21a7f19500a40c4302ccff91f9c4aa34b713cc07183cd83ca45852b6a00afd86[.]exe

resource
21a7f19500a40c4302ccff91f9c4aa34b713cc07183cd83ca45852b6a00afd86.exe
unpack001/$PLUGINSDIR/BgImage.dll
unpack001/$PLUGINSDIR/UserInfo.dll
unpack001/$PLUGINSDIR/nsDialogs.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

21a7f19500a40c4302ccff91f9c4aa34b713cc07183cd83ca45852b6a00afd86.exe

IMPHASH ced282d9b261d1462772017fe2f6972b
SHA256 21a7f19500a40c4302ccff91f9c4aa34b713cc07183cd83ca45852b6a00afd86
MD5 60b3d713550cd09b16181971027e0df5
SHA1 b5ffb312af1ebc5afd7c7b839fcbd1abaece6503
SHA512 125132cceeb9256b6b64fcaf263187c218ec483296a7ab6cc820cb9ab4e096d0f8c9e064167df67c8fdb91cc9622021374629b8c6795e5d76de3a0c4781c6cab
SSDEEP 12288:R0NwzUrQ2sgRZFh/rRAgYBNL3bHGwkuDvU3BbG:fzSQ25NBONLLQLRC
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

13128

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCreateKeyExA RegEnumKeyA RegQueryValueExA RegSetValueExA RegCloseKey RegDeleteValueA RegDeleteKeyA AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken SetFileSecurityA RegOpenKeyExA RegEnumValueA

shell32

SHGetFileInfoA SHFileOperationA SHGetPathFromIDListA ShellExecuteExA SHGetSpecialFolderLocation SHBrowseForFolderA

ole32

IIDFromString OleInitialize OleUninitialize CoCreateInstance CoTaskMemFree

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

SetClipboardData CharPrevA CallWindowProcA PeekMessageA DispatchMessageA MessageBoxIndirectA GetDlgItemTextA SetDlgItemTextA GetSystemMetrics CreatePopupMenu AppendMenuA TrackPopupMenu FillRect EmptyClipboard LoadCursorA GetMessagePos CheckDlgButton GetSysColor SetCursor GetWindowLongA SetClassLongA SetWindowPos IsWindowEnabled GetWindowRect GetSystemMenu EnableMenuItem RegisterClassA ScreenToClient EndDialog GetClassInfoA SystemParametersInfoA CreateWindowExA ExitWindowsEx DialogBoxParamA CharNextA SetTimer DestroyWindow CreateDialogParamA SetForegroundWindow SetWindowTextA PostQuitMessage SendMessageTimeoutA ShowWindow wsprintfA GetDlgItem FindWindowExA IsWindow GetDC SetWindowLongA LoadImageA InvalidateRect ReleaseDC EnableWindow BeginPaint SendMessageA DefWindowProcA DrawTextA GetClientRect EndPaint IsWindowVisible CloseClipboard OpenClipboard

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateFontIndirectA CreateBrushIndirect DeleteObject SetTextColor SelectObject

kernel32

GetExitCodeProcess WaitForSingleObject GetProcAddress GetSystemDirectoryA WideCharToMultiByte MoveFileExA ReadFile GetTempFileNameA WriteFile RemoveDirectoryA CreateProcessA CreateFileA GetLastError CreateThread CreateDirectoryA GlobalUnlock GetDiskFreeSpaceA GlobalLock SetErrorMode GetVersion lstrcpynA GetCommandLineA GetTempPathA lstrlenA SetEnvironmentVariableA ExitProcess GetWindowsDirectoryA GetCurrentProcess GetModuleFileNameA CopyFileA GetTickCount Sleep GetFileSize GetFileAttributesA SetCurrentDirectoryA SetFileAttributesA GetFullPathNameA GetShortPathNameA MoveFileA CompareFileTime SetFileTime SearchPathA lstrcmpiA lstrcmpA CloseHandle GlobalFree GlobalAlloc ExpandEnvironmentStringsA LoadLibraryExA FreeLibrary lstrcpyA lstrcatA FindClose MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA SetFilePointer GetModuleHandleA FindNextFileA FindFirstFileA DeleteFileA MulDiv

$PLUGINSDIR/BgImage.dll

IMPHASH bdcecc8b26871abb93996c6c18e09c94
SHA256 dbf91707fa157603bea025a6411cdcb497ab11262c9c18b14dc431a45aa17c0b
MD5 521df745a41f0b8164ffd01717cacbba
SHA1 dc7a9eacfbeb1fae52091da5e80db6cb1b6bce74
SHA512 c5b1ba062872a8f534e2f0eac57fc3c0d8be9cda79605d86566d67260ba5477444a0ddfed1838b4fb14c677e5342c8419a88fcd38147dbaa36ac1f9e00c52bbe
SSDEEP 96:8eZ0AKTIfv7QCUsthvNL85s4lk38Eb3CDfvEh8uLzqk4jnLiEQjJ3KxkP:tXBfjbUA/85q3wEh8uLmVLpmP
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

7198

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/UserInfo.dll

IMPHASH d576645bcd8a66d2fe678a075f4cc6e0
SHA256 943b33829f9013e4d361482a5c8981ba20a7155c78691dbe02a8f8cd2a02efa0
MD5 acbda33dd5700c122e2fe48e3d4351fd
SHA1 2c154baf7c64052ee712b7cdf9c36b7697dd3fc8
SHA512 d090adf65a74ac5b910b18bb67e989714335e7b4778cd771cff154d7186351a1bebbc7103cca849bdfa2709c991947ffff6c1d8fdf16a74f4dfb614bce3ff6fd
MD5 SHA1 SHA512

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4732

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsDialogs.dll

IMPHASH ebc2d915841be8afc8fa1ee9f6850960
SHA256 8780095aa2f49725388cddf00d79a74e85c9c4863b366f55c39c606a5fb8440c
MD5 1c8b2b40c642e8b5a5b3ff102796fb37
SHA1 3245f55afac50f775eb53fd6d14abb7fe523393d
SHA512 4ff2dc83f640933162ec8818bb1bf3b3be1183264750946a3d949d2e7068ee606277b6c840193ef2b4663952387f07f6ab12c84c4a11cae9a8de7bd4e7971c57
SSDEEP 96:o2DlD3cd51V1zL7xqEscxM2DjDf3GEst+Nt+jvcx4T8qndYv0PLE:o2p34z/x3sREskpx4dO0PLE
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

7513

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Hormonbalance/Deprivationens.Kok

SHA256 261b0be710c8d1692957a8964538011f22dc90177c643bb97fb24f0c341a4d33
MD5 6bec9c5534eb1f475e02527356576362
SHA1 b1766b4b752233ea7d31eccd59e877ad0df46654
SHA512 6bf92642cd5431c997855ed9c9a6cc2acd057ec002297f44e6a3607596d58d9727a2079655a3ccbd1566e18010f30c1cc39751235a86cb485e0f4d589ac89a6c
SSDEEP 6144:UxmugoOdOFwnRFEXKIugTGaEdly2VgGc6xivs3k4MiU:gOkFeeE6Gap2V/1xbFU
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Hormonbalance/Farvebaandsomskifteren.txt

SHA256 6e6f8aae1108a59382f4afe745a9ca4347f5c77df0831b50b6c3d80728923c91
MD5 b45159f417dde8d6389a17bddd125fba
SHA1 baca54c6d6d2ca60f1eb18fe8f02686c1609d72a
SHA512 7df0d76db8a0e764fc40b81b65f2b629d0f58cfcb3fa71c1603e005526db713cff214bf20d8b14d87407fc291dab28755a37c0f8a7554b9a9c888eccf7e451a8
MD5 SHA1 SHA512

NSIS installer

installer

Hormonbalance/Impoverishes.Skj

SHA256 0d92f75f821620f9df25844a0b43c2be5763799f32a61c68f9baeeebe45560fc
MD5 3caa4ac857f4a0000da1b905a819ae72
SHA1 bc1bd3a4b5a1b37c1b213d05c9ed8c472a818949
SHA512 abe4ec64665c8bc701219fae130e25073a4c76a98dd36cb5dd29e1eefc5d7ceb40e3d0e37dc7d1b2d3d84c4e38437883c09a6523c0d3393730659b220aac8e83
SSDEEP 1536:D+b+4uTs99sNSf9B57zaPoxtvVJsA4j+P/3BNwEXpOSfU362081kOH:D+S4uTs9eNc/WWv3sfc/xaEXJjU2s
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Saccharophylly/tegnmssig.bra

SHA256 c2a8ee6ebffdf8d0e1911aca508b6217b5716fa02400f251233428ddddac76fb
MD5 55977ed7f46415522e00c3fdff5caa2d
SHA1 787a22f3acc620d50c29eb03198a4bfdb10113d5
SHA512 5028f6c7080539a4eb40f4e72fa4a34ad5b595e132b098db821498d5688532dd4b63e1e1a2a805520772843673c369f6dab23b2147b1d7496332ac0e77c682f1
SSDEEP 192:IMgd/BOjz7u6eAYyskhEBLZfKBdm9TdtrZi0sMv/UFvDFqsP32:I/d/BGu7sW1ZfKBdm9Tdp3v0/G
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Saccharophylly/tradionsbevarende.unp

SHA256 c42064ecd39bb1e45fbed3247a7e4355c2b751c50c48c355ed65c361221e26e0
MD5 b24f189fe266a3eb1133225548b37313
SHA1 334290f4bb643b6048aef858ab271dcfbc56239d
SHA512 8b9d53591fc89e1311a62a821fc765261cf7830259da55e322b255a140c8dfbd45591d20da7a262cbfa15918a3d8cf654967f96a2e52bc8e601753624bec40ed
SSDEEP 96:ajWqqlfSwTfxv442jXEcdFEykwxlyjOQcw2:aqVlfSwjxt7cdSiexcp
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Smalsporet215/Montanes176.opt

SHA256 2e47e519ebcf0f29c4cfab7867590dd925a1c24bcf9c449a4eeb2e0a20add6e0
MD5 00ee337ee1e09f3056450f7bd466d663
SHA1 e3a09563a6e6ea014a1b8e656978b7224501e2cf
SHA512 8a0e1812fe32a4501def3a64b4579c9c8dc6f46440e5dccb428d34b26cc730317443f7fd287c93fccbba033e16ef6ca1a94d226ce7f1582632fcb040016e4a93
SSDEEP 192:2HzQVSF2rlzQAi0yaxJOSKirtx9tAZxlfIipJBn8beyJ:azHINdida/OSKiTZKaeS
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Smalsporet215/Wafery.unt

SHA256 b4636417b12c1debe224d12ca07ee9d7065005ab1844722c3c720f08629866b7
MD5 0937a5e384e630ea77bdf0d6e23653a0
SHA1 9284b7702dd9ab2f2102092dd26277b7f11cc3e0
SHA512 e7a92e9655848b1185fc5c59d8b2d4b72f624d29f1c4f1b92c38886bf89a54a129a8f9a70c677ab62fb099e814dfe03c3af3c4b3880e479c7e3fc45638f242ee
SSDEEP 192:rGdWIIKTANCxaHuSkkb4wvFtBNssUQkLF3U8yI:rG3T9xmuSfMMFtKLAI
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Smalsporet215/barsel.pul

SHA256 48c2f9ec2bb01f539037809e6dd3ba233e990065d600e12f9bd8f94175f98f92
MD5 0b992a18939a9d444ca1a88e2ffec6a2
SHA1 b7078a01b48a395122c216f3e52c411426f8f069
SHA512 d539252ff07be01c260feb15020d539649f4800b0a72472a471b732c9385a1dd3ae354261cfbe7fa5a578c6275cf48708c83dd7a84c287d5038c42246528ae67
SSDEEP 192:EnqPs0Cjvr66x+1NcgwOUa3QwKdzmchKyqL3Lgu97+Zi1:EUiv6O4Iza3QwKd1hKyNuZIg
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Smalsporet215/migraines.sla

SHA256 0f0480000b0ad9f649c44efe0659c6c8d729b4f88d4cdbd229d5b5f92cea19f1
MD5 0677700f062c42f9ad14c5fc8f21b66b
SHA1 34bc0196a0c3c17564be3bc54108034fe2d1b172
SHA512 f40c87dd3ee7b72607ad818c11e5cd6c75f1eec52ed295a523f835d8b1d87e3444fcf46dae9aabf5a5d25661b07666ab83fb135b33263cee49da31b61aab3895
MD5 SHA1 SHA512

NSIS installer

installer

21a7f19500a40c4302ccff91f9c4aa34b713cc07183cd83ca45852b6a00afd86.exe

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/BgImage.dll

kernel32

user32

gdi32

winmm

generic

$PLUGINSDIR/UserInfo.dll

advapi32

kernel32

generic

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

Hormonbalance/Deprivationens.Kok

Hormonbalance/Farvebaandsomskifteren.txt

Hormonbalance/Impoverishes.Skj

Saccharophylly/tegnmssig.bra

Saccharophylly/tradionsbevarende.unp

Smalsporet215/Montanes176.opt

Smalsporet215/Wafery.unt

Smalsporet215/barsel.pul

Smalsporet215/migraines.sla

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

21a7f19500a40c4302ccff91f9c4aa34b713cc07183cd83ca45852b6a00afd86.exe

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/BgImage.dll

kernel32

user32

gdi32

winmm

generic

$PLUGINSDIR/UserInfo.dll

advapi32

kernel32

generic

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

Hormonbalance/Deprivationens.Kok

Hormonbalance/Farvebaandsomskifteren.txt

Hormonbalance/Impoverishes.Skj

Saccharophylly/tegnmssig.bra

Saccharophylly/tradionsbevarende.unp

Smalsporet215/Montanes176.opt

Smalsporet215/Wafery.unt

Smalsporet215/barsel.pul

Smalsporet215/migraines.sla