39f1703e13bdc112f4ffe9240f70cd5eb5b07cc218e6b22a8d58e4dcfaadd0a1[.]exe

resource
unpack001/$PLUGINSDIR/BgImage.dll
unpack001/$PLUGINSDIR/UserInfo.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/nsExec.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

39f1703e13bdc112f4ffe9240f70cd5eb5b07cc218e6b22a8d58e4dcfaadd0a1.exe

IMPHASH b78ecf47c0a3e24a6f4af114e2d1f5de
SHA256 39f1703e13bdc112f4ffe9240f70cd5eb5b07cc218e6b22a8d58e4dcfaadd0a1
MD5 61bdbe7854f1572202f7916cf7f03616
SHA1 e03a3385bc0cd5869c2a8cc72c80f4115b7b7945
SHA512 b9b41ede8456e65669ddf068bd6d277d60a7f2d233fa947636f998e9f77bc9be72a4b27884c9cc1bb979bbc0a8488ba8efa32375258492eb712ed864eca3a9c6
SSDEEP 12288:rKYi/LYz3kRV6h/3lObHOjeP/AxozXkYD:GFDg3ZhvlwHWiYx2UYD
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

9d:0a:04:d0:4a:d6:94:13:1b:8c:f4:e0:5a:77:74:87:ab:d0:e9:37:95:df:99:0e:e3:67:08:63:a6:4d:9c:77

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Overophedendes,OU=Glippende Unadaptedness\ ,O=Overophedendes,L=Saint-Étienne,ST=Auvergne-Rhône-Alpes,C=FR,1.2.840.113549.1.9.1=#0c134261676772756e64404461776e65642e466f75

Chains

Jul 5, 2024

Minor OS version

0

Major OS version

4

Entry point

12505

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetEnvironmentVariableA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA GetFileAttributesA SetFileAttributesA GetWindowsDirectoryA GetTempPathA GetCommandLineA lstrlenA GetVersion SetErrorMode lstrcpynA ExitProcess GetFullPathNameA GlobalLock CreateThread GetLastError CreateDirectoryA CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA ReadFile WriteFile lstrcpyA MoveFileExA lstrcatA GetSystemDirectoryA GetProcAddress CloseHandle SetCurrentDirectoryA MoveFileA CompareFileTime GetShortPathNameA SearchPathA lstrcmpiA SetFileTime lstrcmpA ExpandEnvironmentStringsA GlobalUnlock GetDiskFreeSpaceA GlobalFree FindFirstFileA FindNextFileA DeleteFileA SetFilePointer GetPrivateProfileStringA FindClose MultiByteToWideChar FreeLibrary MulDiv WritePrivateProfileStringA LoadLibraryExA GetModuleHandleA GetExitCodeProcess WaitForSingleObject GlobalAlloc

user32

ScreenToClient GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard PostQuitMessage GetWindowRect EnableMenuItem CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndDialog RegisterClassA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx GetDC CreateDialogParamA SetTimer GetDlgItem SetWindowLongA SetForegroundWindow LoadImageA IsWindow SendMessageTimeoutA FindWindowExA OpenClipboard TrackPopupMenu AppendMenuA EndPaint DestroyWindow wsprintfA ShowWindow SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA

advapi32

RegDeleteKeyA SetFileSecurityA OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges RegOpenKeyExA RegEnumValueA RegDeleteValueA RegCloseKey RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/BgImage.dll

IMPHASH bdcecc8b26871abb93996c6c18e09c94
SHA256 5c66abd3f06eaa357ed9663224c927cf7120dca010572103faa88832bb31c5ab
MD5 350a507070ed063ac6a511aeef67861a
SHA1 cf647b90a1212e090f1d236d1b50a5010cbf3bae
SHA512 cde5747cc8539625e4262afad9699ce4e8325133d7ed7f47b9d46989a7aa0d2cc2488441acc57368f485ef1dd3e02b9ef2faa642f68e9f1db53a39e0f896d468
SSDEEP 96:8eE0AKTIfv7QCUsthvNL85s4lk38Eb3CDfvEh8uLzqkwnLiEQjJ3KxkP:tWBfjbUA/85q3wEh8uLmjLpmP
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

7198

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/UserInfo.dll

IMPHASH cce05dea98cbac3a9d486b233588f528
SHA256 77b40d42606d48f817b901f1e5abea114b4288b344b8c193bf3e3c52e469a926
MD5 d1e37112390e6bcca8362788d61becf5
SHA1 d97888f0f69d34de202e7c68b8ff5b2c2fec4c5f
SHA512 04121e5241ad14890095a6cf5e698979820fa97d911918b9b77f2064a713e20f4827f72c057d5da1789bc340d63f391872fe5dfbb79e6c33d3995f82c37fa51f
MD5 SHA1 SHA512

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4713

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsDialogs.dll

IMPHASH ddbd50fe6279559edf7d1f1d89b42c2c
SHA256 cb958e21c3935ef7697a2f14d64cae0f9264c91a92d2deeb821ba58852dac911
MD5 13b6a88cf284d0f45619e76191e2b995
SHA1 09ebb0eb4b1dca73d354368414906fc5ad667e06
SHA512 2aeeae709d759e34592d8a06c90e58aa747e14d54be95fb133994fdcebb1bdc8bc5d82782d0c8c3cdfd35c7bea5d7105379d3c3a25377a8c958c7b2555b1209e
SSDEEP 96:oyqZ4zC5RH3cXX1LlYlRowycxM2DjDf3GEst+Nt+jvDYx4yqndYHnxss:oyq+CP3uKrpyREs06YxKdGn
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

7429

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsExec.dll

IMPHASH 46f8b6973f33717335c0f6d8087de67b
SHA256 3e3d516d4f28948a474704d5dc9907dbe39e3b3f98e7299f536337278c59c5c9
MD5 b648c78981c02c434d6a04d4422a6198
SHA1 74d99eed1eae76c7f43454c01cdb7030e5772fc2
SHA512 219c88c0ef9fd6e3be34c56d8458443e695badd27861d74c486143306a94b8318e6593bf4da81421e88e4539b238557dd4fe1f5bedf3ecec59727917099e90d2
SSDEEP 96:U7GUxNkO6GR0t9GKKr1Zd8NHYVVHp4dEeY3kRnHdMqqyVgNN3e:mXhHR0aTQN4gRHdMqJVgNE
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4231

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Angiosperm.Sla

SHA256 ea92d267a29ebea630fc51e02b9e7c42683216b1b4bf1075063a58529657ab16
MD5 74c243e34b9fafdd090165d998591c37
SHA1 376964338a52695316fad59455cd23269312cc21
SHA512 4670d7e9efe8d9738f9406e741991bf8e52de94eae4c202441e7c0457b4c120f6033893e4b1b1ddd69410ec3c39d8edf3c86905ca41a7aab1bd4b2fb9e06657c
SSDEEP 6144:Y0pdzZVmwH8552pWrL6dKhmOHuWKqWJepSQK9ETizjNIlVlDW6Vte:PdzPj85581KurXNqF7fe
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Donkraftes197.sax

SHA256 92746e6cf37b022c9e65f638325d9a260109f8ad1cefdcd9179023a8c43854bd
MD5 ffbf267c60266b56038d6f59a29667fe
SHA1 6670dcfb19c1f662eebb962c5c893e26bfdc6a3a
SHA512 1470d30b40f80ef601e0d8376fa43d868e05b812f56aa6cc214810c6723f2a44200ee518fdac2637053e276a73603d3b89d204b7ebc96bac47d38ab69d5799a0
MD5 SHA1 SHA512

NSIS installer

installer

Filmkundskabers209.kon

SHA256 39dadb40165c61c25e858a914f037cde54b6ca6e280e563c11e14e8eaa5f360e
MD5 697432ae88310017784e05283190c05b
SHA1 0d82f0c883ff55a4847542ad6bfe7c78b6751630
SHA512 768c4181e3455e0c67e2277b70c674f5c960c1a3a92629d8768d090bb2d4d0e7a9f1eab7a3d690a0bee004867c13799cbaefd99bf27b42961112d3efff5da45f
MD5 SHA1 SHA512

NSIS installer

installer

Henseende.ska

SHA256 6bb38a6800a2e28ab2925ebae75a5189fc3273186cd625117caa436536f79efa
MD5 acd3ea83bea818bb3a99f3c9e9a1fd5e
SHA1 9a7d6ab1713e6a20181f52ea1bcc2c0eadbf2d2c
SHA512 a1941147ba67e663d0f82719506e19bcd40efb58d8d043dd03775e7ef68790fd9d56445de3e4c7492df969a01ce1c7b326a97760f943ebebc1addae5dfbbb859
MD5 SHA1 SHA512

NSIS installer

installer

Hospitaliseret.lba

SHA256 28d8be59cfab5805f4ab48aaa72b54079a69c2f48136108849e8f12c9c14f92c
MD5 7ca2dd0bdbf021d85bb1bbca305f4e4a
SHA1 d454677a43d30a5107b0e50f16aecc25d4fdfa8b
SHA512 da65eca8e6865f609b0c7ecf136bdac7231608d936f812c6c304ce3bb58c9c6f5e4cb9315a75b551b52f726b8a1b5e3fd7ef513a4a72f028b5e49e9d1d578641
MD5 SHA1 SHA512

NSIS installer

installer

Ruralt.Tea

SHA256 4df3727a11c8e633d68d7dfb08f7a679aea4b0cfcbda2d54da547499a9c66e16
MD5 e857291cf7cdcfd0413d85abdb01f724
SHA1 f4c0728ba5a0e78bc19489425dfb634327cd664d
SHA512 1007e794c375819bf7e1011bc27077422fc40b3b8648f2aae98cdceba26e0c0944cc82bd6fe93b55b65a87c828b866aaf1260e588bb94d3088635e035ba71f30
SSDEEP 1536:pKKk99E8fYyNfISb0QkDkWNSJPaHsP3aKAh1tx5H4vp80NaGf:pK1c8fYyNfgHYWgk8KKAHtxVsR
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

extravagence.txt

SHA256 e20eb817c5e5dc93935980c16561d27728efe357628d43a684793db9f3130ad7
MD5 270491e6b4f6bab6d9a2034416b1b695
SHA1 098f4a1248e4af2290f44c89d4288fbf742e00bc
SHA512 cfc48a418c30fd8271979e3d3766d8071963fc60d36504debd3cc0ea8d35136ad86ff6b278d3e3b0bcf2b6a953eea94da802aa4014e9e3c8cb471b08fdf20862
MD5 SHA1 SHA512

NSIS installer

installer

intertieing.hyd

SHA256 ab87d4bffbde0f6952906169ad7a87beab87efad84c3460920a243bea659d754
MD5 f8426fdb8764486488bcf8b38dd484a4
SHA1 541158fc40283c0219922cdd651b6e57d9eaaf4f
SHA512 acc54cae6d7668a05abd9c2a293e5ca8e72b1cf177ab0dec6adcb2130d252e738608dd8f3b13cab1b76fb78afe0e2395182f6a9ea499ac436755c45404ecd9de
MD5 SHA1 SHA512

NSIS installer

installer

kannevassers.esk

SHA256 191412af797d357ae97c55047cb5a7427bed940e025d39abc89e862177a5daf6
MD5 1f22eb9db671b05ed5c08f8dd00d5c48
SHA1 8a7959384c2442945087d67cfe129752d2da87fa
SHA512 8ebf76314acbddecfd19849ace9f4eaa9e2b1d4e5e7c370479707b96d139ec2800f719420eb14342394f6679c732bb1c4bc741c2f7d45da772fd75c5a21ce5fe
MD5 SHA1 SHA512

NSIS installer

installer

overvurderingens.syn

SHA256 a5aed468547f93b42c66fc193f770d6e41b5f4701c0e6fc0bba48c1589276933
MD5 612f90bbc9347ddeffb620e1dd4e730b
SHA1 91cd3fb4025685ac7098cd4bd3f822317b192583
SHA512 9a0dbef78c25891d747cc211e53caebc60159fc6630b5a1efbf7436a494e7f9a33e3bb313e25a44c3778df440d5c94377bc4416f2c21934b83a9a07d35246ace
MD5 SHA1 SHA512

NSIS installer

installer

scattier.con

SHA256 ce956ff5404172303308409c64fd6e20dd602cc4d2ddab1ef183f0b9e4deacc7
MD5 31030fc12e7662a05e09f8713e5188e4
SHA1 8bb2e7f32cade158c981ec302c80b31c3dc56327
SHA512 bc95831c3cebd16786cb74ecc121d7048e48bfdee8e0efebbae3406e19afbf54121eb6ac83134b7d70feadfe34cf4d9852ea4c26735c28762bbb5051a757cf03
MD5 SHA1 SHA512

NSIS installer

installer

Sharing

General

Malware Config

Signatures

File Explorer

39f1703e13bdc112f4ffe9240f70cd5eb5b07cc218e6b22a8d58e4dcfaadd0a1.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/BgImage.dll

kernel32

user32

gdi32

winmm

generic

$PLUGINSDIR/UserInfo.dll

kernel32

advapi32

generic

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

$PLUGINSDIR/nsExec.dll

kernel32

user32

advapi32

generic

Angiosperm.Sla

Donkraftes197.sax

Filmkundskabers209.kon

Henseende.ska

Hospitaliseret.lba

Ruralt.Tea

extravagence.txt

intertieing.hyd

kannevassers.esk

overvurderingens.syn

scattier.con