aac1416d21318d7eec4ecc4e87d91cfbee0b5d569ff9642070c9947c4c59265e[.]exe

resource
aac1416d21318d7eec4ecc4e87d91cfbee0b5d569ff9642070c9947c4c59265e.exe
unpack001/$PLUGINSDIR/AdvSplash.dll
unpack001/$PLUGINSDIR/BgImage.dll
unpack001/$PLUGINSDIR/UserInfo.dll
unpack001/$PLUGINSDIR/nsExec.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

aac1416d21318d7eec4ecc4e87d91cfbee0b5d569ff9642070c9947c4c59265e.exe

IMPHASH e160ef8e55bb9d162da4e266afd9eef3
SHA256 aac1416d21318d7eec4ecc4e87d91cfbee0b5d569ff9642070c9947c4c59265e
MD5 55d49f5f1c74dc50dd5ca4b0298a9e5d
SHA1 594dd375a711937812fa7c93ec57eed34fa50edb
SHA512 774ca13ec168e3fe9da983cf6055852c61d39a893b620c5de8e65e725b28baadebe0a5e0b92ddfe9e41dafa4c0d29221b6fe2e4457544618d2ae47c15f5a9790
SSDEEP 6144:z9KOQS4B4GMSGJpFhm0fwtOiCB+VlFbdu3ucUHJxk1p8Tl82nRDJE6pYIQZA:zsB4GOVyquXY1E8obE6pYO
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12514

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetTickCount GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA SearchPathA GetShortPathNameA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess SetEnvironmentVariableA GetWindowsDirectoryA GetTempPathA Sleep CloseHandle LoadLibraryA lstrlenA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA ReadFile lstrcpyA lstrcatA GetSystemDirectoryA GetVersion GetProcAddress GlobalAlloc CompareFileTime SetFileTime ExpandEnvironmentStringsA lstrcmpiA lstrcmpA WaitForSingleObject GlobalFree GetExitCodeProcess GetModuleHandleA SetErrorMode GetCommandLineA LoadLibraryExA FindFirstFileA FindNextFileA DeleteFileA SetFilePointer WriteFile FindClose WritePrivateProfileStringA MultiByteToWideChar MulDiv GetPrivateProfileStringA FreeLibrary

user32

CreateWindowExA EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard GetDC SystemParametersInfoA RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx DestroyWindow CreateDialogParamA SetTimer GetDlgItem wsprintfA SetForegroundWindow ShowWindow IsWindow LoadImageA SetWindowLongA SetClipboardData EmptyClipboard OpenClipboard EndPaint PostQuitMessage FindWindowExA SendMessageTimeoutA SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA

advapi32

RegCloseKey RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegEnumValueA RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

CoCreateInstance CoTaskMemFree OleInitialize OleUninitialize

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/AdvSplash.dll

IMPHASH 2e8d5524d09b794f343fa9e2df0a1d87
SHA256 3ec3cf21a99ab0533ec2c451df3b5542733f70b972089d5c321ad7ae3b87d175
MD5 6def2cf3daf850acdc1a3e7340a439c4
SHA1 95d0d26f60cd5af697502cd5e53a54913ab188fb
SHA512 16b1cf4783284d4a1282c569f5c416c713b4b339efcd4d3948bdf7da2194c597bd732d07ba9fabafcab323ba8c8da68845d4435ab9d1916b1810087ee1f5c413
SSDEEP 96:bNcIcmLEjNev3O2obNnNlXUjDftqlqCstWpFwoS:yIpLSG3O9XX+qlqntWpF
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4448

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/BgImage.dll

IMPHASH bdcecc8b26871abb93996c6c18e09c94
SHA256 71ce676703dad028e4083e6b960b1ed89885877079d46d5021506eaa6d99db53
MD5 2bb17d45e5ad92053ce1e500408dd8a9
SHA1 f5d3a7ee6e28df532e9ce33976c92ff30a5665e4
SHA512 efdcb476b9b9b5691fe6b9cd77ecbe48d50c6683da01fd51c6b428cc262528fb3dcd295abe28718321b2307b0e032fcb599588f1eb00a93fd9e6a1f7b322b41f
SSDEEP 96:8eXR0AKTIfv7QCUsthvNL85s4lk38Eb3CDfvEh8uLzqkNnLiEQjJ3KxkP:tvBfjbUA/85q3wEh8uLmsLpmP
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

7198

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/UserInfo.dll

IMPHASH cce05dea98cbac3a9d486b233588f528
SHA256 41293b9f6588e0fbdc8fcf2a9bd8e2b244cd5ff038fc13033378da337219c9dc
MD5 8ef0e4eb7c89cdd2b552de746f5e2a53
SHA1 820f681e7cec409a02b194a487d1c8af1038acf0
SHA512 a68533e8a19637d0d44219549b24baba0dc4824424842f125600fda3edcafc4bb6bb340d57a00815f262d82373b440d58d6e4e5b2ceb29bb3f6bc4cbde66c3c5
MD5 SHA1 SHA512

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4713

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsExec.dll

IMPHASH 6b7d154c806f1e47db325229c300c6df
SHA256 d3694fa0503158194129d113fcc1c83177ff5a5f93d898ce0bcfe9ce12f06bf4
MD5 c129bc26a26be6f5816a03520bb37833
SHA1 18100042155f948301701744b131c516bf26ddb8
SHA512 dbe79859c41e00a6e951cee889e7f0de29a712792fb531662285a2d6e384884518c7d5d983894c185b3d31d81213d2477cf4576b0114d352b759fe07a1704e63
SSDEEP 96:y7GUaYNwCLuGFctpiKFlYJ8hH4RVHpwdEeY3kRlDr6dMqqyVgN738:8ygp3FcHi0xhYMR8dMqJVgN
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4231

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Unifacial/Reparationsudgift/jomfruelige.fak

SHA256 c1766063715f2a7961beccd2cb3512180997219095ad3f3cb6116514b8bebb77
MD5 b16c195ce02340ba1287c12e33c9790e
SHA1 fedfc3db6dbb2fdfbe8cdc0635f01673c4621d9c
SHA512 a4a01aa3d9f489ee0431b190bf2185bddd3f98087f02da41887592a4e0375359a4e9e5eff1843efe8c2107507edfca317e3ae37ea9e8072c6c10c78feeece7c6
MD5 SHA1 SHA512

NSIS installer

installer

Unifacial/Reparationsudgift/prveudtagningsfrekvenser.blo

SHA256 a03760bebacabb088ae5363ccf3c97a949a7cbd211256c55132ab3f6b7f2219a
MD5 e85513648950813445f40ea6df287ea3
SHA1 55239aff841a8def7abdcba417777412bf727967
SHA512 ef3723d6134de2c0203c6bfafe58c976bc9c715424fb0032b43799876c867f562815f1a39d1800f0e6fd1fcce87333577bcb1ef85ccc3bb3d283fd42ce5c0dcd
MD5 SHA1 SHA512

NSIS installer

installer

Unifacial/Reparationsudgift/voguishness.cha

SHA256 916a729b4cc85c544e2d5d5bbb2f46dbdaa7773abdd81ebcce0f751dfe4451bb
MD5 4ea5e42b01c6313fbdbe3eade57479ce
SHA1 0645db129dffb85f36d6fbde85892f14be0f1dff
SHA512 46b65197b6a57999ac816c82a9b10427868958fd6080e5507a8e04cbd010e7be1c6e834dd9cf47e14fbb725a2a0a650ffc25b81cc6605dc1e555514f1a5009e5
MD5 SHA1 SHA512

NSIS installer

installer

Unifacial/attraktioner.txt

SHA256 e3bb08f79a12b917f2d9461b36fb03a844c7a9774641319fdf0ffad1c72c2fbe
MD5 12cb7310b5673590363734c5a47fd5aa
SHA1 977dc9f414a9034fbba3c52c164daf8868c0a953
SHA512 9a94ad15a2410ea148958871edd705d9b18c0dd21ff230991d31343c0551720367b600e1420f62ea9abd161a9b1adfa1a4675c464e05017c03a5565c9d92e193
MD5 SHA1 SHA512

NSIS installer

installer

Unifacial/bloknings.fle

SHA256 1c0b8eed3efb87a7fff903ba38e32d9fd22a2beefde54dee959080b448469c68
MD5 152f81cd927a1f343150bd5d1d8a028e
SHA1 2e3ac262112273ea0ffca2005806354427bf605d
SHA512 7926c18fcad5f18a36e84e335ddb03c9979e7251d5925cfcf8cf9aceda15ca2d9fdacba033f45603b071c608e4ed72ebd6e7d447e0a73cc80c6399089f8fc291
MD5 SHA1 SHA512

NSIS installer

installer

Unifacial/cassie.dat

SHA256 488e964aa6f447235535571d2284e448b7bdd919d3b8506fe456c0a05bfaf721
MD5 cc73bd1fefadb0fedb1ae6e9cf820c94
SHA1 cdc1169ceaaeda44e3d26820278539d02d17aaa1
SHA512 4e0c67018630a37a413c1ae21bae4cbdec363f223746a08e620e7a6044cc20436b1f833665bdb347c75727bb4b9a3fda49473e73f77674af9fe9c083d274a5d3
MD5 SHA1 SHA512

NSIS installer

installer

Upraught/Bantingize.cha

SHA256 d2c39a6bb8065a288d51e2633ed7a2709665ae6cd4fa439f02f862ac8196a4f3
MD5 2ce3ae40c335deaa2a3522bed4e78077
SHA1 7b6cb678c48bfc11af2870643c97f50f80156136
SHA512 af646c4094b63105639686cbe65862902f632df76f907a698c6d57a52c9f84d5024f0da66dd00275989d1735294198b9c7c4878149ceb9935be438bb5dfe6d24
MD5 SHA1 SHA512

NSIS installer

installer

Upraught/Efterbyrd.per

SHA256 f58625f5b7a76457373e56a7a7b5042c3b3eb3c2a540ff790984725bea48e1d9
MD5 282495ecb4325fd4a251e6d2dd7587af
SHA1 b7bc26f6fb5a1918f2171baab28660c1d37443df
SHA512 290ff573a8a326f775b7a2954d1009e8ce355d1dc28ad8664e1d239444b826722d93dd20cdcc18d4f7e4fe0eae389b254e3c55b38172d5d9cdf56c5cd42a0b5f
MD5 SHA1 SHA512

NSIS installer

installer

Upraught/Photoflash.Han

SHA256 25cee3997bf135d9bd98502de830e137072bf235e1043f3c28d7d1f3a69b1a11
MD5 7bf3790191a67f3d8b0acd355ec7779e
SHA1 cba6e4742a2ed3c4a9422adeb1494beabd6dd1e7
SHA512 98f8b02ac2acb750dc101d6c24d137f38c1254a01515af1d3e567659dac2a6ad6a10fd3c20e65c32b95820d565b4b4a621641ee2c90610cefa9dc53939f6418b
SSDEEP 1536:pFw1rf/whVenTYHR3gs747XSNorrhh4dhesRW+2AQBA6:pFw1rf/4VeTQ747xrhh+hesUAT6
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Upraught/Utaltes.Pos

SHA256 7548c2d5da5f6ab59d691b12b882ef722ba9f88aec448eaf2bb4760fbb950973
MD5 dfe8cbec2738d0ee2ea16a19f7da380a
SHA1 5d4f4408335938819152c1831d1d60cc2b52b5d1
SHA512 53ef786953e09e545bf65a6e9b4217155b28676f0bba3dafc55eaed2d1d600a5544eb6000433c8b7d46384f5724796547c270cab8b51489364c9e638a8058cb5
SSDEEP 6144:OK3bvITrRyQB+cHHykQxs5p/5D9lcYe1dfE3/TGF9sFMC3PCvljy:OK3b+U2+YzQxi/hmfE3/TGDCfwljy
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Upraught/antologis.flb

SHA256 48abcb7276feaee58f6182528c86704e082fdb4e01fb7f41a993bdd60a287f89
MD5 c6401149608c2e9a2cc0526674a884e0
SHA1 853cfca2ecbf1ec78b1c6acdf7595bb28bca7956
SHA512 7d42f8447da0e67e32d95f58be845c6c1b1a6c398ee3d8a4e373076a0adfdabe7dfa27c419ff85ac11036a92a0c42549188ee5917395ef8a7318c16b0f69c418
MD5 SHA1 SHA512

NSIS installer

installer

Sharing

General

Malware Config

Signatures

File Explorer

aac1416d21318d7eec4ecc4e87d91cfbee0b5d569ff9642070c9947c4c59265e.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/AdvSplash.dll

kernel32

user32

gdi32

winmm

generic

$PLUGINSDIR/BgImage.dll

kernel32

user32

gdi32

winmm

generic

$PLUGINSDIR/UserInfo.dll

kernel32

advapi32

generic

$PLUGINSDIR/nsExec.dll

kernel32

user32

advapi32

generic

Unifacial/Reparationsudgift/jomfruelige.fak

Unifacial/Reparationsudgift/prveudtagningsfrekvenser.blo

Unifacial/Reparationsudgift/voguishness.cha

Unifacial/attraktioner.txt

Unifacial/bloknings.fle

Unifacial/cassie.dat

Upraught/Bantingize.cha

Upraught/Efterbyrd.per

Upraught/Photoflash.Han

Upraught/Utaltes.Pos

Upraught/antologis.flb