Selvretfrdig[.]exe

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

Selvretfrdig.exe

IMPHASH f10e4da994053bf80c20cee985b32e29
SHA256 f8aa18d4254a618c058dda0a2be332707f305795953a26402e7b5f791b778bf0
MD5 016b555049364f09f3d2f58fe88c28f7
SHA1 48893b18559daa8392ff371117f799113c81c90d
SHA512 15ce409cdb879c30d14d6211127fa0d8f7cc22611b3c20906f70ef5da059dd769953441e4cd466b2b6c3f7a6124786f0c6f981abc75812f2a99d452bd1d3d586
SSDEEP 6144:9M23AbpBWzrsx8NjZc+2xFLHUxxf5WMG8FtObeYv5JuvWLWC32jTMA3hJCQNUs:vGpQzQ8cLxFQtdG8Ftqvzh9pKJfNb
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

4d:aa:1b:8f:ff:8f:03:a2:d9:92:ed:99:aa:f7:69:34:d3:4f:23:22:0b:d8:9f:35:ba:1f:f1:2d:79:6b:06:0c

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Skarphedsdybdes,OU=Foresaid Bladselleriernes\ ,O=Skarphedsdybdes,L=Morwick Hall,ST=England,C=GB,1.2.840.113549.1.9.1=#0c21446f76656c696b656e657373404465706572736f6e616c69736572696e2e486172

Chains

Jul 8, 2024

Minor OS version

0

Major OS version

4

Entry point

13516

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCreateKeyExA RegEnumKeyA RegQueryValueExA RegSetValueExA RegCloseKey RegDeleteValueA RegDeleteKeyA AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken SetFileSecurityA RegOpenKeyExA RegEnumValueA

shell32

SHGetFileInfoA SHFileOperationA SHGetPathFromIDListA ShellExecuteExA SHGetSpecialFolderLocation SHBrowseForFolderA

ole32

IIDFromString OleInitialize OleUninitialize CoCreateInstance CoTaskMemFree

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

SetClipboardData CharPrevA CallWindowProcA PeekMessageA DispatchMessageA MessageBoxIndirectA GetDlgItemTextA SetDlgItemTextA GetSystemMetrics CreatePopupMenu AppendMenuA TrackPopupMenu FillRect EmptyClipboard LoadCursorA GetMessagePos CheckDlgButton SetWindowPos SetCursor GetSysColor SetClassLongA GetWindowLongA IsWindowEnabled GetWindowRect GetSystemMenu EnableMenuItem RegisterClassA ScreenToClient EndDialog GetClassInfoA SystemParametersInfoA CreateWindowExA ExitWindowsEx DialogBoxParamA CharNextA SetTimer DestroyWindow CreateDialogParamA SetForegroundWindow SetWindowTextA PostQuitMessage SendMessageTimeoutA ShowWindow wsprintfA GetDlgItem FindWindowExA IsWindow GetDC SetWindowLongA LoadImageA InvalidateRect ReleaseDC EnableWindow BeginPaint SendMessageA DefWindowProcA DrawTextA GetClientRect EndPaint IsWindowVisible CloseClipboard OpenClipboard

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateFontIndirectA CreateBrushIndirect DeleteObject SetTextColor SelectObject

kernel32

GetExitCodeProcess WaitForSingleObject GetProcAddress GetSystemDirectoryA WideCharToMultiByte MoveFileExA GetTempFileNameA RemoveDirectoryA WriteFile CreateDirectoryA GetLastError CreateProcessA GlobalLock GlobalUnlock CreateThread lstrcpynA SetErrorMode GetDiskFreeSpaceA lstrlenA GetCommandLineA GetVersionExA GetWindowsDirectoryA SetEnvironmentVariableA GetTempPathA CopyFileA GetCurrentProcess ExitProcess GetModuleFileNameA GetFileSize ReadFile GetTickCount Sleep CreateFileA GetFileAttributesA SetCurrentDirectoryA SetFileAttributesA GetFullPathNameA GetShortPathNameA MoveFileA CompareFileTime SetFileTime SearchPathA lstrcmpiA lstrcmpA CloseHandle GlobalFree GlobalAlloc ExpandEnvironmentStringsA LoadLibraryExA FreeLibrary lstrcpyA lstrcatA FindClose MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA SetFilePointer GetModuleHandleA FindNextFileA FindFirstFileA DeleteFileA MulDiv

Momma/hatchback.jug

SHA256 6592c498eee3b188a8710a98b04b2b9bd747b31751610497302263d50529c44d
MD5 08a5afd573c778bd2c7014a26382b13e
SHA1 4e9e38a517b62b2652b7efa846d42b5af488d49f
SHA512 a286000cabd1f57d50c570977c023d286c81470905c21c6b6027fdb258971e4dd46fee28b3550ec9df2244d1541ac31ecb06d1639fbc338d496ec099a8c07709
SSDEEP 192:jS+u/5/1UOh2+13N46eABQqlea51Zlhivyuc0tb0OlNJYHY3Zf8s:jRS5ys1G6eAmqBhAPfWOWY3Zf8s
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Momma/kitin.bla

SHA256 3734ea4c9a3851e086be8f05c02dca695d0aa06d0e78a700db3df0e75c8f70f8
MD5 1cd36138558d012427b13738359203d8
SHA1 1f46abe30664b2813fec3a12a7eef8cc5cfaaba4
SHA512 f02d0344b2bc21e82239864239835fd6030558024a33abcfe2c62eb954ad7cb021c907f609506b4d7637a7f5e86bff4e84360883a7defd3bfdc2958f0f126829
SSDEEP 192:B0y5JKsu/Fkhw8yi3qepyL2s/tSvDWuyHGMLlCC+L:mkJKsu/FR8Zb6XFSLAGMBW
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Momma/larunda.pho

SHA256 cd30979142bf3d1efd212aba55dbd6a42dcbe44cdd85092b014efb1daaf864a6
MD5 860014be708cc3f30ea875d9548af2f8
SHA1 c04f16c9b9683c431dad64bd4da639f6edc62859
SHA512 4cacd7e70889d191c2944d2d71d7fd4f84b3fcc6e86fef964d823ae4485513649ef9b5f9d7aed38b2b567c3fb3e37a68ac44ae23799515d82aa645b1d80f19b6
SSDEEP 96:zQ2msOD/p1/s3FQrZgVaDCFBkVPXSd+ByK:z3mtRVs0SaDCFOVPCe
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Momma/turjite.pro

SHA256 7601cbd8ef98c5a5bd267ade4a13b19a80b80976d81ca963bdeb1c83751f666b
MD5 4901d55c36deb346b1a7e46910abac62
SHA1 23dd06e1dc344dce092c6d8bd23955f2d49b1059
SHA512 33c9143c948f45fc7ffaff66deb670b69490230562f04295fbc64e82092cf13e81915d7b6cfaab0b06cb374d1e70f817377292af781492bea991e6d11ce6d95e
MD5 SHA1 SHA512

NSIS installer

installer

Momma/undersalgs.txt

SHA256 9338a3176e634e9c3580ca438f78286ba8f5082b22dc9486100fbafd6c41b533
MD5 555962e697c9ef57192cc17dae39a2e0
SHA1 59ae5860198b6073560081154b78ccbfe18e846f
SHA512 984ed8089e8434c7ba7f4934f4d462c5b8440f4a72db5c397470b76cc500244810c292a8dd4031937fe18bcaa1d469a8b402048223fb0cf4fa0a16e331748ea9
MD5 SHA1 SHA512

NSIS installer

installer

Premortuary.heb

SHA256 9cc00b168811b2c693e1c1bf0e4d3ad8bfbf096c2ba46498fc8ebeb41f000f2c
MD5 f8137c5be37907a167f6bf954b5fd08a
SHA1 877b8fcabb756709668756553868e874a00640ec
SHA512 1c7e1435600f97471a4ca07836d159679e22eed5c6adc13adf2d30e653bc511a2f7d821f3ca9a9dd5a8504537822245fad9d9176d2f286470eea22417f62b747
SSDEEP 192:6NXEMRI9UvAdlhun7V6wTnU80bR67KX8sq7zEz8B33eGNumvPPYnjkZ515:6xI9XUnJVnU80bRcV/zfB33/gmw65
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Presenile.Tel

SHA256 38c27304ea5dcdcdbf5214a38989559b4f2feb79b73d680ec96cf2e9e220225d
MD5 67bfad28d1127c53a9aac5c51b3b77b8
SHA1 896af109b830f91baa527847b2cf968cba28b771
SHA512 8eb928e4731dda023c4b253539cd5e6246bcdc2bdbbe74e2f745f129c829a64b04c7d746630eb66a504b417332ea42b6d9bfd987f4704cb51660750fbe467b8b
SSDEEP 6144:LRPruCQrdK9y/AXcmqoEwO1En9Cddcpbz2a6KnCZnu77JJE:dPJQrYyYMmqZ1i9CXAyf9ZnQE
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Sperlingkasserne.Gla

SHA256 92eca1cfe870c436907085d7d2d85ea69c5596d456a98224937d631cfaf4adc6
MD5 c9035c38abb2f8b3e1255a2320926c2b
SHA1 29ee2663a1f9e8c907791957558b79dff166413c
SHA512 9b1f7655ec40cd92a873547bf7b8b03de824ee53bf2cbd516ec245e3cbc385e6659ce61ce5c94c1460877d697a42fbf1ee65db3abed1474c7aeec233208e89f7
SSDEEP 1536:vs8a2m7EDVyBpJ+Gmyr/vyzY3Pr8SXFkcsBs9KmjfybPuqgQZhqM7GNn2:Eb2mIDu+GmyjE/SX+Bs9Kmj6bPgQZfGM
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

burgerbars.squ

SHA256 130ee1819a1a2a076b9c46f615c39353101e1756926af670154eb9409f3e651c
MD5 3520e755ee1e698a2ce78a28c3dc2a99
SHA1 d1437dced86d8328202ecc8966304eb55797b7ec
SHA512 d87e29cb5e2064af13db2db5965423aae2197782e22f4b0140bdcd4d388367a2ed1037b89f32b803fa5a1d98e7afade009f7b75930970fb20d2784c71cf64696
SSDEEP 192:/Pb4QU2rrgePBbV6CfS++wB+uhCXiNwYYmDz:sQnrl9V6OqwB+QCXiCYYwz
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Sharing

General

Malware Config

Signatures

File Explorer