MalwareBazaar[.]0 | Triage™

resource
MalwareBazaar.0
unpack001/$PLUGINSDIR/BgImage.dll
unpack001/$PLUGINSDIR/UserInfo.dll
unpack001/$PLUGINSDIR/nsDialogs.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

MalwareBazaar.0

IMPHASH ced282d9b261d1462772017fe2f6972b
SHA256 5113448d51807a38a76525708683448e742c5461ab21b14b7b4b5682acd627dd
MD5 bd960a153b84571d576d5dd4c48f09ba
SHA1 4e70aed54595067ec69661201247d8664811f710
SHA512 c1958b33e77d05e684c966322f21ed5f24c7816d7c9815849649fdeeb697743704eb79ca135c205fdc6088b3cff80821beb373faa1ee49f2965dca9b3ffd98b9
SSDEEP 12288:R0NwzIoEluDKUIqqUXeVeLm8pNisAhU3Bbg:fzIoEluWUXeVeLmfsA6RM
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

13128

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCreateKeyExA RegEnumKeyA RegQueryValueExA RegSetValueExA RegCloseKey RegDeleteValueA RegDeleteKeyA AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken SetFileSecurityA RegOpenKeyExA RegEnumValueA

shell32

SHGetFileInfoA SHFileOperationA SHGetPathFromIDListA ShellExecuteExA SHGetSpecialFolderLocation SHBrowseForFolderA

ole32

IIDFromString OleInitialize OleUninitialize CoCreateInstance CoTaskMemFree

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

SetClipboardData CharPrevA CallWindowProcA PeekMessageA DispatchMessageA MessageBoxIndirectA GetDlgItemTextA SetDlgItemTextA GetSystemMetrics CreatePopupMenu AppendMenuA TrackPopupMenu FillRect EmptyClipboard LoadCursorA GetMessagePos CheckDlgButton GetSysColor SetCursor GetWindowLongA SetClassLongA SetWindowPos IsWindowEnabled GetWindowRect GetSystemMenu EnableMenuItem RegisterClassA ScreenToClient EndDialog GetClassInfoA SystemParametersInfoA CreateWindowExA ExitWindowsEx DialogBoxParamA CharNextA SetTimer DestroyWindow CreateDialogParamA SetForegroundWindow SetWindowTextA PostQuitMessage SendMessageTimeoutA ShowWindow wsprintfA GetDlgItem FindWindowExA IsWindow GetDC SetWindowLongA LoadImageA InvalidateRect ReleaseDC EnableWindow BeginPaint SendMessageA DefWindowProcA DrawTextA GetClientRect EndPaint IsWindowVisible CloseClipboard OpenClipboard

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateFontIndirectA CreateBrushIndirect DeleteObject SetTextColor SelectObject

kernel32

GetExitCodeProcess WaitForSingleObject GetProcAddress GetSystemDirectoryA WideCharToMultiByte MoveFileExA ReadFile GetTempFileNameA WriteFile RemoveDirectoryA CreateProcessA CreateFileA GetLastError CreateThread CreateDirectoryA GlobalUnlock GetDiskFreeSpaceA GlobalLock SetErrorMode GetVersion lstrcpynA GetCommandLineA GetTempPathA lstrlenA SetEnvironmentVariableA ExitProcess GetWindowsDirectoryA GetCurrentProcess GetModuleFileNameA CopyFileA GetTickCount Sleep GetFileSize GetFileAttributesA SetCurrentDirectoryA SetFileAttributesA GetFullPathNameA GetShortPathNameA MoveFileA CompareFileTime SetFileTime SearchPathA lstrcmpiA lstrcmpA CloseHandle GlobalFree GlobalAlloc ExpandEnvironmentStringsA LoadLibraryExA FreeLibrary lstrcpyA lstrcatA FindClose MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA SetFilePointer GetModuleHandleA FindNextFileA FindFirstFileA DeleteFileA MulDiv

$PLUGINSDIR/BgImage.dll

IMPHASH bdcecc8b26871abb93996c6c18e09c94
SHA256 dbf91707fa157603bea025a6411cdcb497ab11262c9c18b14dc431a45aa17c0b
MD5 521df745a41f0b8164ffd01717cacbba
SHA1 dc7a9eacfbeb1fae52091da5e80db6cb1b6bce74
SHA512 c5b1ba062872a8f534e2f0eac57fc3c0d8be9cda79605d86566d67260ba5477444a0ddfed1838b4fb14c677e5342c8419a88fcd38147dbaa36ac1f9e00c52bbe
SSDEEP 96:8eZ0AKTIfv7QCUsthvNL85s4lk38Eb3CDfvEh8uLzqk4jnLiEQjJ3KxkP:tXBfjbUA/85q3wEh8uLmVLpmP
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

7198

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/UserInfo.dll

IMPHASH d576645bcd8a66d2fe678a075f4cc6e0
SHA256 943b33829f9013e4d361482a5c8981ba20a7155c78691dbe02a8f8cd2a02efa0
MD5 acbda33dd5700c122e2fe48e3d4351fd
SHA1 2c154baf7c64052ee712b7cdf9c36b7697dd3fc8
SHA512 d090adf65a74ac5b910b18bb67e989714335e7b4778cd771cff154d7186351a1bebbc7103cca849bdfa2709c991947ffff6c1d8fdf16a74f4dfb614bce3ff6fd
MD5 SHA1 SHA512

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4732

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsDialogs.dll

IMPHASH ebc2d915841be8afc8fa1ee9f6850960
SHA256 8780095aa2f49725388cddf00d79a74e85c9c4863b366f55c39c606a5fb8440c
MD5 1c8b2b40c642e8b5a5b3ff102796fb37
SHA1 3245f55afac50f775eb53fd6d14abb7fe523393d
SHA512 4ff2dc83f640933162ec8818bb1bf3b3be1183264750946a3d949d2e7068ee606277b6c840193ef2b4663952387f07f6ab12c84c4a11cae9a8de7bd4e7971c57
SSDEEP 96:o2DlD3cd51V1zL7xqEscxM2DjDf3GEst+Nt+jvcx4T8qndYv0PLE:o2p34z/x3sREskpx4dO0PLE
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

7513

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Egernes254.Ins

SHA256 645d8b0b9d1b1ddd1de631ad0aed83ff69c961d42dcf5d8eb2d0cd287bcffff7
MD5 e3196089558187c62094d5ea1e764815
SHA1 34ef1997f036989a312407abf99382ca28dfd43d
SHA512 affacb43fb69444582d98dfb7df33e63bbb5bdd6c5db53e5659aa0c75b686014c7a56f168ce4b6eacf4fa006788434b0f5e51bff0b672f65cd15e7c97dda6551
SSDEEP 1536:3gz0G96jt0TM/ou80+AkrQ5BH/3TOF6nVRbdVAnb9uFgrTC:3gwGwBKM/58jQff3TN1LAn5NrTC
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Farvebaandsomskifteren.txt

SHA256 6e6f8aae1108a59382f4afe745a9ca4347f5c77df0831b50b6c3d80728923c91
MD5 b45159f417dde8d6389a17bddd125fba
SHA1 baca54c6d6d2ca60f1eb18fe8f02686c1609d72a
SHA512 7df0d76db8a0e764fc40b81b65f2b629d0f58cfcb3fa71c1603e005526db713cff214bf20d8b14d87407fc291dab28755a37c0f8a7554b9a9c888eccf7e451a8
MD5 SHA1 SHA512

NSIS installer

installer

Montanes176.opt

SHA256 2e47e519ebcf0f29c4cfab7867590dd925a1c24bcf9c449a4eeb2e0a20add6e0
MD5 00ee337ee1e09f3056450f7bd466d663
SHA1 e3a09563a6e6ea014a1b8e656978b7224501e2cf
SHA512 8a0e1812fe32a4501def3a64b4579c9c8dc6f46440e5dccb428d34b26cc730317443f7fd287c93fccbba033e16ef6ca1a94d226ce7f1582632fcb040016e4a93
SSDEEP 192:2HzQVSF2rlzQAi0yaxJOSKirtx9tAZxlfIipJBn8beyJ:azHINdida/OSKiTZKaeS
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Nonemancipation/Nonscholar/migraines.sla

SHA256 0f0480000b0ad9f649c44efe0659c6c8d729b4f88d4cdbd229d5b5f92cea19f1
MD5 0677700f062c42f9ad14c5fc8f21b66b
SHA1 34bc0196a0c3c17564be3bc54108034fe2d1b172
SHA512 f40c87dd3ee7b72607ad818c11e5cd6c75f1eec52ed295a523f835d8b1d87e3444fcf46dae9aabf5a5d25661b07666ab83fb135b33263cee49da31b61aab3895
MD5 SHA1 SHA512

NSIS installer

installer

Nonemancipation/Nonscholar/tegnmssig.bra

SHA256 c2a8ee6ebffdf8d0e1911aca508b6217b5716fa02400f251233428ddddac76fb
MD5 55977ed7f46415522e00c3fdff5caa2d
SHA1 787a22f3acc620d50c29eb03198a4bfdb10113d5
SHA512 5028f6c7080539a4eb40f4e72fa4a34ad5b595e132b098db821498d5688532dd4b63e1e1a2a805520772843673c369f6dab23b2147b1d7496332ac0e77c682f1
SSDEEP 192:IMgd/BOjz7u6eAYyskhEBLZfKBdm9TdtrZi0sMv/UFvDFqsP32:I/d/BGu7sW1ZfKBdm9Tdp3v0/G
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Nonemancipation/Nonscholar/tradionsbevarende.unp

SHA256 c42064ecd39bb1e45fbed3247a7e4355c2b751c50c48c355ed65c361221e26e0
MD5 b24f189fe266a3eb1133225548b37313
SHA1 334290f4bb643b6048aef858ab271dcfbc56239d
SHA512 8b9d53591fc89e1311a62a821fc765261cf7830259da55e322b255a140c8dfbd45591d20da7a262cbfa15918a3d8cf654967f96a2e52bc8e601753624bec40ed
SSDEEP 96:ajWqqlfSwTfxv442jXEcdFEykwxlyjOQcw2:aqVlfSwjxt7cdSiexcp
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Nonemancipation/barsel.pul

SHA256 48c2f9ec2bb01f539037809e6dd3ba233e990065d600e12f9bd8f94175f98f92
MD5 0b992a18939a9d444ca1a88e2ffec6a2
SHA1 b7078a01b48a395122c216f3e52c411426f8f069
SHA512 d539252ff07be01c260feb15020d539649f4800b0a72472a471b732c9385a1dd3ae354261cfbe7fa5a578c6275cf48708c83dd7a84c287d5038c42246528ae67
SSDEEP 192:EnqPs0Cjvr66x+1NcgwOUa3QwKdzmchKyqL3Lgu97+Zi1:EUiv6O4Iza3QwKd1hKyNuZIg
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Sfolks.Bar

SHA256 e25637b5ec8227764a4b523a6ae214428d57def401550089189ce1ad7ea997ea
MD5 91178630c172a66110d209a637fe3d97
SHA1 f5125f849aac01164441494b89537ac6de8c9678
SHA512 d58219c90d68217b079fd7a446c31250da9c1a589db44e70b2045b3fecc82f58607c658addc091ff32c8647f74dbb1530f1123595488de2d0d9e02123afa7fc2
SSDEEP 6144:n3RftFKFWnmx439ZBKDiQ2bzHujDCsXPOxyD+cqzDQH9iAB1d:3BKkmx43UnQsXPcyDRi0QK
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Wafery.unt

SHA256 b4636417b12c1debe224d12ca07ee9d7065005ab1844722c3c720f08629866b7
MD5 0937a5e384e630ea77bdf0d6e23653a0
SHA1 9284b7702dd9ab2f2102092dd26277b7f11cc3e0
SHA512 e7a92e9655848b1185fc5c59d8b2d4b72f624d29f1c4f1b92c38886bf89a54a129a8f9a70c677ab62fb099e814dfe03c3af3c4b3880e479c7e3fc45638f242ee
SSDEEP 192:rGdWIIKTANCxaHuSkkb4wvFtBNssUQkLF3U8yI:rG3T9xmuSfMMFtKLAI
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

MalwareBazaar.0

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/BgImage.dll

kernel32

user32

gdi32

winmm

generic

$PLUGINSDIR/UserInfo.dll

advapi32

kernel32

generic

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

Egernes254.Ins

Farvebaandsomskifteren.txt

Montanes176.opt

Nonemancipation/Nonscholar/migraines.sla

Nonemancipation/Nonscholar/tegnmssig.bra

Nonemancipation/Nonscholar/tradionsbevarende.unp

Nonemancipation/barsel.pul

Sfolks.Bar

Wafery.unt

Sharing

General

Malware Config

Signatures

File Explorer

MalwareBazaar.0

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/BgImage.dll

kernel32

user32

gdi32

winmm

generic

$PLUGINSDIR/UserInfo.dll

advapi32

kernel32

generic

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

Egernes254.Ins

Farvebaandsomskifteren.txt

Montanes176.opt

Nonemancipation/Nonscholar/migraines.sla

Nonemancipation/Nonscholar/tegnmssig.bra

Nonemancipation/Nonscholar/tradionsbevarende.unp

Nonemancipation/barsel.pul

Sfolks.Bar

Wafery.unt