36c2f4c0313fac3e054c832436887b376c4d5b19312a64b4d8751add5a32ead7

resource
36c2f4c0313fac3e054c832436887b376c4d5b19312a64b4d8751add5a32ead7
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsExec.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

IMPHASH ced282d9b261d1462772017fe2f6972b
SHA256 36c2f4c0313fac3e054c832436887b376c4d5b19312a64b4d8751add5a32ead7
MD5 7374feae9dbf10a24102b2c3f9dab9be
SHA1 a095a19d9624d998bd0f4286da68196b7498607f
SHA512 e236782eadcec54ac1f9f10fcdcfd8eedbdd9404b9f82eea4e75b82505d7aeff21eb390ecd95b6880a9c2f3472d50b5ce2aa5e3bdefb602914d78755a36f5a9d
SSDEEP 6144:3qjIMMwjbAudZg8hqKHXffx2ABryLl45R2Do3xcRArpsIgii8MazvVhH:SwmbAqg8vHEABryhc2D8SAm8BvVhH
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

13074

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCreateKeyExA RegEnumKeyA RegQueryValueExA RegSetValueExA RegCloseKey RegDeleteValueA RegDeleteKeyA AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken SetFileSecurityA RegOpenKeyExA RegEnumValueA

shell32

SHGetFileInfoA SHFileOperationA SHGetPathFromIDListA ShellExecuteExA SHGetSpecialFolderLocation SHBrowseForFolderA

ole32

IIDFromString OleInitialize OleUninitialize CoCreateInstance CoTaskMemFree

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

SetClipboardData CharPrevA CallWindowProcA PeekMessageA DispatchMessageA MessageBoxIndirectA GetDlgItemTextA SetDlgItemTextA GetSystemMetrics CreatePopupMenu AppendMenuA TrackPopupMenu FillRect EmptyClipboard LoadCursorA GetMessagePos CheckDlgButton GetSysColor SetCursor GetWindowLongA SetClassLongA SetWindowPos IsWindowEnabled GetWindowRect GetSystemMenu EnableMenuItem RegisterClassA ScreenToClient EndDialog GetClassInfoA SystemParametersInfoA CreateWindowExA ExitWindowsEx DialogBoxParamA CharNextA SetTimer DestroyWindow CreateDialogParamA SetForegroundWindow SetWindowTextA PostQuitMessage SendMessageTimeoutA ShowWindow wsprintfA GetDlgItem FindWindowExA IsWindow GetDC SetWindowLongA LoadImageA InvalidateRect ReleaseDC EnableWindow BeginPaint SendMessageA DefWindowProcA DrawTextA GetClientRect EndPaint IsWindowVisible CloseClipboard OpenClipboard

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateFontIndirectA CreateBrushIndirect DeleteObject SetTextColor SelectObject

kernel32

GetExitCodeProcess WaitForSingleObject GetProcAddress GetSystemDirectoryA WideCharToMultiByte MoveFileExA ReadFile GetTempFileNameA WriteFile RemoveDirectoryA CreateProcessA CreateFileA GetLastError CreateThread CreateDirectoryA GlobalUnlock GetDiskFreeSpaceA GlobalLock SetErrorMode GetVersion lstrcpynA GetCommandLineA GetTempPathA lstrlenA SetEnvironmentVariableA ExitProcess GetWindowsDirectoryA GetCurrentProcess GetModuleFileNameA CopyFileA GetTickCount Sleep GetFileSize GetFileAttributesA SetCurrentDirectoryA SetFileAttributesA GetFullPathNameA GetShortPathNameA MoveFileA CompareFileTime SetFileTime SearchPathA lstrcmpiA lstrcmpA CloseHandle GlobalFree GlobalAlloc ExpandEnvironmentStringsA LoadLibraryExA FreeLibrary lstrcpyA lstrcatA FindClose MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA SetFilePointer GetModuleHandleA FindNextFileA FindFirstFileA DeleteFileA MulDiv

$PLUGINSDIR/System.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 269d232712c86983336badb40b9e55e80052d8389ed095ebf9214964d43b6bb1
MD5 34442e1e0c2870341df55e1b7b3cccdc
SHA1 99b2fa21aead4b6ccd8ff2f6d3d3453a51d9c70c
SHA512 4a8c57fb12997438b488b862f3fc9dc0f236e07bb47b2bce6053dcb03ac7ad171842f02ac749f02dda4719c681d186330524cd2953d33cb50854844e74b33d51
SSDEEP 192:jPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4I:u7VpNo8gmOyRsVc4
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10529

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsExec.dll

IMPHASH e269b6260a93a17ceff5184b3982ded8
SHA256 3aa8e0abadefea2de58281198acfe48713a1d5b43aea5619f563cea098e9fd34
MD5 ac0f93b2dec82e9579bff14c8572a6c8
SHA1 6460244317cbb77e342adb3561ec3acb496c84d5
SHA512 8055a6af150c45547927499f9cbf645d7f39c8e4f9caff4726fd711d2401abca01a79837095e5752b9f57b06446973ea6506796f2223bdb0179243d6e0575bd2
SSDEEP 96:5OBtEB2flLkatAthPZJoi9jpfW/er6cBbcB/NFyVOHd0+u3wEX:5hB2flXAVJtjf6cBbcB/N8Ved0PJ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4231

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Noncombustible/Israelskes.The

SHA256 aa92b1e597dc9a7811d1d56dc107d8962d8ec391b60ceed949c614b6c9146a3c
MD5 d106d28fd2a483ead54dbfc67294e9c6
SHA1 3d1b88af5c76e614e3423cd7386304c601f84760
SHA512 b7dda5887750d067d746825a0f56cd276b436e364da6fae0f5606c80c2d107eadec81912bde975ade0177ef9a9acc524cb3ad17c588ef84b585d986cd28155fc
SSDEEP 6144:yJY/fRnP+0ggQXDI3rcuBHdquFe+lv9o3:HxGt/owuBblvi
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Noncombustible/Reflektanter.Hor

SHA256 077ab271d326238b1c7324338b65a70b345fa507146af8829aba7dba0321f798
MD5 2477e9abf0b4dd97712d7e53a87f85fa
SHA1 9e3d329e03e0a577ffabae8a41d726a15a3840fd
SHA512 487223a4edc13d699655e986f1a68765ad56e8be055304a5fa4c32ba83b5fdccc3d2ec90582185111d2ae8a7f29b8b25572f2e3abce9bec204356988e1a0e036
SSDEEP 768:QgZg7AVWTSZYcJ+WectsP1f4XPJAvgU0paksedOuZjoZe1TEvDJEE3fRuyEkOJ9/:GG3tsP1fqJmcakGuj12wpKIIoncFBk
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Noncombustible/fyrskibene.txt

SHA256 3af6ea4b90aefa21a5b461c4ea6af66beff78773822fe9e6f91c08a349e0d2bc
MD5 993b2e77e7ba51267d85088066e7760b
SHA1 dd7fea4a8c77febc659a13bb46613d7f71f16f49
SHA512 05330795a5c6de146665726c9fb9ebb145b1c7f816a48d0c36bbafacfc8a0a0f783256db8e4603753a78159e30c051df7536c8f4206537ee4536af6cdd6a3c77
MD5 SHA1 SHA512

NSIS installer

installer

Noncombustible/imaginableness.bal

SHA256 0fc38f9bad25d57d780f2841d27d4c1dae6d6e4dd30ab77366ce45cc140ec1b5
MD5 3160b76b7738820c0127bbe5b1cf5c0c
SHA1 8ff913f6f575cc3b9e7b2c43ce599307c71206e7
SHA512 5cb50bf17d345dfd9e7c294de242174f5abb5e34e14738bb47dca8ca402211177036b7583f7732be51fa6459df28a9456ea96f24b2813ed3df7550157801925b
SSDEEP 192:gvkhByynl4dzuj3r6YLlC6JsQK14/hCtnF9Ae6Z6oTYfBQ7U:HnlrDrBLJg4pCxA56/5Q7U
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

interterm.und

SHA256 0ef9a9e6eecd909d7bcbcd2d97b3f495dc908d2effed23b06459c61e604eebbc
MD5 a609247835f538d0b59f45786aeaeadd
SHA1 55db788480661995dff1688bdfdeb40e22353d63
SHA512 ade0b979932ca053e89840210a1cae93c7e38fdfcb6a0da65b337b0dd9126763c1da4fc94753a7470435f241bb6c8ef546a71c5d30c862020afcf2f1934d1ecb
SSDEEP 192:ConwRhJm+QsYOQRV6o9zcxywgkzJMKXaBwWm8/mynnBll+:CDRhA6oA4PqWwX83Bll+
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

ministersekretrers.rum

SHA256 7e56e83aca9b0b578c2d7b37da72545e4983a10fc75a098097873cc1781b13b3
MD5 b566b84eb1bfd5df6dd19a874a45929f
SHA1 c0eb3c6b6cc4fcf293a8875ffaca3325f584a378
SHA512 1dd5c7e281b9f711007b6ad3332d83d0de391791e684f75fa4c3a7ff52ab61b220db485260b4ab9a743963d5ca2eb31731f077e850215d8965064151afddd028
SSDEEP 96:lMp5QRoXqpNY+7WPFzWHRZBp3oDPZ7STEI1DspWz:K5QRQuZwFmRKcTEIRMo
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

reliberate.phy

SHA256 fa3482af5a8f7cfed68939d13472a1c993424878978bbdab244c406e83811fa7
MD5 e015f55176a22c70e7a9d0e75fb4fc94
SHA1 36ef3af140f89d1e11088c49397afce906a889ca
SHA512 9a8a96d23b26094e0dce51cc16be07ffaf364b3bb6a0949e8c9aa7aab557c90273aa91cc524840783ccec6ac58126957de1e51d3adfad9ebb5e7246e97ea2b19
MD5 SHA1 SHA512

NSIS installer

installer

trammer.sku

SHA256 2b725fd67bfdc025aa38cf6f2c0518632583aebbb9d4e6d9ed2e135bd3c68f23
MD5 c51bfa36fc9cd1de708a2934f2332023
SHA1 ddd32e68b3c351bdf8d3eea3e7a11f80784c7068
SHA512 025c798bc548fc798de0a9ced965aa23154ae3a296732cd9120f7cdbf4cd030f9c76ca50873d8ee360d6f2d4be937ae673cf454c8104ef72b8c2195a5fb5612c
MD5 SHA1 SHA512

NSIS installer

installer