118327932 AR_Feb_kazkhstan _2024-v2[.]exe

resource
unpack001/$PLUGINSDIR/System.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

118327932 AR_Feb_kazkhstan _2024-v2.exe

IMPHASH b78ecf47c0a3e24a6f4af114e2d1f5de
SHA256 2e2b22d80e84945f3149e24fb08a874e5293d4fbbff6d7df7c941fb47be9b4ff
MD5 f2ce50197b4bbb37ea2d92b6375ad39a
SHA1 49453ce5731b600b9459fcd4896cfb22ba85e069
SHA512 70ef9adc4a09b6fdec670a251f3ce2a5b73491bf334bd3c5ca005ccac654c7e99197ef109f173d63c2d0cef94b1b8519457e156c91703d9d241e4b6183475fdc
SSDEEP 12288:9F8SHwVMnjioNvXt2sMVfbc7/B/XVu4HbSeHEt7XtdPMh5EpRamarPV+:9+swyRsVfgBs47s19dPQ5EpRamarPE
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

4e:97:69:77:19:7c:90:c3:86:8c:9d:b9:b3:7c:a9:ae:d3:46:ab:ec:73:6a:19:ec:74:64:c8:55:bb:73:7e:cf

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Flettemuligheds,OU=Auktionshuse fingermaddens\ ,O=Flettemuligheds,L=Cosgrove,ST=England,C=GB,1.2.840.113549.1.9.1=#0c144d657269746f6b726174694053657261772e5061

Chains

Feb 7, 2024

PE Signature issue

Digest

6a:f4:d8:51:41:97:80:d8:07:17:8e:3b:a7:a2:a5:37:56:65:2e:4b

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Flettemuligheds,OU=Auktionshuse fingermaddens\ ,O=Flettemuligheds,L=Cosgrove,ST=England,C=GB,1.2.840.113549.1.9.1=#0c144d657269746f6b726174694053657261772e5061

Chains

Jul 5, 2024

Subject

CN=Flettemuligheds,OU=Auktionshuse fingermaddens\ ,O=Flettemuligheds,L=Cosgrove,ST=England,C=GB,1.2.840.113549.1.9.1=#0c144d657269746f6b726174694053657261772e5061

Serial Number

05:a2:5f:7a:df:fd:8e:c4:0d:8f:49:18:63:e3:77:1f:f2:58:40:a3

Issuer

CN=Flettemuligheds,OU=Auktionshuse fingermaddens\ ,O=Flettemuligheds,L=Cosgrove,ST=England,C=GB,1.2.840.113549.1.9.1=#0c144d657269746f6b726174694053657261772e5061

Timespan

Jul 15, 2023 - Jul 14, 2026

Subject

CN=Flettemuligheds,OU=Auktionshuse fingermaddens\ ,O=Flettemuligheds,L=Cosgrove,ST=England,C=GB,1.2.840.113549.1.9.1=#0c144d657269746f6b726174694053657261772e5061

Serial Number

05:a2:5f:7a:df:fd:8e:c4:0d:8f:49:18:63:e3:77:1f:f2:58:40:a3

Issuer

CN=Flettemuligheds,OU=Auktionshuse fingermaddens\ ,O=Flettemuligheds,L=Cosgrove,ST=England,C=GB,1.2.840.113549.1.9.1=#0c144d657269746f6b726174694053657261772e5061

Timespan

Jul 15, 2023 - Jul 14, 2026

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 23, 2017 - Mar 22, 2029

Minor OS version

0

Major OS version

4

Entry point

12672

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetEnvironmentVariableA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA GetFileAttributesA SetFileAttributesA GetWindowsDirectoryA GetTempPathA GetCommandLineA lstrlenA GetVersion SetErrorMode lstrcpynA ExitProcess GetFullPathNameA GlobalLock CreateThread GetLastError CreateDirectoryA CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA ReadFile WriteFile lstrcpyA MoveFileExA lstrcatA GetSystemDirectoryA GetProcAddress CloseHandle SetCurrentDirectoryA MoveFileA CompareFileTime GetShortPathNameA SearchPathA lstrcmpiA SetFileTime lstrcmpA ExpandEnvironmentStringsA GlobalUnlock GetDiskFreeSpaceA GlobalFree FindFirstFileA FindNextFileA DeleteFileA SetFilePointer GetPrivateProfileStringA FindClose MultiByteToWideChar FreeLibrary MulDiv WritePrivateProfileStringA LoadLibraryExA GetModuleHandleA GetExitCodeProcess WaitForSingleObject GlobalAlloc

user32

ScreenToClient GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard PostQuitMessage GetWindowRect EnableMenuItem CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndDialog RegisterClassA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx GetDC CreateDialogParamA SetTimer GetDlgItem SetWindowLongA SetForegroundWindow LoadImageA IsWindow SendMessageTimeoutA FindWindowExA OpenClipboard TrackPopupMenu AppendMenuA EndPaint DestroyWindow wsprintfA ShowWindow SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA

advapi32

RegDeleteKeyA SetFileSecurityA OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges RegOpenKeyExA RegEnumValueA RegDeleteValueA RegCloseKey RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/System.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 fa4ab1d6f79fd677433a31ada7806373a789d34328da46ccb0449bbf347bd73e
MD5 3f176d1ee13b0d7d6bd92e1c7a0b9bae
SHA1 fe582246792774c2c9dd15639ffa0aca90d6fd0b
SHA512 0a69124819b7568d0dea4e9e85ce8fe61c7ba697c934e3a95e2dcfb9f252b1d9da7faf8774b6e8efd614885507acc94987733eba09a2f5e7098b774dfc8524b6
SSDEEP 192:OPtkumJX7zB22kGwfy0mtVgkCPOsX1un:/702k5qpdsXQn
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

9995

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Overlades.Kos251

SHA256 e6375555acb4d2d398dbcdaedd79975580ad3779b8b3414263d44eb22b88ab94
MD5 bf1e781e3bf6ecd560cdf834c8470802
SHA1 b558ca6cbd23e9292804f6b4f5efed8842bab7b1
SHA512 d700d44e9708ac637b3cdaf201b1b8b7a3e581353bf51776dcd4d3a13fb3e44d7bbcd595ffd4558ded9125a3a4de3f71830d049c66be17df25b2df0aa4736746
SSDEEP 6144:/sLC3j6DZvFPoVRhPjga50IrSc3d5cxdOffoefIM3yrpc1ihl5:WWEZvFPoHBkMmc33sdOfQY3yrpcK3
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

dusken.spo

SHA256 bc786d3b508fdabc2c69e42268f4c0f1d69993fbf8464c1eb19d62f7a168a2aa
MD5 b6b30c74de5b41ef193eccae1d7d0f53
SHA1 363752c0f9b18fe88e26459a52366657f752cb15
SHA512 5336f5af0b5316ec89d95673b06f9a0b284811be861a60351e0748425d3517fc7ddfd521d70db832abb2b7a67b608f828c02dec113f9e493637f6696713912ea
SSDEEP 3072:Fmoh6PtMKTBrNbSrV+fjvfaMRx6AmQbJl6DG+FlUwSrtLNG8sgv:FOVMmBJbtjnq706G+Fkl84v
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

forindisk.adr

SHA256 2d3e476cf30a827ad0645b9d40c6528a7d981e0ccfff9740eaaf29873ce18624
MD5 e95d1ea2c6668e4bb0d382e9c00b0056
SHA1 ae9986b11daa35778fc6cad8bd7846a5bba71017
SHA512 df1a002184fe316709ba77d1b48b75e7d6eff03c807065f69b0241306cbaf0bfb9a9e753f64a542acd1060450f56d83f46464585ba32ec38939e91f582920765
SSDEEP 1536:5PZkE2vRP3R1yD7WN9MZOlcpM/quGSMhomRbw5ZTm7XLFBcpC8HffsAb1LJ7/:ZyduvE9I2/quGRo0eZTCk8Aj/
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

pinuela.sun

SHA256 9211c92f02cf05f192b6780bbaf64b8921a1ab9978a3fbad645cadc6ded5b68a
MD5 7242f968a360619919c424118981fee8
SHA1 1c1179ca20b119b53f427cf0497efee7ce9e3511
SHA512 83c8205963750acf44dec217eb7e89a1cc9265d27dcad77e86dc7817ba1c49bce291fa1c2376928a03d4b60dd554e89e48915f608a7504d92dc1672e8dca06fc
SSDEEP 1536:lj5IaIKkwoAx7iKQgd9vzb8Wc7zMw7iheoyW8UcHBTa4oX:lFAyfv8WcnMwmyF7oX
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

unpredaceously.txt

SHA256 0563f79ca3002e9187eeae6e05779d628e2a922edafc58ebd55b6b50baf6e591
MD5 d52a294f0999cc28aa4c33381743e257
SHA1 2f4185cd6a1b9e616ffc88a5e49e91b359b97497
SHA512 e3ebe1383a0422b7a1f7a092c680f48e1aa12cded0f9dcc8ccb0fed254b5614348db2f62fbd8d5aa06a28767a2a021f6ed05041d783c618d1fcd9ed84315748c
MD5 SHA1 SHA512

NSIS installer

installer

118327932 AR_Feb_kazkhstan _2024-v2.exe

PE Signature issue

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Overlades.Kos251

dusken.spo

forindisk.adr

pinuela.sun

unpredaceously.txt

Sharing

General

Malware Config

Signatures

File Explorer

118327932 AR_Feb_kazkhstan _2024-v2.exe

PE Signature issue

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Overlades.Kos251

dusken.spo

forindisk.adr

pinuela.sun

unpredaceously.txt