6da97627f53ef956b4e000fb9f150553[.]exe

resource
unpack001/$PLUGINSDIR/System.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

6da97627f53ef956b4e000fb9f150553.exe

IMPHASH 5f0c714c36e6cc016b3a1f4bc86559e4
SHA256 e0452ab52309304cd0da107eabf8cf7e15887f977a0e59c22166bcb7383f10d5
MD5 6da97627f53ef956b4e000fb9f150553
SHA1 32edd8d768bf703a5742ff52fdb56f4ef9f42d88
SHA512 48732bec8569ea86a239c7d1dc9f9b9e66cb4900f10bbf6bb4cfb7ea4900ca5537600739c05ca38fd8b3c093adfd137ffb5863c03cb4a23b88027c6b66a3ce58
SSDEEP 12288:rmnpciECA+jAQNuOShCuyulOVeAVAIVRtgUpA:rmn2r+dMhCufQeAVR5gUpA
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

bb:38:54:de:39:c7:d4:aa:35:7c:1b:aa:38:c4:6a:98:d6:28:44:a1:34:0e:10:bf:ab:67:de:c0:8c:00:7f:67

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Vgerne,OU=Affatning Unexplicable Styrketrne\ ,O=Vgerne,L=Alexandria,ST=Virginia,C=US,1.2.840.113549.1.9.1=#0c2149726f6e69736572656e646540467265647362657667656c7365726e652e417366

Chains

Jul 5, 2024

PE Signature issue

Digest

de:46:08:64:af:56:0f:1b:e4:79:78:44:f8:5d:31:81:6b:63:b1:50

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Vgerne,OU=Affatning Unexplicable Styrketrne\ ,O=Vgerne,L=Alexandria,ST=Virginia,C=US,1.2.840.113549.1.9.1=#0c2149726f6e69736572656e646540467265647362657667656c7365726e652e417366

Chains

Jul 5, 2024

Minor OS version

0

Major OS version

4

Entry point

13235

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCreateKeyExA RegEnumKeyA RegQueryValueExA RegSetValueExA RegCloseKey RegDeleteValueA RegDeleteKeyA AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken SetFileSecurityA RegOpenKeyExA RegEnumValueA

shell32

SHGetFileInfoA SHFileOperationA SHGetPathFromIDListA ShellExecuteExA SHGetSpecialFolderLocation SHBrowseForFolderA

ole32

IIDFromString OleInitialize OleUninitialize CoCreateInstance CoTaskMemFree

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

SetClipboardData CharPrevA CallWindowProcA PeekMessageA DispatchMessageA MessageBoxIndirectA GetDlgItemTextA SetDlgItemTextA GetSystemMetrics CreatePopupMenu AppendMenuA TrackPopupMenu FillRect EmptyClipboard LoadCursorA GetMessagePos CheckDlgButton SetWindowPos SetCursor GetSysColor SetClassLongA GetWindowLongA IsWindowEnabled GetWindowRect GetSystemMenu EnableMenuItem RegisterClassA ScreenToClient EndDialog GetClassInfoA SystemParametersInfoA CreateWindowExA ExitWindowsEx DialogBoxParamA CharNextA SetTimer DestroyWindow CreateDialogParamA SetForegroundWindow SetWindowTextA PostQuitMessage SendMessageTimeoutA ShowWindow wsprintfA GetDlgItem FindWindowExA IsWindow GetDC SetWindowLongA LoadImageA InvalidateRect ReleaseDC EnableWindow BeginPaint SendMessageA DefWindowProcA DrawTextA GetClientRect EndPaint IsWindowVisible CloseClipboard OpenClipboard

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateFontIndirectA CreateBrushIndirect DeleteObject SetTextColor SelectObject

kernel32

GetExitCodeProcess WaitForSingleObject GetProcAddress GetSystemDirectoryA WideCharToMultiByte MoveFileExA ReadFile GetTempFileNameA WriteFile RemoveDirectoryA CreateProcessA CreateFileA GetLastError CreateThread CreateDirectoryA GlobalUnlock GetDiskFreeSpaceA GlobalLock SetErrorMode GetVersionExA lstrcpynA GetCommandLineA GetTempPathA lstrlenA SetEnvironmentVariableA ExitProcess GetWindowsDirectoryA GetCurrentProcess GetModuleFileNameA CopyFileA GetTickCount Sleep GetFileSize GetFileAttributesA SetCurrentDirectoryA SetFileAttributesA GetFullPathNameA GetShortPathNameA MoveFileA CompareFileTime SetFileTime SearchPathA lstrcmpiA lstrcmpA CloseHandle GlobalFree GlobalAlloc ExpandEnvironmentStringsA LoadLibraryExA FreeLibrary lstrcpyA lstrcatA FindClose MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA SetFilePointer GetModuleHandleA FindNextFileA FindFirstFileA DeleteFileA MulDiv

$PLUGINSDIR/System.dll

IMPHASH 595a3fd71239f605bb02d7a5e48fd4df
SHA256 7342b73593b3aa1b15e3731bfb1afd1961802a5c66343bac9a2c737ee94f4e38
MD5 e23600029d1b09bdb1d422fb4e46f5a6
SHA1 5d64a2f6a257a98a689a3db9a087a0fd5f180096
SHA512 c971f513142633ce0e6ec6a04c754a286da8016563dab368c3fac83aef81fa3e9df1003c4b63d00a46351a9d18eaa7ae7645caef172e5e1d6e29123ab864e7ac
SSDEEP 192:Vm9rQDenC9VrcK7REgSWOprANupQYLRszDDH/d9CWlXo7U6Wxf:QJQEaVAK7R9SfpjpQYLRszfH/d9CWB1j
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

6

Entry point

6599

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Akkompagnerede.Mar

SHA256 0e9ebc7bdc476c0b8017e6dcdec6647ef270f60bc06f84508ccc1ff63076fd8f
MD5 492a239279ceac3ed4086012bca0f3cc
SHA1 ba0039849a4d2cdcd2bd392eb883f7ea6cc723e6
SHA512 473e403a90a60057e944c177cbedef067e7cc99e4c0637e4b572c05dad473c543e7d4103f244d977a6459746acdba6e9356b80fe660074e2d7822387476ae8b9
SSDEEP 6144:tlFZh4wg7Wk+jD4hAAW2+dvgsgGSCo1hiCRCr:tfaejD4h22+dvgJ9DcCRG
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Bilabial.imp

SHA256 9e0dc63c22702d5bca206995f85f04d200518cf005716ca14c8df024aa32953f
MD5 14df849b9a2e69ed8cb296f50eb44e1a
SHA1 94407b6fa266f21048516e058472570199973689
SHA512 23d86c43988600a39ec42f3ae0985bcf3d03e54bb560d5bd3d0be9e653423aedf02a48773ca49788592bb39d721ca89d2c54527a890a8b1ed85c8d0562ae33d9
MD5 SHA1 SHA512

NSIS installer

installer

Earthkin48.def

SHA256 872b78b7a8a9adf686fb4af24634c3a71e310839ce000adfd295b3df21e71027
MD5 1d9b0d77a70365c21658c7570ef72414
SHA1 3d18dfa8a4eb63b575b4286b6dade926cea31661
SHA512 6474e3de59245840810967795feeac04eac6d194158aef3545ee3a6f2a6753b5e2d51a152dd936d00b9bfa0ec2f45f26228a66c874d88d9f9dd7ee0f6b97382a
MD5 SHA1 SHA512

NSIS installer

installer

Septicizations218.ung

SHA256 32326da036ed42a3789a377b897419c11da9fad2f7d8c8b402368864263b7c37
MD5 0c6f696a0ea6f524cef46c7126d68dc4
SHA1 3eb33e5632b95eecc3515f85fb437ea5692fa528
SHA512 71d65d087baff0c83d7ad651cb92520d458f35af486e215346e11a77fcb549b656556a864d4a000d85badc997c2d779cce30e2151ac04352a35b64668c521548
SSDEEP 192:VzOivp3265RT1pua4+zCVyaHh3uOWXrUpvhJ1jg:x9vdz1cBJT3bmUpvhJq
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Sheriat.Str

SHA256 58676a7f040d41c0c93e3f2773f38a9cc3f05c7a94b8bf384924b3b8db9f9e7d
MD5 35015fc28c33dacbf90b6a3d52120de6
SHA1 778039c7c518852cf556eff6e007abaac1766dd7
SHA512 6e86927224faf68d71df5a85bab5947c4d5a8f845ee0511b650b3b0de47ee4a3e8776a84b4d3464d951afbe0a2ef63299435fc495bb4cb60ab5f48bc9fe1d5d0
SSDEEP 1536:9ZYEMzQ2xAAcXWQei9OLtsRJeAmN55nw6:9ZiQ2itnOBYJh05w6
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

brydesport.unc

SHA256 cdd3db01b61de354ab0c16e08c000241ba25d27b4fa90eae8938573a54256617
MD5 78352c9a7b2feba4569ef26711e637bc
SHA1 11a121f558140826b22a72ffb2cf8404bf1775b0
SHA512 fd3703278a130084357f9bc1578a4e079cf97cc77fb4276ebbde3c9346f224fd8b95a58c1cccfe28ce137d38865f3eeef3a90b55fffeef3f0e2be9618de18b69
SSDEEP 96:7nzIA7jy5v7TVlCU0N8D/Fot5Ms2ySmWyf8R6aSh6on5aIWVb5:7zIA3y51jaMotuy9f4Kh6aaIOb5
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

reflowering.bis

SHA256 221afd33a45d7cf418d5d4a448fc3c1e17ecbcafbf6b1559ffaab8e36fb1c562
MD5 21d79ae4f031ae99619b400e0778dc6d
SHA1 b1ab6d46a6962aac4906c46a6616fe2e302d8244
SHA512 9618eb7bb60346990e910b57afbe14a7946b21dc7fe59363a4d8b240223fc48e5351caed3f6156121c2e5a9d4732fa867fda115928949f965bed62b05041d993
SSDEEP 96:bAy9jcBBHJsnC6wSn8cWBcyJLwval88DMcD:q/JsnCkeBc00valXD/
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

unenounced.fle

SHA256 6299a0bbe4f725d7788ebb8054f8fe3d5b7d4fc37111894be6bbb89ee5e5e63e
MD5 9d46b7e476154a65bf435bc6a22cb53d
SHA1 7153d7fe47bb979b263e9ed9497991984946cfd9
SHA512 b3a9e2db3bce31ef17b59b40aa9077e4779102d9c0a9f2c4e9d15d2803defd36f2ea263dd74ea27412deea3e8c4b2237ec328335c6189781446d292e8ab9b412
SSDEEP 192:nd0Utk7lN1H4/MozVwF+Wtjnol5IeeMk2t9pd7Gw:w7lN+EThtjnolCeeMk2trd7Gw
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

vinterbader.txt

SHA256 231850dbb0c488a8c3020c4440095e14b7eaee395e22aa6f09df0d151954eeef
MD5 262595e7f1ae77e9daac320eff0cafa0
SHA1 d5923d919390cde346daa8b6c5251484552fad86
SHA512 571b1a64c9cd777590dd39752c305409d8191048186932f643b9c75db273bad3bf9057205a6b69d8bc8ac1ace7cbb32da2ad489c2444ae70f7609dad0fdd59c6
MD5 SHA1 SHA512

NSIS installer

installer

6da97627f53ef956b4e000fb9f150553.exe

PE Signature issue

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Akkompagnerede.Mar

Bilabial.imp

Earthkin48.def

Septicizations218.ung

Sheriat.Str

brydesport.unc

reflowering.bis

unenounced.fle

vinterbader.txt

Sharing

General

Malware Config

Signatures

File Explorer

6da97627f53ef956b4e000fb9f150553.exe

PE Signature issue

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Akkompagnerede.Mar

Bilabial.imp

Earthkin48.def

Septicizations218.ung

Sheriat.Str

brydesport.unc

reflowering.bis

unenounced.fle

vinterbader.txt