932062a2b5551bbd3bfd56e5bd96891cc6a65363ea05c197aa9b950e45b9dca9[.]exe

resource
unpack001/$PLUGINSDIR/System.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

932062a2b5551bbd3bfd56e5bd96891cc6a65363ea05c197aa9b950e45b9dca9.exe

IMPHASH 3abe302b6d9a1256e6a915429af4ffd2
SHA256 932062a2b5551bbd3bfd56e5bd96891cc6a65363ea05c197aa9b950e45b9dca9
MD5 732413351fefa0a8069912c0d1325629
SHA1 729457db072fdf2ad63772180358183c98dc6c87
SHA512 8e85435f009dec802e5b5760a491449c5b08669064af9ca49a1a36801e26870d4abb1012feefdd2c419689e54457ff89042b50ff487fd102f7295ecd9b403de5
SSDEEP 6144:YwrvOkgBWZb4JhMOLAPfoxo9qxkNFMhidSv4AnQX15oVnm8K0I:pOkgBWR4HMYgfoxo9qO7I7WDImPr
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

3a:20:e1:1a:79:ae:2c:0e:84:76:89:8d:64:45:b2:15:82:60:ea:29:9f:d2:03:22:9b:af:34:23:c5:4e:4f:19

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Fraadseris,OU=Finary Uncountably Lideformet\ ,O=Fraadseris,L=Fenouillet,ST=Occitanie,C=FR,1.2.840.113549.1.9.1=#0c207375706572696e646976696475616c6c7940416372696d6f6e696f75732e496d

Chains

May 27, 2024

Minor OS version

0

Major OS version

4

Entry point

12758

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetTempPathA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess SetEnvironmentVariableA Sleep GetTickCount GetCommandLineA lstrlenA GetVersion SetErrorMode lstrcpynA GetDiskFreeSpaceA GlobalUnlock GetWindowsDirectoryA SetCurrentDirectoryA GetLastError CreateDirectoryA CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA ReadFile WriteFile lstrcpyA MoveFileExA lstrcatA GetSystemDirectoryA GetProcAddress GetExitCodeProcess WaitForSingleObject CompareFileTime SetFileAttributesA GetFileAttributesA GetShortPathNameA MoveFileA GetFullPathNameA SetFileTime SearchPathA CloseHandle lstrcmpiA CreateThread GlobalLock lstrcmpA FindFirstFileA FindNextFileA DeleteFileA SetFilePointer GetPrivateProfileStringA FindClose MultiByteToWideChar FreeLibrary MulDiv WritePrivateProfileStringA LoadLibraryExA GetModuleHandleA GlobalAlloc GlobalFree ExpandEnvironmentStringsA

user32

ScreenToClient GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard PostQuitMessage GetWindowRect EnableMenuItem CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndDialog RegisterClassA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx GetDC CreateDialogParamA SetTimer GetDlgItem SetWindowLongA SetForegroundWindow LoadImageA IsWindow SendMessageTimeoutA FindWindowExA OpenClipboard TrackPopupMenu AppendMenuA EndPaint DestroyWindow wsprintfA ShowWindow SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation ShellExecuteExA SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA SHFileOperationA

advapi32

AdjustTokenPrivileges RegCreateKeyExA RegOpenKeyExA SetFileSecurityA OpenProcessToken LookupPrivilegeValueA RegEnumValueA RegDeleteKeyA RegDeleteValueA RegCloseKey RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/System.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 a1390a78533c47e55cc364e97af431117126d04a7faed49390210ea3e89dd0e1
MD5 fbe295e5a1acfbd0a6271898f885fe6a
SHA1 d6d205922e61635472efb13c2bb92c9ac6cb96da
SHA512 2cb596971e504eaf1ce8e3f09719ebfb3f6234cea5ca7b0d33ec7500832ff4b97ec2bbe15a1fbf7e6a5b02c59db824092b9562cd8991f4d027feab6fd3177b06
SSDEEP 192:yPtkiQJr7V9r3Ftr87NfwXQ6whlgi62V7i77blbTc4DI:N7Vxr8IgLgi3sVc4
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10465

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Haemosporidian/Blyantsstiftens.Fum

SHA256 6915916f9c9bab807ebd008733850f82e56c93e11b5220a33c66d1c2132a83fa
MD5 a95c10ea17dfc4d55291679147fad5f4
SHA1 95b102dbb99f6a1c590f450e1013a85bdcac6202
SHA512 98b00bbe8944e7ac00ceb80dfd164b060de8861cfacb1eb20e28bf7f479e0bba81c018d968ac0842a7fc36861bf4801dfb14922d30a3bb9aef2425f114e09c3a
SSDEEP 3072:SDjwNKbbdJHDKeJvGf73yTqG2cW9KUtpJRvbJ3p0BwBu+tOuyRg8gHD:S3oKbbrjKLf73yTqLcp4pTvbJ3CwBu+l
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Haemosporidian/Politiinspektrer/Plasterer.Cow

SHA256 cc89189f03167850d6cd441b84802c12dd8a09ce9a666a6107b48fc5d345da1c
MD5 aea85f66a744a546e182179e6718ab9a
SHA1 97c66382bc94139766847053475f6c49cdb66f63
SHA512 d9dca93d5c0af460d78718e2b7f3c04a19fda4a781b2724dc56638e90f8bdc9decb3b9bfd5461c5836ebd42b0d78f6d372e3649e9b2c65824cffba71fdd5b79a
SSDEEP 384:b9BLD5p3nTttRzRDpNlFFm26/CpZmmjPwAw7:zLrnH5pfbF9VZ3jIF7
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Haemosporidian/Politiinspektrer/Preconsole.txt

SHA256 f2da88a67b3192887e7cd4e94d4cdde79c8d5a12e05a7796e8c7fb5c77313734
MD5 30f0c618be6d3404d64fc65b3ec092aa
SHA1 f5a0fd8fef29bf685d0045c22d4ddb3667d362a1
SHA512 a74f7e96ac7a5ce8bf36ff683a8c30ef994dac039c70f9f639b9a93b27a3408167be8ebad4482920382daf2fee3fc1c87028689e33bec7c5f7f18663482f0927
MD5 SHA1 SHA512

NSIS installer

installer

Printerkablers/aeroscepsis.blt

SHA256 befc3a9ff5225aad00bc4eba3bd87fe3c09b076d792ec6f31fec1776cadf444e
MD5 bcadb46b1d96274991878cae8ee2ea57
SHA1 7ad9d3a8418568e446f42a74a9e45ea12b557ed4
SHA512 ea61080dfd61e0533a024ff10b9fefcfe6eb16ee24330d587fd26a53fa7dbff8a01cded5226ee4ca44ab39d9169a73eab9e5f9a9b4ba2dfabb0f6d4447cda160
SSDEEP 768:Vx/Zw7QViGEuRoFA4NfIfnFC1Vall/xKIKE1I:2k
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Printerkablers/letched.und

SHA256 a0f2a183ad849396b641d05c30caeb88abe25d5e5171c7b3ebab4b98f21b8926
MD5 fd195dec380b7a01b4235d01bbafd941
SHA1 47628899c6e416dfbae45c62f7994ccc947fa06f
SHA512 56ad780639116f9abdd13aad3ce5d4d4acb699b7987ac09c5f112c132bb9ab93b3037d80fc40ebf7be987609b113a3577d0fd884bf5f1c70448f9609ec917185
SSDEEP 768:4uNASfJ0iqIvC8Hp54fikre2Zb467K7vgsIflqQM3q:
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Printerkablers/ultraorganized.sti

SHA256 dde633f92d117b3b49b41a6e632aeb6cb0441eefd29da72f481ea34a3e6818d0
MD5 1684192393aaa81e3e841cca9cd2e38b
SHA1 747c50cf952bef6b93e66ea6a352f0252e7d247a
SHA512 b551b54ad2dc9d7160370134fbd2befcb0cc25f1fa5ef65d0bef61d41858ef547cb6232dd8cbc45b8b5df2b5c6ac83cdbce01c1cac53613a64df519e6eed892a
SSDEEP 768:pogzND9jmFbukSXRKdeeY8zuBeo/PdQwaxmvWBlg:
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

932062a2b5551bbd3bfd56e5bd96891cc6a65363ea05c197aa9b950e45b9dca9.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Haemosporidian/Blyantsstiftens.Fum

Haemosporidian/Politiinspektrer/Plasterer.Cow

Haemosporidian/Politiinspektrer/Preconsole.txt

Printerkablers/aeroscepsis.blt

Printerkablers/letched.und

Printerkablers/ultraorganized.sti

Sharing

General

Malware Config

Signatures

File Explorer

932062a2b5551bbd3bfd56e5bd96891cc6a65363ea05c197aa9b950e45b9dca9.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Haemosporidian/Blyantsstiftens.Fum

Haemosporidian/Politiinspektrer/Plasterer.Cow

Haemosporidian/Politiinspektrer/Preconsole.txt

Printerkablers/aeroscepsis.blt

Printerkablers/letched.und

Printerkablers/ultraorganized.sti