82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e

resource
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsExec.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

IMPHASH f677acae05efabe7411a40902b2d88fb
SHA256 82e683f521d395ceabb0703c0e2de95c5c8886aed811da565bb8c03436452d3e
MD5 3d5e8fce4bf5c6fd82e0d299177e6655
SHA1 d77ac97def9efb8a01926dd0b49c1b1a5f1921a2
SHA512 ea714adf86dd210de4bd34485312c1860e070d903d353ea1a3b7903d325bfa851e972b65d37dbec16769818d12005f2f7708e8716dd343aa13895fa9563e7751
SSDEEP 12288:OvxwRbB0H5KUjUPKCuO+ggobwxXptiOn4v6:Ovx6bB0ZqAHgDS5tii
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

df:49:56:1f:b6:19:7e:60:76:ce:91:83:a4:12:9f:70:63:4a:a0:e4:aa:ed:67:46:5a:97:6d:56:6f:57:9d:10

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Pagaj,OU=Overheads livsophold\ ,O=Pagaj,L=Prétot-Sainte-Suzanne,ST=Normandie,C=FR,1.2.840.113549.1.9.1=#0c2352656672796774696e64677964656e64657331383440576573746572696e672e506c61

Chains

Jul 5, 2024

Minor OS version

1

Major OS version

5

Entry point

13518

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCloseKey RegDeleteKeyA RegDeleteValueA RegEnumKeyA RegEnumValueA RegQueryValueExA RegSetValueExA OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueA SetFileSecurityA RegCreateKeyExA RegOpenKeyExA

shell32

SHBrowseForFolderA SHFileOperationA SHGetPathFromIDListA SHGetFileInfoA ShellExecuteExA

ole32

OleUninitialize IIDFromString OleInitialize CoTaskMemFree CoCreateInstance

comctl32

ord17 ImageList_Destroy ImageList_AddMasked ImageList_Create

user32

DispatchMessageA SystemParametersInfoA LoadCursorA SetClassLongA GetSysColor ScreenToClient SetCursor GetWindowRect TrackPopupMenu AppendMenuA EnableMenuItem CreatePopupMenu GetSystemMenu GetSystemMetrics IsWindowEnabled EmptyClipboard SetClipboardData CloseClipboard OpenClipboard CheckDlgButton EndDialog DialogBoxParamA IsWindowVisible SetWindowPos CreateWindowExA GetClassInfoA RegisterClassA PeekMessageA GetMessagePos CharNextA ExitWindowsEx SetWindowTextA SetTimer CreateDialogParamA DestroyWindow LoadImageA FindWindowExA SetWindowLongA InvalidateRect ReleaseDC GetDC SetForegroundWindow EnableWindow GetDlgItem ShowWindow IsWindow PostQuitMessage SendMessageTimeoutA SendMessageA wsprintfA FillRect GetClientRect EndPaint BeginPaint DrawTextA DefWindowProcA SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CallWindowProcA CharPrevA GetWindowLongA

gdi32

SetBkMode CreateBrushIndirect GetDeviceCaps SelectObject DeleteObject SetBkColor SetTextColor CreateFontIndirectA

kernel32

GetTempFileNameA GetLastError WaitForSingleObject RemoveDirectoryA ReadFile CreateFileA CreateDirectoryA lstrcpynA GlobalLock GlobalUnlock CreateThread GetDiskFreeSpaceA CopyFileA lstrlenA GetVersionExA GetWindowsDirectoryA ExitProcess GetExitCodeProcess SetErrorMode GetTempPathA SetEnvironmentVariableA GetCommandLineA GetModuleFileNameA GetTickCount GetFileSize MultiByteToWideChar MoveFileA WritePrivateProfileStringA GetPrivateProfileStringA lstrcmpiA lstrcmpA MulDiv GetShortPathNameA GlobalFree GlobalAlloc LoadLibraryExA GetModuleHandleA FreeLibrary Sleep CloseHandle SetFileTime SetFilePointer SetFileAttributesA GetFullPathNameA GetFileAttributesA FindNextFileA FindFirstFileA FindClose DeleteFileA CompareFileTime SearchPathA SetCurrentDirectoryA ExpandEnvironmentStringsA WriteFile CreateProcessA WideCharToMultiByte GetSystemDirectoryA GetProcAddress lstrcpyA lstrcatA MoveFileExA GetCurrentProcess

$PLUGINSDIR/System.dll

IMPHASH 595a3fd71239f605bb02d7a5e48fd4df
SHA256 aec5af9c7c551c3590492b0c0120b535b55ab048e84f695b617a5ab4b1a52f54
MD5 bff2a11d26d951ec34679b8fa1ee7192
SHA1 d3de629a5a86ee35b6afa1802f6ac8b141b07062
SHA512 1dce397c9cab3cd3b58c181688286a89067c743f195403694819c2d988435268ffd01939beaaa17cfa344160c89414f28273b70de154be0def034af8c470723a
SSDEEP 192:G9rQDenC9VrcK7REgSWOprANupQYLRszDDH/d9CWlXo7U6Wxf:GJQEaVAK7R9SfpjpQYLRszfH/d9CWB1j
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

6

Entry point

6599

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsExec.dll

IMPHASH 0d6ae1f1ecbace583969d8eb8b21d1b8
SHA256 e18984e78d58b2383f2c1e8ed0000088ee8d9d469345383618f179176fcddff6
MD5 fdee755c4987e9859e0eec130ee22efd
SHA1 ba32823881a98da6b92eee1d866be2b3a20c6e5d
SHA512 31ba3dad22fd9b78ab3f6017c4373c923d048cf0c010900a131c4533ef185d408a88052aa4cf6184dbe484d44aab9cfa94a052185cf0b9ad19286ed921e4723f
SSDEEP 96:ft4Vl/7Lo1UBrob9ljNEUgD7cyuM1x9XkraK2A2KAB5VVDyssKZ:ft4Vlw1Iul5J8T1vK20I5VVGsb
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

6

Entry point

4339

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Forsigtigpakker51/Gebommerliges.gas

SHA256 d0f5e3863448ff670432807dcdd47a89698d8c198d382842f69402d70705b46e
MD5 ae58d6ab171c40e9ee5ee43a054f89b0
SHA1 eeba5bfa5c9675eaf8035d727f23422d17a85baa
SHA512 88b60c07e6120ff2a3eb6ae9fbd0f9c5fcc64cf6730b4e046e3149b1413fd92f6944addb1b0d9963b5186ffbf1de23a71a7f0b220caebd90a362d3c128227051
SSDEEP 96:Cmc700sbJT/GeZGWXGGNAhMq4gJm71/sXgsVHxYGIRI+4nqs:hp0sbJ4JGShMqJk710XgWYG/+25
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Forsigtigpakker51/disusance.nar

SHA256 6a02bb5a2dda116bfafc7e0019446b89564e5513c72a47499d6d4debc070d82f
MD5 029f26487d958257ec8b51a1743d1324
SHA1 5a1796c48e7785f8ca7a60a290f4ba759b8e6377
SHA512 c7a091e8a0ac15ca686a7f9b0a024815de71cb9c4e3beeb41f62f0827df31814df5fc6ed3714365ae7a501331ce6fb6c69d0b583a84e932761d8e9550bbf5e4d
SSDEEP 384:/WZKMB2DCvQxpCtqSHYn2GgNDNxijVKwBcwIx1FtDDpNLgA9g0VRaj/Od+exEpPU:/WoMmcHrrxg/xWZDHgMaj/OZUmfQG2I
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Scrollwise.Vis246

SHA256 33783b53b013cd148e726335b08c222ef9348135f068e85edb2d837024421a07
MD5 762b3940be4b1b5b9bae0058bb677823
SHA1 3440bfbb8e829f9771fdb84240df691f0b37ecf3
SHA512 96ab8a104d6bb8fdb4b36e1341ad7ba3f29cb8ff2ed19fbbac1f2efcd44abf2a1a347046f1682b63c575e9528c4b67c10bfb756c8dec71e572e70bf46aff9832
SSDEEP 3072:DxV+FbIEsYrIvON3h9rhHKNBYQoul676PhRo+xstTSca:N0iEWOFhH61oHmPh+Ftba
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

computerspillets.txt

SHA256 888024ef7f696f978d89fc6de80720f01f74c96108f7e747b3fe9b6dc215e630
MD5 df9ff56e018189b5916f39aff5811397
SHA1 653feb865e0c3a7210442b4d48c9419cdc44143e
SHA512 7d390ba963be29909388c9085d45d9156469a345055371aa82cd055c3e7fc78e8f508374c7f8c8a6cb307f43f9976e5c1b86de4b93b60dd95c4dec9eb3aa70eb
MD5 SHA1 SHA512

NSIS installer

installer