Uundgaaelige[.]exe

resource
unpack001/$PLUGINSDIR/BgImage.dll
unpack001/$PLUGINSDIR/UserInfo.dll
unpack001/$PLUGINSDIR/nsDialogs.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

Uundgaaelige.exe

IMPHASH 57e98d9a5a72c8d7ad8fb7a6a58b3daf
SHA256 c9736cdc4ade9fddb9b293e0366f182f972154d98169b58e532b7905c310bf97
MD5 fc55407cc82612103c5971dca1837d6b
SHA1 01efa90009900c64c846b7ac716dea3c5f97c4e8
SHA512 08edfa8f06459ae170ea444664776e57836bd6142721d8df663776051c8c6dab98f7c8902848ed08e4311a858d95eb38d0df13208f8e0144a2fa9fa1a90c0240
SSDEEP 12288:WDkS/CNT9fM913qbLd+cUQj5X7JPKmdE9s4Jr:WDEc9tqb5akVPHE93N
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

21:41:4f:2e:a8:be:bb:b6:7d:06:71:f2:c7:ca:71:52:41:80:9b:bb:b9:e3:e9:7a:64:43:61:0d:d6:79:12:d8

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=anaphoria,OU=Stttepartis Pseudoreminiscence\ ,O=anaphoria,L=Utica,ST=New York,C=US,1.2.840.113549.1.9.1=#0c16547269636f6c6f7572404a6f796f75733131382e556e

Chains

Jul 12, 2024

Minor OS version

0

Major OS version

4

Entry point

13069

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetEnvironmentVariableA CreateFileA GetFileSize GetModuleFileNameA ReadFile GetCurrentProcess CopyFileA Sleep GetTickCount GetWindowsDirectoryA GetTempPathA GetCommandLineA lstrlenA GetVersion SetErrorMode lstrcpynA ExitProcess SetCurrentDirectoryA GlobalLock CreateThread GetLastError CreateDirectoryA CreateProcessA RemoveDirectoryA GetTempFileNameA WriteFile lstrcpyA MoveFileExA lstrcatA GetSystemDirectoryA GetProcAddress GetExitCodeProcess WaitForSingleObject CompareFileTime SetFileAttributesA GetFileAttributesA GetShortPathNameA MoveFileA GetFullPathNameA SetFileTime SearchPathA CloseHandle lstrcmpiA GlobalUnlock GetDiskFreeSpaceA lstrcmpA FindFirstFileA FindNextFileA DeleteFileA SetFilePointer GetPrivateProfileStringA FindClose MultiByteToWideChar FreeLibrary MulDiv WritePrivateProfileStringA LoadLibraryExA GetModuleHandleA GlobalAlloc GlobalFree ExpandEnvironmentStringsA

user32

ScreenToClient GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard PostQuitMessage GetWindowRect EnableMenuItem CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndDialog RegisterClassA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx GetDC CreateDialogParamA SetTimer GetDlgItem SetWindowLongA SetForegroundWindow LoadImageA IsWindow SendMessageTimeoutA FindWindowExA OpenClipboard TrackPopupMenu AppendMenuA EndPaint DestroyWindow wsprintfA ShowWindow SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation ShellExecuteExA SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA SHFileOperationA

advapi32

AdjustTokenPrivileges RegCreateKeyExA RegOpenKeyExA SetFileSecurityA OpenProcessToken LookupPrivilegeValueA RegEnumValueA RegDeleteKeyA RegDeleteValueA RegCloseKey RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/BgImage.dll

IMPHASH bdcecc8b26871abb93996c6c18e09c94
SHA256 d0607e535ff5573638ee1d70612e2239d5cb3c87307f48cfd57aa1c5cc0d9524
MD5 24db082241ace4aca15bdf1e8460c92b
SHA1 d317ef130af6ea6a72a958eee20a58568d38f23d
SHA512 ec1dcf17e2e72dbdf06d91250f0698cd50144836a1ee4a3e8a50605e27f8106db595c61a81349a72ce652bc03aee0033fed1700d87d8f2d0e4cd1db9515e7ee2
SSDEEP 96:8eD0AKTIfv7QCUsthvNL85s4lk38Eb3CDfvEh8uLzqkznLiEQjJ3KxkP:tZBfjbUA/85q3wEh8uLmaLpmP
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

7198

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/UserInfo.dll

IMPHASH cce05dea98cbac3a9d486b233588f528
SHA256 d0949b4c0640ee6a80db5a7f6d93fc631ed194de197d79bf080ec1752c6f1166
MD5 c051c86f6fa84ac87efb0cf3961950a1
SHA1 f18f4bb803099b80a3a013ecb03fea11cff0ac01
SHA512 6e9de5d07aaed2ac297faa5049d567884d817ed94dece055d96913ac8e497ade6f0ff5c28bae7cc7d3ac41f8795efb9939e6d12061a3c446d5d2a3e2287d49d2
MD5 SHA1 SHA512

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4713

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsDialogs.dll

IMPHASH ddbd50fe6279559edf7d1f1d89b42c2c
SHA256 c1cc3aa4326e83a73a778dee0cf9afcc03a6bafb0a32cea791a27eb9c2288985
MD5 ee449b0adce56fbfa433b0239f3f81be
SHA1 ec1e4f9815ea592a3f19b1fe473329b8ddfa201c
SHA512 22fb25bc7628946213e6e970a865d3fbd50d12ce559c37d6848a82c28fa6be09fedffc3b87d5aea8dcfe8dfc4e0f129d9f02e32dae764b8e6a08332b42386686
SSDEEP 96:oCqZ4zC5RH3cXX1LlYlRowycxM2DjDf3GEst+Nt+jvDYx4iqndYHnxss:oCq+CP3uKrpyREs06Yx+dGn
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

7429

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Chugging/Dialektologi.Alt

SHA256 008302e66df0902bdd917aac31979f6a3b248189fadd2ce84c42e3e6618dc8c3
MD5 a2d89f4d3b619450083c55932293f2cf
SHA1 f4975dd0b85438166922a4130dbbe8a058fc009a
SHA512 5a4d8da3322d2734dc277a5168db4a00fb8ee5dc1b19baba5357ad4baf39befa78ab090dfbdd1688635b3e91140de2bc7f65de7754a7b19f7cdaeb9f4ae73cd7
SSDEEP 1536:DDwlPzV4Fn5Wm1flOf6YwkXjvVw92tCsyBjIHOJwvzQCmU65:38yF5Wu9hxkXjvVc2TitmvzQZU65
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Chugging/Helseforretningens.str

SHA256 c481f233e1e2fa5322c3444b51810742bd1e9d1a6a549baa7b2a21378844d93d
MD5 2d9012d9a7be9298b64873ce23afcb6b
SHA1 26111932d7a89dd087c1cd2cd1812ad9068a3ee3
SHA512 cebea6de861b46f561f212423b81bf652ccb5bc57bdd960a449f0f89cd8d5a55b7b711a596972f2e4e86232c568e4db3b3fb032184144b7fabcb1f4f17d92d0e
SSDEEP 6144:RX2X1mbYg3cXeryZWBoFK88LI4dKKOaEXHp7CWs2wx/sJ6Fh2722OKCqe:R9YICgHLJOdXHEWyT2722TC5
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Chugging/braweling.ban

SHA256 98cc30b99717b7753f039609a9ef76553a9c2b0dfdadbcdf962fc95384173792
MD5 4c32ae5b5d401f961380d7daf3afc365
SHA1 0084d96d3e973d9e0a8054ef6098be3f36c9816d
SHA512 27e629328c359b48d56033de2c3811fb44c2f15ebc43108cc5bb8f69e9130006c4745c312cc4922514318f3c9e93964e4f8c58c7f4a78ff0796579817ce7d1c6
SSDEEP 192:oBexGw4CNUs99q5UrUrcnEYWi2qwhXwKCk6:EexGw4C+s9l5I4Km
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Feltrkkeflgerne/flymekanikerne.con

SHA256 91aa495bf1782f68ac5e779fdcbba1b8cf131954f9c42176566472b597387ba0
MD5 3decb5bc070963391ed24136d9d39633
SHA1 cba6b9b3c6421b020649fb07a418297d1bda4f45
SHA512 ff96eb145436c8814facc71ddb5000e293b0610a9dd13a00e71d5be5fff57204dbbc0b6b8d3855a525feacdf0631843010c45babd4ef6f54c5aa54b13ec22949
SSDEEP 192:umvO2UHW0DkAQ1mAerW1e63184s7+jkHYQBALB6klVxzf:uv26lzwQi1e4Ps7+w47L3hf
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Feltrkkeflgerne/insensateness.lic

SHA256 315b816906ee577ba1bed2a2922c43bb1784cabfd8248ee5a5964f3b09bb41a9
MD5 18818318a7091f31a6673c1e6691893e
SHA1 1bcb5ca319505bdc0466ddb93877a4a1e1a51f11
SHA512 256f17d954cf295ca4d8025ac609d84e0010e11c81ba9184b0639bd866680d60df3eb5c69de81b539d735936bc5382f247236d488745becae731d491a6e5c1f5
SSDEEP 96:NCsEB8dygfnrmDE82LCeSSYFGqAn1OaG1IsoJ9M30GKMRwf4Xs4QR:UsExCnqSLg9+GIsQm30aRy4MR
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Feltrkkeflgerne/metrocarcinoma.ref

SHA256 4b1a99dd41c0242616390c0aa7c8c2ae08c1b306d794de3188dfd0b49b1d6775
MD5 20cc3561dee93c050a00596d8b8ee12f
SHA1 055769fed332180b097366e5d8e54a4d4b941be2
SHA512 2dabb57e35f00d25ba834d52aef454185b4cb2e38f774096ea7d771d4374022e887e092d647af8f898bb7f6b0bfef5fdbbee1f70bc9dc8a08ad6d9dc87b81cdf
SSDEEP 96:spFjZT61CS2EXhewGtdqTxOQ2GCxIJE/5jTVZomc91+Ra4O0tBVceGCUY6a:sjZgCghewGLqTxR2GCmG/XoL9vbCDH
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Feltrkkeflgerne/radiosterilizing.exe

SHA256 19b54368c848a4e46bf93c1bb3d4bf47b1ff965caab64d9099258b9b6b61ce76
MD5 845a86a79fba340cef7233c6518f3d22
SHA1 f8b8886d7e1accc8e025a78cb2940992e7d4dd71
SHA512 5c65ff32d15fb7ec3e0ce22f985222a069dfb1bfe636140e2df85b22ad3998e062c76b4418fbbb3ff7953d71960e824ea7a27f161a22c4c9e32bd78934d84878
SSDEEP 96:zVcGBUehj1kyKmuE7RQZCEDc+IEtesKRLiyEqDmPIse:zVZBUevkBrCEDUE0DDmwse
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Feltrkkeflgerne/schuit.txt

SHA256 225d132cef9273ee87874a67240e568e5f1d6a8056d531d66beabca99675cb7f
MD5 db59b30b63b1bb25574e79623913df27
SHA1 7bb0493c43c972b6b78b870b66f3bf093a85116d
SHA512 9037d859f1f714e5910386d39c01a4db429e80e16ae76ab077dab56394a1cbc998f65199547ce8ade833d8df34aafcaeb0d4c052e50d9f7df74eeb0d4cde1050
MD5 SHA1 SHA512

NSIS installer

installer

Uundgaaelige.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/BgImage.dll

kernel32

user32

gdi32

winmm

generic

$PLUGINSDIR/UserInfo.dll

kernel32

advapi32

generic

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

Chugging/Dialektologi.Alt

Chugging/Helseforretningens.str

Chugging/braweling.ban

Feltrkkeflgerne/flymekanikerne.con

Feltrkkeflgerne/insensateness.lic

Feltrkkeflgerne/metrocarcinoma.ref

Feltrkkeflgerne/radiosterilizing.exe

Feltrkkeflgerne/schuit.txt

Sharing

General

Malware Config

Signatures

File Explorer

Uundgaaelige.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/BgImage.dll

kernel32

user32

gdi32

winmm

generic

$PLUGINSDIR/UserInfo.dll

kernel32

advapi32

generic

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

Chugging/Dialektologi.Alt

Chugging/Helseforretningens.str

Chugging/braweling.ban

Feltrkkeflgerne/flymekanikerne.con

Feltrkkeflgerne/insensateness.lic

Feltrkkeflgerne/metrocarcinoma.ref

Feltrkkeflgerne/radiosterilizing.exe

Feltrkkeflgerne/schuit.txt