e31553f33eca2d232994d2cc1056d1b8426c3e8d4c12aa12a93544b95793d558[.]exe

resource
e31553f33eca2d232994d2cc1056d1b8426c3e8d4c12aa12a93544b95793d558.exe
unpack001/$PLUGINSDIR/System.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

e31553f33eca2d232994d2cc1056d1b8426c3e8d4c12aa12a93544b95793d558.exe

IMPHASH b40f29cd171eb54c01b1dd2683c9c26b
SHA256 e31553f33eca2d232994d2cc1056d1b8426c3e8d4c12aa12a93544b95793d558
MD5 736667e7dc440e5841a4b8e91f962998
SHA1 8db35b8be861540df59422eb979752b72379fa5b
SHA512 bc09edfa764fec004e4450c7208206a64f9fe01eb4a2158f7eba6c8a4c66a0c02e9143235a4ecbc1ed0cba3a4a8ad5d9a1ab64138ec145b36ebedb7e887ab0d5
SSDEEP 12288:yqAPWt4Lmt3ZClJfBIr5hT0D8qGBxhUeqJo:Set0D1+ulo
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12508

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

Sleep GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA CompareFileTime SearchPathA GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess SetEnvironmentVariableA GetWindowsDirectoryA SetFileAttributesA lstrcmpiA SetErrorMode LoadLibraryA lstrlenA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrcpyA lstrcatA GetSystemDirectoryA GetVersion GetProcAddress WaitForSingleObject SetFileTime CloseHandle GlobalFree lstrcmpA ExpandEnvironmentStringsA GetExitCodeProcess GlobalAlloc GetModuleHandleA LoadLibraryExA GetCommandLineA GetTempPathA FreeLibrary FindFirstFileA FindNextFileA DeleteFileA SetFilePointer ReadFile FindClose GetPrivateProfileStringA WritePrivateProfileStringA MulDiv WriteFile MultiByteToWideChar

user32

CreateWindowExA EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard GetDC SystemParametersInfoA RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx DestroyWindow CreateDialogParamA SetTimer GetDlgItem wsprintfA SetForegroundWindow ShowWindow IsWindow LoadImageA SetWindowLongA SetClipboardData EmptyClipboard OpenClipboard EndPaint PostQuitMessage FindWindowExA SendMessageTimeoutA SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA

advapi32

RegCloseKey RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegEnumValueA RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

CoCreateInstance CoTaskMemFree OleInitialize OleUninitialize

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/System.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 b9631423a50c666faf2cc6901c5a8d6eb2fecd306fdd2524256b7e2e37b251c2
MD5 6ad39193ed20078aa1b23c33a1e48859
SHA1 95e70e4f47aa1689cc08afbdaef3ec323b5342fa
SHA512 78c89bb8c86f3b68e5314467eca4e8e922d143335081fa66b01d756303e1aec68ed01f4be7098dbe06a789ca32a0f31102f5ba408bc5ab28e61251611bb4f62b
SSDEEP 96:qIsUxO9udx4qYp7AJb76BykUbQMtHUOA5Iv+RnsrqeXV+d1g2IW9t2c+cEwF9Fug:ZVL7ikJb76BQUoUm+RnyXVYO2RvHFug
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

9922

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Indene.Fer

SHA256 3f16d295e8157dc3cd6d142e930bb5ec79f900b698420dff712b99ce50bac9b2
MD5 51dbcb3141cda4fc2c352a517ae6d9e6
SHA1 406a7df6d549b6d5c3b1725ab844f3ac73c89acc
SHA512 91c826cf1b366abbca3fbf469314fe73180a76e8bce263c9012dc92f921081bd7aba9d2497da4de0962290bbf354926e6b9a5e7064b0e71222e6bce461ae9ae5
SSDEEP 3072:EscgkP7mNpETvBYDgzdyGEGykPOTougmHStR9WZ321vmDUE9oN3Goj7:7kxukXxPOUyoR9WZGJmDUiMGoj7
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Jagataic11.jam

SHA256 c03b6789e5c72fefe2ad3097a2c0cf5ec5792b7cc900fc4134726a3ae80947e4
MD5 930f984e688cd9ef115e4203464ca87f
SHA1 1477e06b37a01b11b8de279153b05f74d8206c70
SHA512 3b6c2123db05a1eeccaa4427b12f30f7fb61cd80be5200798df26bbd09ba33f39ada3c74e5bfc5dfad5bd22bf0094dc757f05745a492d2d862d542835dc5bfa5
SSDEEP 96:c1pc9UQbdPxE2EqKHsLJS7KJV0mA8mxp9BEah0RKxDjlzocox0+c537i+8GetdiT:cUEN+NJV0moh0RGDCcf5HevizV/Vjj
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Lamps.skr

SHA256 c0424488553811ed1661a7a5c382604485c3d41ebac31c9109e79c3cb6ff1b78
MD5 cfe7b136bb3305397216089c06bf564e
SHA1 476fda92ea43771a1566bdef95c4a682f4715b6b
SHA512 9f5b017243c7f26b23701d457bd065138495daa4db2d6a7239a0bf237c3972b27122f8f293ded5455022d2300d18e671aa3453e131f98601fb81f097128f4fc6
SSDEEP 96:HCtCvQqR7ITr/o9ZPtAxnAPNwDdJhzNL+/R5oNi0+:HC4NRcTr/CZPtqAPNadJq/zoNE
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Metachronism.urh

SHA256 0c19e80008c05bd191260d776caef0577a499725aef3b9bbe07077f4e94ccd0d
MD5 63a7b164200e89e94048bb4c402e1e6c
SHA1 58fb9a654fdc9c38a472001272ee389f0f19224a
SHA512 45205b249d768882d506e512dc83a5766bd0e0ea60e69e4df9bd6cd6d8a67e1d8add9c012dbb7ed1c357d2d3560d1d562a7cd7aa0d04cc2def2553f8387017e4
SSDEEP 192:3VIExJFJQMX4f5n6hOswst79uyWH7BtkqpqKPxBafH0F8dLRg1Ts:PjwMX4f5uzn4zkCqKKa8d7
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Ratskeller.Str

SHA256 a7ec511dbf859c91e62a0080e8a17c7ab1d5b6c948a88d705664a14631072500
MD5 968f122e568dc7ab273e5b6def3a8072
SHA1 01dec4cd24be46ec52cc9198f9a2cb3a9dfb9ca8
SHA512 6b84beda29d7a48536bc2632bd5ac59a3e84a7032f0c61289a3434edc7e6c7acaad735c381949789004954c3d2ae0329eb5b83764b2cdb15a0ac84d05819aade
SSDEEP 192:VYZrMpH3o2r+Vrlg1glhpJ3CpiuNg+lySDX0vHtweSfCsT:+Zrerip4UbJ3C0uz8aiH5Sq2
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Slidsning/Feign/Dagdrmmerens/Fordunkl/slater.con

SHA256 68f1921c23b7122f0352199bf163be33d3de2a414684fc64347b86f825fda139
MD5 b5ca399decd949ca7b8d3dc1264876de
SHA1 0b64b5c8f8ef18391e9a4f071f4f5d6026c5484b
SHA512 2b128681f2357b03a6b95281d06acc4f2785bd94ebfb74715696c6d58fe0bd69af610165500adbd9ad6acc9841f80854e8213645c7e3e326b17ca292584be95c
SSDEEP 96:sZL5EfdBduXc5wyr76BGsBrR8xPnCtgHHXbsXQbl:KVe+Xc5wygxFOPnCoXbbl
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Slidsning/Feign/Dagdrmmerens/Fordunkl/spars.fej

SHA256 059ff6ea1c335c9d07d060d96b807c55e601fcad378096e98bcb77773401fafe
MD5 664732b8002a55fff13ca0bd95599a67
SHA1 9b148b403c732f2a5a6e76f8c27b4ecbe9881049
SHA512 29188415338f7d16d2d31a6887193bad6db1a81c4280287d31cec654157e64976dec0a59e0ad0c2ae3b90cdab7c17e866d3369b6ca2063ebcc55058db0c073e8
SSDEEP 96:YSiKPLSckr0OEz6Kl2hLm7klHOTjuUkdoJEYgJ:xZ9kZc78HOjgskJ
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Slidsning/Feign/Dagdrmmerens/Fordunkl/stilleje.kli

SHA256 6cc84821a2dd9628c8e9e17c93f3057dc1e2e7bbfd3574bb13237334f75df9e7
MD5 99960ca97bfa07490db69843766c8fe0
SHA1 b30549c7f89e4d41cc48bf0aacbf08cae13de021
SHA512 e2c8451515a1ed840cc08735f0b01fb77f26dd09759af57b0cdd65ea660377472b184ae3d677f8263e07aae90c8d13643c8b82130fa3374a381805e92bd58c25
MD5 SHA1 SHA512

NSIS installer

installer

Slidsning/Feign/Dagdrmmerens/Fordunkl/unattire.gim

SHA256 54e522d9473187a895d72173ccd8c8e5af61c2e4f36370090338d3d7dc85d248
MD5 d1a67a79508c1af35d3100d16044c004
SHA1 48356741841286a0004282eb6fc6f5dfb1a577fb
SHA512 38bdaf8756552209823aadecab5929188f9e93c53b10c8bebe619da6e11e694b5f9ac2c65ee1619d3e03e3465939e0c80e6db198e22d0ef97ce21b32f38e5e92
SSDEEP 192:aswDwO5lZs1caadnTV12XF2p55kfTf4ridp1h9xk7:aswDP5l61badnx12V2rqfwCxk7
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Slidsning/Feign/Dagdrmmerens/pyritizes.rol

SHA256 8e38248473b8a9d50706c0b298282a02427e4ec24c078fced2caec71f691d4aa
MD5 43bc353132473db76b0bdd52274c9954
SHA1 c0942fc99b49df3d79c52297902935d0057f9adb
SHA512 b225f738a3054c704612859da6be2bf1aa0e2d638552bbc786839e5bfc01ea671d0f8f1b8daeaec290c4984ed2ba8ccc8451e5b4aa8aa1251a07bcd0e1c34532
SSDEEP 96:xrkR5tkQ9t4WJacW59B/uamypkE5tXtM41yKZuktPMM:1InTVJacWLTmnEbORMtUM
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Slidsning/Feign/Dagdrmmerens/skrmarbejde.boc

SHA256 be070fcdaff244ae8bd6097b8c0d6d9d86d360fbe7334ebee008f2fe0bc758d5
MD5 41a11855c67281da8ab73ef5533eba9e
SHA1 9815ec2d538ee3054e4d2da8456b1b779a7aad45
SHA512 22039d5655ed6d91e8aebdcb1d6209e6e4558ea04f115291dd42684701508d510e61b3bc6c9245d395c233e3e31b0ecff0c9c60f350baf8374633b6c950e7729
MD5 SHA1 SHA512

NSIS installer

installer

Slidsning/Feign/inchurch.kom

SHA256 ea6426047a3880274b1064beadbd385c1880b832adb7c17b9aca14f707acc9c7
MD5 4c7e52a1b0f9b66504b64e6f179e4854
SHA1 6648be7be52a4d51f025fcf3228ea8c3ad882020
SHA512 b32703fe5009c1ac81e84a612ac6b47a92a585d17b1e0386a29570bcfed31e3c153e80c142671be53a0d2a33edb525ccbfaa23326badcd89a99683a03b14a5c0
SSDEEP 96:Apgxd+mt+V6hT+jww7pCniN32qBtqu2niJxlu8q/iiVVgxgLg3CDedz:AmxArkd+jwwl60rt1xlm6lL3Z
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Slidsning/frantss.hbr

SHA256 6e706a0b69f8bc5c6e7659493cb2fc1c20c62d258d98f1735876e6162997285a
MD5 fd8420518371cc664f909eba03be49e0
SHA1 30a00269e0314dc20cc448fb0a071411f1b0261b
SHA512 301b56515a906a7e0279f5e20f8c812c537c26200f84acebfb98f3504ac79b0a1dbc486d01412f32816fdeeffe3575069820b17ad56ee89739c8cfbc9db931e4
SSDEEP 96:UqhA+kTve18YqhnVRti+XzqG/valTZ+e7kchDEij+:UPY4M+XzqNlTZ+egcRa
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Slidsning/hvirvelsjlens.cra

SHA256 9c6f91fd848997542164ef31e701177b94ce2d97207d0aa007b5707772521cd0
MD5 d7e6963b8c8d5b836d6e915d3eeeaeb0
SHA1 dbe19d7df96b8db71183504376c1c45811e1dc9a
SHA512 746d2d3ca7949fb88186f5073cea75de137dd37d0b8a1fc10a1280614158690089fd5cd03a03bf514c2b2bf824761a707d948547a34dd0c3328467175246b4a3
SSDEEP 384:Of1p8tR6qUpzoYpn1+2BEGrpOKp/SATT9/F:Of1PqIoYphEGNsATh/F
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Slidsning/images.jpg

SHA256 f3a235145c06d6d375448c8fca57ff293560f7083b26235d46508288b99ab570
MD5 96b442b458a174fe167059e370c68be9
SHA1 0e81d2f831cbea6f620cf06b1fc13d254f881f1e
SHA512 172d8a06a275477c63ce897ef4b1406c0f94a1ddbe67b9a5959fd94f3d0625b8f6bd671fa4798591e43b6b6ac22f480b0c2ce9b31f9932aa54fae108dfe9bce1
SSDEEP 96:fcHMuYbZzCMvpz2xhsNm9caeyul1Ckdh84r84tjkRNZy:YMuYbZzv1dvl7uJyj2O
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

afkortelserne.txt

SHA256 e4f68a6503808249b128a316a622e4a25a8fa386949e95aabb46cd090fb7faed
MD5 831b2c0d9d397eae7245d5bfe21a7c86
SHA1 3e77e34f434d7126fe7445d4b0b794da43a5cb4b
SHA512 615c0b166f33909aba102e027d111d13e2f7b01a13d15a409d4d8c9cf7670321b2139753b99be8b2a0b0cb106ef6791c1f83937c34a93d99e8ef0d1a74b2b292
MD5 SHA1 SHA512

NSIS installer

installer

besidder.raa

SHA256 2458c7036a7d714840d4002380ea670a9af7a11764988168f9bc46d30bd75d58
MD5 c8b0d2717e2e13d623012ec2a7e719c2
SHA1 766ca1457af832802472ae7814f3e9cb1b212d0b
SHA512 293e59914bd54e2239b89b49e876bf6024d4a639948a352e26b1f84e7d52babe039a0058d4a04d0cf5e04eee8321900133bf7b8dc129eaa445c2351c043fcfe0
SSDEEP 384:30XBHw36C3hPq6USTzU/XM/KM9+0msUF6+:30XBQ3pES/U/cP9+zsUF6+
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

blreroden.con

SHA256 1b1451756b350d89eaf08ebb187fb69a7562b012a9683286d696262b9d2ba4fa
MD5 ce5521b776a8420d9d4409158ffcf03e
SHA1 7a13c826244766070185f6c68c0fd57452c26b22
SHA512 b2badc7420db94e331a3713b0edc9d2f5b65b0350a30cd9ca4c94c8dc617d6f2bf6b3c9331167caffb4bece7ff537447058cb15fa115cf17d5dcba9b43c22143
SSDEEP 96:tJHrU5MCEdLi4/4d03jIm3npF89YShlCDa/uhzjLNDoXIp:tJ7Fi44d03jn3pF89YShltuhzvRcq
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

excerpter.vap

SHA256 bf96666138613a2ba36589b1a7441c27a846b1e44604f28da04a02a358ec01ab
MD5 e2ff50739c23b0f613012090c3a0a22d
SHA1 464fa4e08ceaeaf093a4fcc6927a738ef9307d7b
SHA512 9924e657eee25b9295839d57e691092f0025c402d11274108a86563e1bf90bf031566a9415253e36c199dd2e04577101d4ac343c9ae0471ff630cd11f6b6c8af
MD5 SHA1 SHA512

NSIS installer

installer

e31553f33eca2d232994d2cc1056d1b8426c3e8d4c12aa12a93544b95793d558.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Indene.Fer

Jagataic11.jam

Lamps.skr

Metachronism.urh

Ratskeller.Str

Slidsning/Feign/Dagdrmmerens/Fordunkl/slater.con

Slidsning/Feign/Dagdrmmerens/Fordunkl/spars.fej

Slidsning/Feign/Dagdrmmerens/Fordunkl/stilleje.kli

Slidsning/Feign/Dagdrmmerens/Fordunkl/unattire.gim

Slidsning/Feign/Dagdrmmerens/pyritizes.rol

Slidsning/Feign/Dagdrmmerens/skrmarbejde.boc

Slidsning/Feign/inchurch.kom

Slidsning/frantss.hbr

Slidsning/hvirvelsjlens.cra

Slidsning/images.jpg

afkortelserne.txt

besidder.raa

blreroden.con

excerpter.vap

Sharing

General

Malware Config

Signatures

File Explorer

e31553f33eca2d232994d2cc1056d1b8426c3e8d4c12aa12a93544b95793d558.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Indene.Fer

Jagataic11.jam

Lamps.skr

Metachronism.urh

Ratskeller.Str

Slidsning/Feign/Dagdrmmerens/Fordunkl/slater.con

Slidsning/Feign/Dagdrmmerens/Fordunkl/spars.fej

Slidsning/Feign/Dagdrmmerens/Fordunkl/stilleje.kli

Slidsning/Feign/Dagdrmmerens/Fordunkl/unattire.gim

Slidsning/Feign/Dagdrmmerens/pyritizes.rol

Slidsning/Feign/Dagdrmmerens/skrmarbejde.boc

Slidsning/Feign/inchurch.kom

Slidsning/frantss.hbr

Slidsning/hvirvelsjlens.cra

Slidsning/images.jpg

afkortelserne.txt

besidder.raa

blreroden.con

excerpter.vap