IMG_0000053Legal_warning_Invoices[.]exe

resource
unpack001/$PLUGINSDIR/LangDLL.dll
unpack001/$PLUGINSDIR/System.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

IMG_0000053Legal_warning_Invoices.exe

IMPHASH dd68e663380c71f66b512f005f1be7ec
SHA256 7fb76cbc560551518f1ed1c77b4e930b6faff77f63815f0090712eb644d87fe0
MD5 70836ea62c86701beea228207ebbe690
SHA1 16aa45a1149f7ac44bfacf029d338a67e26501ff
SHA512 d7fefb5729b6ebcf66fd4339232d43bb7d430255e3bd73cfc0af5edd2030d7744d3ecd51ddc94710ebc18e29bbf30e0af79281d07ca7ee8e1bfb614cd11d1f28
SSDEEP 12288:9I0Ygl+4LU7HJx5q7vMw/hCIToWURuDnEF9jyY2eAuVLZEqhaH/e5ofi:9I0blDAdeIJVAg48AuVLZEkIfi
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

6f:4f:a8:fe:97:2c:5b:23:68:a1:50:4b:03:a0:e5:f6:19:51:1a:88:49:67:d7:0c:3d:4a:90:bc:7d:cc:6d:4f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Brandstiftelsens vareindkbene\ ,O=praktikabelt,L=Amiens,ST=Hauts-de-France,C=FR

Chains

Aug 22, 2024

PE Signature issue

Digest

c9:cd:4c:2b:97:75:58:0c:ab:23:aa:1c:b9:80:b2:19:63:36:b3:5f

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Brandstiftelsens vareindkbene\ ,O=praktikabelt,L=Amiens,ST=Hauts-de-France,C=FR

Chains

Aug 22, 2024

Minor OS version

1

Major OS version

5

Entry point

13552

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCloseKey RegDeleteKeyA RegDeleteValueA RegEnumKeyA RegEnumValueA RegQueryValueExA RegSetValueExA OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueA RegCreateKeyExA RegOpenKeyExA

shell32

SHBrowseForFolderA SHFileOperationA SHGetPathFromIDListA SHGetFileInfoA ShellExecuteExA

ole32

OleUninitialize IIDFromString OleInitialize CoTaskMemFree CoCreateInstance

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

DispatchMessageA SystemParametersInfoA LoadCursorA SetClassLongA GetSysColor ScreenToClient SetCursor GetWindowRect TrackPopupMenu AppendMenuA EnableMenuItem CreatePopupMenu GetSystemMenu GetSystemMetrics IsWindowEnabled EmptyClipboard SetClipboardData CloseClipboard OpenClipboard CheckDlgButton EndDialog DialogBoxParamA IsWindowVisible SetWindowPos CreateWindowExA GetClassInfoA RegisterClassA PeekMessageA GetMessagePos CharNextA ExitWindowsEx SetWindowTextA SetTimer CreateDialogParamA DestroyWindow LoadImageA FindWindowExA SetWindowLongA InvalidateRect ReleaseDC GetDC SetForegroundWindow EnableWindow GetDlgItem ShowWindow IsWindow PostQuitMessage SendMessageTimeoutA SendMessageA wsprintfA FillRect GetClientRect EndPaint BeginPaint DrawTextA DefWindowProcA SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CallWindowProcA CharPrevA GetWindowLongA

gdi32

GetDeviceCaps SetBkColor CreateBrushIndirect SetTextColor SetBkMode SelectObject DeleteObject CreateFontIndirectA

kernel32

GetTempFileNameA GetLastError WaitForSingleObject RemoveDirectoryA ReadFile CreateFileA CreateDirectoryA lstrcpynA GlobalLock GlobalUnlock CreateThread GetDiskFreeSpaceA CopyFileA lstrlenA GetVersionExA GetWindowsDirectoryA ExitProcess GetCurrentProcess GetExitCodeProcess GetTempPathA SetEnvironmentVariableA GetCommandLineA GetModuleFileNameA GetTickCount GetFileSize MultiByteToWideChar MoveFileA WritePrivateProfileStringA GetPrivateProfileStringA lstrcmpiA lstrcmpA MulDiv GetShortPathNameA GlobalFree GlobalAlloc LoadLibraryExA GetModuleHandleA FreeLibrary Sleep CloseHandle SetFileTime SetFilePointer SetFileAttributesA GetFullPathNameA GetFileAttributesA FindNextFileA FindFirstFileA FindClose DeleteFileA CompareFileTime SearchPathA SetCurrentDirectoryA ExpandEnvironmentStringsA WriteFile CreateProcessA WideCharToMultiByte GetSystemDirectoryA GetProcAddress lstrcpyA lstrcatA MoveFileExA SetErrorMode

$PLUGINSDIR/LangDLL.dll

IMPHASH ef8f46d73ecc991edbdd4be60630bee3
SHA256 982954ea90a10844bff23d595ac2449c6fae300aee2ab4c23077aac1197b7c2e
MD5 c5351b7c9aa48e9e7872288a3e7dd583
SHA1 69efcf341345625a4a855f03f2a9d9e8f50319b2
SHA512 6e655e02aa05bc52beec428686622c4c1c1ffc7e5aba0f6d429495cba29bee5733b26ac7aecbeaa9e525eae52706a2513035d17cc7b0ccbcf792c765c9427d7b
SSDEEP 48:SFPPhYdei1W0Moh82rI7+S2QWviyviU1qeePWfhfof3mkV:+BFi1e12rI7+TvpQeh
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

6

Entry point

4817

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 595a3fd71239f605bb02d7a5e48fd4df
SHA256 7e75f148920db6300dad5a1c12fd5d6eecc95698a310a01311181bc98a704d55
MD5 c61501f07cf09bcfcdfe4cc8a1ebbbe3
SHA1 e8581b4359651b857646ae727efaaef372daa0fc
SHA512 9837abe7ec3fa0f1f5193968d12b7ca1893e34eddf628db1f7ab6715b4de339231f0ec1b5f0f86c767f5a30c40da5c4a95e99deedd22eece93cb0d00539aad24
SSDEEP 192:Kk09rQDenC9VrcK7REgSWOprANupQYLRszDDH/d9CWlXo7U6Wxf:Kk0JQEaVAK7R9SfpjpQYLRszfH/d9CWv
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

6

Entry point

6599

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Bevgelsesformer/anmeldelsesblanket.gin

SHA256 562ed97a455137bfd1b942ce1f037c8a37605c04695a28672d055577cc9a8458
MD5 fd4786d683736cc72626abb18e61dbab
SHA1 06ae97341c4436427a745da0d7d5b60f8d7a470f
SHA512 c95c83d462e2da81673fbac70a82c43b0d097bee2b6f1705c8760baf8a04147a6f66dccd33f28d20c1cec49a6ff8d7dcf08e537544c01a097aeea83ca6d7a18c
SSDEEP 768:SYWPPYyZZ1VnLy82RzbKgzACSZB4rydHxk0Dg8B+6isvBcCJ2FpWaFRfEdawuh1J:vyZqoVDqpBvrfdFSyVXzwEqQky6dnu
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Gifterings.Ros

SHA256 9c71985ae52d16ff5648749219c60f958653f8b974bd8f5fd76241dbb9885637
MD5 7a13431a1fcd1517b828b85e09f4dad6
SHA1 bf53361437ff40244d4b83cd7b2912c259d51c78
SHA512 a3e54e07a9df242d1558a20a35fc22ab7facdef28963c90b0f68805849e13d82e1f58f6060606bac998743581b3ceb086c17dfc1b73deeade4e4f0408e0408ac
SSDEEP 6144:sIhwUCfzqsAk91ThdVwLmDYKJadDmhgUW+6+F4Ua3qB:twXW+PNd1pBgUt6uSC
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Rucksack/maallinien.res

SHA256 9cf9539118d51d3600348e07e408d26c9da6867d1b11c6e416e5658ad5ffc7d8
MD5 ad6fbbbc4b75ce0880f5943f2010e0ed
SHA1 c7496ad7ef0568589d41bc84a39f69863077e9fd
SHA512 532ee13401963a70bf2de13c1eb2971c81d375b63b0d5ccc42d2d358f46f37d26b0b22790bbf9b9a5e5278d2744ffe6138f04d771ef4f46514c3922b847d0882
SSDEEP 1536:+Jf2/UkO1cS6pxqJeFM9GoczTyzXEWf7WZxW:Szkw8Hq4ygdK5cxW
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Rucksack/musher.tjr

SHA256 9fe1dc687b28bac33b7f246e50ac517a80faed3390bb2cf90399f582c650621f
MD5 edb44aec1e719ed88ab7ec745269c135
SHA1 7443be3e8a072b3084e04050406b7b7d7fa3eac8
SHA512 810bbb1de9389f19e38aeff62df1a5db51e070e62ca7fb04d4e5c18b42837787b755af5c2aeab927cc13663e57e2839937165598ccd5a4d5a2a2d214b5c074d7
SSDEEP 768:sXn0Buc0+169MlX2H1S8Ejj+/5VQ/RDeo3c3ZZA7NeiP3S4+BFuQxfD7yfccf4s1:MgZgELt4mbPHqL7INNQ5H8Pi
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Rucksack/noising.txt

SHA256 0a38071b79654410bbf0eb53c56fe2cb631fc478851091f5cdeefb3671cab244
MD5 145dc70d19a663ebbc8855f04d52f5d9
SHA1 b0a5f5e9f3862f163b5a31d10e97e891186fee95
SHA512 e2df75da021a46c710153d88d7875db9ee41bd2f26734b2b5b228b3b948de9e08074458d25034846dcca9126547f5839db2cf7cf955b52169e678f4238f6fd1d
MD5 SHA1 SHA512

NSIS installer

installer

Snekasternes/Coelosperm.Unl

SHA256 fc0e227ba9f51086bbe82e93f8a68467583f47b634f270b7498d5608375c648e
MD5 056cf2a8de6f41117588abbe6bcd164a
SHA1 69461f9eac5769333113103da12d760efc0bf75f
SHA512 1ff02dd0651e35770b05574a707ba1084a97f3b33fcaaa46ff1b692ea9dffe38ed0cbe19d0250fca1d07b0ba57c4f17ddbff4972a3f97475be3ca94be0c01f88
SSDEEP 768:aynKDEEC2DEdyFq+gB1KPiXgSogLJyyPGlcnERvydx+ZyEE1JC6L7IRFOVmw/4n3:aC21gU1iJyyGmgRncvxm7LZwJ0C4k8k6
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

IMG_0000053Legal_warning_Invoices.exe

PE Signature issue

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/LangDLL.dll

kernel32

user32

gdi32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Bevgelsesformer/anmeldelsesblanket.gin

Gifterings.Ros

Rucksack/maallinien.res

Rucksack/musher.tjr

Rucksack/noising.txt

Snekasternes/Coelosperm.Unl

Sharing

General

Malware Config

Signatures

File Explorer

IMG_0000053Legal_warning_Invoices.exe

PE Signature issue

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/LangDLL.dll

kernel32

user32

gdi32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Bevgelsesformer/anmeldelsesblanket.gin

Gifterings.Ros

Rucksack/maallinien.res

Rucksack/musher.tjr

Rucksack/noising.txt

Snekasternes/Coelosperm.Unl