Quotation[.]scr[.]exe

resource
Quotation.scr.exe
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsExec.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

Quotation.scr.exe

IMPHASH 5f0c714c36e6cc016b3a1f4bc86559e4
SHA256 a01a62156170d2f163507a09320efe3ac4112be7ac0e82752799963c6603a095
MD5 c4480b58328126c07e887230ad86d282
SHA1 7c226422b08bdf0e3258b9e8d52d1a30a80bd567
SHA512 95479cd3368aea9ee77f7398a9870843c4bbe9b26f8dfc1b0b199e6508513863354f087b447e0691f60d271b79511786b749cbd996f99d470e899936597e79b1
SSDEEP 12288:Ck13jLO9cLkxp6qu07AoF6DrGUnekSnea5+Ns054Pio:C036Qk79uWAoF8ZOSscSd
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

13181

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCreateKeyExA RegEnumKeyA RegQueryValueExA RegSetValueExA RegCloseKey RegDeleteValueA RegDeleteKeyA AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken SetFileSecurityA RegOpenKeyExA RegEnumValueA

shell32

SHGetFileInfoA SHFileOperationA SHGetPathFromIDListA ShellExecuteExA SHGetSpecialFolderLocation SHBrowseForFolderA

ole32

IIDFromString OleInitialize OleUninitialize CoCreateInstance CoTaskMemFree

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

SetClipboardData CharPrevA CallWindowProcA PeekMessageA DispatchMessageA MessageBoxIndirectA GetDlgItemTextA SetDlgItemTextA GetSystemMetrics CreatePopupMenu AppendMenuA TrackPopupMenu FillRect EmptyClipboard LoadCursorA GetMessagePos CheckDlgButton SetWindowPos SetCursor GetSysColor SetClassLongA GetWindowLongA IsWindowEnabled GetWindowRect GetSystemMenu EnableMenuItem RegisterClassA ScreenToClient EndDialog GetClassInfoA SystemParametersInfoA CreateWindowExA ExitWindowsEx DialogBoxParamA CharNextA SetTimer DestroyWindow CreateDialogParamA SetForegroundWindow SetWindowTextA PostQuitMessage SendMessageTimeoutA ShowWindow wsprintfA GetDlgItem FindWindowExA IsWindow GetDC SetWindowLongA LoadImageA InvalidateRect ReleaseDC EnableWindow BeginPaint SendMessageA DefWindowProcA DrawTextA GetClientRect EndPaint IsWindowVisible CloseClipboard OpenClipboard

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateFontIndirectA CreateBrushIndirect DeleteObject SetTextColor SelectObject

kernel32

GetExitCodeProcess WaitForSingleObject GetProcAddress GetSystemDirectoryA WideCharToMultiByte MoveFileExA ReadFile GetTempFileNameA WriteFile RemoveDirectoryA CreateProcessA CreateFileA GetLastError CreateThread CreateDirectoryA GlobalUnlock GetDiskFreeSpaceA GlobalLock SetErrorMode GetVersionExA lstrcpynA GetCommandLineA GetTempPathA lstrlenA SetEnvironmentVariableA ExitProcess GetWindowsDirectoryA GetCurrentProcess GetModuleFileNameA CopyFileA GetTickCount Sleep GetFileSize GetFileAttributesA SetCurrentDirectoryA SetFileAttributesA GetFullPathNameA GetShortPathNameA MoveFileA CompareFileTime SetFileTime SearchPathA lstrcmpiA lstrcmpA CloseHandle GlobalFree GlobalAlloc ExpandEnvironmentStringsA LoadLibraryExA FreeLibrary lstrcpyA lstrcatA FindClose MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA SetFilePointer GetModuleHandleA FindNextFileA FindFirstFileA DeleteFileA MulDiv

$PLUGINSDIR/System.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 c7a20bcaa0197aedddc8e4797bbb33fdf70d980f5e83c203d148121c2106d917
MD5 792b6f86e296d3904285b2bf67ccd7e0
SHA1 966b16f84697552747e0ddd19a4ba8ab5083af31
SHA512 97edc3410b88ca31abc0af0324258d2b59127047810947d0fb5e7e12957db34d206ffd70a0456add3a26b0546643ff0234124b08423c2c9ffe9bdec6eb210f2c
SSDEEP 192:rFiQJ771Jt17C8F1A5xjGNNvgFOiLb7lrT/L93:X71Jt48F2eNvgFF/L
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10673

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsExec.dll

IMPHASH e269b6260a93a17ceff5184b3982ded8
SHA256 10675f13abaee592f14382349aa35d82fb52aab4e27eef61d0c83dec1f6b73da
MD5 5aa38904acdcc21a2fb8a1d30a72d92f
SHA1 a9ce7d1456698921791db91347dba0489918d70c
SHA512 f04740da561d7cd0dea5e839c9e1c339d4a3e63944d3566c94c921a3d170a69918a32dff3f3b43f13d55cc25a2dbb4c21104f062c324308ac5104179766402a3
SSDEEP 96:AOBtEB2flLkatAthPZJoi9jpfW/er6cBbcB/NFyVOHd0+uHwEX:AhB2flXAVJtjf6cBbcB/N8Ved0PZ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4231

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Feltbeskrivelsernes/akilleshles.bur

SHA256 1edae1aefe70ccba599760888cd2cf641b1539f1d0a569261c55dc11a50d84b1
MD5 2ef7e321c82d59579c325034f74ba4ad
SHA1 086f45a146595a46c9bc849312b89f1b5bcde6d2
SHA512 d642c90ca8c70ddef043dbe4fdefdc99ae598780b1fd59492fd2d1dfeeb5f53fbeeaaa1154e560e9d2a44b717cc440c6b3aa581c3952d3e54bcda249d892686d
SSDEEP 768:WenmVh/k7TozK55riAiNJ8t6443KBt7zHZNRpyqMWed:rUKP+8jnxa
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Feltbeskrivelsernes/citerens.bra

SHA256 4f80e6f1db419dd5d623d7e185f74d90c52799a302db99bd6ccc9e2b6295f570
MD5 888f177e0683b79b6d441af045b326f4
SHA1 03d9a09ef833cfe221a90772d1e4546fd0d4261f
SHA512 39fb92d4e9a5237296756437807c16f76083cb294065df3fa5faf827c814550ef48c150f2ad0f9739d91b06e24f2c379d148aaf0480f66bfdf7c62c4cca4d91b
SSDEEP 768:M9DhluOoe1fMZfFHPVpwCVms1Q0A8CbD4tGpx7QLicW2UkOkGBSbSmLssM:Mlta/Vt1J1M7aXip
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Feltbeskrivelsernes/henneth.boh

SHA256 8549c87de02847950bc65caf8e7039e9fc293640eb0f850adee9064dfad7a9d6
MD5 13b1b7ab14ded226678354f654062a36
SHA1 56555b9c396c1cfa7b289f9b34c1f85f5bdc9f93
SHA512 695d2bb1ea2d32057a6768de4e82c8e3d37d7ee8a2cd47c066543e4f8daccf4db1e5d0e7d28e80d239c294df07b455aed12935387900eb0cd831f3f0658a5c15
SSDEEP 48:FtQQBWTu5fmY59wxRv/TOi9AWFM0P2osj5OIAtF6/8JF6:MQg65mDi8CjcDa
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Feltbeskrivelsernes/irresiliency.fen

SHA256 503c39408403116ff0322dbd262b6a7c9506db4c4c9385c7612ad2bfdc038d1a
MD5 9a8bb2f18f1f388a6669feb7359b8c5f
SHA1 502b38f86935cd011c01ad85f74a9d7256a1f959
SHA512 519d83d5da40f6759a6f137aee1c26384548da7f3c9c0773f5eb6588868945f5bec8971aba8adbc75da8a2fe4170f2c070350b3294b18f893bf77b684bdeba68
SSDEEP 768:rl5hQMLbU5wLoRCnqzRjuoQYSwX8aCW6xQFO+iFmxa1L1xQsbPQTGFH3sS+DQgUR:ja8aMhFmU1j4McsKXdO0kp
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Feltbeskrivelsernes/maniform.lic

SHA256 317b6fb5e8bf3be3b1917e7efc4292769981a0e9ccbe9dfce0d8f50b22b89f2a
MD5 a743239852b769682031b0202afc0c2f
SHA1 579b06715fcb9d8afbbf4cf804f0d395503863f8
SHA512 b433da21c70cf611454ee73c2045914c9ee66aa799c18b6571e0aa8b2ef67936e505187b28b6d734db96f5e1e746c337aed7d0d1c88c005f62f718f0b5f19688
SSDEEP 768:iRJ349wvwq1AYt/DHNrr+C6+qBvXngt3yY1kidN6zyBSelQBOkFKi2HT78bExsQ0:in3pTNZUu1LJohx3t
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Hudormene.svr

SHA256 ad2abcddcf963acc3388796ee9a8aeed2e206ae39c1ab4989577bebacd55b6f2
MD5 2f94bab742d098f603582b5a87070472
SHA1 f366400d7d1c460129f626c56cf5447f4204cacb
SHA512 06fbc422a8c6d361bdc45679d4fe991b5c4db5ef171e3ef1b4688e001cd489674d7b12a87aab6df1e226236f1c586693248dfe1ef904e10c6dbf76afc1580d77
SSDEEP 768:Ce4jUurc2sdFwiUbkifCHsn6ZBsOUWUAlCLv7QiGXZwsc:GeMrMKvUc
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Nationalbudgetternes.Oms

SHA256 7529524aaee315f4e5d57e46988a86a6a62c1e6aa97dd82ed43d58cea9d2f208
MD5 bc3219013431b736152718b854d5d0d8
SHA1 8ad9b89b3ccc420e46c78145a80dfcccb6dd5582
SHA512 2ec8880c39560b62a852aa717f7b0167bb7c565f2a1cbbe08dc619b7fa98d59e62ce478076d179045284ae5c188b0a2f26a821c88a32d26465a2130c85deb6d6
SSDEEP 3072:Fwrah2wnXGV8IPPMO9mT56hBJIiPga01hW8l9S36ytAACAH:Ga2rVQO9M5MBJI3nWGaf
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Rhodosperm.Tra

SHA256 ac52f6d6464b58b716a6d3c83df4f90695d3ec7f446fce63e2be0efb781cb201
MD5 e519aabb8c8189f20d6c50ed622694e1
SHA1 586b88267558899013c45562c75bfed299c4803e
SHA512 c4bcb0f7c82fe517b180dbcbe36709f136fb832636f647a83f36829c7e6abaab394787958583260360f6749a87ca4baa2ed39ec9689f80e94b874ac4b531e5df
SSDEEP 192:hFMAK1b8x1A8/hQhiaJ8f418h2y5lsoAvQajIsWXOs4QrIx:hib1b8Q8/h94Oh9soO1jIdXO1Qsx
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Tolvmandsforeningernes/Trod.txt

SHA256 ffcaffd73f4661c5bfc8f7aaf1a048a2f7627b6d9e05aa23cdb5a48ec5c5b336
MD5 2c00d966cfdff8b11c0f33d2ba87cf2a
SHA1 95762821a7f3231ca97a2e5907cca9330b0727f0
SHA512 003c54ea50b56e01632dbc49713d4f3c2ff4c97e43d7ee356fba5e435aaad92e0edebfdc030ecaf693621f0254f3f19744cc14e1f7681daff6c41355386d4a41
MD5 SHA1 SHA512

NSIS installer

installer

Quotation.scr.exe

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/nsExec.dll

advapi32

user32

kernel32

generic

Feltbeskrivelsernes/akilleshles.bur

Feltbeskrivelsernes/citerens.bra

Feltbeskrivelsernes/henneth.boh

Feltbeskrivelsernes/irresiliency.fen

Feltbeskrivelsernes/maniform.lic

Hudormene.svr

Nationalbudgetternes.Oms

Rhodosperm.Tra

Tolvmandsforeningernes/Trod.txt

Sharing

General

Malware Config

Signatures

File Explorer

Quotation.scr.exe

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/nsExec.dll

advapi32

user32

kernel32

generic

Feltbeskrivelsernes/akilleshles.bur

Feltbeskrivelsernes/citerens.bra

Feltbeskrivelsernes/henneth.boh

Feltbeskrivelsernes/irresiliency.fen

Feltbeskrivelsernes/maniform.lic

Hudormene.svr

Nationalbudgetternes.Oms

Rhodosperm.Tra

Tolvmandsforeningernes/Trod.txt