9bc70a2e37123deefafa303ca59ea0dd304b17e2f0288b3b6730104da0e0f6f1[.]exe

resource
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsExec.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

9bc70a2e37123deefafa303ca59ea0dd304b17e2f0288b3b6730104da0e0f6f1.exe

IMPHASH 076b06e6a65c9b7cca5a61be0cd82165
SHA256 9bc70a2e37123deefafa303ca59ea0dd304b17e2f0288b3b6730104da0e0f6f1
MD5 e9b1be2e63fc218bd1207838612575ca
SHA1 9bdea32b60dbd1166072774d75a3019417690b1c
SHA512 057171c9690bca3c7c711b24d310e2a373f4d2f1cd210296476c2c29ce162cedb21f8fd5f0987b09dae9e19e127f46114abe6141ac0ca8e26f49b5ee11e76d96
SSDEEP 12288:xaMgwQk0407ft8pjs0pGBvxM/r9RKGqHmIdD+Z:gMwt2Y0MMz9RKHHF9K
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

10:b8:cc:70:cf:5f:17:ae:6d:a2:5e:aa:e2:1b:72:d4:b7:5e:4d:9b:4d:f5:2a:34:08:3d:1a:ee:57:db:50:d4

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Trakteringers,OU=Blaster Enhedens Slumarbejdes\ ,O=Trakteringers,L=Mévouillon,ST=Auvergne-Rhône-Alpes,C=FR,1.2.840.113549.1.9.1=#0c1b506170696572343340456e67616e677362656c62656e652e44726b

Chains

Jul 5, 2024

Minor OS version

0

Major OS version

4

Entry point

12505

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

Sleep SetFileAttributesA GetFileAttributesA GetTickCount GetModuleFileNameA GetCurrentProcess CopyFileA GetFileSize ExitProcess GetWindowsDirectoryA GetTempPathA GetCommandLineA GetVersion SetErrorMode lstrlenA lstrcpynA ExpandEnvironmentStringsA SetEnvironmentVariableA GetFullPathNameA CreateThread GetLastError CreateDirectoryA CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA ReadFile WriteFile lstrcpyA MoveFileExA lstrcatA GetSystemDirectoryA LoadLibraryA GetProcAddress lstrcmpiA lstrcmpA SetCurrentDirectoryA MoveFileA CompareFileTime GetShortPathNameA SearchPathA CloseHandle SetFileTime GlobalLock GetDiskFreeSpaceA GlobalUnlock GlobalFree FindFirstFileA FindNextFileA DeleteFileA SetFilePointer GetPrivateProfileStringA FindClose MultiByteToWideChar MulDiv WritePrivateProfileStringA FreeLibrary LoadLibraryExA GetModuleHandleA GetExitCodeProcess WaitForSingleObject GlobalAlloc

user32

GetSystemMenu SetClassLongA EnableMenuItem IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard ScreenToClient GetWindowRect GetDlgItem CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA GetDC ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect EndDialog RegisterClassA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx LoadImageA CreateDialogParamA SetTimer SetWindowTextA SetWindowLongA SetForegroundWindow ShowWindow IsWindow SendMessageTimeoutA FindWindowExA OpenClipboard TrackPopupMenu AppendMenuA DrawTextA EndPaint DestroyWindow wsprintfA PostQuitMessage

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA

advapi32

RegDeleteKeyA SetFileSecurityA OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges RegOpenKeyExA RegEnumValueA RegDeleteValueA RegCloseKey RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_AddMasked ord17 ImageList_Destroy ImageList_Create

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/System.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 fda0018ab182ac6025d2fc9a2efcce3745d1da21ce5141859f8286cf319a52ce
MD5 4d3b19a81bd51f8ce44b93643a4e3a99
SHA1 35f8b00e85577b014080df98bd2c378351d9b3e9
SHA512 b2ba9c961c0e1617f802990587a9000979ab5cc493ae2f8ca852eb43eeaf24916b0b29057dbff7d41a1797dfb2dce3db41990e8639b8f205771dbec3fd80f622
SSDEEP 192:BPtkumJX7zB22kGwfy0mtVgkCPOse1un:u702k5qpdseQn
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

9995

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsExec.dll

IMPHASH 46f8b6973f33717335c0f6d8087de67b
SHA256 1c2f19e57dc72587aa00800a498c5f581b7d6761dc13b24bcf287ea7bd5ca2bf
MD5 3eb4cd50dcb9f5981f5408578cb7fb70
SHA1 13b38cc104ba6ee22dc4dfa6e480e36587f4bc71
SHA512 5a0c9d28df7a77e157046dce876282c48f434a441ee34e12b88f55be31be536eff676f580adbe4586da3f1519f94b5793ccbb3068b4b009eee286c0c5135d324
SSDEEP 96:+7GUxNkO6GR0t9GKKr1Zd8NHYVVHp4dEeY3kRnHdMqqyVgNv3e:QXhHR0aTQN4gRHdMqJVgNG
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4231

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Bygaksenes/Herbiest116.vre

SHA256 53512f1c52eaf92a898fb36109dae0a9d213756a883e05b2f0fcf116eef6b60e
MD5 62de12ed6ed6ff40a198d8b60827cceb
SHA1 fdc628000b2c284c8ec7dd07a125060deb714813
SHA512 3941aeb05dabca894676c6701827f5e93eb262cf39086a445f9de4e26ad84727f5ada7054d35cc3b5b196ca7785c4e928e2328a064198eccd47841fb16364909
SSDEEP 768:Sx+0VL5OUfjWsP4iWQPZ1VJ0FVBBHvr/L2UJVQIH:SMRB
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Bygaksenes/Spigrenes/afrettelsers.stj

SHA256 94e16d1fe3825dc4f2ca01698d2cdc0f1d4f9507aa606c7b5a6ce6d1e8bba64d
MD5 2c23f1adc70959d7f715ff1decaa3ffe
SHA1 89597d09d89bb076d30b3303feac287cecd339f8
SHA512 dbfeba6be17c9781049c9f3d4ac653e3f61b64fee143b47b313199d398bbc5e97c01506e9113ad0decba29db639e5dd2c0d143a50a13f6e1d577e359246eb3c0
SSDEEP 768:6tVRQvXsCZx/3WqeKzGl1ixDDcYhuMu39HqMjRCqaWW0knhjhPlKWMtO4G3VeEwJ:6P4Dba
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Bygaksenes/Spigrenes/figurally.txt

SHA256 66a293dc597f6dec3a665255a2adb2fc3652cefa4977e4551eae99f70586a94c
MD5 eb25616ae9dd1f3469be2ab4bc497047
SHA1 50b7c2992000772d52ce857e3ff4d30b891f8181
SHA512 8e4fb6f25baa50aa8e53a14d2443f48b01f0e6c8ee439bcd0b9cc17d8a799fc9bd9ba0fa69e5aa5784ad661457508f19fd149c1e8aaa44c5e53721c9f884b0e4
MD5 SHA1 SHA512

NSIS installer

installer

Bygaksenes/Spigrenes/smudses.yde

SHA256 5181b85f34ad4a096b83647c13d31656dcdd3c993fac3a96d4396b8d69f3e5e7
MD5 893cd3b016a43f89778f901eef7a7ece
SHA1 259ca8de763f1c32526bc23516f77130a7782faa
SHA512 31d393ae2e9ce2d155143ee2a5fe2493c6a5030f5c428ee29d8151d3315f27f13ab3dd7ff9a1dcc83c6d55cba64a13202a49a84000de22ee29300f3726a190a5
SSDEEP 768:TvBs/GHVGz2HBbnQ30Lo0yvDHGg3Gv2x1htjY8Z6nxv52ou+GwBCpEu8Q4IxbVIr:dsHOCa
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Bygaksenes/Unfrail.nay

SHA256 af0e57677bd14876793edb39eff56c044919a1ab62cd4b16754f6745b52f22e4
MD5 2494532c59743970919b467911cf098c
SHA1 0a651c761229511408ec9974dae00bc051bdcb4b
SHA512 eabe10516f56fc95c24512e1d6ea0d6f9f28d353febf51531fa200479abe5a296da598f3187dce73c96949daec5aabb647ebddc4c7a75a71c56b2c627be9b894
SSDEEP 384:GlAaIvea1OoHvWR7RyDyrTF7TeFNXvCGEKutK3cAgnXE37WzaZ3IIDOGAOBp5qXu:0cTKRRvJgr6UWGKIDbzEUKf1gip9xvE
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Forbundsformndene237.gen

SHA256 889569c108fa11e997516be33f3fe3a596c51b7e724cc2685ff7489d1e4f785e
MD5 68e60fbc8995cf416a66817858cf474e
SHA1 11e403b2e4e55f3f273385e8a6b06e3af9df9393
SHA512 f63681e583c3dda89eeee00a064ed6eba46d17761ce4367570f28ed3311e07e7cee43264e1243cd800bd889855269bfe9cb65f7bd74e0eefecdee75d99225e6f
SSDEEP 768:7OnjCMOzGZmKApM2SXVd1FAWTowGv6AyC8ROl2MHLZnPvcWhXkSKUP48Y6jmZ2EE:ynwo
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Jernbanetransporter.Spa

SHA256 ff17e39baaa16b17e6b0fd6d3717dfd49c4adcb46fb7c6bd7007c1b1611e67ed
MD5 2567c3213c40c25db7cda25f2b465ca2
SHA1 8928fc700918210cc24054516a422d37856ff30d
SHA512 db5fbb25f2fa6272788306796c47cb3c03446edd0cf17cc019e6757aeee016907db03bf531d488ce6d0d871d570fe356e42e953cc89bf95bb355212e652fc6a0
SSDEEP 3072:6tPS9phFtMeHpgbICW+vDM3SNeo00uSc0I:EkFtJJgKiQUej0zcl
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Middagstids.Tum

SHA256 48e92c677077693bd3c0326dcfefc02f9f0610e5e167ad1b43d3044062b7300b
MD5 410e1dfb8b3784badd62b0944e339cc6
SHA1 ea8a54486dd457b8e19a669d5dab311b0cb74f2a
SHA512 1519fd12b8ea9d1948b596f6b9d308378cb88db3a7088936805236f85b817680e0f0cc4547b322ff592625aca6e29709b6e70fa3344755a096d4fd2351219cdd
SSDEEP 384:ov9Bux83zNmXxOnwaBWlJvAaPtIt7oSe2Ahg+:ojux83zGOwSWleaVItUSe20g+
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

9bc70a2e37123deefafa303ca59ea0dd304b17e2f0288b3b6730104da0e0f6f1.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/nsExec.dll

kernel32

user32

advapi32

generic

Bygaksenes/Herbiest116.vre

Bygaksenes/Spigrenes/afrettelsers.stj

Bygaksenes/Spigrenes/figurally.txt

Bygaksenes/Spigrenes/smudses.yde

Bygaksenes/Unfrail.nay

Forbundsformndene237.gen

Jernbanetransporter.Spa

Middagstids.Tum

Sharing

General

Malware Config

Signatures

File Explorer

9bc70a2e37123deefafa303ca59ea0dd304b17e2f0288b3b6730104da0e0f6f1.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/nsExec.dll

kernel32

user32

advapi32

generic

Bygaksenes/Herbiest116.vre

Bygaksenes/Spigrenes/afrettelsers.stj

Bygaksenes/Spigrenes/figurally.txt

Bygaksenes/Spigrenes/smudses.yde

Bygaksenes/Unfrail.nay

Forbundsformndene237.gen

Jernbanetransporter.Spa

Middagstids.Tum