rSHIPMENT_DOCMSS24071327[.]exe

resource
unpack001/$PLUGINSDIR/System.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

rSHIPMENT_DOCMSS24071327.exe

IMPHASH dd68e663380c71f66b512f005f1be7ec
SHA256 bc94d4814be919e507e812ff0b12a0f16d9a490c855b72ff7b8d4285bed16941
MD5 5b1b10d16308f61ac598822de806e827
SHA1 9f78e03576e15884ec73852a3e304d53bd1ef51e
SHA512 7aae7617eb8d413791bfa55fe2b590d414cb8e73e19a93eef3e7fc66df540101cb0b1c606a6290a90a512c24aaf0401455b3efbaf3a0247576353b79e5984dc0
SSDEEP 12288:SZCgwRmWooxcQTjJvJe09+9LwIvtqWMaH79E0mRRpcQ3xpJD0DIkLsQVlC:SLfhHAdvJ/LaUWMabXWReQ3DJCLsWlC
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

eb:6e:80:18:c2:55:88:ba:7d:6d:39:73:e8:0c:70:8f:a7:02:27:1c:db:89:75:6d:50:5d:23:e6:35:4d:26:d5

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Indebres Kartoffelkure\ ,O=Ballepressedes,L=Cunel,ST=Grand Est,C=FR

Chains

Aug 22, 2024

PE Signature issue

Digest

1f:fd:b0:c8:bc:d6:2f:ce:f0:58:75:73:f4:df:5e:3d:dd:25:0c:68

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Indebres Kartoffelkure\ ,O=Ballepressedes,L=Cunel,ST=Grand Est,C=FR

Chains

Aug 22, 2024

Minor OS version

1

Major OS version

5

Entry point

13518

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCloseKey RegDeleteKeyA RegDeleteValueA RegEnumKeyA RegEnumValueA RegQueryValueExA RegSetValueExA OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueA RegCreateKeyExA RegOpenKeyExA

shell32

SHBrowseForFolderA SHFileOperationA SHGetPathFromIDListA SHGetFileInfoA ShellExecuteExA

ole32

OleUninitialize IIDFromString OleInitialize CoTaskMemFree CoCreateInstance

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

DispatchMessageA SystemParametersInfoA LoadCursorA SetClassLongA GetSysColor ScreenToClient SetCursor GetWindowRect TrackPopupMenu AppendMenuA EnableMenuItem CreatePopupMenu GetSystemMenu GetSystemMetrics IsWindowEnabled EmptyClipboard SetClipboardData CloseClipboard OpenClipboard CheckDlgButton EndDialog DialogBoxParamA IsWindowVisible SetWindowPos CreateWindowExA GetClassInfoA RegisterClassA PeekMessageA GetMessagePos CharNextA ExitWindowsEx SetWindowTextA SetTimer CreateDialogParamA DestroyWindow LoadImageA FindWindowExA SetWindowLongA InvalidateRect ReleaseDC GetDC SetForegroundWindow EnableWindow GetDlgItem ShowWindow IsWindow PostQuitMessage SendMessageTimeoutA SendMessageA wsprintfA FillRect GetClientRect EndPaint BeginPaint DrawTextA DefWindowProcA SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CallWindowProcA CharPrevA GetWindowLongA

gdi32

GetDeviceCaps SetBkColor CreateBrushIndirect SetTextColor SetBkMode SelectObject DeleteObject CreateFontIndirectA

kernel32

GetTempFileNameA GetLastError WaitForSingleObject RemoveDirectoryA ReadFile CreateFileA CreateDirectoryA lstrcpynA GlobalLock GlobalUnlock CreateThread GetDiskFreeSpaceA CopyFileA lstrlenA GetVersionExA GetWindowsDirectoryA ExitProcess GetCurrentProcess GetExitCodeProcess GetTempPathA SetEnvironmentVariableA GetCommandLineA GetModuleFileNameA GetTickCount GetFileSize MultiByteToWideChar MoveFileA WritePrivateProfileStringA GetPrivateProfileStringA lstrcmpiA lstrcmpA MulDiv GetShortPathNameA GlobalFree GlobalAlloc LoadLibraryExA GetModuleHandleA FreeLibrary Sleep CloseHandle SetFileTime SetFilePointer SetFileAttributesA GetFullPathNameA GetFileAttributesA FindNextFileA FindFirstFileA FindClose DeleteFileA CompareFileTime SearchPathA SetCurrentDirectoryA ExpandEnvironmentStringsA WriteFile CreateProcessA WideCharToMultiByte GetSystemDirectoryA GetProcAddress lstrcpyA lstrcatA MoveFileExA SetErrorMode

$PLUGINSDIR/System.dll

IMPHASH 595a3fd71239f605bb02d7a5e48fd4df
SHA256 90f3cebb5b3759eb1bd72cee7cd8b694440ee398fe970b763db7a7b67208e4c8
MD5 8508fa0ab17e36e071687243283c2aef
SHA1 d45391d0454fbb9eb66fa72ecf0e2cadf0522bfe
SHA512 241cf26e57006402897d8adaff37f3006c1bdbb09d6c5d10c32d556996df5785dc81c35ccbbc74384f80853a3e4aea7be251a4fa2613be42108e11a00692df5a
SSDEEP 192:S9rQDenC9VrcK7REgSWOprANupQYLRszDDH/d9CWlXo7U6Wxf:SJQEaVAK7R9SfpjpQYLRszfH/d9CWB1j
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

6

Entry point

6599

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Nunneries.sub

SHA256 0370251f5dd197ece0ea8a41f159fddc42d7a1cd91608156ddf57bf7ff6340c1
MD5 8b035f50b7d03e8e3c12c4a7e9ef0416
SHA1 c40ddfd166a8a2a57de34c6e6f0eaa737f562523
SHA512 51f7301f04a81b9f7341273c6d9afc942ac1318a63b9c9beb60389e3c22dc1741df62aff2c9986fca787370cef6da2ee4dd062da8f6436b0095c1872b065d9c3
SSDEEP 768:Ata7tm7RWWlp29ZCMz+vsS/zMRb5xH5/z41RAKozj/hBzOsREA8mEs4p/QsO6mGE:iNMh2nK8E90bM+aad
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Respektabel.Reg

SHA256 e7afa25e968cca80d60e5a489a8fe5da116787eed66038c8a32e8ea25a99a339
MD5 c33aa092c157e989d05c41031c2300e9
SHA1 6003db21e2c6a06de270e85c5e06c41c2a780c4f
SHA512 8b75f810f3aa3ef811e09f805ee5b8b7a228037821a233e7e1cab9dc3d98c5a26af773feeed451b11c175f61320c1aae9cb9c78152432ea91022e47b455b2b87
SSDEEP 1536:wSsXbDORwEPcWqg0UJtQ5Ak3Odso+IP5ys/DFzZ3bdWVl0V6GYqS+5EvulW0gxvd:mFwLCox0c50vPbj4zfmT42kBDM
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Simooms.Aud

SHA256 ad6d8e5fac2662565561c695941faa9bf07680338c6d17ab8c3c243c0b12c4e8
MD5 fb8705598c13390aaacef05145902f6c
SHA1 49868e9f5e3ce5210047a28a07aac04f651fdf0b
SHA512 fe329ba781d58120958a6bbde542f08aa962d8395f1abc32ac53b9a7cc977a604211bf34fbf17ee5d68bec59b1cc807c316f70cfd094759594bdeb7116ed7982
SSDEEP 3072:DBKSbGAvmKrAzKKGsZ0qdbi1CgxVU8av3aUyBXzTT7MHF3KtWDvjZa:DVfmKiKF1qdbG48aytVfwl34W34
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

albuquerque.jer

SHA256 a3564ecfd5ee16655709ba738ea111285494a4950a40b5e9df6c3f7853eedc7f
MD5 301c0542b3a4f12751237e7d66ab87e7
SHA1 22047c1df9dbbcd9629b38893fa7294c0956914d
SHA512 be76b52f6901bb470c3f562f33b72c5883aade81abd6658bdf6e569969617195cb736af1842890058421bb273c51a72683f14e77d15d0edbdfc119ac41ea39b9
SSDEEP 768:z7X3OpuJLln4NHehXm71SCUVbrqAIMv+2/b4V2P3u3WK7N8Bf3OK25EJVKkDhzCF:/KtvU3Q+WaYCvzP/T308dU9Jt
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

alpasotes.fly

SHA256 facddd60c2d25ae9b18fb1fe559ecfb027f4f5d0779c1687ed7bd715e290a8d0
MD5 e5e18855acc6a11a45d0d13a2bc6cdb6
SHA1 8b54e9570e511a1049704cccac783b5d75379ced
SHA512 9a4de5b8654a0f1f1655341bc1b4206d04f5a8cc48a837020ae2b14414bd39d4d84e52ddd4e4554a4b51ae2abcbaa3b74327da25f15c5a1e87547209e5c2a223
SSDEEP 768:dCKtpgJr83BA79OLaRtFEA5cd2XMTPo2C1hNM5/Vvtdh4uwPYCP8LUS9tp9hd4aH:dZiSUi/ore/T4jSjjWacNg1llIx3f09
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

mourids.txt

SHA256 a61ac9bc9dbdc35bea83cffef578649fcf318f62a519a329b5a5540c582de100
MD5 371a762db20650dd795210d34000f4d2
SHA1 cf39e990575ad68dce8f74ba3edfba31468619d3
SHA512 a7588050a2dc1c43f59828769aeaa40cc8d9a10ae2773788e7d1a42759e4271339995be521e1ddfee3e1e780111d750e1ec1e6e9fe7d807a5c3cb9afbdbafef1
MD5 SHA1 SHA512

NSIS installer

installer

rSHIPMENT_DOCMSS24071327.exe

PE Signature issue

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Nunneries.sub

Respektabel.Reg

Simooms.Aud

albuquerque.jer

alpasotes.fly

mourids.txt

Sharing

General

Malware Config

Signatures

File Explorer

rSHIPMENT_DOCMSS24071327.exe

PE Signature issue

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Nunneries.sub

Respektabel.Reg

Simooms.Aud

albuquerque.jer

alpasotes.fly

mourids.txt