0dd723bd1d59072f6f4dbcf89647cd9f6aaa604280029fc3fe871908087c2c26[.]exe

resource
unpack001/$PLUGINSDIR/System.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

0dd723bd1d59072f6f4dbcf89647cd9f6aaa604280029fc3fe871908087c2c26.exe

IMPHASH 5f0c714c36e6cc016b3a1f4bc86559e4
SHA256 0dd723bd1d59072f6f4dbcf89647cd9f6aaa604280029fc3fe871908087c2c26
MD5 a3f0cebb9b684121e5db16199f7d22fb
SHA1 aaf097bc35a6e86c7ae1edc686db90b4a783ad42
SHA512 58d7f169ca18157cc08d7fb8ef26d7374049e8dc7fcb474f5f34b4dd16c8eaa44eef93fcd0fe8377814f5b808e5256cccb86d916821eb5c659028f652d97f980
SSDEEP 6144:WGemqFepW9/ZvkdEHSHh092pAl3CmY5XJkrQiqcEKiGGORnFCViBP4LMnBrnhs9:umnpcQ1h4aXJkrQiqhbO3Q4n3g
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

57:cb:d5:0a:66:2b:c5:c6:8f:19:dc:5f:81:0c:98:ca:b0:a5:8a:b3:c0:1d:2a:c4:c8:a8:c6:17:ed:99:52:ab

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Sneakiness,OU=Beskyttelsesvrdigere Sviklers Blodbad\ ,O=Sneakiness,L=La Rochelle,ST=Nouvelle-Aquitaine,C=FR,1.2.840.113549.1.9.1=#0c236b756c7475727265766f6c7574696f6e65726e657340456e76656e6f6d6f75732e5370

Chains

Jul 11, 2024

PE Signature issue

Digest

b0:a3:6a:9a:ba:27:3a:65:2c:60:9c:b0:ad:21:3d:ee:65:36:c5:56

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Sneakiness,OU=Beskyttelsesvrdigere Sviklers Blodbad\ ,O=Sneakiness,L=La Rochelle,ST=Nouvelle-Aquitaine,C=FR,1.2.840.113549.1.9.1=#0c236b756c7475727265766f6c7574696f6e65726e657340456e76656e6f6d6f75732e5370

Chains

Jul 11, 2024

Minor OS version

0

Major OS version

4

Entry point

13235

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCreateKeyExA RegEnumKeyA RegQueryValueExA RegSetValueExA RegCloseKey RegDeleteValueA RegDeleteKeyA AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken SetFileSecurityA RegOpenKeyExA RegEnumValueA

shell32

SHGetFileInfoA SHFileOperationA SHGetPathFromIDListA ShellExecuteExA SHGetSpecialFolderLocation SHBrowseForFolderA

ole32

IIDFromString OleInitialize OleUninitialize CoCreateInstance CoTaskMemFree

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

SetClipboardData CharPrevA CallWindowProcA PeekMessageA DispatchMessageA MessageBoxIndirectA GetDlgItemTextA SetDlgItemTextA GetSystemMetrics CreatePopupMenu AppendMenuA TrackPopupMenu FillRect EmptyClipboard LoadCursorA GetMessagePos CheckDlgButton SetWindowPos SetCursor GetSysColor SetClassLongA GetWindowLongA IsWindowEnabled GetWindowRect GetSystemMenu EnableMenuItem RegisterClassA ScreenToClient EndDialog GetClassInfoA SystemParametersInfoA CreateWindowExA ExitWindowsEx DialogBoxParamA CharNextA SetTimer DestroyWindow CreateDialogParamA SetForegroundWindow SetWindowTextA PostQuitMessage SendMessageTimeoutA ShowWindow wsprintfA GetDlgItem FindWindowExA IsWindow GetDC SetWindowLongA LoadImageA InvalidateRect ReleaseDC EnableWindow BeginPaint SendMessageA DefWindowProcA DrawTextA GetClientRect EndPaint IsWindowVisible CloseClipboard OpenClipboard

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateFontIndirectA CreateBrushIndirect DeleteObject SetTextColor SelectObject

kernel32

GetExitCodeProcess WaitForSingleObject GetProcAddress GetSystemDirectoryA WideCharToMultiByte MoveFileExA ReadFile GetTempFileNameA WriteFile RemoveDirectoryA CreateProcessA CreateFileA GetLastError CreateThread CreateDirectoryA GlobalUnlock GetDiskFreeSpaceA GlobalLock SetErrorMode GetVersionExA lstrcpynA GetCommandLineA GetTempPathA lstrlenA SetEnvironmentVariableA ExitProcess GetWindowsDirectoryA GetCurrentProcess GetModuleFileNameA CopyFileA GetTickCount Sleep GetFileSize GetFileAttributesA SetCurrentDirectoryA SetFileAttributesA GetFullPathNameA GetShortPathNameA MoveFileA CompareFileTime SetFileTime SearchPathA lstrcmpiA lstrcmpA CloseHandle GlobalFree GlobalAlloc ExpandEnvironmentStringsA LoadLibraryExA FreeLibrary lstrcpyA lstrcatA FindClose MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA SetFilePointer GetModuleHandleA FindNextFileA FindFirstFileA DeleteFileA MulDiv

$PLUGINSDIR/System.dll

IMPHASH 595a3fd71239f605bb02d7a5e48fd4df
SHA256 7342b73593b3aa1b15e3731bfb1afd1961802a5c66343bac9a2c737ee94f4e38
MD5 e23600029d1b09bdb1d422fb4e46f5a6
SHA1 5d64a2f6a257a98a689a3db9a087a0fd5f180096
SHA512 c971f513142633ce0e6ec6a04c754a286da8016563dab368c3fac83aef81fa3e9df1003c4b63d00a46351a9d18eaa7ae7645caef172e5e1d6e29123ab864e7ac
SSDEEP 192:Vm9rQDenC9VrcK7REgSWOprANupQYLRszDDH/d9CWlXo7U6Wxf:QJQEaVAK7R9SfpjpQYLRszfH/d9CWB1j
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

6

Entry point

6599

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Clape/Bilabial.imp

SHA256 9e0dc63c22702d5bca206995f85f04d200518cf005716ca14c8df024aa32953f
MD5 14df849b9a2e69ed8cb296f50eb44e1a
SHA1 94407b6fa266f21048516e058472570199973689
SHA512 23d86c43988600a39ec42f3ae0985bcf3d03e54bb560d5bd3d0be9e653423aedf02a48773ca49788592bb39d721ca89d2c54527a890a8b1ed85c8d0562ae33d9
MD5 SHA1 SHA512

NSIS installer

installer

Clape/Earthkin48.def

SHA256 872b78b7a8a9adf686fb4af24634c3a71e310839ce000adfd295b3df21e71027
MD5 1d9b0d77a70365c21658c7570ef72414
SHA1 3d18dfa8a4eb63b575b4286b6dade926cea31661
SHA512 6474e3de59245840810967795feeac04eac6d194158aef3545ee3a6f2a6753b5e2d51a152dd936d00b9bfa0ec2f45f26228a66c874d88d9f9dd7ee0f6b97382a
MD5 SHA1 SHA512

NSIS installer

installer

Clape/Septicizations218.ung

SHA256 32326da036ed42a3789a377b897419c11da9fad2f7d8c8b402368864263b7c37
MD5 0c6f696a0ea6f524cef46c7126d68dc4
SHA1 3eb33e5632b95eecc3515f85fb437ea5692fa528
SHA512 71d65d087baff0c83d7ad651cb92520d458f35af486e215346e11a77fcb549b656556a864d4a000d85badc997c2d779cce30e2151ac04352a35b64668c521548
SSDEEP 192:VzOivp3265RT1pua4+zCVyaHh3uOWXrUpvhJ1jg:x9vdz1cBJT3bmUpvhJq
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Clape/Standsnings.Vbn

SHA256 0d1245384aeb747f33881a0f5db9c28441d5e0915ce04d545703db7825a3e991
MD5 b6aa4f3f4f0c3638f84743a57e95ef86
SHA1 08b88296578fd65ea978f762f0f893f6e4b7aae4
SHA512 a61ba5210405b41d2f2e5defa04fa0cd6744080d819e647fb49855e56bc82a9df0abc8e3cbf080aaab238b7313b460527d85d2ea69fc665ff9f33ee6f546e203
SSDEEP 6144:U4IllwkcQK7+IHbSoaSjrtfAy879oUlRmx1CF/rCUeJ9Z+g:UZllwkcQ0n+oXhORLFeFJ9v
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Clape/Stylobata.Tof

SHA256 fa0c0c93529d6f008eedff0902e142f461d032d130d1bf7ab64e9553c79f1c4c
MD5 4f1fe27b4d649bd8abcae56ac2d4d9d7
SHA1 dccb6613c35bfaa158d338d00b4d9281dcc867cc
SHA512 caf2290530f6c7b39c59d5ff393d74020d86a1ac120cebd8215eb8269e122eb7b648c1f962eac63ea4c771f075e07777002c9a956efd96efe06d94fa254f4570
SSDEEP 1536:vXrVMAKe/prhn/ibWAaFCoof7HZ+jK6jEtxIRIh+AjRFlhtwzfVDbs:frSAr/Ln/iakz5+WutSaC
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Clape/brydesport.unc

SHA256 cdd3db01b61de354ab0c16e08c000241ba25d27b4fa90eae8938573a54256617
MD5 78352c9a7b2feba4569ef26711e637bc
SHA1 11a121f558140826b22a72ffb2cf8404bf1775b0
SHA512 fd3703278a130084357f9bc1578a4e079cf97cc77fb4276ebbde3c9346f224fd8b95a58c1cccfe28ce137d38865f3eeef3a90b55fffeef3f0e2be9618de18b69
SSDEEP 96:7nzIA7jy5v7TVlCU0N8D/Fot5Ms2ySmWyf8R6aSh6on5aIWVb5:7zIA3y51jaMotuy9f4Kh6aaIOb5
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Clape/reflowering.bis

SHA256 221afd33a45d7cf418d5d4a448fc3c1e17ecbcafbf6b1559ffaab8e36fb1c562
MD5 21d79ae4f031ae99619b400e0778dc6d
SHA1 b1ab6d46a6962aac4906c46a6616fe2e302d8244
SHA512 9618eb7bb60346990e910b57afbe14a7946b21dc7fe59363a4d8b240223fc48e5351caed3f6156121c2e5a9d4732fa867fda115928949f965bed62b05041d993
SSDEEP 96:bAy9jcBBHJsnC6wSn8cWBcyJLwval88DMcD:q/JsnCkeBc00valXD/
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Clape/unenounced.fle

SHA256 6299a0bbe4f725d7788ebb8054f8fe3d5b7d4fc37111894be6bbb89ee5e5e63e
MD5 9d46b7e476154a65bf435bc6a22cb53d
SHA1 7153d7fe47bb979b263e9ed9497991984946cfd9
SHA512 b3a9e2db3bce31ef17b59b40aa9077e4779102d9c0a9f2c4e9d15d2803defd36f2ea263dd74ea27412deea3e8c4b2237ec328335c6189781446d292e8ab9b412
SSDEEP 192:nd0Utk7lN1H4/MozVwF+Wtjnol5IeeMk2t9pd7Gw:w7lN+EThtjnolCeeMk2trd7Gw
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Clape/vinterbader.txt

SHA256 231850dbb0c488a8c3020c4440095e14b7eaee395e22aa6f09df0d151954eeef
MD5 262595e7f1ae77e9daac320eff0cafa0
SHA1 d5923d919390cde346daa8b6c5251484552fad86
SHA512 571b1a64c9cd777590dd39752c305409d8191048186932f643b9c75db273bad3bf9057205a6b69d8bc8ac1ace7cbb32da2ad489c2444ae70f7609dad0fdd59c6
MD5 SHA1 SHA512

NSIS installer

installer

0dd723bd1d59072f6f4dbcf89647cd9f6aaa604280029fc3fe871908087c2c26.exe

PE Signature issue

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Clape/Bilabial.imp

Clape/Earthkin48.def

Clape/Septicizations218.ung

Clape/Standsnings.Vbn

Clape/Stylobata.Tof

Clape/brydesport.unc

Clape/reflowering.bis

Clape/unenounced.fle

Clape/vinterbader.txt

Sharing

General

Malware Config

Signatures

File Explorer

0dd723bd1d59072f6f4dbcf89647cd9f6aaa604280029fc3fe871908087c2c26.exe

PE Signature issue

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Clape/Bilabial.imp

Clape/Earthkin48.def

Clape/Septicizations218.ung

Clape/Standsnings.Vbn

Clape/Stylobata.Tof

Clape/brydesport.unc

Clape/reflowering.bis

Clape/unenounced.fle

Clape/vinterbader.txt