Purchase Order2883[.]exe

resource
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsExec.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

Purchase Order2883.exe

IMPHASH dd68e663380c71f66b512f005f1be7ec
SHA256 a7ce140d12ae3b2180a2f170bd9cf812034046b5b4da2bc0725240445264a404
MD5 17eb8202cd25ebfb49eb1347ddbbe1d1
SHA1 cc59c2f0d3b4ad9cebdca36ede5182f6746cff87
SHA512 6338f1da11bc3e33a864aca2b349401cf190f5bca8a7b18a21ad1f3ab40f110ba9f32474a7e0d0a4813a5911b974c70d107d8f3acebcbf0759a21f32b486ebda
SSDEEP 12288:I1xZkxtCt777js4n4OdpvhVlp/+sH2WDAqQnm:I1xmCtLbBvpRH2WkqQm
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

85:fd:5b:fb:08:d3:73:51:fd:07:4a:10:cd:f6:d4:8c:95:50:40:70:ef:05:dc:8c:4b:7b:78:06:bd:2b:f2:7c

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Ancher,OU=Crack Jonses\ ,O=Ancher,L=Glaine-Montaigut,ST=Auvergne-Rhône-Alpes,C=FR,1.2.840.113549.1.9.1=#0c1144657276697368404f756c61702e5a6573

Chains

Aug 22, 2024

PE Signature issue

Digest

e4:f2:1c:ce:29:0f:b6:39:a6:53:d3:0e:15:01:6e:b5:11:d3:66:4b

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Ancher,OU=Crack Jonses\ ,O=Ancher,L=Glaine-Montaigut,ST=Auvergne-Rhône-Alpes,C=FR,1.2.840.113549.1.9.1=#0c1144657276697368404f756c61702e5a6573

Chains

Aug 22, 2024

Minor OS version

1

Major OS version

5

Entry point

13518

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCloseKey RegDeleteKeyA RegDeleteValueA RegEnumKeyA RegEnumValueA RegQueryValueExA RegSetValueExA OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueA RegCreateKeyExA RegOpenKeyExA

shell32

SHBrowseForFolderA SHFileOperationA SHGetPathFromIDListA SHGetFileInfoA ShellExecuteExA

ole32

OleUninitialize IIDFromString OleInitialize CoTaskMemFree CoCreateInstance

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

DispatchMessageA SystemParametersInfoA LoadCursorA SetClassLongA GetSysColor ScreenToClient SetCursor GetWindowRect TrackPopupMenu AppendMenuA EnableMenuItem CreatePopupMenu GetSystemMenu GetSystemMetrics IsWindowEnabled EmptyClipboard SetClipboardData CloseClipboard OpenClipboard CheckDlgButton EndDialog DialogBoxParamA IsWindowVisible SetWindowPos CreateWindowExA GetClassInfoA RegisterClassA PeekMessageA GetMessagePos CharNextA ExitWindowsEx SetWindowTextA SetTimer CreateDialogParamA DestroyWindow LoadImageA FindWindowExA SetWindowLongA InvalidateRect ReleaseDC GetDC SetForegroundWindow EnableWindow GetDlgItem ShowWindow IsWindow PostQuitMessage SendMessageTimeoutA SendMessageA wsprintfA FillRect GetClientRect EndPaint BeginPaint DrawTextA DefWindowProcA SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CallWindowProcA CharPrevA GetWindowLongA

gdi32

GetDeviceCaps SetBkColor CreateBrushIndirect SetTextColor SetBkMode SelectObject DeleteObject CreateFontIndirectA

kernel32

GetTempFileNameA GetLastError WaitForSingleObject RemoveDirectoryA ReadFile CreateFileA CreateDirectoryA lstrcpynA GlobalLock GlobalUnlock CreateThread GetDiskFreeSpaceA CopyFileA lstrlenA GetVersionExA GetWindowsDirectoryA ExitProcess GetCurrentProcess GetExitCodeProcess GetTempPathA SetEnvironmentVariableA GetCommandLineA GetModuleFileNameA GetTickCount GetFileSize MultiByteToWideChar MoveFileA WritePrivateProfileStringA GetPrivateProfileStringA lstrcmpiA lstrcmpA MulDiv GetShortPathNameA GlobalFree GlobalAlloc LoadLibraryExA GetModuleHandleA FreeLibrary Sleep CloseHandle SetFileTime SetFilePointer SetFileAttributesA GetFullPathNameA GetFileAttributesA FindNextFileA FindFirstFileA FindClose DeleteFileA CompareFileTime SearchPathA SetCurrentDirectoryA ExpandEnvironmentStringsA WriteFile CreateProcessA WideCharToMultiByte GetSystemDirectoryA GetProcAddress lstrcpyA lstrcatA MoveFileExA SetErrorMode

$PLUGINSDIR/System.dll

IMPHASH 595a3fd71239f605bb02d7a5e48fd4df
SHA256 90f3cebb5b3759eb1bd72cee7cd8b694440ee398fe970b763db7a7b67208e4c8
MD5 8508fa0ab17e36e071687243283c2aef
SHA1 d45391d0454fbb9eb66fa72ecf0e2cadf0522bfe
SHA512 241cf26e57006402897d8adaff37f3006c1bdbb09d6c5d10c32d556996df5785dc81c35ccbbc74384f80853a3e4aea7be251a4fa2613be42108e11a00692df5a
SSDEEP 192:S9rQDenC9VrcK7REgSWOprANupQYLRszDDH/d9CWlXo7U6Wxf:SJQEaVAK7R9SfpjpQYLRszfH/d9CWB1j
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

6

Entry point

6599

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsExec.dll

IMPHASH 0d6ae1f1ecbace583969d8eb8b21d1b8
SHA256 608364aa628004d02d786e961b6fe3d04addeee7892d393871f71241cdf3137f
MD5 3032c25dd603e66c040dce56f73de8d3
SHA1 9393ba163219bf0913c1b6b13a42bad7ad69916c
SHA512 08533c8b43f90210b47922ddfb7533e19ff1d85796705b2ff707e92315ae81cfc4b95428f1c26d34e742a57e183781bc12efafd2a50a97c02f14b3fd29fff851
SSDEEP 96:rt4Vl/7Lo1UBrob9ljNEUgD7cyuM1x9XkraK2A2KAB5VVDyssKZ:rt4Vlw1Iul5J8T1vK20I5VVGsb
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

6

Entry point

4339

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Athogen.Fle

SHA256 9eb2b8a8e0c1d591a556236c4736fbb471ad64a4d5a8db79eed6b695a9106de3
MD5 a2ad5e1468da871f867a625db1e36d87
SHA1 8f778c968a7b92cef61c276def64b93e07e61abe
SHA512 434d90ac75c95dd58cc7ec07cb3bda6ffe618d93fb3fdd8abf1b44e01013e33341e9ac8078d3e9b0913d3c70dc057ddc48d73453055aff7bb625d031471181cd
SSDEEP 1536:1EbTEwehFKVA7WP6/CeCZPecIbtp69KrrFAp:WxcFt4
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Besgstidernes.txt

SHA256 6957afaad41fe8f8e5acb4a066b50b74f4d24437888581cfee5a1eb38ef6d1c4
MD5 f7ae2959feb947c6a03aa1d38f8753f2
SHA1 b95507d626fca3aa1130585081751d21c43c92f5
SHA512 c3978bd5b77e47eb54e2edcc0ea64a9e2412f40618e5e57cb6d792f0f484bf3f28a3f40da67847b855061205b980ec0469f5f4414e7653028a5f0d07a4ec42ca
MD5 SHA1 SHA512

NSIS installer

installer

Demidolmen.Cro

SHA256 c1381389d35214a424aee0f5b690dbaa9897206b18d67f6b24a1cdbe8350fc4d
MD5 6883a1757d6e6251e9c1bf0df5132f16
SHA1 b1121ff710f4b926176979e8319393337c367660
SHA512 0b39eefdb906a216bfdcec6536f1b04529be66615afcc26788d525072faf007f4f716616114095b4ea128b259a7508553bf3723bfba3d537ed3616c7657c43f5
SSDEEP 3072:G12M0ZwFEQ7S5Ypdgzr5vzep0aQFy1uBpFxbeRNtIuU06r5SB5TkhVYMudUq:G12M0e1u5Hn5beulSmTbeRNtcjGTkPP2
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Frituregrydernes/kipskins.red

SHA256 d41782c02a2fb667889deb276cad2f6903df9d2f3f657fa54a446b3309ecf500
MD5 93f19b4afb65314e6c049f4ec213bd44
SHA1 a16c9fad377f1c9f324c69016be9f20f1f5e74d1
SHA512 76e2f5685c5e0b6afc2d38a0d13c7a5c32c9fde0702b05233188e0aeb75a8c9f68055fab7b5cd81d43494b855569fe4d0243b5f30b06cf976ab709ec53395d6e
SSDEEP 768:Zf4aPdTX79h3RdP32j1m+IEbU7HlpDJaV6GLbeTkFT8ySfamXVkrgONI+ppGCC9N:rmL
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Frituregrydernes/mustulent.vin

SHA256 8e01da4ffa3f70214afbbb4733471fe1d7eefd30c73e651a428fb5d5716a0e5c
MD5 5f6f44e0b8fa018f7ae741f2bd79c69c
SHA1 f57b662a2d4e4424c94d568def382ecd9c810832
SHA512 9f1417ff9fa6b346f2ed4834f132c062288f53c066f5bba631dfebc1c60a3be7c97e5cf3ca1023eb147620762ae2f906630f46e184e77916208c7ae78667d7e1
SSDEEP 768:hRRXcIvD1J6Ro9eW7JrTXhPJAZDKpjqDZm9XSQa8su5o886je57m+ajoVBheRwbp:HCZEq
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Opdateringsprogrammernes.pre

SHA256 aab1883039ea2c392135dac06b7ef91ccc1c2de76da324713991a1efb115c869
MD5 c0b47a46042b6cc63460a12cd02cac41
SHA1 ee8028814f7b0e89f71b40ed74a2dff280be6a47
SHA512 c6aef4f0e2e4da9854152851232a92f731a0e5fabb6e1aeb5230035dad97efe9117eb7da1dc55a5b7cd440d62e5305ad8de5dea4987153472ec3c086e5533b5c
SSDEEP 768:FhsJf8bIeyyHoqQAJbV5UqFGoGew9M6vr5x:Y
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

gynic.bel

SHA256 2b0ef2111a87d562fb43768eddc596d35fa81558bc775dafc6cc13a29214b626
MD5 1349ac9e0f72d66d88aa256282dfca34
SHA1 62c013fe9b4a932074e3347747c14a7e80dc5590
SHA512 a4bfb97151b72e92b78dd374eb75bdce1704858c5efe2a1a92c38ae43194907499e4a1304c1ea3a74ca28bd93cc53f57ca88330d2806129a01b1cbf09b4c7f1a
SSDEEP 768:o125htElGBfvWh7vT/PRPNJ8p5P33MybKK02VsdFFWHl84LVvxNnCJZXC7RB7M+a:5K
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

ineligible.boy

SHA256 4554b82c5ec4820060ec0c7506e3e7a145e18244556ad19ebb0299c1ca16d984
MD5 ee89012340afe426bfe5216b4a1258ca
SHA1 ba5b562ea4c5d1a8205350cf837e491592fbb72d
SHA512 850aabc2d325d21512e5b4500df453a7f4972f469674180716c533befe23bc5df705bdfed2f2675e50f8f95c543ff05cb4b6237004cc610dc3534a62d00529f7
SSDEEP 768:gQCi0RNWxKDy3PWzVerAJJ88518u719ULs8I2fBwFh0LlvE1NVNk2tuZIodYZU/X:0X65
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Purchase Order2883.exe

PE Signature issue

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/nsExec.dll

advapi32

user32

kernel32

generic

Athogen.Fle

Besgstidernes.txt

Demidolmen.Cro

Frituregrydernes/kipskins.red

Frituregrydernes/mustulent.vin

Opdateringsprogrammernes.pre

gynic.bel

ineligible.boy

Sharing

General

Malware Config

Signatures

File Explorer

Purchase Order2883.exe

PE Signature issue

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/nsExec.dll

advapi32

user32

kernel32

generic

Athogen.Fle

Besgstidernes.txt

Demidolmen.Cro

Frituregrydernes/kipskins.red

Frituregrydernes/mustulent.vin

Opdateringsprogrammernes.pre

gynic.bel

ineligible.boy