4a83e984de761ee13699b30d48ea2ba2499371efa437698cf3b81d495e266008[.]exe

resource
unpack001/$PLUGINSDIR/System.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

4a83e984de761ee13699b30d48ea2ba2499371efa437698cf3b81d495e266008.exe

IMPHASH ea4e67a31ace1a72683a99b80cf37830
SHA256 4a83e984de761ee13699b30d48ea2ba2499371efa437698cf3b81d495e266008
MD5 4cd15dc8b62b8638a429d4c7722ad1f6
SHA1 b8df8bcc13adbaf14c17d6ea3459c6afed991e8e
SHA512 da8a5cbe477185908434b5e099abe972cfe3d369d3156a2a309d28b57e4e84d23a040332b69319198b567769274f5fa2f83f2237be54cb71f3b1fda776ace27f
SSDEEP 12288:OKdQYPhiCUSyZsnY40EfLBe69uUZrSP9bKcaPv0po9jwoUCAgBm:OJYHUS9F0ETB5IEuocanTdwoJAZ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

9b:05:7e:a0:cf:65:99:f0:af:39:98:f6:6a:38:5e:69:71:28:ae:00:a8:0e:c6:24:b8:98:23:cd:69:9c:42:73

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=bortslbtes,OU=Privatkonomi Yodels\ ,O=bortslbtes,L=Hescamps,ST=Hauts-de-France,C=FR,1.2.840.113549.1.9.1=#0c1a426f726b7376656a40536b72707065626c61646574732e547269

Chains

May 16, 2024

PE Signature issue

Digest

04:18:12:7f:4a:52:0f:c3:d9:43:c4:47:43:77:43:e8:12:73:5d:1c

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=bortslbtes,OU=Privatkonomi Yodels\ ,O=bortslbtes,L=Hescamps,ST=Hauts-de-France,C=FR,1.2.840.113549.1.9.1=#0c1a426f726b7376656a40536b72707065626c61646574732e547269

Chains

Jun 10, 2024

Subject

CN=bortslbtes,OU=Privatkonomi Yodels\ ,O=bortslbtes,L=Hescamps,ST=Hauts-de-France,C=FR,1.2.840.113549.1.9.1=#0c1a426f726b7376656a40536b72707065626c61646574732e547269

Serial Number

49:ad:6a:52:4d:a5:14:0e:2e:72:f9:e2:07:de:ed:2e:d9:f3:a0:47

Issuer

CN=bortslbtes,OU=Privatkonomi Yodels\ ,O=bortslbtes,L=Hescamps,ST=Hauts-de-France,C=FR,1.2.840.113549.1.9.1=#0c1a426f726b7376656a40536b72707065626c61646574732e547269

Timespan

Nov 1, 2023 - Oct 31, 2026

Subject

CN=bortslbtes,OU=Privatkonomi Yodels\ ,O=bortslbtes,L=Hescamps,ST=Hauts-de-France,C=FR,1.2.840.113549.1.9.1=#0c1a426f726b7376656a40536b72707065626c61646574732e547269

Serial Number

49:ad:6a:52:4d:a5:14:0e:2e:72:f9:e2:07:de:ed:2e:d9:f3:a0:47

Issuer

CN=bortslbtes,OU=Privatkonomi Yodels\ ,O=bortslbtes,L=Hescamps,ST=Hauts-de-France,C=FR,1.2.840.113549.1.9.1=#0c1a426f726b7376656a40536b72707065626c61646574732e547269

Timespan

Nov 1, 2023 - Oct 31, 2026

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 23, 2017 - Mar 22, 2029

Minor OS version

0

Major OS version

4

Entry point

13409

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCreateKeyExA RegEnumKeyA RegQueryValueExA RegSetValueExA RegCloseKey RegDeleteValueA RegDeleteKeyA AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken SetFileSecurityA RegOpenKeyExA RegEnumValueA

shell32

SHGetFileInfoA SHFileOperationA SHGetPathFromIDListA ShellExecuteExA SHGetSpecialFolderLocation SHBrowseForFolderA

ole32

IIDFromString OleInitialize OleUninitialize CoCreateInstance CoTaskMemFree

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

SetClipboardData CharPrevA CallWindowProcA PeekMessageA DispatchMessageA MessageBoxIndirectA GetDlgItemTextA SetDlgItemTextA GetSystemMetrics CreatePopupMenu AppendMenuA TrackPopupMenu FillRect EmptyClipboard LoadCursorA GetMessagePos CheckDlgButton GetSysColor SetCursor GetWindowLongA SetClassLongA SetWindowPos IsWindowEnabled GetWindowRect GetSystemMenu EnableMenuItem RegisterClassA ScreenToClient EndDialog GetClassInfoA SystemParametersInfoA CreateWindowExA ExitWindowsEx DialogBoxParamA CharNextA SetTimer DestroyWindow CreateDialogParamA SetForegroundWindow SetWindowTextA PostQuitMessage SendMessageTimeoutA ShowWindow wsprintfA GetDlgItem FindWindowExA IsWindow GetDC SetWindowLongA LoadImageA InvalidateRect ReleaseDC EnableWindow BeginPaint SendMessageA DefWindowProcA DrawTextA GetClientRect EndPaint IsWindowVisible CloseClipboard OpenClipboard

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateFontIndirectA CreateBrushIndirect DeleteObject SetTextColor SelectObject

kernel32

GetExitCodeProcess WaitForSingleObject GetProcAddress GetSystemDirectoryA WideCharToMultiByte MoveFileExA GetTempFileNameA RemoveDirectoryA WriteFile CreateDirectoryA GetLastError CreateProcessA GlobalLock GlobalUnlock CreateThread lstrcpynA SetErrorMode GetDiskFreeSpaceA lstrlenA GetCommandLineA GetVersion GetWindowsDirectoryA SetEnvironmentVariableA GetTempPathA CopyFileA GetCurrentProcess ExitProcess GetModuleFileNameA GetFileSize ReadFile GetTickCount Sleep CreateFileA GetFileAttributesA SetCurrentDirectoryA SetFileAttributesA GetFullPathNameA GetShortPathNameA MoveFileA CompareFileTime SetFileTime SearchPathA lstrcmpiA lstrcmpA CloseHandle GlobalFree GlobalAlloc ExpandEnvironmentStringsA LoadLibraryExA FreeLibrary lstrcpyA lstrcatA FindClose MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA SetFilePointer GetModuleHandleA FindNextFileA FindFirstFileA DeleteFileA MulDiv

$PLUGINSDIR/System.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 269d232712c86983336badb40b9e55e80052d8389ed095ebf9214964d43b6bb1
MD5 34442e1e0c2870341df55e1b7b3cccdc
SHA1 99b2fa21aead4b6ccd8ff2f6d3d3453a51d9c70c
SHA512 4a8c57fb12997438b488b862f3fc9dc0f236e07bb47b2bce6053dcb03ac7ad171842f02ac749f02dda4719c681d186330524cd2953d33cb50854844e74b33d51
SSDEEP 192:jPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4I:u7VpNo8gmOyRsVc4
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10529

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Opslagsformlers.Bai

SHA256 a548c1cd4f26e9bbf32981f53dfc245e31b5b2b20ef42e23849c32756e321d82
MD5 3be0056c1ac97197390577d26b2aa96b
SHA1 c701129eb55241875132e5631ac997c71e104b9a
SHA512 e54ddbba841ae44c45760b9274203f5a754e3287f16e2a28ea1126b5e5efa1fcea69f409c99e2c0c152135bb4dd8bffc0c9626628a857cc1802c50410b4e8d96
SSDEEP 6144:wpTue6l5hG0o8nuIS6gUFlB/jQmMEjvDBjl7LBBMq7ZVuFV9R:KieO5WeuIS6Z5bQmDLDLBdAFV9R
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Unalphabetical.nuc

SHA256 95a06839df03661c732e7517b624c5091ff5ece1a10f20171e776e1bfb07a100
MD5 1b2b32f1b9664f6618a7086851bb5dcb
SHA1 48a0f959c4cad08f3ea25f23d3cebd853277b7e7
SHA512 43f6d34205d7e32bda9086c274e64ba4463f98d21635661d70016e8f78f25a2837370fe1cce2dfdef662bf8c6d8cfb574c2cc8a1f62d5a75198721ec635e288c
SSDEEP 24:GiG5VCiil9xzkWFAgoIPlSOAakga+4dCaLnvCCaZCoXIgytMMzm:A5Ti5gW4clSOGgaJMvnpXIgzMz
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

carcoon.txt

SHA256 63038d32fb5157052435ec5ae2d7a28606e8f801c86f2dec187ce2b9e1be59b4
MD5 9d56caa657c499242cee0d4ca31ba2a0
SHA1 99392b3fe07311d468fe038f31dcb020417891d7
SHA512 36c1b3f8a63b5f1b45f6304cd6f5a3492539d7501feb1d02c55e7569deb5f608a612dcdd7985977e22318b8cb4f8f060443741099c28d8ca42d03da24dea9357
MD5 SHA1 SHA512

NSIS installer

installer

ceroline.cha

SHA256 972585795998ed370226cd33e37eb4555433d0cb4951391b31734745ae09b4f9
MD5 b00c3ade5a3fee1ee05e9db640968e32
SHA1 27cec838b372c5928368a75f0c01537e195c389a
SHA512 83ca34db3cc535b0931dce440abad14c62bd68cd54f640f141caee1e50300da88384d5f02b482ff69f9691f4ce3e11932bb7d324a09a3ed66260f541cbbb8605
SSDEEP 384:11ugUjZibER15ke6IxuP/cVb9i1iHdB53C:1RU7RfoMbzdB
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

obducerendes.myt

SHA256 b9333ade5f3cf5592638b06b7f1071bac50111f961a12cefb1e1b696a9200e0c
MD5 1b5551fe88dddde0d83953971068683a
SHA1 4f2f426c09607d0e678c9bfa9ae044382ff29ced
SHA512 c1d80003ccff409b221d84f26ed81f8ba7152c8230db79a6c87de2a1ad35cbadff020fdc0e694134be689dc1406b2db1ea654a07a283513c9e6b90dda14871fe
SSDEEP 48:10aTGDGYsLAdqInPf7Cur/X9331L8UWWEUI+on3MFN:/GN3OSN331L/WWEr+uG
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

predeserving.bed

SHA256 3301548551758f829bad9a57f63f46e1e81909a6e7668ca5148983e3196130b2
MD5 18c77508bd1e3e6325956f6bb0b75911
SHA1 d78a51d5b4b2821d3a9d7c8662235b1972e546ff
SHA512 5da9291ef4953318f5ac3e0b359e88ff612a8a00d2bf3e569cb38288e7f0682011293e92a06f90d98a95cbb7606e48b4dd4d8613f3753fe88877bd426e1f51ea
SSDEEP 48:u8qJbVPRpWe4fETsm01MICZ8GxaN5O/BrQYq:f+rpWTETJICZ8GxaN5gBrQr
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

strany.for

SHA256 aace0f67e37ef79fd7a66bd0ac0dd0289e5221463d4abb82651f07365cea202b
MD5 f73c6d062c028740aa41e7f22b0fe7e5
SHA1 52a6780e9e999fa82c9a5242a4f8b306b31eb85b
SHA512 62ecf91b0a65f51ccceb60b90dff68ded1eda816a3a4846ac3fce8b38c092dfdd95cd29508434c16a6dd2459dcbbee8693a4ae8ab957058ae866db1057867f5b
SSDEEP 384:IXGuBicePZhDHFUE3pCjxVnmBTXGxNwqoHb8:ISzOH7Nw
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

4a83e984de761ee13699b30d48ea2ba2499371efa437698cf3b81d495e266008.exe

PE Signature issue

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Opslagsformlers.Bai

Unalphabetical.nuc

carcoon.txt

ceroline.cha

obducerendes.myt

predeserving.bed

strany.for

Sharing

General

Malware Config

Signatures

File Explorer

4a83e984de761ee13699b30d48ea2ba2499371efa437698cf3b81d495e266008.exe

PE Signature issue

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Opslagsformlers.Bai

Unalphabetical.nuc

carcoon.txt

ceroline.cha

obducerendes.myt

predeserving.bed

strany.for