3a8b254e5d72bd8465898f3f7d3af731c103ad07b064a78f80b6f042213c66bd

resource
3a8b254e5d72bd8465898f3f7d3af731c103ad07b064a78f80b6f042213c66bd
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsExec.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

IMPHASH 0293eec0b5432ad092f24065016203b2
SHA256 3a8b254e5d72bd8465898f3f7d3af731c103ad07b064a78f80b6f042213c66bd
MD5 1b2cbeac6edcd04ca160e8f73275d58e
SHA1 4eb5c4db67655932f0d904dc037b44b0d486158c
SHA512 6dba4d2c3781b16faecbeadcce20b3fd6245d89a3fd587521e71d228698a098622d7f9cbff1298aa20fb3a4007d8d61d8bb49e8990441add56782ccb35718fc6
SSDEEP 12288:oXXR47mwO8E0dAjNWiyfp0/mms22qBTO7hIB+J2W+ei:KXR47NTEWANRZsHgC7Y+AWm
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

13521

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueA RegEnumKeyA RegQueryValueExA RegSetValueExA RegCloseKey RegDeleteValueA RegDeleteKeyA AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken RegOpenKeyExA RegCreateKeyExA

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA SHFileOperationA ShellExecuteExA

ole32

OleUninitialize OleInitialize IIDFromString CoCreateInstance CoTaskMemFree

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create

user32

SetDlgItemTextA GetSystemMetrics CreatePopupMenu AppendMenuA OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcA GetMessagePos CheckDlgButton LoadCursorA SetCursor GetSysColor SetWindowPos GetWindowLongA IsWindowEnabled SetClassLongA GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassA SystemParametersInfoA CreateWindowExA GetDlgItemTextA DialogBoxParamA CharNextA ExitWindowsEx DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow ShowWindow wsprintfA SendMessageTimeoutA FindWindowExA IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint MessageBoxIndirectA CharPrevA PeekMessageA GetClassInfoA DispatchMessageA TrackPopupMenu

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor

kernel32

CreateProcessA RemoveDirectoryA GetTempFileNameA CreateDirectoryA GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceA lstrcpynA SetErrorMode GetVersionExA lstrlenA GetCommandLineA GetTempPathA GetWindowsDirectoryA SetEnvironmentVariableA ExitProcess WriteFile GetCurrentProcess ReadFile GetModuleFileNameA GetFileSize CreateFileA GetTickCount Sleep SetFileAttributesA GetFileAttributesA SetCurrentDirectoryA MoveFileA GetFullPathNameA GetShortPathNameA SearchPathA CompareFileTime SetFileTime CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc GetModuleHandleA LoadLibraryExA FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA MulDiv lstrcpyA MoveFileExA lstrcatA WideCharToMultiByte GetSystemDirectoryA GetProcAddress GetExitCodeProcess WaitForSingleObject CopyFileA

$PLUGINSDIR/System.dll

IMPHASH 240ca92ecc1c291801c451c447e16c12
SHA256 7fb0f8d452fefaac789986b933df050f3d3e4feb8a8d9944ada995f572dcdca1
MD5 dd87a973e01c5d9f8e0fcc81a0af7c7a
SHA1 c9206ced48d1e5bc648b1d0f54cccc18bf643a14
SHA512 4910b39b1a99622ac8b3c42f173bbe7035ac2f8d40c946468e7db7e2868a2da81ea94da453857f06f39957dd690c7f1ba498936a7aaa0039975e472376f92e8f
SSDEEP 192:VFiQJ77pJp17C8F1A5xjGNxrgFOgb7lrT/993:97pJp48F2exrg5F/9
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10673

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsExec.dll

IMPHASH 9076fa7961baeaeda0746cb0928f486a
SHA256 bcb93204bd1854d0c34fa30883bab51f6813ab32abf7fb7d4aeed21d71f6af87
MD5 6c881f00ba860b17821d8813aa34dbc6
SHA1 0e5a1e09b1ce1bc758d6977b913a8d9ccbe52a13
SHA512 c78d6f43aa9bb35260a7bd300392ce809282660283fa6cb3059bae50d6db229b0b853cab7c949d4bdf19309fb183257b1c9feb01a66347e1c0adeb21543315b6
SSDEEP 96:DOBtYZKtPsrqBApt1JHpb9XWk7Qe06iE6mE6YNFyVOHd0+ugwEX:DtZKtrAJJJbP7iEHEbN8Ved0PM
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4231

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Jagtfalk.Fre

SHA256 fa6a8328fc5f1ddaa84af133493bb756f44c1a1a017ffc2b168f98c74f4549f9
MD5 b05cdbe092e82bc133ead5ceb28ba521
SHA1 c026fb55991f1135407fb620618a63e770c5dd28
SHA512 0b8395bb035816913403cb675d97d761e865fbdf375d9f60100c875f5ed921bd6ff30168d254dd3e9c958acf092c161687855570dbef006c26119bf9f8ab657a
SSDEEP 3072:G/k20PEcFQu5W/VKYruzWON5LUdtGKuLrhQnS0iAj7tUenna1gn7:G/YshdK51NudO/hA7tLaOn7
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Overtakes.fly

SHA256 b27b92bb984761cb945b257717d3a1e7df5bd2d7e44f34b31501fb1165cdba8f
MD5 c7688273dd442ca5afaf3620ed9cd5ec
SHA1 e57d04092bd94eba3d9712bfb77921b9193d47ec
SHA512 1ad90075674a1415209c89f2f784ccabe641d667d0bba59a6a806d377f28d5076bca72c1b8084a4b4b9f9f288d5790a3c65ac6eb99a5e7f519666c0fc4694499
SSDEEP 768:GmUFs2WPei0BaqsTk/6FZghu5YKn86BwGhBtjKhFVaWTNYhdMuFJ6aCaXu/Qcz2I:GJk7D8TYd/XwL
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Perichord.str

SHA256 e2e0bf5e5850f022ca997045b11d7ccb9aece19914280cba562e2d0500ab32a0
MD5 5b7f5b5a204cd4c13dff4d1a2bf3a2ff
SHA1 c82b59017b12848265f3e5253d7b2c375a642602
SHA512 b62108ea5758d0297d1336b7a5962172af8f47bd87843ed688d40948667dab21c963e90767f3c984677e0bca24e7aa676239271b0151d4e79d2b3feeaab2b433
SSDEEP 1536:MKijEcN9t8qPSrWSgHB5fYf7zDu7Aicv4tpo32:MKijO8YWyz7nv442
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Septifragal.fla

SHA256 593257e9fe0c432305f9de6641fb76aed417ace94a0c8e911ba4619cfa6c9d49
MD5 d8f6164d5b626b750056f5c086263bfe
SHA1 77baea4cd35680e7d8215ab4b8bdd1662c809a70
SHA512 e22d8d09390e0fdfd44aef0e8d46b1309531b3613c4b59de76950d303be1178c0b7950e3d1110a5d0afa8a26aafb3ed59c3fb90652680eed6ee187e3857a1f32
SSDEEP 24:07FJhLQiMnveli1NJH21QmvhaITgqS2m+xqa1ttVeOsSJDBxUlvFqzydVk5rO1Z/:CxMmlmb/A/gqGKdxqWIVQO1Z5EeqUr
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Sesquihydrated12.txt

SHA256 6d1f244d7bf046a00bf753bd308adc08813a8077fe52d88466989f984cb7f39b
MD5 031601aa1ef3929271b263aabf32109a
SHA1 0c40bbcb0943544337a8fadc54b64a07806dd223
SHA512 5f3358204bdab2c313ea60fbacf10aa1464f431760744804daf7152391019aec7c81106cd38df04d4a7459f36b17eb43b81ccce009d0d1012e5bc37fb3fec132
MD5 SHA1 SHA512

NSIS installer

installer

Terpe.dat

SHA256 375969793a510667a00c2cfa05960de73d89525b56abbeab7f46d66ca35a3e68
MD5 cf0d2a3273a8b26db0a56da0a08a125a
SHA1 0b4c271c9bb3371d17c3e2014043703339026ce2
SHA512 5c516dd2e0283afa7636d3d31aac9a5b4d0eb4657ef62052e81e0e4cbf42382b791ddea370ecf85a2faf2856fb0cb45fb95fe8d4959fe5aa223ea6db0ee48d22
SSDEEP 1536:/qcQq9VHd06H+BfSTO90EZWWzGTvTF+yuGxALZ5aw:mSHJifj90UrmAhN5aw
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Titanernes.Ane

SHA256 06a42a43e56ed5202e2f3ff899d1131cab297b3aacb5f3b174cd68d6b111984f
MD5 96484a19ad86f8ef4dfabd9a63744e79
SHA1 9d5b58c849e9a2e9d0ecdbb23a0778221dca648a
SHA512 a36b691eece898a94b4950001ed24f771532425264946ea57b1a34a60618d5d8264cdd473fe9263670eb03796592d0f40c2793f9182f6266cfcb3af60c1e3223
SSDEEP 96:0mc7c07FsBOlgDLq7m5MRm+yPFPjc28hHTW/ZBV5svd9x2X:7R07FsBO2DTWzsFPjMzWBb5sDx2X
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

spirographin.sur

SHA256 4605b20a04549f7fbb2de2a52ad5bdccca2ecc2b055cbf1ffcf4fffcf3b630be
MD5 6d7cad86aac0a74c29f3796365622a71
SHA1 c6567889aec60bb631d49268a92fcbaa6c153b7f
SHA512 67b4e7f874945309abad3ebb4ef3f7b3cc8a1760ec030958ccd1ac5e4ad870a5a4c82ec968e523cc0c674373faa247cddc546becda596505f92c4a7b7b6177e2
SSDEEP 1536:XMkxvTvxvJCgONOw9fXCOuAkuAAoP7lAXR3/F:XMkxrZ6NOw5pk+XR
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

talpatate.luk

SHA256 99149df7e611348d78576e332056846c7d8f55d52badd6f20df3470668bf2c9b
MD5 5c9d072769d223672e8b8296f37ec4e0
SHA1 24c03ad82ac8f9a5f3a532e73d9b2d20286a87e7
SHA512 d7b406e021a47d967bca2a915ee85cbbcb56a79833767f3ed02625904bb6cb33b48c84d185e776614e034921b1b316e9bac0b15c159bcc22472100e6c0d65864
SSDEEP 768:puPv9os7d+LwUT3cWQc+mmYW7Q6Tj2NW0VVcI9zFW+oLtLylQBWKPip+rFr:k9RUTZJa/
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer