??????-POORD210865679-09XY-21-Order[.]com[.]exe

resource
??????-POORD210865679-09XY-21-Order.com.exe
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

??????-POORD210865679-09XY-21-Order.com.exe

IMPHASH 57e98d9a5a72c8d7ad8fb7a6a58b3daf
SHA256 31eb29c56f113f47c0e4d29f346f685db8a00b9394efa9643caafa254f0618d7
MD5 cc1de5fc5a01a4157d61a28961ace142
SHA1 80d84c0ac436370e87a583267fcd44f5d55df0f1
SHA512 9b8efb3c717f2d33342a86d94da3d7cb203636ff7cb892c2b5b3bf0dfb27bda099dbaaae3b8a12089967bf885350f552087e127499d0145a3b54a9e76ab6b69d
SSDEEP 6144:VhRkHGPBfjVd4QMtGOipbEOKEvV3OGOizNm0OGtTd0K1eOxnrpAAdvHnICdmCFfC:PGu+Q+idEOZFO3iN710Va6uJAC5C
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

13069

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetEnvironmentVariableA CreateFileA GetFileSize GetModuleFileNameA ReadFile GetCurrentProcess CopyFileA Sleep GetTickCount GetWindowsDirectoryA GetTempPathA GetCommandLineA lstrlenA GetVersion SetErrorMode lstrcpynA ExitProcess SetCurrentDirectoryA GlobalLock CreateThread GetLastError CreateDirectoryA CreateProcessA RemoveDirectoryA GetTempFileNameA WriteFile lstrcpyA MoveFileExA lstrcatA GetSystemDirectoryA GetProcAddress GetExitCodeProcess WaitForSingleObject CompareFileTime SetFileAttributesA GetFileAttributesA GetShortPathNameA MoveFileA GetFullPathNameA SetFileTime SearchPathA CloseHandle lstrcmpiA GlobalUnlock GetDiskFreeSpaceA lstrcmpA FindFirstFileA FindNextFileA DeleteFileA SetFilePointer GetPrivateProfileStringA FindClose MultiByteToWideChar FreeLibrary MulDiv WritePrivateProfileStringA LoadLibraryExA GetModuleHandleA GlobalAlloc GlobalFree ExpandEnvironmentStringsA

user32

ScreenToClient GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard PostQuitMessage GetWindowRect EnableMenuItem CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndDialog RegisterClassA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx GetDC CreateDialogParamA SetTimer GetDlgItem SetWindowLongA SetForegroundWindow LoadImageA IsWindow SendMessageTimeoutA FindWindowExA OpenClipboard TrackPopupMenu AppendMenuA EndPaint DestroyWindow wsprintfA ShowWindow SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation ShellExecuteExA SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA SHFileOperationA

advapi32

AdjustTokenPrivileges RegCreateKeyExA RegOpenKeyExA SetFileSecurityA OpenProcessToken LookupPrivilegeValueA RegEnumValueA RegDeleteKeyA RegDeleteValueA RegCloseKey RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/System.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 904fd5481d72f4e03b01a455f848dedd095d0fb17e33608e0d849f5196fb6ff8
MD5 55a26d7800446f1373056064c64c3ce8
SHA1 80256857e9a0a9c8897923b717f3435295a76002
SHA512 04b8ab7a85c26f188c0a06f524488d6f2ac2884bf107c860c82e94ae12c3859f825133d78338fd2b594dfc48f7dc9888ae76fee786c6252a5c77c88755128a5b
SSDEEP 192:MPtkumJX7zBE2kGwfy9S9VkPsFQ1Mx1c:97O2k5q9wA1Mxa
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

9993

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsDialogs.dll

IMPHASH ddbd50fe6279559edf7d1f1d89b42c2c
SHA256 c1cc3aa4326e83a73a778dee0cf9afcc03a6bafb0a32cea791a27eb9c2288985
MD5 ee449b0adce56fbfa433b0239f3f81be
SHA1 ec1e4f9815ea592a3f19b1fe473329b8ddfa201c
SHA512 22fb25bc7628946213e6e970a865d3fbd50d12ce559c37d6848a82c28fa6be09fedffc3b87d5aea8dcfe8dfc4e0f129d9f02e32dae764b8e6a08332b42386686
SSDEEP 96:oCqZ4zC5RH3cXX1LlYlRowycxM2DjDf3GEst+Nt+jvDYx4iqndYHnxss:oCq+CP3uKrpyREs06Yx+dGn
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

7429

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Cheatery.Eme

SHA256 31328678735ef6334cfbdcc2b1c37cf96cc7f81eedf0da69a77e14ee917cc535
MD5 38a9642046cbff0d4d9c176885cc6aa2
SHA1 3e5e52ed248473fe08ce1e05943265a4adbacf67
SHA512 349d2050b25f3a0d34a859d5b76167ac4ad7dddf6120f78232862ec9abe76ae4d4fd3915286f0aff0ff1f1cd7343de04208f06b1130c010e71b035f9359dc3a9
SSDEEP 3072:zWARJ74HOdCAbPZf9XzrPdxJIZE+sN+wUMv5hV9FuCimG+Cw9my/Qla:zWeJ73d1PZVd4kN+dwLV9FuCHTEy/Qla
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Obumbrant240/Joceline.bac

SHA256 bd8079bd1b86f25c04ed36c9cc32bab94f86990754359527fd251153caecd62d
MD5 2e2893fb39977d82ccb2ca2967f965da
SHA1 91f8e5e200a196cbd7b00aa49ba764e6f3fe09ec
SHA512 9743f28dc778d543f9440e913143d552328fc01cbdde5b8d07086beab3e6fb463098a9ad5c39396672262fdeb5a52af9450db29f4b121ac5e5b1e9f7eb45e4a6
MD5 SHA1 SHA512

NSIS installer

installer

Obumbrant240/Landbrugsejendommen/Gadeuordens.Myr

SHA256 5a55216cb7b875aa1ae9345811769d9407ce58fdef3fe3697f2273c658edd096
MD5 680fe281fea9fac00fcd867ed9efa8b8
SHA1 e8eb2dd6f27c8ea113e03e815ab97f8609e5caa6
SHA512 adf42c3efaad36860ba3813bd4e1ab18daeeda7b923830515d39fca2c10dfa48315f66303baad3f53ad36024d7b54ca52be3dabad01c4f2faaac51dc4dbbf74e
SSDEEP 384:POKX9chntgKC26phZ3eb4+YKyFMvfDTnhel:ms9chMZhZcZHY
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Obumbrant240/Landbrugsejendommen/Kildeskatternes.pro

SHA256 feea7346d55d859189de897f16e305ace8436860e20bc77039c59f9da9cbf583
MD5 dbd840119a2ac58475601746da5319bc
SHA1 61d2855e4c3cc450285bea353621f0073be09716
SHA512 5d6e21a7fd00b10cd3afd6367315100ae9741fe36ad4c0ad2c71858deb64f0008fa23482fad2527aaaa9dae612f5798ad4e82a9b8421653e89ddae63cc578471
MD5 SHA1 SHA512

NSIS installer

installer

Obumbrant240/Landbrugsejendommen/Plagers.nan

SHA256 97af602a1cd064f54fac95dbcf13daee459e647e9920505dd569c43d484059ff
MD5 70f7c0e27e7f80a908d2f4097db180f1
SHA1 d692ab6396648520e532e45e0d88fd4f13ae9c34
SHA512 913838f3695f440ae5e9e5603ca2c13d37580217c7fbab46b0c7fe09723a266f208bd07f3fb1536d9279e54a95d11541f0a21e5f593dc9c4ba03edd2b147724c
SSDEEP 96:XNp/dEUEfCUsBREDWonchHRbq7De71InNw9lxcj5HVryHG9O:XsfCUKPmiANw9WNSG0
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Obumbrant240/Landbrugsejendommen/cedry.sun

SHA256 7410b99c93eeea45977993b4a2d6339e2a07e4ec1b2e6906574c3987641fcf34
MD5 dd0210872ca3a7f9a5f9831f02c9d296
SHA1 5cf4f9ce8ba13d3bae3939de6a760d3f631ed713
SHA512 7de4b4945ad53a0f7ca99edba54d84d83f22fc362780c4b36470d5c9f68fec2f893071fff051975a9ec8860ff127df9853878fdf8d91dbf9836020fd374f1deb
MD5 SHA1 SHA512

NSIS installer

installer

Obumbrant240/Landbrugsejendommen/detentionslokalerne.int

SHA256 27c97a3d638bf3cfc6d59866bd42045797df98a68191e424d9d95509de087b76
MD5 e827dc6070276b08dd15819fec22ee03
SHA1 d390735ce31daaf687fc0aff46919533ac469960
SHA512 0798208a4b332c0f9d1cd88e796b2230f61966266ec515e84d96a35d045590b05315485304b908bba2c2bfacba69ecfba97cbaa6966c45afedcdabe902cae815
SSDEEP 96:fPrYEBUFW/a/VoWMpnnYiN9pq1WorF/I3J9QaRbIexFyz:fPrnSW/a9mnYiN9pih5/IHR8z
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Obumbrant240/Landbrugsejendommen/emnespecifik.tvi

SHA256 b7feb1b91a2c74771a0cc47bc925da14333c989916ad035f143427ef5a1716ca
MD5 ab8f897c4c79645d1162a1f418351f6f
SHA1 0962e64bd5cecb1cce731811cebb1caf4e04c011
SHA512 e180f4799f00ce039f83b1ba543c02c6a147bf7ddefef9eab044c27ddd9ee30cdf4585028dc11026770454193d82ea62758c609da38122232b7460442342a88d
MD5 SHA1 SHA512

NSIS installer

installer

quileses.gna

SHA256 27494b80b60039a8c04bc2220ce8fe1ef55348a496d18e5cdd35605e2fc66bb5
MD5 7e9da84e610db39856153ebf1e36e9e1
SHA1 ad879dbb6ee70f64f34ea7504b3d6993545a0546
SHA512 bb567932b6528d8279f888ad4ad8135139b107d2505cc60c6c813e6e83f94669a8de3d924c639b66bce134937de52c1109715d77c4f2e2df9f7655b50b002242
MD5 SHA1 SHA512

NSIS installer

installer

sauchs.sph

SHA256 e4589d0754ccd6dfc258ad2d79b57c9b2a0ba6e63507bd6700d2aadf370b1054
MD5 347a5f32c097cd78a026300f12b3a798
SHA1 563e738081824e66bc468b636e6f92133a954781
SHA512 421aebd24c5225a49322e84fff0c025915574385cab2e21f44737765c8eb0679170a53ec6c0a17fc71bfe7630f6d15758213f36fcaf98848d6fa40b891798244
SSDEEP 96:PYEKzQUM6EnrOHssb3ka/u0O5zyYaQCWIqxc2vkxjWek/vwCQ5BGZ:SzGDryss/uLyXxckxi9vwH/S
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

stamaktiers.syl

SHA256 e07275c8c1bc210da2cba10cf9829da4696756e5b85a5f45c8cd5341e492c665
MD5 a7243fdaa2123fa793216c64806ba87a
SHA1 8f2739e1864171e1e9f79ed63d367515cf6f0ca2
SHA512 7ca65cf4be2e7950893cf6fbd3fb2300009caef913620d99f7c5f70e1fcccce2c47d09cd1b2a9b4d359577b992c27aaa9f214087288e02d866a9136a7ab0a33b
MD5 SHA1 SHA512

NSIS installer

installer

swivet.lut

SHA256 ac7d2119766c440955710d48f14e62079fdd583e7524561a3de9f28ba5f14676
MD5 58aae58816129856a55b77d5f0605f12
SHA1 a0ff59606c6399a7e11d702fe8d38be9025550e7
SHA512 68f9986a374baeada0d5318f9885d853ef7349a87b072962f73c79e2ff0b82259dcb3a61991bcb65decf01b2105bbf53b01604fa6efe0e3cb191feea5ce6804c
MD5 SHA1 SHA512

NSIS installer

installer

telexes.lge

SHA256 33788d7aaf1f62df09055f972b02443b7e85280bb4698a68adfd945af3bbe000
MD5 2f3736746c30f86e6e13043cdba9bbad
SHA1 7afb9f118714b526242027ef2c893f7893aa834c
SHA512 5819efc2476b03b5a204786afa542f6c23cd3eea705815d1130ff3707eeaaa754810d30df7691426935abebcf2b36ebc56c7a17b57156e890119f5ac77b7c6bc
MD5 SHA1 SHA512

NSIS installer

installer

uddannelsesinstitution.kom

SHA256 c0d1d15dcf97bb14558e4c5f1fcb0acddcb8075a1789661e8cac23d78585f6ea
MD5 cfdb1998bd33872df3148f87ffc2ebab
SHA1 819bdd1604f7238ebe2d0c91fa81ab826d2a6fac
SHA512 c2003c47e61725a9fd80f03009c72fc14b58d5eb064c55b4bea17e67a3e7d427aec79e6f4d5ff3449cf2bccb01de9b763494bf957b3008551cc6a54142271523
MD5 SHA1 SHA512

NSIS installer

installer

unpity.txt

SHA256 62d7bf61bc7be1ba26ceb33757f858fde0a4b6d326312a1258a0031e0231a38f
MD5 5096ed30a2bdcae435f26ab487e438a2
SHA1 08a1583be6baed1a5d34deb6cf4a0dcb98a24c52
SHA512 a473abda84f7e0e6386f1d6318c0652b40091b9773beec56165bf55403d7d5652f9dee022bec6bbe481743ec45368908b6b033c801de72cfb7aefaef8c26991f
MD5 SHA1 SHA512

NSIS installer

installer

viperoidea.for

SHA256 4f488bb22a8c910a96e8d11d71b268e45db81f0ad5bf6242e975805d3406e4e7
MD5 1d73b1d509a650bbbfa7d4ca05c6e231
SHA1 b940026a4332d2fd486ff91b9ffd4bc254765f3a
SHA512 4d46bb1b177fe1ce64d57cd56f201f32ce5137d7db879f1a68461eebe764ed067abcfe2ed92e3a27aac31f72f2e2a2a4cc1d2c334d37707b23cd8d2048ec7508
MD5 SHA1 SHA512

NSIS installer

installer

zan.fri

SHA256 3f58ae065723162dc437244799ee6cad4bd9053e86197b3693540ec0bd48a18a
MD5 a478d15e4c6ab140be31b51410778797
SHA1 78993a34987ecbea5b0c5d9410f3dce303e656c1
SHA512 28f86cc5a052c8a309a9e6a8ccfc1ad5484d6173f1b7ab8686444e94a80a08ef92b906327db51a33eb1d480ca70c9a528e9379e0e8844dd5813cba6dfc45f086
MD5 SHA1 SHA512

NSIS installer

installer

zymotoxic.tre

SHA256 87157d17725e03e114dfca417e101e5608de762bcf2d6b643df2867be64e309e
MD5 03733cef020aab398a57d7376ccb0d98
SHA1 4bebe8cd1e9e6587804463eab6b66358cfb83fcf
SHA512 b4d6033e8d70b17168259151e5265e5396ffaf3c752c4989c17ea41e3bc16b7ef0aeb0354da92a27c0ea7134209248994d90a1db3569c283f7a5c24de900d6f3
MD5 SHA1 SHA512

NSIS installer

installer

??????-POORD210865679-09XY-21-Order.com.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

Cheatery.Eme

Obumbrant240/Joceline.bac

Obumbrant240/Landbrugsejendommen/Gadeuordens.Myr

Obumbrant240/Landbrugsejendommen/Kildeskatternes.pro

Obumbrant240/Landbrugsejendommen/Plagers.nan

Obumbrant240/Landbrugsejendommen/cedry.sun

Obumbrant240/Landbrugsejendommen/detentionslokalerne.int

Obumbrant240/Landbrugsejendommen/emnespecifik.tvi

quileses.gna

sauchs.sph

stamaktiers.syl

swivet.lut

telexes.lge

uddannelsesinstitution.kom

unpity.txt

viperoidea.for

zan.fri

zymotoxic.tre

Sharing

General

Malware Config

Signatures

File Explorer

??????-POORD210865679-09XY-21-Order.com.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

Cheatery.Eme

Obumbrant240/Joceline.bac

Obumbrant240/Landbrugsejendommen/Gadeuordens.Myr

Obumbrant240/Landbrugsejendommen/Kildeskatternes.pro

Obumbrant240/Landbrugsejendommen/Plagers.nan

Obumbrant240/Landbrugsejendommen/cedry.sun

Obumbrant240/Landbrugsejendommen/detentionslokalerne.int

Obumbrant240/Landbrugsejendommen/emnespecifik.tvi

quileses.gna

sauchs.sph

stamaktiers.syl

swivet.lut

telexes.lge

uddannelsesinstitution.kom

unpity.txt

viperoidea.for

zan.fri

zymotoxic.tre