d3da22560f0fcc2db9c1dabf88266dbe8ddaeee9f9be11fef8812c0879e5b306[.]exe

resource
d3da22560f0fcc2db9c1dabf88266dbe8ddaeee9f9be11fef8812c0879e5b306.exe
unpack001/$PLUGINSDIR/AdvSplash.dll
unpack001/$PLUGINSDIR/BgImage.dll
unpack001/$PLUGINSDIR/UserInfo.dll
unpack001/$PLUGINSDIR/nsExec.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

d3da22560f0fcc2db9c1dabf88266dbe8ddaeee9f9be11fef8812c0879e5b306.exe

IMPHASH e160ef8e55bb9d162da4e266afd9eef3
SHA256 d3da22560f0fcc2db9c1dabf88266dbe8ddaeee9f9be11fef8812c0879e5b306
MD5 76583ad77f92f7c21402dcf6e7a4b613
SHA1 8b20685d00b9c729356f8b3d371da03b326e4a80
SHA512 79c4a2621da0707c22a79b472a3a90f34debb6a9e1266ccf6826886646c9a1e495535ff800fccc08ac35531cce4e84f98b5b68afdf25e040bdc3e1720109fced
SSDEEP 12288:zsB4GOFNFqtVK+NvRHTLii5BpGH1uF5BhZeizW0Ij3:I4GOnFqrnj5BpkO5/ZjKj3
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12514

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetTickCount GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA SearchPathA GetShortPathNameA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess SetEnvironmentVariableA GetWindowsDirectoryA GetTempPathA Sleep CloseHandle LoadLibraryA lstrlenA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA ReadFile lstrcpyA lstrcatA GetSystemDirectoryA GetVersion GetProcAddress GlobalAlloc CompareFileTime SetFileTime ExpandEnvironmentStringsA lstrcmpiA lstrcmpA WaitForSingleObject GlobalFree GetExitCodeProcess GetModuleHandleA SetErrorMode GetCommandLineA LoadLibraryExA FindFirstFileA FindNextFileA DeleteFileA SetFilePointer WriteFile FindClose WritePrivateProfileStringA MultiByteToWideChar MulDiv GetPrivateProfileStringA FreeLibrary

user32

CreateWindowExA EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard GetDC SystemParametersInfoA RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx DestroyWindow CreateDialogParamA SetTimer GetDlgItem wsprintfA SetForegroundWindow ShowWindow IsWindow LoadImageA SetWindowLongA SetClipboardData EmptyClipboard OpenClipboard EndPaint PostQuitMessage FindWindowExA SendMessageTimeoutA SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA

advapi32

RegCloseKey RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegEnumValueA RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

CoCreateInstance CoTaskMemFree OleInitialize OleUninitialize

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/AdvSplash.dll

IMPHASH 2e8d5524d09b794f343fa9e2df0a1d87
SHA256 3ec3cf21a99ab0533ec2c451df3b5542733f70b972089d5c321ad7ae3b87d175
MD5 6def2cf3daf850acdc1a3e7340a439c4
SHA1 95d0d26f60cd5af697502cd5e53a54913ab188fb
SHA512 16b1cf4783284d4a1282c569f5c416c713b4b339efcd4d3948bdf7da2194c597bd732d07ba9fabafcab323ba8c8da68845d4435ab9d1916b1810087ee1f5c413
SSDEEP 96:bNcIcmLEjNev3O2obNnNlXUjDftqlqCstWpFwoS:yIpLSG3O9XX+qlqntWpF
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4448

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/BgImage.dll

IMPHASH bdcecc8b26871abb93996c6c18e09c94
SHA256 71ce676703dad028e4083e6b960b1ed89885877079d46d5021506eaa6d99db53
MD5 2bb17d45e5ad92053ce1e500408dd8a9
SHA1 f5d3a7ee6e28df532e9ce33976c92ff30a5665e4
SHA512 efdcb476b9b9b5691fe6b9cd77ecbe48d50c6683da01fd51c6b428cc262528fb3dcd295abe28718321b2307b0e032fcb599588f1eb00a93fd9e6a1f7b322b41f
SSDEEP 96:8eXR0AKTIfv7QCUsthvNL85s4lk38Eb3CDfvEh8uLzqkNnLiEQjJ3KxkP:tvBfjbUA/85q3wEh8uLmsLpmP
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

7198

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/UserInfo.dll

IMPHASH cce05dea98cbac3a9d486b233588f528
SHA256 41293b9f6588e0fbdc8fcf2a9bd8e2b244cd5ff038fc13033378da337219c9dc
MD5 8ef0e4eb7c89cdd2b552de746f5e2a53
SHA1 820f681e7cec409a02b194a487d1c8af1038acf0
SHA512 a68533e8a19637d0d44219549b24baba0dc4824424842f125600fda3edcafc4bb6bb340d57a00815f262d82373b440d58d6e4e5b2ceb29bb3f6bc4cbde66c3c5
MD5 SHA1 SHA512

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4713

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsExec.dll

IMPHASH 6b7d154c806f1e47db325229c300c6df
SHA256 d3694fa0503158194129d113fcc1c83177ff5a5f93d898ce0bcfe9ce12f06bf4
MD5 c129bc26a26be6f5816a03520bb37833
SHA1 18100042155f948301701744b131c516bf26ddb8
SHA512 dbe79859c41e00a6e951cee889e7f0de29a712792fb531662285a2d6e384884518c7d5d983894c185b3d31d81213d2477cf4576b0114d352b759fe07a1704e63
SSDEEP 96:y7GUaYNwCLuGFctpiKFlYJ8hH4RVHpwdEeY3kRlDr6dMqqyVgN738:8ygp3FcHi0xhYMR8dMqJVgN
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4231

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Bygningsbestanddels/Kork.Eks

SHA256 134b2aeb304ebbbcd2cf8b1eff5b54bd122795ea5eaf70c939ac27fb979459f2
MD5 c81a6714a02500d34518c574f9d4b01f
SHA1 e8f5d63579d995c2e80aa96c2fa51b3502739792
SHA512 90fe3078eb67b5cf39605672f130feeb4e348042ee8792a8e366332d12b3c1c5950655e10b7d6112d8a96b98760fe0a6f5ffb217bb932cbb66494c1a1c6e35c4
SSDEEP 1536:Z3U+cPFy8IFoPrvc61xRqsn6/lFfYhXh8LFrahwk:Z3ctgFQrk0M0xdh9
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Bygningsbestanddels/Pitilessness.Lge211

SHA256 40ac4dd2689ff258481e2881bfb93508828a98f3236b09393f7fdbeafd461805
MD5 84cb54267314cdae695bbdbbdd55740a
SHA1 5bf6c405ff05211a5b5455818380449baecac63b
SHA512 49b46e4e08c720207b968b02b301881f8a7140b1afaf3e5adc05119634a69acabb81097a17daed421c96ef14c9ec4919b718d7d768099d6a2bbf47497f67fa4b
SSDEEP 6144:+TbPiUhyP3Oejp7bENLi183TxWnrCm6tVlRjGzwjGrwsLjxsHW3Gce:8ha3OejpHEMGNSrCm2lRCGGUKC+le
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Dysfatikerens/voguishness.cha

SHA256 916a729b4cc85c544e2d5d5bbb2f46dbdaa7773abdd81ebcce0f751dfe4451bb
MD5 4ea5e42b01c6313fbdbe3eade57479ce
SHA1 0645db129dffb85f36d6fbde85892f14be0f1dff
SHA512 46b65197b6a57999ac816c82a9b10427868958fd6080e5507a8e04cbd010e7be1c6e834dd9cf47e14fbb725a2a0a650ffc25b81cc6605dc1e555514f1a5009e5
MD5 SHA1 SHA512

NSIS installer

installer

Gstelrers/Bantingize.cha

SHA256 d2c39a6bb8065a288d51e2633ed7a2709665ae6cd4fa439f02f862ac8196a4f3
MD5 2ce3ae40c335deaa2a3522bed4e78077
SHA1 7b6cb678c48bfc11af2870643c97f50f80156136
SHA512 af646c4094b63105639686cbe65862902f632df76f907a698c6d57a52c9f84d5024f0da66dd00275989d1735294198b9c7c4878149ceb9935be438bb5dfe6d24
MD5 SHA1 SHA512

NSIS installer

installer

Gstelrers/Licenced/Efterbyrd.per

SHA256 f58625f5b7a76457373e56a7a7b5042c3b3eb3c2a540ff790984725bea48e1d9
MD5 282495ecb4325fd4a251e6d2dd7587af
SHA1 b7bc26f6fb5a1918f2171baab28660c1d37443df
SHA512 290ff573a8a326f775b7a2954d1009e8ce355d1dc28ad8664e1d239444b826722d93dd20cdcc18d4f7e4fe0eae389b254e3c55b38172d5d9cdf56c5cd42a0b5f
MD5 SHA1 SHA512

NSIS installer

installer

Gstelrers/Licenced/antologis.flb

SHA256 48abcb7276feaee58f6182528c86704e082fdb4e01fb7f41a993bdd60a287f89
MD5 c6401149608c2e9a2cc0526674a884e0
SHA1 853cfca2ecbf1ec78b1c6acdf7595bb28bca7956
SHA512 7d42f8447da0e67e32d95f58be845c6c1b1a6c398ee3d8a4e373076a0adfdabe7dfa27c419ff85ac11036a92a0c42549188ee5917395ef8a7318c16b0f69c418
MD5 SHA1 SHA512

NSIS installer

installer

Trencherman/attraktioner.txt

SHA256 e3bb08f79a12b917f2d9461b36fb03a844c7a9774641319fdf0ffad1c72c2fbe
MD5 12cb7310b5673590363734c5a47fd5aa
SHA1 977dc9f414a9034fbba3c52c164daf8868c0a953
SHA512 9a94ad15a2410ea148958871edd705d9b18c0dd21ff230991d31343c0551720367b600e1420f62ea9abd161a9b1adfa1a4675c464e05017c03a5565c9d92e193
MD5 SHA1 SHA512

NSIS installer

installer

Trencherman/bloknings.fle

SHA256 1c0b8eed3efb87a7fff903ba38e32d9fd22a2beefde54dee959080b448469c68
MD5 152f81cd927a1f343150bd5d1d8a028e
SHA1 2e3ac262112273ea0ffca2005806354427bf605d
SHA512 7926c18fcad5f18a36e84e335ddb03c9979e7251d5925cfcf8cf9aceda15ca2d9fdacba033f45603b071c608e4ed72ebd6e7d447e0a73cc80c6399089f8fc291
MD5 SHA1 SHA512

NSIS installer

installer

Trencherman/cassie.dat

SHA256 488e964aa6f447235535571d2284e448b7bdd919d3b8506fe456c0a05bfaf721
MD5 cc73bd1fefadb0fedb1ae6e9cf820c94
SHA1 cdc1169ceaaeda44e3d26820278539d02d17aaa1
SHA512 4e0c67018630a37a413c1ae21bae4cbdec363f223746a08e620e7a6044cc20436b1f833665bdb347c75727bb4b9a3fda49473e73f77674af9fe9c083d274a5d3
MD5 SHA1 SHA512

NSIS installer

installer

Trencherman/jomfruelige.fak

SHA256 c1766063715f2a7961beccd2cb3512180997219095ad3f3cb6116514b8bebb77
MD5 b16c195ce02340ba1287c12e33c9790e
SHA1 fedfc3db6dbb2fdfbe8cdc0635f01673c4621d9c
SHA512 a4a01aa3d9f489ee0431b190bf2185bddd3f98087f02da41887592a4e0375359a4e9e5eff1843efe8c2107507edfca317e3ae37ea9e8072c6c10c78feeece7c6
MD5 SHA1 SHA512

NSIS installer

installer

Trencherman/prveudtagningsfrekvenser.blo

SHA256 a03760bebacabb088ae5363ccf3c97a949a7cbd211256c55132ab3f6b7f2219a
MD5 e85513648950813445f40ea6df287ea3
SHA1 55239aff841a8def7abdcba417777412bf727967
SHA512 ef3723d6134de2c0203c6bfafe58c976bc9c715424fb0032b43799876c867f562815f1a39d1800f0e6fd1fcce87333577bcb1ef85ccc3bb3d283fd42ce5c0dcd
MD5 SHA1 SHA512

NSIS installer

installer

Sharing

General

Malware Config

Signatures

File Explorer

d3da22560f0fcc2db9c1dabf88266dbe8ddaeee9f9be11fef8812c0879e5b306.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/AdvSplash.dll

kernel32

user32

gdi32

winmm

generic

$PLUGINSDIR/BgImage.dll

kernel32

user32

gdi32

winmm

generic

$PLUGINSDIR/UserInfo.dll

kernel32

advapi32

generic

$PLUGINSDIR/nsExec.dll

kernel32

user32

advapi32

generic

Bygningsbestanddels/Kork.Eks

Bygningsbestanddels/Pitilessness.Lge211

Dysfatikerens/voguishness.cha

Gstelrers/Bantingize.cha

Gstelrers/Licenced/Efterbyrd.per

Gstelrers/Licenced/antologis.flb

Trencherman/attraktioner.txt

Trencherman/bloknings.fle

Trencherman/cassie.dat

Trencherman/jomfruelige.fak

Trencherman/prveudtagningsfrekvenser.blo