MalwareBazaar[.]1 | Triage™

resource
MalwareBazaar.1

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

MalwareBazaar.1

IMPHASH e160ef8e55bb9d162da4e266afd9eef3
SHA256 c293bf33914dcab819681869283b39b23b45fb608d42fa3a26562d301eab3746
MD5 a2a727c5efacf8ab6028c4524e21bef9
SHA1 d3ea7079959667ad786a7142371f536feb537802
SHA512 822accf498440732a5df498558d33e9191a62b5b6386dbaec0784abb27c93865cb0dae15a43c99515f1c5cbb217151a80659b915a5b3c07a550a6d2b02bc8c20
SSDEEP 12288:tLfCKKKKKI1KFeGkSrsUQ1nILHMEDm73l8a5+JS2rLaOvjKFDSLJPo7yF1mAm:tBEkQ1nILzClFiS2iYeNSZo26Am
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12489

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetTickCount GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA SearchPathA GetShortPathNameA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess SetEnvironmentVariableA GetWindowsDirectoryA GetTempPathA Sleep CloseHandle LoadLibraryA lstrlenA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA ReadFile lstrcpyA lstrcatA GetSystemDirectoryA GetVersion GetProcAddress GlobalAlloc CompareFileTime SetFileTime ExpandEnvironmentStringsA lstrcmpiA lstrcmpA WaitForSingleObject GlobalFree GetExitCodeProcess GetModuleHandleA SetErrorMode GetCommandLineA LoadLibraryExA FindFirstFileA FindNextFileA DeleteFileA SetFilePointer WriteFile FindClose WritePrivateProfileStringA MultiByteToWideChar MulDiv GetPrivateProfileStringA FreeLibrary

user32

CreateWindowExA EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard GetDC SystemParametersInfoA RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx DestroyWindow CreateDialogParamA SetTimer GetDlgItem wsprintfA SetForegroundWindow ShowWindow IsWindow LoadImageA SetWindowLongA SetClipboardData EmptyClipboard OpenClipboard EndPaint PostQuitMessage FindWindowExA SendMessageTimeoutA SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA

advapi32

RegCloseKey RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegEnumValueA RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

CoCreateInstance CoTaskMemFree OleInitialize OleUninitialize

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

Konnekterer/recidiveres.nat

SHA256 e4ea9b5e592cd96747ccb6d22398b9cc63e379b768bffb77e0a329584767d92b
MD5 1512e39843f4345e1ebdb77f8539c933
SHA1 228f422930df9fe35a6b1e703fc2457d2ec5ef62
SHA512 4895a8ae79d9b109d2e4cb141f0eaef77c3a809e575c6e4d3956cc1f220d39190e7ffb1d301d6fc91f3e9346488f30c871e0da62edecb8a77fb4bdb20d985344
SSDEEP 192:2KyXiAMnbOhGWZuxdKK4CMriW5KkX9UZDg:2tPAb+/uxdx4CMkkuZDg
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Papize.Qua252

SHA256 c95beac74c2688e9e19c57844380af7377b33df25a7d7d68c2d1c7d8680b64f5
MD5 8cf5764661567cca0bdd3c87ca6aa89a
SHA1 76aae2dc6f7a27de01841890370c787f4759c2e2
SHA512 5a0097e9a61abdb577d15240d1297f9e49702d6e6bc08493054cca9cb33d75f9ac9eb540c917b407628164fd629d6bd1de147303f22be4bda4f14ff1763f1ed9
SSDEEP 6144:mw9vlVzAmoQs49+b4DT5csDvvwSTfQM1uQthrrtdtK0hywIrF:mUVd9+b4f6sLwS08frrtdIOTG
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

bevidstheder.txt

SHA256 d61a9532c5d556346aec957bb81be6db43fcca6fde8b17e7095304c833470c35
MD5 fdfb71e998bcb08a62d4e8deccc7ea69
SHA1 96c0122f7a2f2970d15ad93f68d1f5705cd76b80
SHA512 c65e2f1f35c8daeed5e163d4e5499430274cbaa7d13fd27e911e7a60e74087d43c57dcd94a2501786706ccfde756abf121be8742d184dcc9656704a8c186ac37
MD5 SHA1 SHA512

NSIS installer

installer

decimaltabuleringen.ski

SHA256 1962c2f21d22a8490c922d045a392f594b082a36039bdd45c8cb853a2801774d
MD5 4bd5bf6930260c45583c17bc7410ece7
SHA1 d3749bca335b915efefd86627cc9e7a2a40278be
SHA512 8bbad7dd5e3a2939ea7151f75ce99d439409cddec36482161538e8f7f78bd478950abc34af6507bcbd2fb7da83ed1c132d82bdc6da4be46374a944e9e5c3aa1f
SSDEEP 192:sPctAeWpnhz4AZzk9ZXI49la8h6lZAmO0DSdJCeiw1h9SE0W4:UdI0zkjl2fAmVOd9hB01
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

gamebag.bor

SHA256 0ea871c1cbd1c0acc33c8e09db477eca48e01a281112da08f705b1b02dfc6050
MD5 e378ad212b0727caaa09d1597273f9f1
SHA1 f7ab0f4026e96db2d021a209b9b3a963baba163c
SHA512 395c52290e319b83231e9faaac637746b4349d7ca6d6ec556a09a8f4c1146bf7ef265a5fb8fce8c1e157bfef5eeb1a332f60a238c97cc7925f36f459bbdbc338
SSDEEP 96:rrggwS6sNoQAwxZUqiOppr0ZNbRkBEbl0qSlreFsFLu3gzqKmFtwhsUPH:rn3NHAw/nBYZNbRkibi72sFLuwzqKmFK
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

konfektionsfabriks.imp

SHA256 27c10f718f60fb07d5438bc4d6255c1f651d2bb481e216015cdd36bab2425316
MD5 a094713448270a809b901f4b27ff5366
SHA1 7b3eb5e4f3475147dd40b8b637b1cfee902f3373
SHA512 38539d70598ac0ff07a23e4b6a2bbf689bc0ba70fc910bf85f8ce72fa6b0c5dc68b89514524ae0611a58c2122e3aee98df876be17a6cbc73468da33d21b600ee
SSDEEP 96:aM7ya+Y+D//GIriZJQLytEih4xiiOXLvPnKJUWzWYKWon:V+Y+D/+ImZJRtEDArfsUWzwDn
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

origines.kej

SHA256 75e1d8697e8a61f1172e8afda54135d82bdb70925a84c2509c775f2124eba6f3
MD5 4d889f764572f140a4ca38702902ae9c
SHA1 e2655b09e49134034e162d3d46d8facd6f507563
SHA512 f7d5ffc4ac5caedee3df9bfef0dc2677cedbe838c10d7fc41ae18078762d623a9547afdf0d69ea0b6709d967d6bec1e8704a5b9f71a64161510a82e92dda400f
SSDEEP 192:hUOmeuPtp4AtHV1S5pvqv96Id+yAPLga5HgDomDMHFhzLNI75:yeap4ARwv296nyAEQUo2GLy5
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

zygomata.Coo

SHA256 e910d5f3afd1733a1824afc9a9dbb1c78529a2a5c63e24601038aa81241e9b7a
MD5 e3a338313194482f28d8e74771889d09
SHA1 97ee237e38a3ef18a938334dec3a5aff1bffbcab
SHA512 301b208278db99007e10e9827d304fce475844239213e09f98054dd43e72891b84b6816b6bc58c1439df8ef7d74f9f8ef8ee1925736637c064e4481dc6baea6c
SSDEEP 1536:dFBT1S+vYiA7BXTlBATaD5lO2XgFIFk0xToSdM35zzX:LXXA7BBB065lO24Ia0bG35v
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Sharing

General

Malware Config

Signatures

File Explorer