1c17ac3bab8bb94d79dbac1d96dc3c851a27ca69c3a58214c7f9fabc84709d1c[.]exe

resource
1c17ac3bab8bb94d79dbac1d96dc3c851a27ca69c3a58214c7f9fabc84709d1c.exe
unpack001/$PLUGINSDIR/LangDLL.dll
unpack001/$PLUGINSDIR/System.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

1c17ac3bab8bb94d79dbac1d96dc3c851a27ca69c3a58214c7f9fabc84709d1c.exe

IMPHASH ced282d9b261d1462772017fe2f6972b
SHA256 1c17ac3bab8bb94d79dbac1d96dc3c851a27ca69c3a58214c7f9fabc84709d1c
MD5 16896ff6cc1f6405d6572112fa99e77a
SHA1 a2679c0869ddc42e6521f4c382ae5d1d8946e311
SHA512 91ce438c820aa2873f5c48be681267027a0d43a30b1d572ee11490b5f8261cbfd88b5bd8f4706f0463a557fbc604660cee1e250d47dfe43c7deb55e5f78b36b5
SSDEEP 6144:tqjIR4uIDtVLjU/TyxcNY9Ezrs+63D9Wmy9eHhiYSz9Zh7iRhuV2DUFRfDOca6ZL:E5INYaR6D54eBiYSwaV2DC0cuuO+
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

13074

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCreateKeyExA RegEnumKeyA RegQueryValueExA RegSetValueExA RegCloseKey RegDeleteValueA RegDeleteKeyA AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken SetFileSecurityA RegOpenKeyExA RegEnumValueA

shell32

SHGetFileInfoA SHFileOperationA SHGetPathFromIDListA ShellExecuteExA SHGetSpecialFolderLocation SHBrowseForFolderA

ole32

IIDFromString OleInitialize OleUninitialize CoCreateInstance CoTaskMemFree

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

SetClipboardData CharPrevA CallWindowProcA PeekMessageA DispatchMessageA MessageBoxIndirectA GetDlgItemTextA SetDlgItemTextA GetSystemMetrics CreatePopupMenu AppendMenuA TrackPopupMenu FillRect EmptyClipboard LoadCursorA GetMessagePos CheckDlgButton GetSysColor SetCursor GetWindowLongA SetClassLongA SetWindowPos IsWindowEnabled GetWindowRect GetSystemMenu EnableMenuItem RegisterClassA ScreenToClient EndDialog GetClassInfoA SystemParametersInfoA CreateWindowExA ExitWindowsEx DialogBoxParamA CharNextA SetTimer DestroyWindow CreateDialogParamA SetForegroundWindow SetWindowTextA PostQuitMessage SendMessageTimeoutA ShowWindow wsprintfA GetDlgItem FindWindowExA IsWindow GetDC SetWindowLongA LoadImageA InvalidateRect ReleaseDC EnableWindow BeginPaint SendMessageA DefWindowProcA DrawTextA GetClientRect EndPaint IsWindowVisible CloseClipboard OpenClipboard

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateFontIndirectA CreateBrushIndirect DeleteObject SetTextColor SelectObject

kernel32

GetExitCodeProcess WaitForSingleObject GetProcAddress GetSystemDirectoryA WideCharToMultiByte MoveFileExA ReadFile GetTempFileNameA WriteFile RemoveDirectoryA CreateProcessA CreateFileA GetLastError CreateThread CreateDirectoryA GlobalUnlock GetDiskFreeSpaceA GlobalLock SetErrorMode GetVersion lstrcpynA GetCommandLineA GetTempPathA lstrlenA SetEnvironmentVariableA ExitProcess GetWindowsDirectoryA GetCurrentProcess GetModuleFileNameA CopyFileA GetTickCount Sleep GetFileSize GetFileAttributesA SetCurrentDirectoryA SetFileAttributesA GetFullPathNameA GetShortPathNameA MoveFileA CompareFileTime SetFileTime SearchPathA lstrcmpiA lstrcmpA CloseHandle GlobalFree GlobalAlloc ExpandEnvironmentStringsA LoadLibraryExA FreeLibrary lstrcpyA lstrcatA FindClose MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA SetFilePointer GetModuleHandleA FindNextFileA FindFirstFileA DeleteFileA MulDiv

$PLUGINSDIR/LangDLL.dll

IMPHASH 274b99a815ba574d8c9e1712916d8b30
SHA256 d1fa47d8485b212eccd266fe5fc2be9750c4b843da78bddd2349ab58ef138b32
MD5 adad756e278127e9d31eb33d6e053740
SHA1 71943b9697441152b131a21075f5463ab40ca6ed
SHA512 047fa57a44ed2c2f214be68af1b2740591e4b508a4ca9c2eed7f84b3bb5b6f0a7c1d584e6790cc231dfbb6a23a96f826079ed5b0d9d961e95397ffc345cb7a5c
SSDEEP 48:im11EhqneMPUptuMMNvimk2BAZuMTRCpYEvJdUJvR0Jlof5dwe:F1ppl9NLBAZuYtR0Gd
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

5582

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 269d232712c86983336badb40b9e55e80052d8389ed095ebf9214964d43b6bb1
MD5 34442e1e0c2870341df55e1b7b3cccdc
SHA1 99b2fa21aead4b6ccd8ff2f6d3d3453a51d9c70c
SHA512 4a8c57fb12997438b488b862f3fc9dc0f236e07bb47b2bce6053dcb03ac7ad171842f02ac749f02dda4719c681d186330524cd2953d33cb50854844e74b33d51
SSDEEP 192:jPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4I:u7VpNo8gmOyRsVc4
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10529

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Outdwelling.Hyp

SHA256 4cf51fe0b4d60d564cbd06873509453edb23b2574ef890ff17882d98325e5175
MD5 dd394674faed2e58eec48ff0c8cbc5ed
SHA1 20360e077b9e3558c9e9d6ab157b3c5830b6f602
SHA512 16e2b869c348d05dd887f75132b2983296563c5d0d67eaf5d49927e51cea24c96944f165138b0ecd3c4a67409116ffdf4e53080a9246cb3920f2c0afc12e8290
SSDEEP 1536:0uMHPQqS1bMiTlsBWoX02o0aeT4lnAbj6pYq87VLBFsQoH61HzeMn07Y+u:0cFKmxwdRufo
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Synchromesh.Ang

SHA256 fdc548e507449fdb60b86ae6da85e70a03b38fdfdd8cc9013bdc113fc7d5b119
MD5 f18f2ae472bf23484d34a948e99e9caa
SHA1 addd7758d9f0824c9da2fd84920716d555a0159b
SHA512 5d0801a0fee2d39bee60ea348b141a7f71dfb093d06269b175a10125ab2218be60e9273f201fefcb38dd78db641c2afcf6eb6192e1b6aab30baca7637b267c44
SSDEEP 6144:JljTM/aUMnJGpWanzwXKfZgF29p6sbCmgusybd7Xx:J+/PMJGsaEKfZgF2NR1s8d7h
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Totaled/sea-8437245_640.jpg

SHA256 4b8bb7c3819baac8a1c12e2faaac080378d78ef619729e544e085eb334d433d4
MD5 fbca6d917415dab1055a4f45e510ff80
SHA1 6d16554e5abdb4be5ccf264ef5ea00ddcb2ae69b
SHA512 40c362af7726ae0ef5add6d9077e43a3dbd43be53ba75e50072b78e92ffedb3d624191f8d1355373b8a206878e67184af4faefff90434e6b0ab2139b8e939252
SSDEEP 768:bAwGpc9+U0ejNw/IiZ8hZHry9EfPNAyeBLYZc5gsA0/X9:bvyc9X0sqIRTL6EnuyJ+rA0F
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Totaled/unroots.fli

SHA256 6cc68bac06ced8108e693e1503f3ae24eaf1bdd5620497c3b05ab801a6e9174b
MD5 85d78c6067945eb258b34e228cd50702
SHA1 8c48e5014e9fd8633fa5cc16ad6f4615e8ffb79b
SHA512 d2181a76ad2e093a87b2dda38f144fa1a023eb56ea602f5097a4c39bc3818c73fec0bf61b3451fca83ba53334a6f078248828f90898ce6be3a23d4625877ee0f
MD5 SHA1 SHA512

NSIS installer

installer

bndellakridsen.bel

SHA256 b7a0180e92ecfb5fe111ba8da4a8c07b784cb4f24bcc04e268ab86aa64687467
MD5 053f7f6a4f431d3f7eb32fccd8b908bc
SHA1 2a2f65155b87c93b805e99fb89485654b77021cf
SHA512 19cec6e9d35730a7e0c38ce8606514b5ee642d0f1c01d048410d20ec7d9acc1cbb5e3e41442beaf61758de72c769fbcf892bef47adfecc667040d5dce4da4fc1
MD5 SHA1 SHA512

NSIS installer

installer

brandalarmer.txt

SHA256 e0f5d4c1c5482d54f63d39d7c3950bf668269d56d1a133d6987dfbc8977c218e
MD5 33aaf9fe646c1b07c609d7c892319d72
SHA1 0423510afad338b63fe901dfa2d579984e39389b
SHA512 d1db7c81f9358b37cd4e34b03d5b145258ced5576ea5ff177f9b2a4cf6e4f1ac1d14148949849721c8d41f4d4fe01f1bae29fb6fc6100784911a7b696adaee38
MD5 SHA1 SHA512

NSIS installer

installer

kompasskivernes.rev

SHA256 fcca29b556052190c302aca72d4601942ebb75168a359be3a5f182cca467407d
MD5 a84c9b086261860103bb4df0622e58f0
SHA1 f6ca30ef300e7d296252250d5deefadbb9df86dd
SHA512 4f7e2583b3e4d667dbc4a47d9cce79229407ce9b0e5afc86e6bbca635a7cc5aef266c0fd27463978a3d0d7b1d1867b272da0f546e89e826ebc94295d4c94fd31
SSDEEP 96:8Xl09nsDZNO4CEwLzFbjo/UPdgsT0YQ7uXBd28IOgAuRFSuhhQAGlIHsiolfAq:Wl09nsbO4dwFo/2PT03uXBdgOgAohhQx
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

reprokoteknikere.hop

SHA256 267b9b1e4ddddf650a766e04ffc312658e95fba3767f85f7b5900e287c159d76
MD5 4a639c187010581ad005f0d56022d4ab
SHA1 752ddeeec934d2b705251ab6237c59e170210eef
SHA512 8b3524c5e5dd1ef3c3021f9d3df84a6184475cae81415b874d4c65ef61f28746df2525ab5d02488b4b2476ff9ba06956b59ea8fea35971f131ec100f303e288b
SSDEEP 192:c3QwkpmY5ZXxWdCgHSyt8MX3hkaGMWPRmNMp:ZmiXGXS+8gdGMWp5p
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

sammenfolder.exh

SHA256 979a343433e9634263c5a460f2fd64e1c09dc94e8498724eb9231f0002570f02
MD5 6674ba08982c4d968a9d241eb6f1b3b6
SHA1 021d9d39ec5df9c1f842b1feb43e6f1b09a54c51
SHA512 7fa9efa647d3acc0ad2cbd9a685f37edf3e64ac0b3fd7a1f618b35017c525b4909c8066913c2b40581bbe634353dd68d2b531eb057ca97f92af23673bcc5e9a4
SSDEEP 192:OXoRXsUQpM4GQsYruCaYaBqEPwD/zf4KCiS1Q06c:42QDGLavcDPafkFQ06c
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

1c17ac3bab8bb94d79dbac1d96dc3c851a27ca69c3a58214c7f9fabc84709d1c.exe

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/LangDLL.dll

kernel32

user32

gdi32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Outdwelling.Hyp

Synchromesh.Ang

Totaled/sea-8437245_640.jpg

Totaled/unroots.fli

bndellakridsen.bel

brandalarmer.txt

kompasskivernes.rev

reprokoteknikere.hop

sammenfolder.exh

Sharing

General

Malware Config

Signatures

File Explorer

1c17ac3bab8bb94d79dbac1d96dc3c851a27ca69c3a58214c7f9fabc84709d1c.exe

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/LangDLL.dll

kernel32

user32

gdi32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Outdwelling.Hyp

Synchromesh.Ang

Totaled/sea-8437245_640.jpg

Totaled/unroots.fli

bndellakridsen.bel

brandalarmer.txt

kompasskivernes.rev

reprokoteknikere.hop

sammenfolder.exh