c58de5f40be8fd760fc08b1ef7ae5a3f5771dbc214426156e3a21a89bb8303fc[.]exe

resource
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsExec.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

c58de5f40be8fd760fc08b1ef7ae5a3f5771dbc214426156e3a21a89bb8303fc.exe

IMPHASH 076b06e6a65c9b7cca5a61be0cd82165
SHA256 c58de5f40be8fd760fc08b1ef7ae5a3f5771dbc214426156e3a21a89bb8303fc
MD5 0d0f944239a7dd07826e28edf9647185
SHA1 3911f09935fb37f9f6cc3ff990e12e6143282d8a
SHA512 e5077fa3179d7082587d606b8c8c6b5c0d74794225394522d92a06295e962a1cdb9868ac415720e3908222cc6c55312d24868be8d8ec2e52ef81243080fe5b7e
SSDEEP 12288:7akAv7gfFvt8pjs0p1cvxM/r9RKGqHmIdD+c:+kiext2Y0QMz9RKHHF9D
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

49:aa:93:8c:9e:24:42:17:81:32:ba:a7:09:76:27:59:9e:33:ce:91:3a:72:f2:f4:1f:13:ea:2f:aa:30:2e:dd

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Antievangelical,OU=Stormskadernes Mammae fashionering\ ,O=Antievangelical,L=Madonne-et-Lamerey,ST=Grand Est,C=FR,1.2.840.113549.1.9.1=#0c1648657465726f67726166744042726472656e652e4b61

Chains

Jul 9, 2024

Minor OS version

0

Major OS version

4

Entry point

12505

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

Sleep SetFileAttributesA GetFileAttributesA GetTickCount GetModuleFileNameA GetCurrentProcess CopyFileA GetFileSize ExitProcess GetWindowsDirectoryA GetTempPathA GetCommandLineA GetVersion SetErrorMode lstrlenA lstrcpynA ExpandEnvironmentStringsA SetEnvironmentVariableA GetFullPathNameA CreateThread GetLastError CreateDirectoryA CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA ReadFile WriteFile lstrcpyA MoveFileExA lstrcatA GetSystemDirectoryA LoadLibraryA GetProcAddress lstrcmpiA lstrcmpA SetCurrentDirectoryA MoveFileA CompareFileTime GetShortPathNameA SearchPathA CloseHandle SetFileTime GlobalLock GetDiskFreeSpaceA GlobalUnlock GlobalFree FindFirstFileA FindNextFileA DeleteFileA SetFilePointer GetPrivateProfileStringA FindClose MultiByteToWideChar MulDiv WritePrivateProfileStringA FreeLibrary LoadLibraryExA GetModuleHandleA GetExitCodeProcess WaitForSingleObject GlobalAlloc

user32

GetSystemMenu SetClassLongA EnableMenuItem IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard ScreenToClient GetWindowRect GetDlgItem CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA GetDC ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect EndDialog RegisterClassA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx LoadImageA CreateDialogParamA SetTimer SetWindowTextA SetWindowLongA SetForegroundWindow ShowWindow IsWindow SendMessageTimeoutA FindWindowExA OpenClipboard TrackPopupMenu AppendMenuA DrawTextA EndPaint DestroyWindow wsprintfA PostQuitMessage

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA

advapi32

RegDeleteKeyA SetFileSecurityA OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges RegOpenKeyExA RegEnumValueA RegDeleteValueA RegCloseKey RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_AddMasked ord17 ImageList_Destroy ImageList_Create

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/System.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 fda0018ab182ac6025d2fc9a2efcce3745d1da21ce5141859f8286cf319a52ce
MD5 4d3b19a81bd51f8ce44b93643a4e3a99
SHA1 35f8b00e85577b014080df98bd2c378351d9b3e9
SHA512 b2ba9c961c0e1617f802990587a9000979ab5cc493ae2f8ca852eb43eeaf24916b0b29057dbff7d41a1797dfb2dce3db41990e8639b8f205771dbec3fd80f622
SSDEEP 192:BPtkumJX7zB22kGwfy0mtVgkCPOse1un:u702k5qpdseQn
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

9995

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsExec.dll

IMPHASH 46f8b6973f33717335c0f6d8087de67b
SHA256 1c2f19e57dc72587aa00800a498c5f581b7d6761dc13b24bcf287ea7bd5ca2bf
MD5 3eb4cd50dcb9f5981f5408578cb7fb70
SHA1 13b38cc104ba6ee22dc4dfa6e480e36587f4bc71
SHA512 5a0c9d28df7a77e157046dce876282c48f434a441ee34e12b88f55be31be536eff676f580adbe4586da3f1519f94b5793ccbb3068b4b009eee286c0c5135d324
SSDEEP 96:+7GUxNkO6GR0t9GKKr1Zd8NHYVVHp4dEeY3kRnHdMqqyVgNv3e:QXhHR0aTQN4gRHdMqJVgNG
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4231

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Hylozoism/Forbundsformndene237.gen

SHA256 889569c108fa11e997516be33f3fe3a596c51b7e724cc2685ff7489d1e4f785e
MD5 68e60fbc8995cf416a66817858cf474e
SHA1 11e403b2e4e55f3f273385e8a6b06e3af9df9393
SHA512 f63681e583c3dda89eeee00a064ed6eba46d17761ce4367570f28ed3311e07e7cee43264e1243cd800bd889855269bfe9cb65f7bd74e0eefecdee75d99225e6f
SSDEEP 768:7OnjCMOzGZmKApM2SXVd1FAWTowGv6AyC8ROl2MHLZnPvcWhXkSKUP48Y6jmZ2EE:ynwo
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Hylozoism/Haardhudet.rav

SHA256 e516cbf11affce145b97030f76e9018d0d0e192e1344889f2f32aee9fd793d72
MD5 448051ad54c2ef3f720bf745e574633e
SHA1 fd9ac245e6017e4101dcb97b91e8333064b1f628
SHA512 e6e4d782d51f85671c781d9af6f909690c58d7405ecae3f75774f4e142a542047375cfdc7159b471c4b4c1613238855ed3e41a72ff8d0bee9958a38255d1f29a
SSDEEP 192:mYI89WkpIDLXWpuzU4YESK3K/n2EExBg15x:TokpIDCpuzAEVcExqd
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Hylozoism/Herbiest116.vre

SHA256 53512f1c52eaf92a898fb36109dae0a9d213756a883e05b2f0fcf116eef6b60e
MD5 62de12ed6ed6ff40a198d8b60827cceb
SHA1 fdc628000b2c284c8ec7dd07a125060deb714813
SHA512 3941aeb05dabca894676c6701827f5e93eb262cf39086a445f9de4e26ad84727f5ada7054d35cc3b5b196ca7785c4e928e2328a064198eccd47841fb16364909
SSDEEP 768:Sx+0VL5OUfjWsP4iWQPZ1VJ0FVBBHvr/L2UJVQIH:SMRB
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Hylozoism/Unfrail.nay

SHA256 af0e57677bd14876793edb39eff56c044919a1ab62cd4b16754f6745b52f22e4
MD5 2494532c59743970919b467911cf098c
SHA1 0a651c761229511408ec9974dae00bc051bdcb4b
SHA512 eabe10516f56fc95c24512e1d6ea0d6f9f28d353febf51531fa200479abe5a296da598f3187dce73c96949daec5aabb647ebddc4c7a75a71c56b2c627be9b894
SSDEEP 384:GlAaIvea1OoHvWR7RyDyrTF7TeFNXvCGEKutK3cAgnXE37WzaZ3IIDOGAOBp5qXu:0cTKRRvJgr6UWGKIDbzEUKf1gip9xvE
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Hylozoism/afrettelsers.stj

SHA256 94e16d1fe3825dc4f2ca01698d2cdc0f1d4f9507aa606c7b5a6ce6d1e8bba64d
MD5 2c23f1adc70959d7f715ff1decaa3ffe
SHA1 89597d09d89bb076d30b3303feac287cecd339f8
SHA512 dbfeba6be17c9781049c9f3d4ac653e3f61b64fee143b47b313199d398bbc5e97c01506e9113ad0decba29db639e5dd2c0d143a50a13f6e1d577e359246eb3c0
SSDEEP 768:6tVRQvXsCZx/3WqeKzGl1ixDDcYhuMu39HqMjRCqaWW0knhjhPlKWMtO4G3VeEwJ:6P4Dba
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Hylozoism/figurally.txt

SHA256 66a293dc597f6dec3a665255a2adb2fc3652cefa4977e4551eae99f70586a94c
MD5 eb25616ae9dd1f3469be2ab4bc497047
SHA1 50b7c2992000772d52ce857e3ff4d30b891f8181
SHA512 8e4fb6f25baa50aa8e53a14d2443f48b01f0e6c8ee439bcd0b9cc17d8a799fc9bd9ba0fa69e5aa5784ad661457508f19fd149c1e8aaa44c5e53721c9f884b0e4
MD5 SHA1 SHA512

NSIS installer

installer

Hylozoism/smudses.yde

SHA256 5181b85f34ad4a096b83647c13d31656dcdd3c993fac3a96d4396b8d69f3e5e7
MD5 893cd3b016a43f89778f901eef7a7ece
SHA1 259ca8de763f1c32526bc23516f77130a7782faa
SHA512 31d393ae2e9ce2d155143ee2a5fe2493c6a5030f5c428ee29d8151d3315f27f13ab3dd7ff9a1dcc83c6d55cba64a13202a49a84000de22ee29300f3726a190a5
SSDEEP 768:TvBs/GHVGz2HBbnQ30Lo0yvDHGg3Gv2x1htjY8Z6nxv52ou+GwBCpEu8Q4IxbVIr:dsHOCa
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Occluding225.Ten

SHA256 105ba1547c65997e87eb160e25dc8f06e9b40811477a48b3eb18bd15ce459867
MD5 4e1ae5f5d6b31a47fdea4e64dedf5fb2
SHA1 b7b268bc4e6f2568a6c5ac2a6e2d10ffbcae26e7
SHA512 cdba7852db1787944ac7414eac18b1438f0eebf21c2a6415048b43bccf54b9431db88f1692e2c35113e137617e477ce9339a5fbec3c55e93b3862c8a1595a130
SSDEEP 3072://tL4mssBCciuzOVbcHbzYD0yZfPaLvT7XOWr99Rqt4Z:tszrcpOVbSbcevGPc
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

c58de5f40be8fd760fc08b1ef7ae5a3f5771dbc214426156e3a21a89bb8303fc.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/nsExec.dll

kernel32

user32

advapi32

generic

Hylozoism/Forbundsformndene237.gen

Hylozoism/Haardhudet.rav

Hylozoism/Herbiest116.vre

Hylozoism/Unfrail.nay

Hylozoism/afrettelsers.stj

Hylozoism/figurally.txt

Hylozoism/smudses.yde

Occluding225.Ten

Sharing

General

Malware Config

Signatures

File Explorer

c58de5f40be8fd760fc08b1ef7ae5a3f5771dbc214426156e3a21a89bb8303fc.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/nsExec.dll

kernel32

user32

advapi32

generic

Hylozoism/Forbundsformndene237.gen

Hylozoism/Haardhudet.rav

Hylozoism/Herbiest116.vre

Hylozoism/Unfrail.nay

Hylozoism/afrettelsers.stj

Hylozoism/figurally.txt

Hylozoism/smudses.yde

Occluding225.Ten