c1ac9d7f43c663808c60ff26c2e41f32f5d101a8ef0f76d68cef613b19fab280[.]exe

resource
unpack001/$PLUGINSDIR/System.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

c1ac9d7f43c663808c60ff26c2e41f32f5d101a8ef0f76d68cef613b19fab280.exe

IMPHASH ea4e67a31ace1a72683a99b80cf37830
SHA256 c1ac9d7f43c663808c60ff26c2e41f32f5d101a8ef0f76d68cef613b19fab280
MD5 b70a38a0517d82332d49008ed8544280
SHA1 5d2405742b69a74d1534746919f9125204234114
SHA512 1267737b027b3b9a77945a111352591f8c231035fe7a093f06b2e296784096775cfcfd819dbe437cd38c60babd154900707971a5626b84e083ebe044f6478542
SSDEEP 12288:/KdQYPhiCUSyZsnY40EfLB5uarQWBLqBmxsTEUL9i6aoEO7nLOilOtE:/JYHUS9F0ETB5uD4LqBmxC/Lw6L7Ki/
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

ab:b9:d1:d3:bf:f6:f8:1c:47:1a:40:38:1a:30:bd:20:b2:72:18:e4:b7:fc:07:fe:67:ee:22:fb:1e:94:a3:1a

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Boraces,OU=Nonvariousness Streptococci Momsbehandling\ ,O=Boraces,L=Welcombe,ST=England,C=GB,1.2.840.113549.1.9.1=#0c166d6f6d69736d40496d70657261746976656c792e5374

Chains

May 16, 2024

PE Signature issue

Digest

4b:28:dd:b3:1b:e8:b9:5d:86:dd:11:d7:21:13:43:8c:81:63:a7:44

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Boraces,OU=Nonvariousness Streptococci Momsbehandling\ ,O=Boraces,L=Welcombe,ST=England,C=GB,1.2.840.113549.1.9.1=#0c166d6f6d69736d40496d70657261746976656c792e5374

Chains

Jun 7, 2024

Subject

CN=Boraces,OU=Nonvariousness Streptococci Momsbehandling\ ,O=Boraces,L=Welcombe,ST=England,C=GB,1.2.840.113549.1.9.1=#0c166d6f6d69736d40496d70657261746976656c792e5374

Serial Number

52:b2:77:dc:11:fa:03:7a:83:43:c5:8c:1c:06:3f:7e:ce:e4:d6:c8

Issuer

CN=Boraces,OU=Nonvariousness Streptococci Momsbehandling\ ,O=Boraces,L=Welcombe,ST=England,C=GB,1.2.840.113549.1.9.1=#0c166d6f6d69736d40496d70657261746976656c792e5374

Timespan

Jan 4, 2024 - Jan 3, 2027

Subject

CN=Boraces,OU=Nonvariousness Streptococci Momsbehandling\ ,O=Boraces,L=Welcombe,ST=England,C=GB,1.2.840.113549.1.9.1=#0c166d6f6d69736d40496d70657261746976656c792e5374

Serial Number

52:b2:77:dc:11:fa:03:7a:83:43:c5:8c:1c:06:3f:7e:ce:e4:d6:c8

Issuer

CN=Boraces,OU=Nonvariousness Streptococci Momsbehandling\ ,O=Boraces,L=Welcombe,ST=England,C=GB,1.2.840.113549.1.9.1=#0c166d6f6d69736d40496d70657261746976656c792e5374

Timespan

Jan 4, 2024 - Jan 3, 2027

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 23, 2017 - Mar 22, 2029

Minor OS version

0

Major OS version

4

Entry point

13409

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCreateKeyExA RegEnumKeyA RegQueryValueExA RegSetValueExA RegCloseKey RegDeleteValueA RegDeleteKeyA AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken SetFileSecurityA RegOpenKeyExA RegEnumValueA

shell32

SHGetFileInfoA SHFileOperationA SHGetPathFromIDListA ShellExecuteExA SHGetSpecialFolderLocation SHBrowseForFolderA

ole32

IIDFromString OleInitialize OleUninitialize CoCreateInstance CoTaskMemFree

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

SetClipboardData CharPrevA CallWindowProcA PeekMessageA DispatchMessageA MessageBoxIndirectA GetDlgItemTextA SetDlgItemTextA GetSystemMetrics CreatePopupMenu AppendMenuA TrackPopupMenu FillRect EmptyClipboard LoadCursorA GetMessagePos CheckDlgButton GetSysColor SetCursor GetWindowLongA SetClassLongA SetWindowPos IsWindowEnabled GetWindowRect GetSystemMenu EnableMenuItem RegisterClassA ScreenToClient EndDialog GetClassInfoA SystemParametersInfoA CreateWindowExA ExitWindowsEx DialogBoxParamA CharNextA SetTimer DestroyWindow CreateDialogParamA SetForegroundWindow SetWindowTextA PostQuitMessage SendMessageTimeoutA ShowWindow wsprintfA GetDlgItem FindWindowExA IsWindow GetDC SetWindowLongA LoadImageA InvalidateRect ReleaseDC EnableWindow BeginPaint SendMessageA DefWindowProcA DrawTextA GetClientRect EndPaint IsWindowVisible CloseClipboard OpenClipboard

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateFontIndirectA CreateBrushIndirect DeleteObject SetTextColor SelectObject

kernel32

GetExitCodeProcess WaitForSingleObject GetProcAddress GetSystemDirectoryA WideCharToMultiByte MoveFileExA GetTempFileNameA RemoveDirectoryA WriteFile CreateDirectoryA GetLastError CreateProcessA GlobalLock GlobalUnlock CreateThread lstrcpynA SetErrorMode GetDiskFreeSpaceA lstrlenA GetCommandLineA GetVersion GetWindowsDirectoryA SetEnvironmentVariableA GetTempPathA CopyFileA GetCurrentProcess ExitProcess GetModuleFileNameA GetFileSize ReadFile GetTickCount Sleep CreateFileA GetFileAttributesA SetCurrentDirectoryA SetFileAttributesA GetFullPathNameA GetShortPathNameA MoveFileA CompareFileTime SetFileTime SearchPathA lstrcmpiA lstrcmpA CloseHandle GlobalFree GlobalAlloc ExpandEnvironmentStringsA LoadLibraryExA FreeLibrary lstrcpyA lstrcatA FindClose MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA SetFilePointer GetModuleHandleA FindNextFileA FindFirstFileA DeleteFileA MulDiv

$PLUGINSDIR/System.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 269d232712c86983336badb40b9e55e80052d8389ed095ebf9214964d43b6bb1
MD5 34442e1e0c2870341df55e1b7b3cccdc
SHA1 99b2fa21aead4b6ccd8ff2f6d3d3453a51d9c70c
SHA512 4a8c57fb12997438b488b862f3fc9dc0f236e07bb47b2bce6053dcb03ac7ad171842f02ac749f02dda4719c681d186330524cd2953d33cb50854844e74b33d51
SSDEEP 192:jPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4I:u7VpNo8gmOyRsVc4
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10529

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Almonry.Per

SHA256 1294c697caaf46d477e8c7af2aafce67a4d1f31dac946c811d3c55d24da8e2dd
MD5 19575199bf998902aeb5485ab3a1cb5a
SHA1 987f58015df8982809d28986e803da6889ce0f4d
SHA512 4f72dc4ca0b0fb0d59cedcc94f0c97976bb7f51868a81e80939c5e02b4bb5c1ecd9602263ed6c46c07641bf5dacf46e52a780301e3cf6fcd21782337adfcb882
SSDEEP 6144:s2KhSa3i42AK4HMOs/ub8bGglosU64LBIcY+6yBmgVFLe+DeQdn:7KhSaS42AK4s3ub6LlXU3eSfS+Djh
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Klienteller/carcoon.txt

SHA256 63038d32fb5157052435ec5ae2d7a28606e8f801c86f2dec187ce2b9e1be59b4
MD5 9d56caa657c499242cee0d4ca31ba2a0
SHA1 99392b3fe07311d468fe038f31dcb020417891d7
SHA512 36c1b3f8a63b5f1b45f6304cd6f5a3492539d7501feb1d02c55e7569deb5f608a612dcdd7985977e22318b8cb4f8f060443741099c28d8ca42d03da24dea9357
MD5 SHA1 SHA512

NSIS installer

installer

Klienteller/ceroline.cha

SHA256 972585795998ed370226cd33e37eb4555433d0cb4951391b31734745ae09b4f9
MD5 b00c3ade5a3fee1ee05e9db640968e32
SHA1 27cec838b372c5928368a75f0c01537e195c389a
SHA512 83ca34db3cc535b0931dce440abad14c62bd68cd54f640f141caee1e50300da88384d5f02b482ff69f9691f4ce3e11932bb7d324a09a3ed66260f541cbbb8605
SSDEEP 384:11ugUjZibER15ke6IxuP/cVb9i1iHdB53C:1RU7RfoMbzdB
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Klienteller/obducerendes.myt

SHA256 b9333ade5f3cf5592638b06b7f1071bac50111f961a12cefb1e1b696a9200e0c
MD5 1b5551fe88dddde0d83953971068683a
SHA1 4f2f426c09607d0e678c9bfa9ae044382ff29ced
SHA512 c1d80003ccff409b221d84f26ed81f8ba7152c8230db79a6c87de2a1ad35cbadff020fdc0e694134be689dc1406b2db1ea654a07a283513c9e6b90dda14871fe
SSDEEP 48:10aTGDGYsLAdqInPf7Cur/X9331L8UWWEUI+on3MFN:/GN3OSN331L/WWEr+uG
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Klienteller/predeserving.bed

SHA256 3301548551758f829bad9a57f63f46e1e81909a6e7668ca5148983e3196130b2
MD5 18c77508bd1e3e6325956f6bb0b75911
SHA1 d78a51d5b4b2821d3a9d7c8662235b1972e546ff
SHA512 5da9291ef4953318f5ac3e0b359e88ff612a8a00d2bf3e569cb38288e7f0682011293e92a06f90d98a95cbb7606e48b4dd4d8613f3753fe88877bd426e1f51ea
SSDEEP 48:u8qJbVPRpWe4fETsm01MICZ8GxaN5O/BrQYq:f+rpWTETJICZ8GxaN5gBrQr
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Klienteller/strany.for

SHA256 aace0f67e37ef79fd7a66bd0ac0dd0289e5221463d4abb82651f07365cea202b
MD5 f73c6d062c028740aa41e7f22b0fe7e5
SHA1 52a6780e9e999fa82c9a5242a4f8b306b31eb85b
SHA512 62ecf91b0a65f51ccceb60b90dff68ded1eda816a3a4846ac3fce8b38c092dfdd95cd29508434c16a6dd2459dcbbee8693a4ae8ab957058ae866db1057867f5b
SSDEEP 384:IXGuBicePZhDHFUE3pCjxVnmBTXGxNwqoHb8:ISzOH7Nw
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Unalphabetical.nuc

SHA256 95a06839df03661c732e7517b624c5091ff5ece1a10f20171e776e1bfb07a100
MD5 1b2b32f1b9664f6618a7086851bb5dcb
SHA1 48a0f959c4cad08f3ea25f23d3cebd853277b7e7
SHA512 43f6d34205d7e32bda9086c274e64ba4463f98d21635661d70016e8f78f25a2837370fe1cce2dfdef662bf8c6d8cfb574c2cc8a1f62d5a75198721ec635e288c
SSDEEP 24:GiG5VCiil9xzkWFAgoIPlSOAakga+4dCaLnvCCaZCoXIgytMMzm:A5Ti5gW4clSOGgaJMvnpXIgzMz
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

c1ac9d7f43c663808c60ff26c2e41f32f5d101a8ef0f76d68cef613b19fab280.exe

PE Signature issue

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Almonry.Per

Klienteller/carcoon.txt

Klienteller/ceroline.cha

Klienteller/obducerendes.myt

Klienteller/predeserving.bed

Klienteller/strany.for

Unalphabetical.nuc

Sharing

General

Malware Config

Signatures

File Explorer

c1ac9d7f43c663808c60ff26c2e41f32f5d101a8ef0f76d68cef613b19fab280.exe

PE Signature issue

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Almonry.Per

Klienteller/carcoon.txt

Klienteller/ceroline.cha

Klienteller/obducerendes.myt

Klienteller/predeserving.bed

Klienteller/strany.for

Unalphabetical.nuc