c95764c294dd8139cfcd34b796a77f6d218942ca5d485152c489dda2c9c9c0d0

resource
unpack001/$PLUGINSDIR/System.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

IMPHASH dd68e663380c71f66b512f005f1be7ec
SHA256 c95764c294dd8139cfcd34b796a77f6d218942ca5d485152c489dda2c9c9c0d0
MD5 302556d322a1b90777ba093ae93b2aa9
SHA1 1a05d5018191f273e9a8c09e894c599ede8a6c58
SHA512 6cbced8fbce7ff964f4b4b662796913c9f9c638367d04456689697420091f07f022a346c49d8dcf26f97738589374e85293543f7d9118a845abb7e317e6ea58d
SSDEEP 12288:cZCgwRmWooxcQTjJGMlE4pjBXDf0w40mRRtN9QkLImDIkLsQVlx:cLfhHAdHXpjBzf0+WRtppLsWlx
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

51:15:ca:ed:e9:5f:02:e3:25:0f:3a:75:f6:2c:f2:e4:e8:8c:55:fc:eb:82:31:ba:9d:16:21:5d:8e:12:52:36

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Bunkeres Discloak\ ,O=Konsolidkwr,L=Hooe Common,ST=England,C=GB

Chains

Aug 22, 2024

PE Signature issue

Digest

62:5f:c9:eb:62:ae:1f:92:58:16:a7:fb:d3:3d:0f:b8:6b:40:96:c6

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Bunkeres Discloak\ ,O=Konsolidkwr,L=Hooe Common,ST=England,C=GB

Chains

Aug 22, 2024

Minor OS version

1

Major OS version

5

Entry point

13518

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCloseKey RegDeleteKeyA RegDeleteValueA RegEnumKeyA RegEnumValueA RegQueryValueExA RegSetValueExA OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueA RegCreateKeyExA RegOpenKeyExA

shell32

SHBrowseForFolderA SHFileOperationA SHGetPathFromIDListA SHGetFileInfoA ShellExecuteExA

ole32

OleUninitialize IIDFromString OleInitialize CoTaskMemFree CoCreateInstance

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

DispatchMessageA SystemParametersInfoA LoadCursorA SetClassLongA GetSysColor ScreenToClient SetCursor GetWindowRect TrackPopupMenu AppendMenuA EnableMenuItem CreatePopupMenu GetSystemMenu GetSystemMetrics IsWindowEnabled EmptyClipboard SetClipboardData CloseClipboard OpenClipboard CheckDlgButton EndDialog DialogBoxParamA IsWindowVisible SetWindowPos CreateWindowExA GetClassInfoA RegisterClassA PeekMessageA GetMessagePos CharNextA ExitWindowsEx SetWindowTextA SetTimer CreateDialogParamA DestroyWindow LoadImageA FindWindowExA SetWindowLongA InvalidateRect ReleaseDC GetDC SetForegroundWindow EnableWindow GetDlgItem ShowWindow IsWindow PostQuitMessage SendMessageTimeoutA SendMessageA wsprintfA FillRect GetClientRect EndPaint BeginPaint DrawTextA DefWindowProcA SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CallWindowProcA CharPrevA GetWindowLongA

gdi32

GetDeviceCaps SetBkColor CreateBrushIndirect SetTextColor SetBkMode SelectObject DeleteObject CreateFontIndirectA

kernel32

GetTempFileNameA GetLastError WaitForSingleObject RemoveDirectoryA ReadFile CreateFileA CreateDirectoryA lstrcpynA GlobalLock GlobalUnlock CreateThread GetDiskFreeSpaceA CopyFileA lstrlenA GetVersionExA GetWindowsDirectoryA ExitProcess GetCurrentProcess GetExitCodeProcess GetTempPathA SetEnvironmentVariableA GetCommandLineA GetModuleFileNameA GetTickCount GetFileSize MultiByteToWideChar MoveFileA WritePrivateProfileStringA GetPrivateProfileStringA lstrcmpiA lstrcmpA MulDiv GetShortPathNameA GlobalFree GlobalAlloc LoadLibraryExA GetModuleHandleA FreeLibrary Sleep CloseHandle SetFileTime SetFilePointer SetFileAttributesA GetFullPathNameA GetFileAttributesA FindNextFileA FindFirstFileA FindClose DeleteFileA CompareFileTime SearchPathA SetCurrentDirectoryA ExpandEnvironmentStringsA WriteFile CreateProcessA WideCharToMultiByte GetSystemDirectoryA GetProcAddress lstrcpyA lstrcatA MoveFileExA SetErrorMode

$PLUGINSDIR/System.dll

IMPHASH 595a3fd71239f605bb02d7a5e48fd4df
SHA256 90f3cebb5b3759eb1bd72cee7cd8b694440ee398fe970b763db7a7b67208e4c8
MD5 8508fa0ab17e36e071687243283c2aef
SHA1 d45391d0454fbb9eb66fa72ecf0e2cadf0522bfe
SHA512 241cf26e57006402897d8adaff37f3006c1bdbb09d6c5d10c32d556996df5785dc81c35ccbbc74384f80853a3e4aea7be251a4fa2613be42108e11a00692df5a
SSDEEP 192:S9rQDenC9VrcK7REgSWOprANupQYLRszDDH/d9CWlXo7U6Wxf:SJQEaVAK7R9SfpjpQYLRszfH/d9CWB1j
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

6

Entry point

6599

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Nunneries.sub

SHA256 0370251f5dd197ece0ea8a41f159fddc42d7a1cd91608156ddf57bf7ff6340c1
MD5 8b035f50b7d03e8e3c12c4a7e9ef0416
SHA1 c40ddfd166a8a2a57de34c6e6f0eaa737f562523
SHA512 51f7301f04a81b9f7341273c6d9afc942ac1318a63b9c9beb60389e3c22dc1741df62aff2c9986fca787370cef6da2ee4dd062da8f6436b0095c1872b065d9c3
SSDEEP 768:Ata7tm7RWWlp29ZCMz+vsS/zMRb5xH5/z41RAKozj/hBzOsREA8mEs4p/QsO6mGE:iNMh2nK8E90bM+aad
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Sigjners.Opr

SHA256 273038f06df8b4d65789569a60887977b381edde1847daf9a9c923096a6b1811
MD5 e5f89994adc3df146bee4b6951e2f476
SHA1 99b987e834aadf27a9f0d1f416381629b80624a0
SHA512 67be0c2da974c26a1a5caaa3ce1915c6980b34879ec6d97d1768f0146b9fe01beb779106190d9668dc7b8dfad6d70618fa6ba356a7fe72b36c0533d712d586de
SSDEEP 3072:uo0RbCJ0IC8gj9XywUgl7eQYHS6lQ0gcwo:uFRbVIC8O9XyR+iQYHhlQ0gcwo
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Tnde.Jul

SHA256 f5d3c23293c1021b6f1a3c0ae68a5cbbae0bf76840daec6b34a7c1c4bfd400dd
MD5 7503900df3cb4d360f8e9d5e97938147
SHA1 e3736c4e820e78c573affb01ff654433449a3f62
SHA512 6153afd3827fd150182508d5ac1b53923a3b071ef53859b63b6bfdeaa9867900c1ad86b41c4b5a0499616ba45b0bc4741549bc4f48f4e74870b731803eaba69f
SSDEEP 6144:00R2Ow19ZVkB1NodR7AaKIlFph/Cuzb5yRtkcR:0VD9m0dAbIlvBrJTcR
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

albuquerque.jer

SHA256 a3564ecfd5ee16655709ba738ea111285494a4950a40b5e9df6c3f7853eedc7f
MD5 301c0542b3a4f12751237e7d66ab87e7
SHA1 22047c1df9dbbcd9629b38893fa7294c0956914d
SHA512 be76b52f6901bb470c3f562f33b72c5883aade81abd6658bdf6e569969617195cb736af1842890058421bb273c51a72683f14e77d15d0edbdfc119ac41ea39b9
SSDEEP 768:z7X3OpuJLln4NHehXm71SCUVbrqAIMv+2/b4V2P3u3WK7N8Bf3OK25EJVKkDhzCF:/KtvU3Q+WaYCvzP/T308dU9Jt
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

alpasotes.fly

SHA256 facddd60c2d25ae9b18fb1fe559ecfb027f4f5d0779c1687ed7bd715e290a8d0
MD5 e5e18855acc6a11a45d0d13a2bc6cdb6
SHA1 8b54e9570e511a1049704cccac783b5d75379ced
SHA512 9a4de5b8654a0f1f1655341bc1b4206d04f5a8cc48a837020ae2b14414bd39d4d84e52ddd4e4554a4b51ae2abcbaa3b74327da25f15c5a1e87547209e5c2a223
SSDEEP 768:dCKtpgJr83BA79OLaRtFEA5cd2XMTPo2C1hNM5/Vvtdh4uwPYCP8LUS9tp9hd4aH:dZiSUi/ore/T4jSjjWacNg1llIx3f09
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

mourids.txt

SHA256 a61ac9bc9dbdc35bea83cffef578649fcf318f62a519a329b5a5540c582de100
MD5 371a762db20650dd795210d34000f4d2
SHA1 cf39e990575ad68dce8f74ba3edfba31468619d3
SHA512 a7588050a2dc1c43f59828769aeaa40cc8d9a10ae2773788e7d1a42759e4271339995be521e1ddfee3e1e780111d750e1ec1e6e9fe7d807a5c3cb9afbdbafef1
MD5 SHA1 SHA512

NSIS installer

installer