Revised PI_2024[.]exe

resource
Revised PI_2024.exe
unpack001/$PLUGINSDIR/AdvSplash.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

Revised PI_2024.exe

IMPHASH e160ef8e55bb9d162da4e266afd9eef3
SHA256 75128be2810392ee9cb9f4d4c847332bd943a321179bb3bc13395bf546caa2fe
MD5 8b7c477a89b7c69d52da4cc6c9656ac1
SHA1 db48a055cb6b0a92aa87d77e96c0c31c68f63cec
SHA512 afd596813e8038c724af6d9effc8261073d183c4d66293f5f706685f61bd30a38e2a52212db0a972f95611ecfd39b32ccfbb1f9f692743e3d14358b44860e1c6
SSDEEP 12288:QC3wdew5NKr6XvisqmSC5OPmnnorWhynci3lCkRe0991X:QAmewTW6fisBSCOOnKWhl03Q0V
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12491

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetTickCount GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA SearchPathA GetShortPathNameA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess SetEnvironmentVariableA GetWindowsDirectoryA GetTempPathA Sleep CloseHandle LoadLibraryA lstrlenA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA ReadFile lstrcpyA lstrcatA GetSystemDirectoryA GetVersion GetProcAddress GlobalAlloc CompareFileTime SetFileTime ExpandEnvironmentStringsA lstrcmpiA lstrcmpA WaitForSingleObject GlobalFree GetExitCodeProcess GetModuleHandleA SetErrorMode GetCommandLineA LoadLibraryExA FindFirstFileA FindNextFileA DeleteFileA SetFilePointer WriteFile FindClose WritePrivateProfileStringA MultiByteToWideChar MulDiv GetPrivateProfileStringA FreeLibrary

user32

CreateWindowExA EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard GetDC SystemParametersInfoA RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx DestroyWindow CreateDialogParamA SetTimer GetDlgItem wsprintfA SetForegroundWindow ShowWindow IsWindow LoadImageA SetWindowLongA SetClipboardData EmptyClipboard OpenClipboard EndPaint PostQuitMessage FindWindowExA SendMessageTimeoutA SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA

advapi32

RegCloseKey RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegEnumValueA RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

CoCreateInstance CoTaskMemFree OleInitialize OleUninitialize

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/AdvSplash.dll

IMPHASH 2e8d5524d09b794f343fa9e2df0a1d87
SHA256 5e71559df5cbcc4d98ebd9d4ddffabe18b047f9a50d98a96e46a4c0ac589105c
MD5 7a514e97fb29eccff3c7ab5147f4de9a
SHA1 e573f6e51d26d5601c68b7370fa94a030e561a9f
SHA512 f320dd5b60c5f1a6cba69b399d32151ca13c2b10f873f0c3cc05c3f1707ca80b396c5fc71175269117e0a6c13e56c51b89ea1dee47879fcc62d29f6ea8087604
SSDEEP 96:0NcIcmLEjNev3O2obNnNlXUjDftqlqCstWpgwoS:xIpLSG3O9XX+qlqntWpg
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4448

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 484f8e9f194ed9016274ef3672b2c52ed5f574fb71d3884edf3c222b758a75a2
MD5 960a5c48e25cf2bca332e74e11d825c9
SHA1 da35c6816ace5daf4c6c1d57b93b09a82ecdc876
SHA512 cc450179e2d0d56aee2ccf8163d3882978c4e9c1aa3d3a95875fe9ba9831e07ddfd377111dc67f801fa53b6f468a418f086f1de7c71e0a5b634e1ae2a67cd3da
SSDEEP 192:jVL7iZJX76BiqsO7+UZEw+RlthVEoC0O3XB:g7ssOpZs/hS3X
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10027

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsDialogs.dll

IMPHASH 38e7b5c3ee58b43a91f9679e94aabd09
SHA256 495bddc0be6e18e981db82fab9d1de55c7e269ab4ec3ff43035193bc017a307b
MD5 8ced0b79f7b9033d0795aab3be6d627c
SHA1 90c2043ffccd068f407c624c50ac7b795db1e132
SHA512 e38f63a342729f5ff6d0db607d7877b65c33ed19e2b5a97dd868ece8c2a3e829d4153624943444be2f0de885496161d54c1da9594bdc0a5a0bcc8b727e2facb0
SSDEEP 96:3Rp41CMj95rKhkfL5RkEdKkcxM2DjDf3GEEE9v5E9av+Yx4indY7ndS27gA:3RujesS4HREEK5MYxDdqn420
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

7410

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Antiforeignism.Kon

SHA256 e1e5b3c96a061f87ec7df004df33040072b59c1edf7f30d61668a1ae9719abb1
MD5 a4a4a12371071df1c71d04b9c29e03dc
SHA1 f37f8b93ab21af1dc946c9b700333414b4df73b6
SHA512 4114d33590c7013b1dcdc381c46c8d5b3e4a5a1855426f15e965e4dd6b6723b453e9b7278d37add2fc7cd44132fed475a9729988f94be31a28c72a445f8106cd
SSDEEP 6144:LeRUmaXKDCpEKEfX1g4V/yR9L2luHsJ9sjEnbS:LeR8XNE/hxyR9L2sHscf
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Forker135.txt

SHA256 295df39032f49e7ce7c47b4e4c0a6e2d5b7cd8bb3adb9f47f8b5c24324a62983
MD5 e0fa5d623b0f74b3372f72a6c16a3040
SHA1 63a23a9a11081d70040bda8bfc4609d0ce50f709
SHA512 2b35a41302b74d75ba764f90d42af379bad4d2bb1d4d61da39dd6dd06553ea2f7289dc07c102b7271bcc211eabf92a0f7b2f37d735dc041d47dc29afaa90eb99
MD5 SHA1 SHA512

NSIS installer

installer

Locutor28.cit

SHA256 fb786392baa21a6733340b30344a37718341e76d274d8267d2d0fac07f1cea64
MD5 3b11e6d5d5da9539e19142ed45fb7b4a
SHA1 822125496e96046a419ada97d4c67ce004035aba
SHA512 5c3fd97d9b5b3a6a2e410428094ec85d46d7032f0fe78869f2cec3135bdcec9688f38b8e42e7ff270f4a0f4ca91ef12a02279ef3a04e75fb30dd5811aef59819
MD5 SHA1 SHA512

NSIS installer

installer

Lrerkollegiet/Pussyfoots80.slu

SHA256 d53c671f46c589bd88ffa0db66c2dfa53f975f6dd983708c981c94352db4b7ff
MD5 2e014a447f0db015bf55d8dcfd780aa6
SHA1 7dc9b07bdf85fcaeb5ded5e3c531c7c931d71dfd
SHA512 9bcf3830e862e43949069130a5e394dd93904da5e9a024563191d5586e4ac132dfd584c763fc80e5f4a610da690bbdd495706a1704251dcf86c09e0ec2020b21
SSDEEP 96:AKj3bNex89dJb1I4isCWQPOri0W95Rh2psTgZ1G6Z7TTFhMshA5yZZUDecVtoN5:A8bM89vy1fPOmB95R+GmB7HFhvA5yDz3
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Lrerkollegiet/Udgrundet.red

SHA256 6f0e8f35ea03a6e58df06371e0578be68743e60ba55ad41b310a8caade15ae35
MD5 edc0cf304b67c7d5b6290bdb7fbcb332
SHA1 05c408b6f504d94bfb0caca5e197bf326a6cca65
SHA512 7c7d2bb9addd6726522513abc147868a213240b8ae97798756c86678ab09740994b3b0db09e9053a235680703b8f6d716717f71be123a65dc58e59f3d1d42129
SSDEEP 96:bYAnT9tP8AaftmtyG4HGP5BfpwsZJWD9GQKolCGcwpBa2KQHvH8y:bYABt0RsAmBBysZgDBK78soHf8y
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Lrerkollegiet/canvassed.gig

SHA256 b6673aca4870902aabe978592c8b7c63283d7db98f3c8cd713a9cc3f537238e2
MD5 3eac5ed8d3dcb5f7e22d26e67a485cc7
SHA1 861bbb82dbee93ee53ddc1192b27b628de149a44
SHA512 e77ea3d9bcd37934647c64647e50ff220813b3a682b4f6e9ed57946bcda66dbdeff40b714449e8f281a7fe778cbdc3fc34f958c28426351c5ecd0c3ecc1c19ad
SSDEEP 96:g6D744S/ipBwuf8uOVmEIkjVUgtL471nWI2OcSjSyQ9KthDLXFxIBW/yqf:L7BSoBrmYLYVUgtEgESKt5Tk8Kqf
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Lrerkollegiet/fulgtes.and

SHA256 ce1f75953ef722f2c16021cc0ae9e45f8382107f479c9c5392a9adbd5ac0678d
MD5 94c99ab740dffde35d317caa54622476
SHA1 f950e58888657d80cb1a92fa89ff67c4a5f0c189
SHA512 ede78b41d728a41d31883a5f831a871e48b153f61f5d85984c465585ebf6d33a6a2ac18317badfcff2f1ceec13d0c92f18727b0bbdb528c1687b0d55c17c5a8c
SSDEEP 192:R4E1r9hhmHwuYb2nPGOJaymT5zAvdEVl/5:f1r9hhmHtOUPGOJUKdi5
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Skrike.Ret

SHA256 74966ace7dc1c0b0f72cc23b5a89c3dea72e950822b9b5e88b44ee3289f6c7ca
MD5 57c75a78e88547b36811740f468bda97
SHA1 4d6e4c0b4f173ef8dfd3f9b8df3f45908b6172b6
SHA512 0787b1da1d2f7d9a57af1cd14201a342e44805ee2471aadb504df85eebb21d23d326acd6331e32aebc6aa489e35c5b43b217a19731daf555d001f80778ebe764
SSDEEP 1536:8+JR1p4Y1XIr8NVdmcf1clq2G5xsRRIRSFhz4:pL1XT/3UKeY
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Revised PI_2024.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/AdvSplash.dll

kernel32

user32

gdi32

winmm

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

Antiforeignism.Kon

Forker135.txt

Locutor28.cit

Lrerkollegiet/Pussyfoots80.slu

Lrerkollegiet/Udgrundet.red

Lrerkollegiet/canvassed.gig

Lrerkollegiet/fulgtes.and

Skrike.Ret

Sharing

General

Malware Config

Signatures

File Explorer

Revised PI_2024.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/AdvSplash.dll

kernel32

user32

gdi32

winmm

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

Antiforeignism.Kon

Forker135.txt

Locutor28.cit

Lrerkollegiet/Pussyfoots80.slu

Lrerkollegiet/Udgrundet.red

Lrerkollegiet/canvassed.gig

Lrerkollegiet/fulgtes.and

Skrike.Ret