pko_trans_details_20240710_105339·pdf[.]exe

resource
pko_trans_details_20240710_105339·pdf.exe
unpack001/$PLUGINSDIR/BgImage.dll
unpack001/$PLUGINSDIR/UserInfo.dll
unpack001/$PLUGINSDIR/nsDialogs.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

pko_trans_details_20240710_105339·pdf.exe

IMPHASH ced282d9b261d1462772017fe2f6972b
SHA256 d7325eb4553b2c58a8580cb84af63cfe5cdf4ff23a3d4e09a963c656d5717d8c
MD5 c601d5e720a191b1e304c8bcbf63b675
SHA1 80133fe77b17d44886e6201d7723be90489a55d2
SHA512 2a78f640f01f365d23bb45bfc96e6900eb1814804bbf905876ac9d6e9353fd3e648efc08858b9e29e41eb6c2262e528d34b00d847524aeeabf41eb319792566f
SSDEEP 6144:39X0GFlllllllqllllllllllllhllllYllltlld0wz/ypzAJP8xvP2nWaLcAqRFk:R0Nwzy4EP2nWaPqzJgBKjYl92gCU3Bbl
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

13128

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCreateKeyExA RegEnumKeyA RegQueryValueExA RegSetValueExA RegCloseKey RegDeleteValueA RegDeleteKeyA AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken SetFileSecurityA RegOpenKeyExA RegEnumValueA

shell32

SHGetFileInfoA SHFileOperationA SHGetPathFromIDListA ShellExecuteExA SHGetSpecialFolderLocation SHBrowseForFolderA

ole32

IIDFromString OleInitialize OleUninitialize CoCreateInstance CoTaskMemFree

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

SetClipboardData CharPrevA CallWindowProcA PeekMessageA DispatchMessageA MessageBoxIndirectA GetDlgItemTextA SetDlgItemTextA GetSystemMetrics CreatePopupMenu AppendMenuA TrackPopupMenu FillRect EmptyClipboard LoadCursorA GetMessagePos CheckDlgButton GetSysColor SetCursor GetWindowLongA SetClassLongA SetWindowPos IsWindowEnabled GetWindowRect GetSystemMenu EnableMenuItem RegisterClassA ScreenToClient EndDialog GetClassInfoA SystemParametersInfoA CreateWindowExA ExitWindowsEx DialogBoxParamA CharNextA SetTimer DestroyWindow CreateDialogParamA SetForegroundWindow SetWindowTextA PostQuitMessage SendMessageTimeoutA ShowWindow wsprintfA GetDlgItem FindWindowExA IsWindow GetDC SetWindowLongA LoadImageA InvalidateRect ReleaseDC EnableWindow BeginPaint SendMessageA DefWindowProcA DrawTextA GetClientRect EndPaint IsWindowVisible CloseClipboard OpenClipboard

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateFontIndirectA CreateBrushIndirect DeleteObject SetTextColor SelectObject

kernel32

GetExitCodeProcess WaitForSingleObject GetProcAddress GetSystemDirectoryA WideCharToMultiByte MoveFileExA ReadFile GetTempFileNameA WriteFile RemoveDirectoryA CreateProcessA CreateFileA GetLastError CreateThread CreateDirectoryA GlobalUnlock GetDiskFreeSpaceA GlobalLock SetErrorMode GetVersion lstrcpynA GetCommandLineA GetTempPathA lstrlenA SetEnvironmentVariableA ExitProcess GetWindowsDirectoryA GetCurrentProcess GetModuleFileNameA CopyFileA GetTickCount Sleep GetFileSize GetFileAttributesA SetCurrentDirectoryA SetFileAttributesA GetFullPathNameA GetShortPathNameA MoveFileA CompareFileTime SetFileTime SearchPathA lstrcmpiA lstrcmpA CloseHandle GlobalFree GlobalAlloc ExpandEnvironmentStringsA LoadLibraryExA FreeLibrary lstrcpyA lstrcatA FindClose MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA SetFilePointer GetModuleHandleA FindNextFileA FindFirstFileA DeleteFileA MulDiv

$PLUGINSDIR/BgImage.dll

IMPHASH bdcecc8b26871abb93996c6c18e09c94
SHA256 dbf91707fa157603bea025a6411cdcb497ab11262c9c18b14dc431a45aa17c0b
MD5 521df745a41f0b8164ffd01717cacbba
SHA1 dc7a9eacfbeb1fae52091da5e80db6cb1b6bce74
SHA512 c5b1ba062872a8f534e2f0eac57fc3c0d8be9cda79605d86566d67260ba5477444a0ddfed1838b4fb14c677e5342c8419a88fcd38147dbaa36ac1f9e00c52bbe
SSDEEP 96:8eZ0AKTIfv7QCUsthvNL85s4lk38Eb3CDfvEh8uLzqk4jnLiEQjJ3KxkP:tXBfjbUA/85q3wEh8uLmVLpmP
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

7198

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/UserInfo.dll

IMPHASH d576645bcd8a66d2fe678a075f4cc6e0
SHA256 943b33829f9013e4d361482a5c8981ba20a7155c78691dbe02a8f8cd2a02efa0
MD5 acbda33dd5700c122e2fe48e3d4351fd
SHA1 2c154baf7c64052ee712b7cdf9c36b7697dd3fc8
SHA512 d090adf65a74ac5b910b18bb67e989714335e7b4778cd771cff154d7186351a1bebbc7103cca849bdfa2709c991947ffff6c1d8fdf16a74f4dfb614bce3ff6fd
MD5 SHA1 SHA512

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4732

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsDialogs.dll

IMPHASH ebc2d915841be8afc8fa1ee9f6850960
SHA256 8780095aa2f49725388cddf00d79a74e85c9c4863b366f55c39c606a5fb8440c
MD5 1c8b2b40c642e8b5a5b3ff102796fb37
SHA1 3245f55afac50f775eb53fd6d14abb7fe523393d
SHA512 4ff2dc83f640933162ec8818bb1bf3b3be1183264750946a3d949d2e7068ee606277b6c840193ef2b4663952387f07f6ab12c84c4a11cae9a8de7bd4e7971c57
SSDEEP 96:o2DlD3cd51V1zL7xqEscxM2DjDf3GEst+Nt+jvcx4T8qndYv0PLE:o2p34z/x3sREskpx4dO0PLE
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

7513

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Farvebaandsomskifteren.txt

SHA256 6e6f8aae1108a59382f4afe745a9ca4347f5c77df0831b50b6c3d80728923c91
MD5 b45159f417dde8d6389a17bddd125fba
SHA1 baca54c6d6d2ca60f1eb18fe8f02686c1609d72a
SHA512 7df0d76db8a0e764fc40b81b65f2b629d0f58cfcb3fa71c1603e005526db713cff214bf20d8b14d87407fc291dab28755a37c0f8a7554b9a9c888eccf7e451a8
MD5 SHA1 SHA512

NSIS installer

installer

Helicopter.San

SHA256 de1db1c0a065f580b4fe878c5b363933e45ec7f0c06118d29b6d167af24189ff
MD5 bf1ebfd1285dd7ef43a587e9f51a8e33
SHA1 1dede4026611e9f40c91d9bbe406a06b2fd8bfa4
SHA512 3b7b11a8989a0b46e4091c8e4c81e71a2454fc9fba77618d844653d548ecd59a2c8b8fce3338fa499ca84da8664f7e34f355ab8b18e3507598f5f63dd3a80389
SSDEEP 1536:biBPr7SAOuArhkT0OIS7QtyYH7Tn+9I2rqKC5cdKX2ECa7AZx46:GBPrWAyheZQtxH7r+K23C0BasHR
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Montanes176.opt

SHA256 2e47e519ebcf0f29c4cfab7867590dd925a1c24bcf9c449a4eeb2e0a20add6e0
MD5 00ee337ee1e09f3056450f7bd466d663
SHA1 e3a09563a6e6ea014a1b8e656978b7224501e2cf
SHA512 8a0e1812fe32a4501def3a64b4579c9c8dc6f46440e5dccb428d34b26cc730317443f7fd287c93fccbba033e16ef6ca1a94d226ce7f1582632fcb040016e4a93
SSDEEP 192:2HzQVSF2rlzQAi0yaxJOSKirtx9tAZxlfIipJBn8beyJ:azHINdida/OSKiTZKaeS
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Nsvisheder/migraines.sla

SHA256 0f0480000b0ad9f649c44efe0659c6c8d729b4f88d4cdbd229d5b5f92cea19f1
MD5 0677700f062c42f9ad14c5fc8f21b66b
SHA1 34bc0196a0c3c17564be3bc54108034fe2d1b172
SHA512 f40c87dd3ee7b72607ad818c11e5cd6c75f1eec52ed295a523f835d8b1d87e3444fcf46dae9aabf5a5d25661b07666ab83fb135b33263cee49da31b61aab3895
MD5 SHA1 SHA512

NSIS installer

installer

Nsvisheder/tegnmssig.bra

SHA256 c2a8ee6ebffdf8d0e1911aca508b6217b5716fa02400f251233428ddddac76fb
MD5 55977ed7f46415522e00c3fdff5caa2d
SHA1 787a22f3acc620d50c29eb03198a4bfdb10113d5
SHA512 5028f6c7080539a4eb40f4e72fa4a34ad5b595e132b098db821498d5688532dd4b63e1e1a2a805520772843673c369f6dab23b2147b1d7496332ac0e77c682f1
SSDEEP 192:IMgd/BOjz7u6eAYyskhEBLZfKBdm9TdtrZi0sMv/UFvDFqsP32:I/d/BGu7sW1ZfKBdm9Tdp3v0/G
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Nsvisheder/tradionsbevarende.unp

SHA256 c42064ecd39bb1e45fbed3247a7e4355c2b751c50c48c355ed65c361221e26e0
MD5 b24f189fe266a3eb1133225548b37313
SHA1 334290f4bb643b6048aef858ab271dcfbc56239d
SHA512 8b9d53591fc89e1311a62a821fc765261cf7830259da55e322b255a140c8dfbd45591d20da7a262cbfa15918a3d8cf654967f96a2e52bc8e601753624bec40ed
SSDEEP 96:ajWqqlfSwTfxv442jXEcdFEykwxlyjOQcw2:aqVlfSwjxt7cdSiexcp
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Polemoniaceae11.Non

SHA256 02a71af4b95cf275ba0430022e9c2665bd1e4ddb3177202c1c3059901eefd4f0
MD5 afc1982fff88592a55312010cfc773c6
SHA1 c57e918c5149ca9c2a331a78ecef84ffc667feb7
SHA512 f4acf46244cb0115e0666a631af6dd2e7400478103cd9c152e48307a2239108e7e6bf3b39467747b3efa8b0fbdc59216ad6a26ec5587c19bb56fb4512233117e
SSDEEP 6144:Hvciu9HEUPP3zVlNI6fZqgw4sNbIPsj4wBT5OIi9eu3N95RhGeOQd6:H0isPP3zVli+Nbs9IZw3MF3N9ThGfr
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Wafery.unt

SHA256 b4636417b12c1debe224d12ca07ee9d7065005ab1844722c3c720f08629866b7
MD5 0937a5e384e630ea77bdf0d6e23653a0
SHA1 9284b7702dd9ab2f2102092dd26277b7f11cc3e0
SHA512 e7a92e9655848b1185fc5c59d8b2d4b72f624d29f1c4f1b92c38886bf89a54a129a8f9a70c677ab62fb099e814dfe03c3af3c4b3880e479c7e3fc45638f242ee
SSDEEP 192:rGdWIIKTANCxaHuSkkb4wvFtBNssUQkLF3U8yI:rG3T9xmuSfMMFtKLAI
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

barsel.pul

SHA256 48c2f9ec2bb01f539037809e6dd3ba233e990065d600e12f9bd8f94175f98f92
MD5 0b992a18939a9d444ca1a88e2ffec6a2
SHA1 b7078a01b48a395122c216f3e52c411426f8f069
SHA512 d539252ff07be01c260feb15020d539649f4800b0a72472a471b732c9385a1dd3ae354261cfbe7fa5a578c6275cf48708c83dd7a84c287d5038c42246528ae67
SSDEEP 192:EnqPs0Cjvr66x+1NcgwOUa3QwKdzmchKyqL3Lgu97+Zi1:EUiv6O4Iza3QwKd1hKyNuZIg
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

pko_trans_details_20240710_105339·pdf.exe

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/BgImage.dll

kernel32

user32

gdi32

winmm

generic

$PLUGINSDIR/UserInfo.dll

advapi32

kernel32

generic

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

Farvebaandsomskifteren.txt

Helicopter.San

Montanes176.opt

Nsvisheder/migraines.sla

Nsvisheder/tegnmssig.bra

Nsvisheder/tradionsbevarende.unp

Polemoniaceae11.Non

Wafery.unt

barsel.pul

Sharing

General

Malware Config

Signatures

File Explorer

pko_trans_details_20240710_105339·pdf.exe

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/BgImage.dll

kernel32

user32

gdi32

winmm

generic

$PLUGINSDIR/UserInfo.dll

advapi32

kernel32

generic

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

Farvebaandsomskifteren.txt

Helicopter.San

Montanes176.opt

Nsvisheder/migraines.sla

Nsvisheder/tegnmssig.bra

Nsvisheder/tradionsbevarende.unp

Polemoniaceae11.Non

Wafery.unt

barsel.pul