disputants stiftsfrkens[.]exe

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

disputants stiftsfrkens.exe

IMPHASH 671f2a1f8aee14d336bab98fea93d734
SHA256 01618cb8300d5bb370de6153d225f095003576e8da803153934dff299db1fd74
MD5 0cc4ebcd7ec0b53aa3619c6a622ce2b4
SHA1 a0c52a0c83e996c168f944764abf1e03aed30fb3
SHA512 c75d064463f3735da813f1db95f89846159c64d613b0257333988a03b7469258c42bc706e811adf44c528765b1c4e42151006c512fb65e428648f64ee37ccdcc
SSDEEP 24576:L3WbOu88H9JZWWAIJVGBhc4CaHouNH6K8Yx1L:L3Wyu8WzWh6aI6aRY/
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

6e:ee:a5:fc:90:3c:c3:e1:82:5a:3f:ed:b2:93:f1:32:82:f8:4a:c3:3b:ae:71:23:ac:d9:41:3b:44:57:0c:5a

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Gynaecoid,OU=wreathlike Modpart Olympiskes\ ,O=Gynaecoid,L=New Boston,ST=Texas,C=US,1.2.840.113549.1.9.1=#0c104b6973686b65734048656c6d652e4361

Chains

Jul 5, 2024

Minor OS version

0

Major OS version

4

Entry point

13186

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueA RegEnumKeyA RegQueryValueExA RegSetValueExA RegCloseKey RegDeleteValueA RegDeleteKeyA AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken RegOpenKeyExA RegCreateKeyExA

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA SHFileOperationA ShellExecuteExA

ole32

OleUninitialize OleInitialize IIDFromString CoCreateInstance CoTaskMemFree

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create

user32

SetDlgItemTextA GetSystemMetrics CreatePopupMenu AppendMenuA OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcA GetMessagePos CheckDlgButton LoadCursorA SetCursor GetSysColor SetWindowPos GetWindowLongA IsWindowEnabled SetClassLongA GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassA SystemParametersInfoA CreateWindowExA GetDlgItemTextA DialogBoxParamA CharNextA ExitWindowsEx DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow ShowWindow wsprintfA SendMessageTimeoutA FindWindowExA IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint MessageBoxIndirectA CharPrevA PeekMessageA GetClassInfoA DispatchMessageA TrackPopupMenu

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor

kernel32

CreateFileA GetTempFileNameA ReadFile RemoveDirectoryA CreateProcessA CreateDirectoryA GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceA lstrcpynA SetErrorMode GetVersionExA lstrlenA GetCommandLineA GetTempPathA GetWindowsDirectoryA WriteFile ExitProcess CopyFileA GetCurrentProcess GetModuleFileNameA GetFileSize GetTickCount Sleep SetFileAttributesA GetFileAttributesA SetCurrentDirectoryA MoveFileA GetFullPathNameA GetShortPathNameA SearchPathA CompareFileTime SetFileTime CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc GetModuleHandleA LoadLibraryExA FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA MulDiv lstrcpyA MoveFileExA lstrcatA WideCharToMultiByte GetSystemDirectoryA GetProcAddress GetExitCodeProcess WaitForSingleObject SetEnvironmentVariableA

Bankfunktionren/adoptanten.fig

SHA256 f26424217cd03bc44951a7c6041cb47064c0ac6a2c973332ee67a46f91cd9de4
MD5 413951feaee5d7a111062bd44b114684
SHA1 1e50e33719d17903d8a554594dc8408655bcec15
SHA512 d318e61d0f836b217f3102ced874e604db7ad06237fc91986d3fee162603393fa3b2f193621e0a25ad69680ce1c123885947dee3acd9572607f4a7d849d01686
SSDEEP 384:IqU2IJohqB8ymfLKqpQNhPPv5/H2ZJO/UCXCeQNQMaZmgQNHWMek7O7+baO:ooFxpmRdCBmo2X
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Bankfunktionren/blokindskuddenes.uns

SHA256 554b43fa80d0f1107ac0800d408d8e6afd19b76058dbf988cdfc0830c1267869
MD5 5a7190fe8c19f5d1a06cb5f8dd4d3943
SHA1 6c0fc6bd78136b71c7f5dedb75b8ed7b88399d7d
SHA512 f49adde6525865fdaca2799d550391f718a26e2168262a027b6d69ac9f89c0446c9c6ec66269978979263ab839a413a0e3ce59a9116a018f976c90b0afa49e08
SSDEEP 768:AXsQNRUDnR3yDd0dbvkOHel7+XIOK87Hjgr8HnUD8uM6saBTH:Ah
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Bankfunktionren/catenoid.syg

SHA256 4d32fa35efe90a9e351123afee0adbc0c2814d1a50d2cbfb89fc8b0c08da8b83
MD5 c2eeabc675d230419496a0aaec227ae4
SHA1 56d45a6c81988aa2637d5864caa4b0527ea640df
SHA512 919d729a8a2e06ad63c1250776754e42389e2ebce6b4992dea8ca17cc46b6dbca3a9a5ddaf7443fa0851ef569b572f974637cb84fa9070a235cf4349a4dc5307
SSDEEP 768:l0nUVlrW3MD5Vk9HJOzZgTh3Mj3Hl737nI6N58IiwMCwDvvqJqw7wLwj3KMH/y:ed
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Bankfunktionren/goddises.hov

SHA256 639e30dfa1d0c3691bbf0b57bef3a167c70f21b8e5c9f9dccac1e88cecbdaf68
MD5 e539656049c4ba24825f0a4bc30ffff3
SHA1 5be6e5d0043c5b3c15f7fb5659ba028644aae031
SHA512 4ccbc2cf90103adada3ee93479346b184ff1f75f44f0752bf3b770ac3ed782305d761c4e4f014beaa9e6647b9bd8b763691f21bba8b262aae6d527b9dfb4af72
SSDEEP 768:7VoKZvDv05E7oIJLCO0F3JTQE3X/I+2AD2diCfLkDFAnuBGnUCPnPgTaf:J
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Bankfunktionren/grssers.sol

SHA256 09ecb43cefb2ee8d4f496dc5a1cba0c4669962054e331aa29e5776a33f950923
MD5 97c0f36262acd7cc385f5196fcdca543
SHA1 bcd846201f4ff8d1cbed2f6db19a814386600445
SHA512 b1574258c80a8ea9bf5ff03e4e5e4cce37137fcf4648b7f51819d257145c7d68f84d941de5be5d288da6d1826eb244a14c301fe230fffeb10ddbbc8940a19216
SSDEEP 768:0ZVODWmKWoj9fQNNYGzv/I/Z4o6EFdD6v916rg+lDAZ47f2iNCY3pkiXeFv7Fqj:OyEHgTg
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Bankfunktionren/lugworm.cep

SHA256 1029756c98a4045871fdcf9db96b7206ecea1534300279faad5a4385543bc219
MD5 05c732fdba542e6586967dfb41224bc3
SHA1 66a9b0c2f9125c2657579851a8eaa270a84ef569
SHA512 8a6d6034a55b053c3379a9f513b689e849bd3b677104d32fb7dccc01dd1adcfe685dc7446b135649d9c8a69146004badf4618edec446140493a70b4f7452be05
SSDEEP 768:nMSVmERJPejgoV37VwdjlXZP6DOFj0VjqoLeiGEkUwa0jqlXF326WqBYeh6AO:E
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Bankfunktionren/saddeltaskerne.wit

SHA256 6f61ff678aa8683ad8531be130be16430772ae0559cefab3f4bd5d1ff18941d2
MD5 baa2138ea74ac522a05504a493beb708
SHA1 7f7d1a17f9d538614718bc8c8fc084c2502a2c18
SHA512 6d07b79fd7a5257e4b09386bc468e4268c51136321f3629491ee2a761e1e10c872671d26b774e6ed11e7bf841875a655ddf0d666b5611a3e96c0d3bfe7a452cd
SSDEEP 768:Ij0F2rU92UWBfgOxXmeicUA5PdMMW8zaERnN3QqHx6b4fcmP8jrJyHzCOYTBv3fb:CLDDK4
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Bankfunktionren/variabelnavn.san

SHA256 840cacc0f7073573d0a69de4256763c0b9f38d28e806a822cb44cf09557ffdfe
MD5 ef4c03d018bf45ab4bdfe58df15d3bcc
SHA1 c01ce9cf32b3e90d90c38732b4514ba7375df76e
SHA512 b806df760384c38415f6cf33f6963eeb0fbc02f7d693e955fc748d45c7f20ee34a6008b65919afcb9f6e8c67c73e6d41fce4ee81d5fc4f91db33dca5f0728bd6
SSDEEP 768:8Nn5kFNvMUCRaVmvAF1ZkRe4+4/hPmV+rkHicz3D1rpezic7uRY1lwfXN0KEl2fc:1ewk
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Flavors.fif

SHA256 576443ef6299c1f875d7d388d8a152445d4a8e016127f880c4a8bcd054eef0aa
MD5 f5b585e07fa4dba346b092554a8a8c4a
SHA1 98cff3e05f0ed3ec347464885730eeafa0147587
SHA512 d26c91799c75e5ca28a5c8f612d415ba61a3f0a35fd0206d1aa244653c709fb1a139247a4ff0e01049f641d745fefb0b7e8716f87a9c202e22ab672f7744a9f0
SSDEEP 768:iw4l8+rBVeiT5q9nzYiPRip5tiT3xN9uzx6H7/pRTeD5LehjmfoST+1rNbdzhkxU:DKoz
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Fordampningsevnens.Dov

SHA256 42c4334ec87c7fe9ab1628d1830df495862341a23beecee5169e197e813409d4
MD5 9048e3505d97732d157206fe7fb17895
SHA1 bc7bdf86eba6a4b573b4a00af84d22780fcaf341
SHA512 75c43d8ca80f8a8897de0e137ae621cfa551f8983d1d6567913ebb13992bfc9688ff0f98d3aa14b3666454e04c58fface8b1fc722077ed7242c86ba2fcc07c96
SSDEEP 6144:9imi+ALmuMB5FfKuNH09sTOUFVUcXPokKE1E+4sJl+:9dMKu+pKu10+OUFVUbbE1l5s
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Haanendes.txt

SHA256 13da62ddc7eefc3d80cddec1fcd703fd07e614fa90576d7eb9be520adf9bc6bf
MD5 f24ead49da527490cc6d6c3afd585a4b
SHA1 0adf1b8d4ea1d6d133fce286aaf57bafaaec8844
SHA512 24ea46c8c153c4108d529e43f95314d04d6730cbd8866091973e44b0ecefa1d5888ffe2beeec37f1504d94353d85402693f73ab5cbdbe78364cd739178ab785b
MD5 SHA1 SHA512

NSIS installer

installer

Hygiastic.Dva

SHA256 8d0922c9e45ed0fd4c01776a1797988fd9f07919566128753eaf3d89a954edc2
MD5 a931bb69bcd6bc3aaa6dcccc2ca41979
SHA1 5e93a472745acf4235003b44b6ad6e47406cde4f
SHA512 aba8cbf4ca78313d22f3825863a0685d36920921cedb0a20ef93e8e93303e7a614d05d272fd5b902987d17ea7dc55a727111602178efaa888790fd97aa00949b
SSDEEP 1536:Yf9m1a/VuA8oEPpLxoif+otYPnkBiXWdEdT3d5T/UI1yc5fQ6:YA1cI/lLxowtYYCAM5G6
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Sharing

General

Malware Config

Signatures

File Explorer