bcfec36e2772f7b
SHA512 ef6432b6d5107883f6cfa5eed753ca96be4e59d89a883da67d8112a7ba7950a3462f2dee07228b89923569c727145396254c0eb10b84dfae1632cec17074413d
MD5 SHA1 SHA512

NSIS installer

installer

Classifies/noninstitutionally.ski

SHA256 fcc5d4a2e0881d23f6c696dfb854b0b348fb552c4cf6b001c2b2594f14e7f499
MD5 509f09bc859f53a5d728b23ea140eab6
SHA1 99e6e1efe5eb129b608e81f90b0109eae1763d31
SHA512 5c9ce0916d77de0d51fcf90dcd25144b679b5827074acbe2c74d862702582b6001a201540d5b00f07afcbb1fd1908c1579d2b05b69a85c4dacfc1e7274711ab9
MD5 SHA1 SHA512

NSIS installer

installer

Classifies/pulpwood.int

SHA256 00d99dd2f1d3196580d52247d1d45605da3f5ee2893bde0b6855dd10e63a7569
MD5 6d9c825c8ae36d64eef435461ce73532
SHA1 4718c6be7780a611d9a88e99effe5dff487f9bec
SHA512 b8e8bf5e1872d3981629d6747c21ae4634628792997c9322c0088251d47fcb83a516d6dff3c694d0134eb9ba77ec7d7bf3b09994ec9abed01554637aea6f4da7
SSDEEP 384:X1AiZV4bKGFvytAAQTi5hMU708wbHhzCiFel:llXGFy9D4HJ3K
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Classifies/seksturenes.sem

SHA256 624b10dff501106fd6297b70fafb3505dd1aacdaa29d895e72a0ae77ca0fab90
MD5 2b83bf46a89d65cf762bddc2c38e9e7b
SHA1 e59b337ac20c43ce7f4b486c38486f8912c98789
SHA512 6c217caf5d9a5f679c6e4904904b0b19f11c8a42547056442783f32ce73723fdd4f159127d38acc34cb3a91a3553ff73159ed895ed89e5a264426154f512af97
SSDEEP 192:RmN6YZxvgXhbbZhe6/PK5X1937sCfOh1ZGXerBUfk89HHWva2GkzypGBnaRKb:QNLxvgXhXZhh/PK5XH3QukzGOrBUfk8m
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Classifies/stonefolk.mor

SHA256 a82d5e28ff5c786801a0d526db840ee3452b74274c0d95a37c9a7180e0859d87
MD5 bd2878f5871e874fa3a7c037048f7c3c
SHA1 ddb784273bf208161e10c930ef94788f42c1e4bd
SHA512 35cd9c96334787a3d0168367fb27714339fdbc9f3107f81b2197730bf7b496d038b2d617f4f6c6f6d1a4b2c6375c9c36732af715e88b7f5cb2fa69516868cd24
SSDEEP 192:5D/P9kefPUbCijjBw/TI5F44EOvex8O5+2idKNr1k7PKTf0YsBcCfPdlEjQM/:tP/fPU+ijoQF44EOGuO5+2VNre+L0YkI
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Hakam.hrd

SHA256 d923009286a94ea38855a2badf858969428c2da0e65ac3dae8cb886bf3ee2bf7
MD5 568e524c05fd8ee41882bbc14464c6d3
SHA1 8130f25ad135621e2f451efd20a3b180c01a3f66
SHA512 00f9b3763ca9223002e421294a7fd69a9e9ffc2af399f48226fdbb0523a82aa5c4e6dcfdca073fcfa5b21df8ac397d0f6701cb47d8750915d370b627927cc308
SSDEEP 96:48Ez2ekD6/CkklLdgw/Hk4hHe1egefyK2WP3d+lw/6olYP1eI7:/EK4/+uwHk5DeaK2BW6rcI7
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Nonsacrilegiously/Udlse77.smk

SHA256 fe87ac62dbc45b792551492c09613db3f2831185f6e7a33ce5617bb0e59e3fa1
MD5 852509e2c3fffa729fdffccfe066cdb4
SHA1 f1c2f850464412285ff92f72613ca9442db734e8
SHA512 b4c1542fd567d265bd78df03691051d874ef6cd8fe6d29ad418c7dd766b7067183af5608e9f15941515b0e7846215399af33dd1facdf0bab966764b6ca377cd1
SSDEEP 192:VTVWctVeruwskAXv0v/LLDkNpYl7R/OuR6CHkm/EpRGtfMCzYaKN/:2ctsTCf0r0LcOuR6CHv8VsK
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Nonsacrilegiously/aerosolens.red

SHA256 2c11d49a6bfb47ed8197a18ded9282686795bab7e2f09b7b127917c88269b206
MD5 d81ec25a5bee5d384868b24a6a8c663f
SHA1 f131ab88175daf4039d860feeec4b1a6d21e121e
SHA512 2be940e42c70c592b2f9c3637f56851bfbbb8fab5539d51e04c3ed2e15e76e88562d176b234739c8eea3f438d328065e471077c278a2dace8af2fed02ce7c6a9
SSDEEP 96:cAbrH6fD8NbUwBsatM8DzRcRWXqUrDcML+Cf+5arV1lSRiHzLUlkLBj4I1Xk0:tLeD8BDmRlAHlnlS2LUkuI100
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Nonsacrilegiously/andantinoen.str

SHA256 809fda512937ef4c6bc58c22c47993dfa100ae4df56c8b0a14cb759a40e6ef62
MD5 74779824acae1e1c870095c780405054
SHA1 dc4c932288b739dd1345d7bf64a683750bee2c4d
SHA512 dccc9248e22cb16bbfdf7985f116f599eb97a4b63ccf8203276c600765648062c59238be409b18e9c9f09840e80451f3cf2f59ceae5b8d098c38bc5e399f4474
SSDEEP 192:fNq+2AFf73C5TP3cahnwy2G6kZhcm/bA/wdY1Z6+gFIDsPkXL4AQLd0hge1g3:ff2+u3wqbculuL949y/y
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Nonsacrilegiously/complainant.pri

SHA256 af12d990703c8fc341cbf9fe7f5b51938408d5fe48ca388db39bdcd35edd90d3
MD5 f4f390c25cfbb9f86edad76c437f6571
SHA1 548390deb8c7a5021676cb1e0c03fc6aabf89b98
SHA512 47f0520eafa72308b188099f796e9713a4cfcdea9bbbbf523136a371aea3d4d167f3467708ce9ec6d82bc09862da7d5bd122cb183796e948bcab41665d07238a
MD5 SHA1 SHA512

NSIS installer

installer

Nonsacrilegiously/divisioner.par

SHA256 290f31b8fb70c5e745918df19cf3a2dd3e7d368a2bc5d9c79611d004ab2ac9d8
MD5 7721863171ba672f3f660981c836e35b
SHA1 6f7a2c0d30d51ca6b31f0fcc803d58100d1d54be
SHA512 0474541ffe562d37bb638ea5500189f4e093e59a6ce8f4039e1bdd4ffb4ef7cbfa18d6850f81da416dcf91ba40836c73684be405091708351f5acd00dd27cc3c
SSDEEP 192:dZ0sW/87yXEweaM8tpic2SGGfMIyUlj0wggbxIrfmsxiS:dZ0sw87zjBspic2SGGR1lj0wgoxI3J
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Nonsacrilegiously/hyperalgebra.txt

SHA256 24677bd64bdfb8d904a096d013232993c005856ed59aa5ffbe504eb4f761cd75
MD5 8097e08408c796656d6fbe5b4011609a
SHA1 234444944cbe5c50c7dc38fd51c565cca3276164
SHA512 127264bca9489e3cef728204aa128e705730513025e8b7e0f8464abe5d0edee3fc8d5043e4da7d8a67a3a115aef7237bc04c6cd5cd956923afc1921fd3d29638
MD5 SHA1 SHA512

NSIS installer

installer

Nonsacrilegiously/jaqueline.bow

SHA256 71341213976b73e52a10998ccb06599c8edc6e7d12e3338927fe56e5dabae760
MD5 56013432ce9f5f20196ed4d8766eb72a
SHA1 4df3b7cdffd65dd9d14bb212080c608703906554
SHA512 c8bb9713c4e9b7cb95c452fa8e112b0c11a92f7c3661d902e50b51552981ab60404e5d84fb3cfc7b4794963c06e3b0e73892794cdaaf95846b8b67b838ae384a
SSDEEP 384:pl7QxurtO8pawzlNSBjw6YhtRK61R1f7W0:P7QxuhO8pawgwXR1TW0
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Nonsacrilegiously/macroconidium.fan

SHA256 f89e9a19b6d6a219d9aac39623dc5c30cfea6519cc7376e18656a5a7c999dc53
MD5 a1bb2c0226a81753c3c2f6fa6562b6f3
SHA1 edc6ecafa090b95f7b4a3e3b26a6a4e5539d932b
SHA512 26695dbf9fde77625a12be1f12797df821b8b20204d4be58d5e43e27159908d7afba4adaa1b39438d931c076854877b3008a4f12ce984053c877d5c89e15f000
SSDEEP 192:JwxK7lxC6+88oXtWeJvBdfUW8aZcrZFb0IDAeXBZ3QHju4LEFdTKUAZNW:Jd+6+88neJvB78aiZZDDXBZADu4LaSZQ
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Reallnsnedgangen241.sta

SHA256 ef7907372f05f11488321ab0694b0c59bb487f9b8c87e6c7ad93d33c226eb194
MD5 6e58e362553b5789e1069a0179b61372
SHA1 99780077dced2149b6bf80439172ff98df8f90e6
SHA512 6fb5a47a7b8937d898ff58d4fc5ed7959ab10c9e3eddf66585be7fb011cf46ac7eda4fdcbf81297deb841de807a3ca2a23c4b205c71cddef8d8dc87b1b15efb0
SSDEEP 192:ADjauT3yXT1VRXVkCGOeTC3WgdgTNb7dYSxs446HTXZG:ADjaZDFV7Hx3Wgd8b757k
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Stephanis.Bin

SHA256 cc97921e1fff1ee9561ea1d79f6ff1f297ab05004ae150828e33a2c032c3c37e
MD5 7f347cfa8f27e352ed83c3bb88c5057b
SHA1 8ee750c1e86644ca4e938ce66eac4c50207c1b21
SHA512 09d6c2c4c7eacf5f5ff9397cc13e5ef8a1a9565f5d292071c96a91969b3f0e029d0579f7cc2dee6b5a90cc67e3f7e7039572c165987b1655c7c871ad24b95ddb
SSDEEP 6144:uKPS3s/UriKDyqFZ8q/Uj6iYTVhKstsXxp0TL6OOGUMpo6hcHaj3jT:3NiiKDs0hKMsBprznM3fz
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Trykkestederne.dre

SHA256 e99bb7df5ea4a3983d7308a41630a8b1128a1f7e0e59b7f02511dfc71e67bdc4
MD5 9a172303da4d5a6fffa3583cd88a6848
SHA1 a59f712638898ed08e235ed321b8f3033f32b324
SHA512 4c6755ea315dca8868ea650cfaee595d60b910a6829df232cddb617318bd81b40a8e407e5b5135a485eedd76265a04a2ff75dbe656c5d216f1ef0672eaaf5631
MD5 SHA1 SHA512

NSIS installer

installer

82940860d0091481df6eb2a273504bd2066f83649ffd87dffe03582440a938cc.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Blevins126.for

Classifies/noninstitutionally.ski

Classifies/pulpwood.int

Classifies/seksturenes.sem

Classifies/stonefolk.mor

Hakam.hrd

Nonsacrilegiously/Udlse77.smk

Nonsacrilegiously/aerosolens.red

Nonsacrilegiously/andantinoen.str

Nonsacrilegiously/complainant.pri

Nonsacrilegiously/divisioner.par

Nonsacrilegiously/hyperalgebra.txt

Nonsacrilegiously/jaqueline.bow

Nonsacrilegiously/macroconidium.fan

Reallnsnedgangen241.sta

Stephanis.Bin

Trykkestederne.dre

Sharing

General

Malware Config

Signatures

File Explorer

82940860d0091481df6eb2a273504bd2066f83649ffd87dffe03582440a938cc.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Blevins126.for

Classifies/noninstitutionally.ski

Classifies/pulpwood.int

Classifies/seksturenes.sem

Classifies/stonefolk.mor

Hakam.hrd

Nonsacrilegiously/Udlse77.smk

Nonsacrilegiously/aerosolens.red

Nonsacrilegiously/andantinoen.str

Nonsacrilegiously/complainant.pri

Nonsacrilegiously/divisioner.par

Nonsacrilegiously/hyperalgebra.txt

Nonsacrilegiously/jaqueline.bow

Nonsacrilegiously/macroconidium.fan

Reallnsnedgangen241.sta

Stephanis.Bin

Trykkestederne.dre