6cdb1945b437ad901cb1399793ccd675094a4cd8265fe92be815a38287f07c1f

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_B64_Encoded_UserAgent

resource
6cdb1945b437ad901cb1399793ccd675094a4cd8265fe92be815a38287f07c1f
unpack001/$EXEFILE
unpack001/$PLUGINSDIR/Banner.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsisdl.dll
unpack001/$TEMP/$EXEFILE

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

IMPHASH b40f29cd171eb54c01b1dd2683c9c26b
SHA256 6cdb1945b437ad901cb1399793ccd675094a4cd8265fe92be815a38287f07c1f
MD5 d6335e97811b75b748e68d5bba5bbc39
SHA1 38475b6422e85e52c0106122dfc3d2380f25974d
SHA512 e14e0524dea3c400fca793b2d98a188d5a23c24efe9fc9d481f9edf67f01e967d9c356bd49899f100f540b0a278e75a5c0ae5266fde48a4e9943ff0f1ebed926
SSDEEP 6144:I+K0wdD+icP7f/Z1ILr3wp1F/SvlaRsI+cb+0YDmtnyhzc+Y9G2iNY2:JwdJcPzALjwl/SdcsI/b+0YDWscv9niL
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Detects executables containing base64 encoded User Agent
Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12508

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

Sleep GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA CompareFileTime SearchPathA GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess SetEnvironmentVariableA GetWindowsDirectoryA SetFileAttributesA lstrcmpiA SetErrorMode LoadLibraryA lstrlenA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrcpyA lstrcatA GetSystemDirectoryA GetVersion GetProcAddress WaitForSingleObject SetFileTime CloseHandle GlobalFree lstrcmpA ExpandEnvironmentStringsA GetExitCodeProcess GlobalAlloc GetModuleHandleA LoadLibraryExA GetCommandLineA GetTempPathA FreeLibrary FindFirstFileA FindNextFileA DeleteFileA SetFilePointer ReadFile FindClose GetPrivateProfileStringA WritePrivateProfileStringA MulDiv WriteFile MultiByteToWideChar

user32

CreateWindowExA EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard GetDC SystemParametersInfoA RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx DestroyWindow CreateDialogParamA SetTimer GetDlgItem wsprintfA SetForegroundWindow ShowWindow IsWindow LoadImageA SetWindowLongA SetClipboardData EmptyClipboard OpenClipboard EndPaint PostQuitMessage FindWindowExA SendMessageTimeoutA SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA

advapi32

RegCloseKey RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegEnumValueA RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

CoCreateInstance CoTaskMemFree OleInitialize OleUninitialize

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$EXEFILE

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 2ef95fbbceb36d20ccc464c8193266ab32b613bf2336b11f4f19bcaa1ea0bfd3
MD5 04a46ed2f4dbb2229237ef397beee6dc
SHA1 681466ada224d8a2571aa1629eac235454146927
SHA512 e5f4142ce070418e9f3ec72139826c9feb038c8d1e1717d0724d182e94af1cd531426afb409c48a303ed8db53145e1bd6a2c4dcb03405f3eb5aa1ec7513d16e5
SSDEEP 96:FvlrPZoh0IZ5C+l/QGdlLByCPaEhqec8:Fvwh/vl/QGoCCE7c8
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Detects executables containing base64 encoded User Agent
Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

11422

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

$EXEFILE.config

SHA256 689393cb6ef8116640554d67c5c5d1742817bb53afb754f14a28134ea8abed8b
MD5 26d995b829f45c1588f33b0e5b465c57
SHA1 1d6a7acaeb2623bbab9b04da4b2e799aa9927a4b
SHA512 3b16c66eee1a4d439f4e4c0a6fb5770e604ddca61527795db766334d9be389159393605337a830f5f99a37bd3f212bc3b3738e059e3f4f37732765341ecfaa76
MD5 SHA1 SHA512

Detects executables containing base64 encoded User Agent
NSIS installer

installer

$PLUGINSDIR/Banner.dll

IMPHASH f81377f1c55b7962f1e18d52fc7eb628
SHA256 de59710bad95741c41e608f946d9eb4edacdf73ab92a1a3341f8a160b8952c66
MD5 fcca36e21ca7c4ecfc29f6804acbd76b
SHA1 2f1972d5a0ec8377e043b9b304e62c24c6c38506
SHA512 1885aaf379e6547e519a65751d192beb9f078d63f056886cbcdae75f37f12bf8e89c98fa3c45aa60967e19ba51329a8384cf7a64d851ab10b648b17daf9b175e
MD5 SHA1 SHA512

windows:4 windows x86 arch:x86

Detects executables containing base64 encoded User Agent
Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4759

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 3b6a5cb2a3c091814fce297c04fb677f72732fb21615102c62a195fdc2e7dfac
MD5 cf85183b87314359488b850f9e97a698
SHA1 6b6c790037eec7ebea4d05590359cb4473f19aea
SHA512 fe484b3fc89aeed3a6b71b90b90ea11a787697e56be3077154b6ddc2646850f6c38589ed422ff792e391638a80a778d33f22e891e76b5d65896c6fb4696a2c3b
SSDEEP 96:3IsUxO9udx4qYp7AJb76BykUbQMtHUOA5Iv+RnsrqeXV+d1g2IW9t2c+cEwF9oug:YVL7ikJb76BQUoUm+RnyXVYO2RvHoug
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Detects executables containing base64 encoded User Agent
Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

9922

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsisdl.dll

IMPHASH 35098e8775f91723e90a28745ef6495b
SHA256 72c65f7cd4a611b077b1ad0be8185780909e9cb04c53ecdac3e17fc72c99b245
MD5 1dadb63a5dfaa0679485c5dbaf96033f
SHA1 d1717aab683c55bd13bbd520d2a91178efa0d676
SHA512 46535c2d96937d49ee7c222428db4a8d61eb346efa0845fcd88e06523ed7836518e5a72d623e9c5563bf6759b449b6d2fcb0340b98a6e7966027bc983db4f722
SSDEEP 384:wck76gi51kE5aYOMLDC4UnDp9B0Jc5HNw2PE:wck76gibLCMLDLCx04HNVPE
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Detects executables containing base64 encoded User Agent
Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

8905

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$TEMP/$EXEFILE

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 2ef95fbbceb36d20ccc464c8193266ab32b613bf2336b11f4f19bcaa1ea0bfd3
MD5 04a46ed2f4dbb2229237ef397beee6dc
SHA1 681466ada224d8a2571aa1629eac235454146927
SHA512 e5f4142ce070418e9f3ec72139826c9feb038c8d1e1717d0724d182e94af1cd531426afb409c48a303ed8db53145e1bd6a2c4dcb03405f3eb5aa1ec7513d16e5
SSDEEP 96:FvlrPZoh0IZ5C+l/QGdlLByCPaEhqec8:Fvwh/vl/QGoCCE7c8
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Detects executables containing base64 encoded User Agent
Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

11422

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

$TEMP/$EXEFILE.config

SHA256 689393cb6ef8116640554d67c5c5d1742817bb53afb754f14a28134ea8abed8b
MD5 26d995b829f45c1588f33b0e5b465c57
SHA1 1d6a7acaeb2623bbab9b04da4b2e799aa9927a4b
SHA512 3b16c66eee1a4d439f4e4c0a6fb5770e604ddca61527795db766334d9be389159393605337a830f5f99a37bd3f212bc3b3738e059e3f4f37732765341ecfaa76
MD5 SHA1 SHA512

Detects executables containing base64 encoded User Agent
NSIS installer

installer

$TEMP/43cf441080b24048909add36ebfff0bc.txt

SHA256 96a1dfba3432574feadc2852cc38e8d17c0a7b75b968c00fc6ccab45c63b379b
MD5 937721fc725e13801f2d656fa6dee0d9
SHA1 ef4b6785d9843bd9391038f87e930920376a2926
SHA512 edf8c42c6d35e90689661c2827b99ddb93656ef7e2a1df5bca77a46da7efedf360e8c4f7493fb1670476b4c7ba0719c688013709f2fc6044e6cc12fe30db3f60
SSDEEP 6144:OicP7f/Z1ILr3wp1F/SvlaRsI+cb+0YDmtnyhzc+Y9G2k:NcPzALjwl/SdcsI/b+0YDWscv9nk
MD5 SHA1 SHA512 SSDEEP

Detects executables containing base64 encoded User Agent
NSIS installer

installer

43cf441080b24048909add36ebfff0bc.txt

SHA256 96a1dfba3432574feadc2852cc38e8d17c0a7b75b968c00fc6ccab45c63b379b
MD5 937721fc725e13801f2d656fa6dee0d9
SHA1 ef4b6785d9843bd9391038f87e930920376a2926
SHA512 edf8c42c6d35e90689661c2827b99ddb93656ef7e2a1df5bca77a46da7efedf360e8c4f7493fb1670476b4c7ba0719c688013709f2fc6044e6cc12fe30db3f60
SSDEEP 6144:OicP7f/Z1ILr3wp1F/SvlaRsI+cb+0YDmtnyhzc+Y9G2k:NcPzALjwl/SdcsI/b+0YDWscv9nk
MD5 SHA1 SHA512 SSDEEP

Detects executables containing base64 encoded User Agent
NSIS installer

installer