Quote Request (Tupy S[.]A[.]) 523AM - 924BR·pdf[.]exe

resource
Quote Request (Tupy S.A.) 523AM - 924BR·pdf.exe
unpack001/$PLUGINSDIR/AdvSplash.dll
unpack001/$PLUGINSDIR/BgImage.dll
unpack001/$PLUGINSDIR/UserInfo.dll
unpack001/$PLUGINSDIR/nsExec.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

Quote Request (Tupy S.A.) 523AM - 924BR·pdf.exe

IMPHASH e160ef8e55bb9d162da4e266afd9eef3
SHA256 1789a36b829cd09dc4fd24323a0d1bb900494714b4cc7083af651630f2c42d2f
MD5 93a658e985408e0538044b8b91a2729c
SHA1 c1f250915cb43fc6a46d29dc28a1f09881fe0ded
SHA512 5337c140a778e4ababf7dd82fcd280feb2a7e9e9db981c7fed1fff9c0ea8d562afe71992aa054e98ba9c715f0bea48d939f98b171110a7aaffcd372d23e2816e
SSDEEP 12288:zsB4GOFuvCfdDrklbm9QfwYUcTWQ5xQryR2:I4GOFCCFf4m9ESQWQDQ2Q
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12514

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetTickCount GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA SearchPathA GetShortPathNameA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess SetEnvironmentVariableA GetWindowsDirectoryA GetTempPathA Sleep CloseHandle LoadLibraryA lstrlenA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA ReadFile lstrcpyA lstrcatA GetSystemDirectoryA GetVersion GetProcAddress GlobalAlloc CompareFileTime SetFileTime ExpandEnvironmentStringsA lstrcmpiA lstrcmpA WaitForSingleObject GlobalFree GetExitCodeProcess GetModuleHandleA SetErrorMode GetCommandLineA LoadLibraryExA FindFirstFileA FindNextFileA DeleteFileA SetFilePointer WriteFile FindClose WritePrivateProfileStringA MultiByteToWideChar MulDiv GetPrivateProfileStringA FreeLibrary

user32

CreateWindowExA EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard GetDC SystemParametersInfoA RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx DestroyWindow CreateDialogParamA SetTimer GetDlgItem wsprintfA SetForegroundWindow ShowWindow IsWindow LoadImageA SetWindowLongA SetClipboardData EmptyClipboard OpenClipboard EndPaint PostQuitMessage FindWindowExA SendMessageTimeoutA SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA

advapi32

RegCloseKey RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegEnumValueA RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

CoCreateInstance CoTaskMemFree OleInitialize OleUninitialize

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/AdvSplash.dll

IMPHASH 2e8d5524d09b794f343fa9e2df0a1d87
SHA256 3ec3cf21a99ab0533ec2c451df3b5542733f70b972089d5c321ad7ae3b87d175
MD5 6def2cf3daf850acdc1a3e7340a439c4
SHA1 95d0d26f60cd5af697502cd5e53a54913ab188fb
SHA512 16b1cf4783284d4a1282c569f5c416c713b4b339efcd4d3948bdf7da2194c597bd732d07ba9fabafcab323ba8c8da68845d4435ab9d1916b1810087ee1f5c413
SSDEEP 96:bNcIcmLEjNev3O2obNnNlXUjDftqlqCstWpFwoS:yIpLSG3O9XX+qlqntWpF
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4448

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/BgImage.dll

IMPHASH bdcecc8b26871abb93996c6c18e09c94
SHA256 71ce676703dad028e4083e6b960b1ed89885877079d46d5021506eaa6d99db53
MD5 2bb17d45e5ad92053ce1e500408dd8a9
SHA1 f5d3a7ee6e28df532e9ce33976c92ff30a5665e4
SHA512 efdcb476b9b9b5691fe6b9cd77ecbe48d50c6683da01fd51c6b428cc262528fb3dcd295abe28718321b2307b0e032fcb599588f1eb00a93fd9e6a1f7b322b41f
SSDEEP 96:8eXR0AKTIfv7QCUsthvNL85s4lk38Eb3CDfvEh8uLzqkNnLiEQjJ3KxkP:tvBfjbUA/85q3wEh8uLmsLpmP
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

7198

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/UserInfo.dll

IMPHASH cce05dea98cbac3a9d486b233588f528
SHA256 41293b9f6588e0fbdc8fcf2a9bd8e2b244cd5ff038fc13033378da337219c9dc
MD5 8ef0e4eb7c89cdd2b552de746f5e2a53
SHA1 820f681e7cec409a02b194a487d1c8af1038acf0
SHA512 a68533e8a19637d0d44219549b24baba0dc4824424842f125600fda3edcafc4bb6bb340d57a00815f262d82373b440d58d6e4e5b2ceb29bb3f6bc4cbde66c3c5
MD5 SHA1 SHA512

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4713

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsExec.dll

IMPHASH 6b7d154c806f1e47db325229c300c6df
SHA256 d3694fa0503158194129d113fcc1c83177ff5a5f93d898ce0bcfe9ce12f06bf4
MD5 c129bc26a26be6f5816a03520bb37833
SHA1 18100042155f948301701744b131c516bf26ddb8
SHA512 dbe79859c41e00a6e951cee889e7f0de29a712792fb531662285a2d6e384884518c7d5d983894c185b3d31d81213d2477cf4576b0114d352b759fe07a1704e63
SSDEEP 96:y7GUaYNwCLuGFctpiKFlYJ8hH4RVHpwdEeY3kRlDr6dMqqyVgN738:8ygp3FcHi0xhYMR8dMqJVgN
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4231

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Bantingize.cha

SHA256 d2c39a6bb8065a288d51e2633ed7a2709665ae6cd4fa439f02f862ac8196a4f3
MD5 2ce3ae40c335deaa2a3522bed4e78077
SHA1 7b6cb678c48bfc11af2870643c97f50f80156136
SHA512 af646c4094b63105639686cbe65862902f632df76f907a698c6d57a52c9f84d5024f0da66dd00275989d1735294198b9c7c4878149ceb9935be438bb5dfe6d24
MD5 SHA1 SHA512

NSIS installer

installer

Cotes13/bloknings.fle

SHA256 1c0b8eed3efb87a7fff903ba38e32d9fd22a2beefde54dee959080b448469c68
MD5 152f81cd927a1f343150bd5d1d8a028e
SHA1 2e3ac262112273ea0ffca2005806354427bf605d
SHA512 7926c18fcad5f18a36e84e335ddb03c9979e7251d5925cfcf8cf9aceda15ca2d9fdacba033f45603b071c608e4ed72ebd6e7d447e0a73cc80c6399089f8fc291
MD5 SHA1 SHA512

NSIS installer

installer

Cotes13/cassie.dat

SHA256 488e964aa6f447235535571d2284e448b7bdd919d3b8506fe456c0a05bfaf721
MD5 cc73bd1fefadb0fedb1ae6e9cf820c94
SHA1 cdc1169ceaaeda44e3d26820278539d02d17aaa1
SHA512 4e0c67018630a37a413c1ae21bae4cbdec363f223746a08e620e7a6044cc20436b1f833665bdb347c75727bb4b9a3fda49473e73f77674af9fe9c083d274a5d3
MD5 SHA1 SHA512

NSIS installer

installer

Cotes13/jomfruelige.fak

SHA256 c1766063715f2a7961beccd2cb3512180997219095ad3f3cb6116514b8bebb77
MD5 b16c195ce02340ba1287c12e33c9790e
SHA1 fedfc3db6dbb2fdfbe8cdc0635f01673c4621d9c
SHA512 a4a01aa3d9f489ee0431b190bf2185bddd3f98087f02da41887592a4e0375359a4e9e5eff1843efe8c2107507edfca317e3ae37ea9e8072c6c10c78feeece7c6
MD5 SHA1 SHA512

NSIS installer

installer

Efterbyrd.per

SHA256 f58625f5b7a76457373e56a7a7b5042c3b3eb3c2a540ff790984725bea48e1d9
MD5 282495ecb4325fd4a251e6d2dd7587af
SHA1 b7bc26f6fb5a1918f2171baab28660c1d37443df
SHA512 290ff573a8a326f775b7a2954d1009e8ce355d1dc28ad8664e1d239444b826722d93dd20cdcc18d4f7e4fe0eae389b254e3c55b38172d5d9cdf56c5cd42a0b5f
MD5 SHA1 SHA512

NSIS installer

installer

Gasolier166/prveudtagningsfrekvenser.blo

SHA256 a03760bebacabb088ae5363ccf3c97a949a7cbd211256c55132ab3f6b7f2219a
MD5 e85513648950813445f40ea6df287ea3
SHA1 55239aff841a8def7abdcba417777412bf727967
SHA512 ef3723d6134de2c0203c6bfafe58c976bc9c715424fb0032b43799876c867f562815f1a39d1800f0e6fd1fcce87333577bcb1ef85ccc3bb3d283fd42ce5c0dcd
MD5 SHA1 SHA512

NSIS installer

installer

Gasolier166/voguishness.cha

SHA256 916a729b4cc85c544e2d5d5bbb2f46dbdaa7773abdd81ebcce0f751dfe4451bb
MD5 4ea5e42b01c6313fbdbe3eade57479ce
SHA1 0645db129dffb85f36d6fbde85892f14be0f1dff
SHA512 46b65197b6a57999ac816c82a9b10427868958fd6080e5507a8e04cbd010e7be1c6e834dd9cf47e14fbb725a2a0a650ffc25b81cc6605dc1e555514f1a5009e5
MD5 SHA1 SHA512

NSIS installer

installer

Hoodmold.pal

SHA256 ab066f63579ee3e93dce7659a29411242b96046c457995c77c129ead19dfc4f8
MD5 f10a2e78305cc76f40bc76797a5aca0e
SHA1 d107e88d4968c40da18b58a6ac7112e39410189d
SHA512 922c1c3967fd723430211e0e6ef09bb485e4e6ec8e95233a9d7c71a8c41c8d8276dae064648990974c1e093f19eae495b6be1956ef2e7f349ecb68621d3c2f00
SSDEEP 1536:AjrqedVgnQlx3/wro5HduK5FyfjfKOSwikk77KQB1btpU2Kn/+C0JDR3:A/DfgQj3/wrKHFEbo/7WQBRkd/ZA
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Overtidsbetalingers.Afl

SHA256 dfc92f1fb223f6a81ec1e72026e7e95376ce5f572b9a154a1d24c9abb2204888
MD5 c086b00efbe9cc4e81f801d0804e1647
SHA1 91751d0d919de34ed03abcb1662b35c68b17682d
SHA512 65fc0721c3818bd523d6766f51fea3efbcdb5629ce337ca39a4894c2ef677179b39e1ba3b2355c93f6d7d072313d1a8665c3534e69c523f20ce10cd3c4f33879
SSDEEP 6144:kPP+liU0rxCFmIxWJZyrPc2JslhMoWOE5j/9Fd8HgzF9hw+Qz:kPPI0rcKYzcHMojE1/tYy0+Qz
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

antologis.flb

SHA256 48abcb7276feaee58f6182528c86704e082fdb4e01fb7f41a993bdd60a287f89
MD5 c6401149608c2e9a2cc0526674a884e0
SHA1 853cfca2ecbf1ec78b1c6acdf7595bb28bca7956
SHA512 7d42f8447da0e67e32d95f58be845c6c1b1a6c398ee3d8a4e373076a0adfdabe7dfa27c419ff85ac11036a92a0c42549188ee5917395ef8a7318c16b0f69c418
MD5 SHA1 SHA512

NSIS installer

installer

attraktioner.txt

SHA256 e3bb08f79a12b917f2d9461b36fb03a844c7a9774641319fdf0ffad1c72c2fbe
MD5 12cb7310b5673590363734c5a47fd5aa
SHA1 977dc9f414a9034fbba3c52c164daf8868c0a953
SHA512 9a94ad15a2410ea148958871edd705d9b18c0dd21ff230991d31343c0551720367b600e1420f62ea9abd161a9b1adfa1a4675c464e05017c03a5565c9d92e193
MD5 SHA1 SHA512

NSIS installer

installer

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

Quote Request (Tupy S.A.) 523AM - 924BR·pdf.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/AdvSplash.dll

kernel32

user32

gdi32

winmm

generic

$PLUGINSDIR/BgImage.dll

kernel32

user32

gdi32

winmm

generic

$PLUGINSDIR/UserInfo.dll

kernel32

advapi32

generic

$PLUGINSDIR/nsExec.dll

kernel32

user32

advapi32

generic

Bantingize.cha

Cotes13/bloknings.fle

Cotes13/cassie.dat

Cotes13/jomfruelige.fak

Efterbyrd.per

Gasolier166/prveudtagningsfrekvenser.blo

Gasolier166/voguishness.cha

Hoodmold.pal

Overtidsbetalingers.Afl

antologis.flb

attraktioner.txt