invoice[.]exe | Triage™

resource
unpack001/$PLUGINSDIR/BgImage.dll
unpack001/$PLUGINSDIR/UserInfo.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/nsExec.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

invoice.exe

IMPHASH b78ecf47c0a3e24a6f4af114e2d1f5de
SHA256 2926ff4aaaf732eb191704ec4b0b5081c9046b1a08ccf3871b14e7600e07d34c
MD5 5cb973edda7244515c1ddf1f532b67bc
SHA1 e03200f1949f4c85379cb31d2d61165794efb481
SHA512 220f5d5b8677de13495525bc825e048f25dbd9fe829f37e31a64f5ee72cf62945a1d71456a4438f96cd58496289f3cbccb2d7a3ee7fbe1c75e0ee15c93bad9ed
SSDEEP 12288:uKYi/LALj3EpUkdwsVZKRukGeYO+NRPNTvJiYn:bFD6rXsgPQhNRPNTxiYn
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

32:fe:df:e8:f5:2b:72:47:7e:dd:5e:c4:d6:94:71:c5:03:25:30:56:ab:2a:04:17:6c:5d:5a:e7:2e:1d:22:f8

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Legarts,OU=Schorlomite Leatherlikeness\ ,O=Legarts,L=Winswell,ST=England,C=GB,1.2.840.113549.1.9.1=#0c1a4e6f6e70617265696c6c6540556e6465726265677265622e476f

Chains

Jul 4, 2024

Minor OS version

0

Major OS version

4

Entry point

12505

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetEnvironmentVariableA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA GetFileAttributesA SetFileAttributesA GetWindowsDirectoryA GetTempPathA GetCommandLineA lstrlenA GetVersion SetErrorMode lstrcpynA ExitProcess GetFullPathNameA GlobalLock CreateThread GetLastError CreateDirectoryA CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA ReadFile WriteFile lstrcpyA MoveFileExA lstrcatA GetSystemDirectoryA GetProcAddress CloseHandle SetCurrentDirectoryA MoveFileA CompareFileTime GetShortPathNameA SearchPathA lstrcmpiA SetFileTime lstrcmpA ExpandEnvironmentStringsA GlobalUnlock GetDiskFreeSpaceA GlobalFree FindFirstFileA FindNextFileA DeleteFileA SetFilePointer GetPrivateProfileStringA FindClose MultiByteToWideChar FreeLibrary MulDiv WritePrivateProfileStringA LoadLibraryExA GetModuleHandleA GetExitCodeProcess WaitForSingleObject GlobalAlloc

user32

ScreenToClient GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard PostQuitMessage GetWindowRect EnableMenuItem CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndDialog RegisterClassA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx GetDC CreateDialogParamA SetTimer GetDlgItem SetWindowLongA SetForegroundWindow LoadImageA IsWindow SendMessageTimeoutA FindWindowExA OpenClipboard TrackPopupMenu AppendMenuA EndPaint DestroyWindow wsprintfA ShowWindow SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA

advapi32

RegDeleteKeyA SetFileSecurityA OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges RegOpenKeyExA RegEnumValueA RegDeleteValueA RegCloseKey RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/BgImage.dll

IMPHASH bdcecc8b26871abb93996c6c18e09c94
SHA256 5c66abd3f06eaa357ed9663224c927cf7120dca010572103faa88832bb31c5ab
MD5 350a507070ed063ac6a511aeef67861a
SHA1 cf647b90a1212e090f1d236d1b50a5010cbf3bae
SHA512 cde5747cc8539625e4262afad9699ce4e8325133d7ed7f47b9d46989a7aa0d2cc2488441acc57368f485ef1dd3e02b9ef2faa642f68e9f1db53a39e0f896d468
SSDEEP 96:8eE0AKTIfv7QCUsthvNL85s4lk38Eb3CDfvEh8uLzqkwnLiEQjJ3KxkP:tWBfjbUA/85q3wEh8uLmjLpmP
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

7198

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/UserInfo.dll

IMPHASH cce05dea98cbac3a9d486b233588f528
SHA256 77b40d42606d48f817b901f1e5abea114b4288b344b8c193bf3e3c52e469a926
MD5 d1e37112390e6bcca8362788d61becf5
SHA1 d97888f0f69d34de202e7c68b8ff5b2c2fec4c5f
SHA512 04121e5241ad14890095a6cf5e698979820fa97d911918b9b77f2064a713e20f4827f72c057d5da1789bc340d63f391872fe5dfbb79e6c33d3995f82c37fa51f
MD5 SHA1 SHA512

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4713

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsDialogs.dll

IMPHASH ddbd50fe6279559edf7d1f1d89b42c2c
SHA256 cb958e21c3935ef7697a2f14d64cae0f9264c91a92d2deeb821ba58852dac911
MD5 13b6a88cf284d0f45619e76191e2b995
SHA1 09ebb0eb4b1dca73d354368414906fc5ad667e06
SHA512 2aeeae709d759e34592d8a06c90e58aa747e14d54be95fb133994fdcebb1bdc8bc5d82782d0c8c3cdfd35c7bea5d7105379d3c3a25377a8c958c7b2555b1209e
SSDEEP 96:oyqZ4zC5RH3cXX1LlYlRowycxM2DjDf3GEst+Nt+jvDYx4yqndYHnxss:oyq+CP3uKrpyREs06YxKdGn
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

7429

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsExec.dll

IMPHASH 46f8b6973f33717335c0f6d8087de67b
SHA256 3e3d516d4f28948a474704d5dc9907dbe39e3b3f98e7299f536337278c59c5c9
MD5 b648c78981c02c434d6a04d4422a6198
SHA1 74d99eed1eae76c7f43454c01cdb7030e5772fc2
SHA512 219c88c0ef9fd6e3be34c56d8458443e695badd27861d74c486143306a94b8318e6593bf4da81421e88e4539b238557dd4fe1f5bedf3ecec59727917099e90d2
SSDEEP 96:U7GUxNkO6GR0t9GKKr1Zd8NHYVVHp4dEeY3kRnHdMqqyVgNN3e:mXhHR0aTQN4gRHdMqJVgNE
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4231

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

collinsia/Donkraftes197.sax

SHA256 92746e6cf37b022c9e65f638325d9a260109f8ad1cefdcd9179023a8c43854bd
MD5 ffbf267c60266b56038d6f59a29667fe
SHA1 6670dcfb19c1f662eebb962c5c893e26bfdc6a3a
SHA512 1470d30b40f80ef601e0d8376fa43d868e05b812f56aa6cc214810c6723f2a44200ee518fdac2637053e276a73603d3b89d204b7ebc96bac47d38ab69d5799a0
MD5 SHA1 SHA512

NSIS installer

installer

collinsia/Filmkundskabers209.kon

SHA256 39dadb40165c61c25e858a914f037cde54b6ca6e280e563c11e14e8eaa5f360e
MD5 697432ae88310017784e05283190c05b
SHA1 0d82f0c883ff55a4847542ad6bfe7c78b6751630
SHA512 768c4181e3455e0c67e2277b70c674f5c960c1a3a92629d8768d090bb2d4d0e7a9f1eab7a3d690a0bee004867c13799cbaefd99bf27b42961112d3efff5da45f
MD5 SHA1 SHA512

NSIS installer

installer

collinsia/Handelsstandsforeningernes.Toi

SHA256 9f288ab07bf267422b4670dfd87f373115682a026e63db13e9bab44977c8cc0f
MD5 9f369129a14ef6d8d0867ec4d9b6eb19
SHA1 2a56ca0fb0b4590c030d293a7829ac087212821b
SHA512 d8fd8aeabfa1bd47f0d3ca2208ac9154496d9b38ef6b185a3c9bf26877539f57a5b0e022c02ae2121a68f74ab13f45f446124dc6d8d90020defd1abeb2825326
SSDEEP 1536:zL2PxikL3EyzfNPBVfXIOgQnyIoxOVhEuCU3G0W5ZS30F:+PxnL3EiIOhwShEuCGirA0F
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

collinsia/Henseende.ska

SHA256 6bb38a6800a2e28ab2925ebae75a5189fc3273186cd625117caa436536f79efa
MD5 acd3ea83bea818bb3a99f3c9e9a1fd5e
SHA1 9a7d6ab1713e6a20181f52ea1bcc2c0eadbf2d2c
SHA512 a1941147ba67e663d0f82719506e19bcd40efb58d8d043dd03775e7ef68790fd9d56445de3e4c7492df969a01ce1c7b326a97760f943ebebc1addae5dfbbb859
MD5 SHA1 SHA512

NSIS installer

installer

collinsia/Hospitaliseret.lba

SHA256 28d8be59cfab5805f4ab48aaa72b54079a69c2f48136108849e8f12c9c14f92c
MD5 7ca2dd0bdbf021d85bb1bbca305f4e4a
SHA1 d454677a43d30a5107b0e50f16aecc25d4fdfa8b
SHA512 da65eca8e6865f609b0c7ecf136bdac7231608d936f812c6c304ce3bb58c9c6f5e4cb9315a75b551b52f726b8a1b5e3fd7ef513a4a72f028b5e49e9d1d578641
MD5 SHA1 SHA512

NSIS installer

installer

collinsia/Typehuses.Ver

SHA256 b1246b2938bd2fa73f3a6679ea5040697db9a6ace3607fd2f20c5db2eeecc907
MD5 edd82166d9af4f94ca8413254ad27eee
SHA1 cbe26db0839f63fc825205293f32660e8fa4b63c
SHA512 7f25fac516c23cdddfbf8f22e3f29e23c599ceacdfcf5d84531535e7838114bc982bef629ab219c7a17bcbc9ac97f159642297da7e2c1d8fa8d921917986fae8
SSDEEP 6144:V7CgZsP4sUIRsqpN2M51Rk4aaQN6a1PQDNUj:MgKP4DIRsSQg1Rk4a4a1PQDmj
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

collinsia/extravagence.txt

SHA256 e20eb817c5e5dc93935980c16561d27728efe357628d43a684793db9f3130ad7
MD5 270491e6b4f6bab6d9a2034416b1b695
SHA1 098f4a1248e4af2290f44c89d4288fbf742e00bc
SHA512 cfc48a418c30fd8271979e3d3766d8071963fc60d36504debd3cc0ea8d35136ad86ff6b278d3e3b0bcf2b6a953eea94da802aa4014e9e3c8cb471b08fdf20862
MD5 SHA1 SHA512

NSIS installer

installer

collinsia/intertieing.hyd

SHA256 ab87d4bffbde0f6952906169ad7a87beab87efad84c3460920a243bea659d754
MD5 f8426fdb8764486488bcf8b38dd484a4
SHA1 541158fc40283c0219922cdd651b6e57d9eaaf4f
SHA512 acc54cae6d7668a05abd9c2a293e5ca8e72b1cf177ab0dec6adcb2130d252e738608dd8f3b13cab1b76fb78afe0e2395182f6a9ea499ac436755c45404ecd9de
MD5 SHA1 SHA512

NSIS installer

installer

collinsia/kannevassers.esk

SHA256 191412af797d357ae97c55047cb5a7427bed940e025d39abc89e862177a5daf6
MD5 1f22eb9db671b05ed5c08f8dd00d5c48
SHA1 8a7959384c2442945087d67cfe129752d2da87fa
SHA512 8ebf76314acbddecfd19849ace9f4eaa9e2b1d4e5e7c370479707b96d139ec2800f719420eb14342394f6679c732bb1c4bc741c2f7d45da772fd75c5a21ce5fe
MD5 SHA1 SHA512

NSIS installer

installer

collinsia/overvurderingens.syn

SHA256 a5aed468547f93b42c66fc193f770d6e41b5f4701c0e6fc0bba48c1589276933
MD5 612f90bbc9347ddeffb620e1dd4e730b
SHA1 91cd3fb4025685ac7098cd4bd3f822317b192583
SHA512 9a0dbef78c25891d747cc211e53caebc60159fc6630b5a1efbf7436a494e7f9a33e3bb313e25a44c3778df440d5c94377bc4416f2c21934b83a9a07d35246ace
MD5 SHA1 SHA512

NSIS installer

installer

collinsia/scattier.con

SHA256 ce956ff5404172303308409c64fd6e20dd602cc4d2ddab1ef183f0b9e4deacc7
MD5 31030fc12e7662a05e09f8713e5188e4
SHA1 8bb2e7f32cade158c981ec302c80b31c3dc56327
SHA512 bc95831c3cebd16786cb74ecc121d7048e48bfdee8e0efebbae3406e19afbf54121eb6ac83134b7d70feadfe34cf4d9852ea4c26735c28762bbb5051a757cf03
MD5 SHA1 SHA512

NSIS installer

installer

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

invoice.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/BgImage.dll

kernel32

user32

gdi32

winmm

generic

$PLUGINSDIR/UserInfo.dll

kernel32

advapi32

generic

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

$PLUGINSDIR/nsExec.dll

kernel32

user32

advapi32

generic

collinsia/Donkraftes197.sax

collinsia/Filmkundskabers209.kon

collinsia/Handelsstandsforeningernes.Toi

collinsia/Henseende.ska

collinsia/Hospitaliseret.lba

collinsia/Typehuses.Ver

collinsia/extravagence.txt

collinsia/intertieing.hyd

collinsia/kannevassers.esk

collinsia/overvurderingens.syn

collinsia/scattier.con