53a75b58c18af831e5df638291570b99235bf9e4b4ce9e4fca7cd13da3df6f25[.]exe

resource
unpack001/$PLUGINSDIR/System.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

53a75b58c18af831e5df638291570b99235bf9e4b4ce9e4fca7cd13da3df6f25.exe

IMPHASH 5f0c714c36e6cc016b3a1f4bc86559e4
SHA256 53a75b58c18af831e5df638291570b99235bf9e4b4ce9e4fca7cd13da3df6f25
MD5 1b3338a849721abf60efec1f28901ffa
SHA1 6da8a229ee3aaa589f161d1bf9b16f0cd5118730
SHA512 620634f18536dd1b06143814015423307e25f47e1336a3f9cf47ddadd2daaa462459ea6ae38fd0792532d6fe05433f988418006e91fd04a55f4e341ee89cc70b
SSDEEP 12288:VmnpcT6/18retJCCWZFv28MC6YWPCPFhenvh1dZk7SBu:Vmn2iZIdnMCOC3ep1U7SBu
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

bf:8b:27:17:64:a0:a2:28:1e:f2:cb:c4:6a:16:d1:fd:1a:59:4f:68:b4:4c:05:78:cb:b8:a0:87:08:d8:0d:90

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Palaeogeographic,OU=Tessellation Snegrnsernes\ ,O=Palaeogeographic,L=Bilton,ST=England,C=GB,1.2.840.113549.1.9.1=#0c255469707469706f6c64656d6f646572656e7340446961676e6f7374696365726564652e4261

Chains

Jul 5, 2024

PE Signature issue

Digest

36:a3:a3:3c:07:3a:9e:bc:d4:9a:7e:15:c2:8f:d9:00:65:e4:5c:b7

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Palaeogeographic,OU=Tessellation Snegrnsernes\ ,O=Palaeogeographic,L=Bilton,ST=England,C=GB,1.2.840.113549.1.9.1=#0c255469707469706f6c64656d6f646572656e7340446961676e6f7374696365726564652e4261

Chains

Jul 5, 2024

Minor OS version

0

Major OS version

4

Entry point

13235

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCreateKeyExA RegEnumKeyA RegQueryValueExA RegSetValueExA RegCloseKey RegDeleteValueA RegDeleteKeyA AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken SetFileSecurityA RegOpenKeyExA RegEnumValueA

shell32

SHGetFileInfoA SHFileOperationA SHGetPathFromIDListA ShellExecuteExA SHGetSpecialFolderLocation SHBrowseForFolderA

ole32

IIDFromString OleInitialize OleUninitialize CoCreateInstance CoTaskMemFree

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

SetClipboardData CharPrevA CallWindowProcA PeekMessageA DispatchMessageA MessageBoxIndirectA GetDlgItemTextA SetDlgItemTextA GetSystemMetrics CreatePopupMenu AppendMenuA TrackPopupMenu FillRect EmptyClipboard LoadCursorA GetMessagePos CheckDlgButton SetWindowPos SetCursor GetSysColor SetClassLongA GetWindowLongA IsWindowEnabled GetWindowRect GetSystemMenu EnableMenuItem RegisterClassA ScreenToClient EndDialog GetClassInfoA SystemParametersInfoA CreateWindowExA ExitWindowsEx DialogBoxParamA CharNextA SetTimer DestroyWindow CreateDialogParamA SetForegroundWindow SetWindowTextA PostQuitMessage SendMessageTimeoutA ShowWindow wsprintfA GetDlgItem FindWindowExA IsWindow GetDC SetWindowLongA LoadImageA InvalidateRect ReleaseDC EnableWindow BeginPaint SendMessageA DefWindowProcA DrawTextA GetClientRect EndPaint IsWindowVisible CloseClipboard OpenClipboard

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateFontIndirectA CreateBrushIndirect DeleteObject SetTextColor SelectObject

kernel32

GetExitCodeProcess WaitForSingleObject GetProcAddress GetSystemDirectoryA WideCharToMultiByte MoveFileExA ReadFile GetTempFileNameA WriteFile RemoveDirectoryA CreateProcessA CreateFileA GetLastError CreateThread CreateDirectoryA GlobalUnlock GetDiskFreeSpaceA GlobalLock SetErrorMode GetVersionExA lstrcpynA GetCommandLineA GetTempPathA lstrlenA SetEnvironmentVariableA ExitProcess GetWindowsDirectoryA GetCurrentProcess GetModuleFileNameA CopyFileA GetTickCount Sleep GetFileSize GetFileAttributesA SetCurrentDirectoryA SetFileAttributesA GetFullPathNameA GetShortPathNameA MoveFileA CompareFileTime SetFileTime SearchPathA lstrcmpiA lstrcmpA CloseHandle GlobalFree GlobalAlloc ExpandEnvironmentStringsA LoadLibraryExA FreeLibrary lstrcpyA lstrcatA FindClose MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA SetFilePointer GetModuleHandleA FindNextFileA FindFirstFileA DeleteFileA MulDiv

$PLUGINSDIR/System.dll

IMPHASH 595a3fd71239f605bb02d7a5e48fd4df
SHA256 7342b73593b3aa1b15e3731bfb1afd1961802a5c66343bac9a2c737ee94f4e38
MD5 e23600029d1b09bdb1d422fb4e46f5a6
SHA1 5d64a2f6a257a98a689a3db9a087a0fd5f180096
SHA512 c971f513142633ce0e6ec6a04c754a286da8016563dab368c3fac83aef81fa3e9df1003c4b63d00a46351a9d18eaa7ae7645caef172e5e1d6e29123ab864e7ac
SSDEEP 192:Vm9rQDenC9VrcK7REgSWOprANupQYLRszDDH/d9CWlXo7U6Wxf:QJQEaVAK7R9SfpjpQYLRszfH/d9CWB1j
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

6

Entry point

6599

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Akslet.Fle

SHA256 01481f49d7207cd071a25fb09c13d7dc10ea4d040ca5105ddc0d4a087fe83fac
MD5 c8b89fac27e90ac08196f0eda64c9f5c
SHA1 0ee519ddf57985a6c429be3acae3b01289c0a168
SHA512 51e7a3f15879a4f4a7cacee7904f8de52319d39d44783000e0952f4a0bf0f75ce62357509a86a7809b3ce2a04a43498209495e22c8a8bb9b62b441cc0ff0de15
SSDEEP 3072:OBIaslJj9o78RQsYY4uMLePj4x8n3FBGwi:OBVGP4uMLeExGI
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Bilabial.imp

SHA256 9e0dc63c22702d5bca206995f85f04d200518cf005716ca14c8df024aa32953f
MD5 14df849b9a2e69ed8cb296f50eb44e1a
SHA1 94407b6fa266f21048516e058472570199973689
SHA512 23d86c43988600a39ec42f3ae0985bcf3d03e54bb560d5bd3d0be9e653423aedf02a48773ca49788592bb39d721ca89d2c54527a890a8b1ed85c8d0562ae33d9
MD5 SHA1 SHA512

NSIS installer

installer

Committeeman.Sen

SHA256 40bbafa6ba9ae6f25faedef5778525c5312cb2a9cbbe8f575f7d773a7d851a50
MD5 6aa240b5ab44f26e5ef38aab2b23b1d0
SHA1 c3717098deedd85f0130948be1f341767e8d3819
SHA512 7a604f88af360a01f6b97b84aaad1c83225d9767619d06f253b6e3cd677722497d7882723e8969562f90e2a60c28b289a1cbc9134bfcdacc085773cad732f72b
SSDEEP 6144:/Y1SyaUTwlOZc4n2937TQcu0Onfj5/hH9KjK0lF:/Yw9Uclo5nyTrlOfj55dsH
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Mockbird25/Earthkin48.def

SHA256 872b78b7a8a9adf686fb4af24634c3a71e310839ce000adfd295b3df21e71027
MD5 1d9b0d77a70365c21658c7570ef72414
SHA1 3d18dfa8a4eb63b575b4286b6dade926cea31661
SHA512 6474e3de59245840810967795feeac04eac6d194158aef3545ee3a6f2a6753b5e2d51a152dd936d00b9bfa0ec2f45f26228a66c874d88d9f9dd7ee0f6b97382a
MD5 SHA1 SHA512

NSIS installer

installer

Mockbird25/Septicizations218.ung

SHA256 32326da036ed42a3789a377b897419c11da9fad2f7d8c8b402368864263b7c37
MD5 0c6f696a0ea6f524cef46c7126d68dc4
SHA1 3eb33e5632b95eecc3515f85fb437ea5692fa528
SHA512 71d65d087baff0c83d7ad651cb92520d458f35af486e215346e11a77fcb549b656556a864d4a000d85badc997c2d779cce30e2151ac04352a35b64668c521548
SSDEEP 192:VzOivp3265RT1pua4+zCVyaHh3uOWXrUpvhJ1jg:x9vdz1cBJT3bmUpvhJq
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Mockbird25/brydesport.unc

SHA256 cdd3db01b61de354ab0c16e08c000241ba25d27b4fa90eae8938573a54256617
MD5 78352c9a7b2feba4569ef26711e637bc
SHA1 11a121f558140826b22a72ffb2cf8404bf1775b0
SHA512 fd3703278a130084357f9bc1578a4e079cf97cc77fb4276ebbde3c9346f224fd8b95a58c1cccfe28ce137d38865f3eeef3a90b55fffeef3f0e2be9618de18b69
SSDEEP 96:7nzIA7jy5v7TVlCU0N8D/Fot5Ms2ySmWyf8R6aSh6on5aIWVb5:7zIA3y51jaMotuy9f4Kh6aaIOb5
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Mockbird25/reflowering.bis

SHA256 221afd33a45d7cf418d5d4a448fc3c1e17ecbcafbf6b1559ffaab8e36fb1c562
MD5 21d79ae4f031ae99619b400e0778dc6d
SHA1 b1ab6d46a6962aac4906c46a6616fe2e302d8244
SHA512 9618eb7bb60346990e910b57afbe14a7946b21dc7fe59363a4d8b240223fc48e5351caed3f6156121c2e5a9d4732fa867fda115928949f965bed62b05041d993
SSDEEP 96:bAy9jcBBHJsnC6wSn8cWBcyJLwval88DMcD:q/JsnCkeBc00valXD/
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Mockbird25/unenounced.fle

SHA256 6299a0bbe4f725d7788ebb8054f8fe3d5b7d4fc37111894be6bbb89ee5e5e63e
MD5 9d46b7e476154a65bf435bc6a22cb53d
SHA1 7153d7fe47bb979b263e9ed9497991984946cfd9
SHA512 b3a9e2db3bce31ef17b59b40aa9077e4779102d9c0a9f2c4e9d15d2803defd36f2ea263dd74ea27412deea3e8c4b2237ec328335c6189781446d292e8ab9b412
SSDEEP 192:nd0Utk7lN1H4/MozVwF+Wtjnol5IeeMk2t9pd7Gw:w7lN+EThtjnolCeeMk2trd7Gw
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Mockbird25/vinterbader.txt

SHA256 231850dbb0c488a8c3020c4440095e14b7eaee395e22aa6f09df0d151954eeef
MD5 262595e7f1ae77e9daac320eff0cafa0
SHA1 d5923d919390cde346daa8b6c5251484552fad86
SHA512 571b1a64c9cd777590dd39752c305409d8191048186932f643b9c75db273bad3bf9057205a6b69d8bc8ac1ace7cbb32da2ad489c2444ae70f7609dad0fdd59c6
MD5 SHA1 SHA512

NSIS installer

installer

53a75b58c18af831e5df638291570b99235bf9e4b4ce9e4fca7cd13da3df6f25.exe

PE Signature issue

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Akslet.Fle

Bilabial.imp

Committeeman.Sen

Mockbird25/Earthkin48.def

Mockbird25/Septicizations218.ung

Mockbird25/brydesport.unc

Mockbird25/reflowering.bis

Mockbird25/unenounced.fle

Mockbird25/vinterbader.txt

Sharing

General

Malware Config

Signatures

File Explorer

53a75b58c18af831e5df638291570b99235bf9e4b4ce9e4fca7cd13da3df6f25.exe

PE Signature issue

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Akslet.Fle

Bilabial.imp

Committeeman.Sen

Mockbird25/Earthkin48.def

Mockbird25/Septicizations218.ung

Mockbird25/brydesport.unc

Mockbird25/reflowering.bis

Mockbird25/unenounced.fle

Mockbird25/vinterbader.txt