c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b[.]exe

resource
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsExec.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe

IMPHASH f677acae05efabe7411a40902b2d88fb
SHA256 c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b
MD5 b409d2fd594633bc71e64da08aed9951
SHA1 c6f38e204419c12044e34baf398030b76e616a2f
SHA512 b234f0a848c3d775cde23d4965084714fe13b3dd076f3749213e0f55a3f69cad302bebd2db2ce189333f85b4d81554dffc74b58553120251acb0f2ce6b03ecf6
SSDEEP 12288:9vxwRbB0H5KUjUPKCuO+ggobwxbAW07FN3WNZt:9vx6bB0ZqAHgDSbxQFN3WDt
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

07:7e:cb:62:23:cd:53:1f:fe:a6:08:3c:49:b2:40:a3:1a:08:80:f5:d7:79:07:85:78:51:2e:d0:72:86:c3:8f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Flypasts,OU=Fordrivelsers Skipperlgne Defector\ ,O=Flypasts,L=Besançon,ST=Bourgogne-Franche-Comté,C=FR,1.2.840.113549.1.9.1=#0c1a47616c6f636865726e65313533405269766572686561642e4e6f

Chains

Jul 9, 2024

Minor OS version

1

Major OS version

5

Entry point

13518

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCloseKey RegDeleteKeyA RegDeleteValueA RegEnumKeyA RegEnumValueA RegQueryValueExA RegSetValueExA OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueA SetFileSecurityA RegCreateKeyExA RegOpenKeyExA

shell32

SHBrowseForFolderA SHFileOperationA SHGetPathFromIDListA SHGetFileInfoA ShellExecuteExA

ole32

OleUninitialize IIDFromString OleInitialize CoTaskMemFree CoCreateInstance

comctl32

ord17 ImageList_Destroy ImageList_AddMasked ImageList_Create

user32

DispatchMessageA SystemParametersInfoA LoadCursorA SetClassLongA GetSysColor ScreenToClient SetCursor GetWindowRect TrackPopupMenu AppendMenuA EnableMenuItem CreatePopupMenu GetSystemMenu GetSystemMetrics IsWindowEnabled EmptyClipboard SetClipboardData CloseClipboard OpenClipboard CheckDlgButton EndDialog DialogBoxParamA IsWindowVisible SetWindowPos CreateWindowExA GetClassInfoA RegisterClassA PeekMessageA GetMessagePos CharNextA ExitWindowsEx SetWindowTextA SetTimer CreateDialogParamA DestroyWindow LoadImageA FindWindowExA SetWindowLongA InvalidateRect ReleaseDC GetDC SetForegroundWindow EnableWindow GetDlgItem ShowWindow IsWindow PostQuitMessage SendMessageTimeoutA SendMessageA wsprintfA FillRect GetClientRect EndPaint BeginPaint DrawTextA DefWindowProcA SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CallWindowProcA CharPrevA GetWindowLongA

gdi32

SetBkMode CreateBrushIndirect GetDeviceCaps SelectObject DeleteObject SetBkColor SetTextColor CreateFontIndirectA

kernel32

GetTempFileNameA GetLastError WaitForSingleObject RemoveDirectoryA ReadFile CreateFileA CreateDirectoryA lstrcpynA GlobalLock GlobalUnlock CreateThread GetDiskFreeSpaceA CopyFileA lstrlenA GetVersionExA GetWindowsDirectoryA ExitProcess GetExitCodeProcess SetErrorMode GetTempPathA SetEnvironmentVariableA GetCommandLineA GetModuleFileNameA GetTickCount GetFileSize MultiByteToWideChar MoveFileA WritePrivateProfileStringA GetPrivateProfileStringA lstrcmpiA lstrcmpA MulDiv GetShortPathNameA GlobalFree GlobalAlloc LoadLibraryExA GetModuleHandleA FreeLibrary Sleep CloseHandle SetFileTime SetFilePointer SetFileAttributesA GetFullPathNameA GetFileAttributesA FindNextFileA FindFirstFileA FindClose DeleteFileA CompareFileTime SearchPathA SetCurrentDirectoryA ExpandEnvironmentStringsA WriteFile CreateProcessA WideCharToMultiByte GetSystemDirectoryA GetProcAddress lstrcpyA lstrcatA MoveFileExA GetCurrentProcess

$PLUGINSDIR/System.dll

IMPHASH 595a3fd71239f605bb02d7a5e48fd4df
SHA256 aec5af9c7c551c3590492b0c0120b535b55ab048e84f695b617a5ab4b1a52f54
MD5 bff2a11d26d951ec34679b8fa1ee7192
SHA1 d3de629a5a86ee35b6afa1802f6ac8b141b07062
SHA512 1dce397c9cab3cd3b58c181688286a89067c743f195403694819c2d988435268ffd01939beaaa17cfa344160c89414f28273b70de154be0def034af8c470723a
SSDEEP 192:G9rQDenC9VrcK7REgSWOprANupQYLRszDDH/d9CWlXo7U6Wxf:GJQEaVAK7R9SfpjpQYLRszfH/d9CWB1j
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

6

Entry point

6599

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsExec.dll

IMPHASH 0d6ae1f1ecbace583969d8eb8b21d1b8
SHA256 e18984e78d58b2383f2c1e8ed0000088ee8d9d469345383618f179176fcddff6
MD5 fdee755c4987e9859e0eec130ee22efd
SHA1 ba32823881a98da6b92eee1d866be2b3a20c6e5d
SHA512 31ba3dad22fd9b78ab3f6017c4373c923d048cf0c010900a131c4533ef185d408a88052aa4cf6184dbe484d44aab9cfa94a052185cf0b9ad19286ed921e4723f
SSDEEP 96:ft4Vl/7Lo1UBrob9ljNEUgD7cyuM1x9XkraK2A2KAB5VVDyssKZ:ft4Vlw1Iul5J8T1vK20I5VVGsb
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

6

Entry point

4339

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Doundake/disusance.nar

SHA256 6a02bb5a2dda116bfafc7e0019446b89564e5513c72a47499d6d4debc070d82f
MD5 029f26487d958257ec8b51a1743d1324
SHA1 5a1796c48e7785f8ca7a60a290f4ba759b8e6377
SHA512 c7a091e8a0ac15ca686a7f9b0a024815de71cb9c4e3beeb41f62f0827df31814df5fc6ed3714365ae7a501331ce6fb6c69d0b583a84e932761d8e9550bbf5e4d
SSDEEP 384:/WZKMB2DCvQxpCtqSHYn2GgNDNxijVKwBcwIx1FtDDpNLgA9g0VRaj/Od+exEpPU:/WoMmcHrrxg/xWZDHgMaj/OZUmfQG2I
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Fiskerimssige.Ebr

SHA256 9891d0c4fc62f92b380e91343c0f6985715042c368f55ef17f51a7cf746c297b
MD5 caf7638318263008374cefe3d1df91b2
SHA1 50c7394eae97d5ec91efe1d3ab600535fb9365dc
SHA512 4a4961d125b115d78d7db53361172880ccdcdf2ab2959e508a725fadfc3a5fbaef0f4dff189695674ae48c0df413d890ad606b59edf2652fe6dd63fb3ef34244
SSDEEP 3072:WjJsNTzep0XB8ZrCtdzcvrTP1PJFQI63gOBKORXNg8+74Yv2:Z/00XyGdov1hj6XKORdWe
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Unwig.cal

SHA256 d2c49e0b222aef73be75481b3f05b1db409221b309201bcf8794c0294bc1958b
MD5 7e12105629d3aff3e390d05c1562b88f
SHA1 99b7a121d574465cff585adc8a445944d629767d
SHA512 c070bf9102ae678fd3e9866fb47ab5edf828bc09be4bbe9a9e07fbbb9196056589fb4a6a5584ffa5c9ebeedc8ea5062d038af46ca94795743eaace4ede70172d
SSDEEP 192:Uc4AF1AI948EmI0K1F6E+umTfvjMrGCQxGGIHLqIi:UMF1AeaR1F6fTfvIrGCeGGIHuIi
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

computerspillets.txt

SHA256 888024ef7f696f978d89fc6de80720f01f74c96108f7e747b3fe9b6dc215e630
MD5 df9ff56e018189b5916f39aff5811397
SHA1 653feb865e0c3a7210442b4d48c9419cdc44143e
SHA512 7d390ba963be29909388c9085d45d9156469a345055371aa82cd055c3e7fc78e8f508374c7f8c8a6cb307f43f9976e5c1b86de4b93b60dd95c4dec9eb3aa70eb
MD5 SHA1 SHA512

NSIS installer

installer

c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/nsExec.dll

advapi32

user32

kernel32

generic

Doundake/disusance.nar

Fiskerimssige.Ebr

Unwig.cal

computerspillets.txt

Sharing

General

Malware Config

Signatures

File Explorer

c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b.exe

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/nsExec.dll

advapi32

user32

kernel32

generic

Doundake/disusance.nar

Fiskerimssige.Ebr

Unwig.cal

computerspillets.txt