c62df0729acd9f8e1b3b922113242fc75a746b15d184cbbcf7a429fe4730bd98[.]exe

resource
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsExec.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

c62df0729acd9f8e1b3b922113242fc75a746b15d184cbbcf7a429fe4730bd98.exe

IMPHASH b78ecf47c0a3e24a6f4af114e2d1f5de
SHA256 c62df0729acd9f8e1b3b922113242fc75a746b15d184cbbcf7a429fe4730bd98
MD5 07174a2dcc7016ccef4cd9cbc04e5652
SHA1 c19c203341b04f71b432f5228daaafb44e25514f
SHA512 bd5910f9123941af67d844bfa09b53c8cd0de863163b32b8bbde4ef85356951bbce2858587727bd2ff8b39dbec9618eccb135051bc150b6217a3d55fbb9cd692
SSDEEP 6144:xC2Evn/IvIrb2m3El3AoZIvdRLM2fwk6IeldVU8lwDDtoNRuv0j1JtX7PXjrnCgN:YnC8Cmu3AMWwk6jdVUcwHeNEgzjLEcvH
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

ff:f7:b4:c6:bd:55:e6:65:db:50:3c:62:8c:9d:06:6d:59:f1:91:b4:e7:41:84:c4:a7:e4:bc:ee:94:02:2c:82

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Aandsretnings Fetishising Planers\ ,O=Armbaandsur,L=Castledawson,ST=Northern Ireland,C=GB

Chains

Oct 8, 2024

Minor OS version

0

Major OS version

4

Entry point

12505

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetEnvironmentVariableA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA GetFileAttributesA SetFileAttributesA GetWindowsDirectoryA GetTempPathA GetCommandLineA lstrlenA GetVersion SetErrorMode lstrcpynA ExitProcess GetFullPathNameA GlobalLock CreateThread GetLastError CreateDirectoryA CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA ReadFile WriteFile lstrcpyA MoveFileExA lstrcatA GetSystemDirectoryA GetProcAddress CloseHandle SetCurrentDirectoryA MoveFileA CompareFileTime GetShortPathNameA SearchPathA lstrcmpiA SetFileTime lstrcmpA ExpandEnvironmentStringsA GlobalUnlock GetDiskFreeSpaceA GlobalFree FindFirstFileA FindNextFileA DeleteFileA SetFilePointer GetPrivateProfileStringA FindClose MultiByteToWideChar FreeLibrary MulDiv WritePrivateProfileStringA LoadLibraryExA GetModuleHandleA GetExitCodeProcess WaitForSingleObject GlobalAlloc

user32

ScreenToClient GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard PostQuitMessage GetWindowRect EnableMenuItem CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndDialog RegisterClassA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx GetDC CreateDialogParamA SetTimer GetDlgItem SetWindowLongA SetForegroundWindow LoadImageA IsWindow SendMessageTimeoutA FindWindowExA OpenClipboard TrackPopupMenu AppendMenuA EndPaint DestroyWindow wsprintfA ShowWindow SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA

advapi32

RegDeleteKeyA SetFileSecurityA OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges RegOpenKeyExA RegEnumValueA RegDeleteValueA RegCloseKey RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/System.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 4c86b238e64ecfaabe322a70fd78db229a663ccc209920f3385596a6e3205f78
MD5 375e8a08471dc6f85f3828488b1147b3
SHA1 1941484ac710fc301a7d31d6f1345e32a21546af
SHA512 5ba29db13723ddf27b265a4548606274b850d076ae1f050c64044f8ccd020585ad766c85c3e20003a22f356875f76fb3679c89547b0962580d8e5a42b082b9a8
SSDEEP 192:MPtkumJX7zB22kGwfy0mtVgkCPOs91un:9702k5qpds9Qn
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

9995

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsExec.dll

IMPHASH 46f8b6973f33717335c0f6d8087de67b
SHA256 482536968672d70279a5204060ff84ace25237f24b1bdf3b02e289d50ea5450c
MD5 4bbc9d77ef7f748f8c85750c3a445f0a
SHA1 d57a8304bb44ccdb3163b880b3c1bb213461399d
SHA512 b9430939daab0c8b7e77b96f2f7f85e8e1abd9f43eccbdf94078f77ef05b31a2a31f04ca3a2eff5aa7cc965029ed437af2eb100c197ef51f128ca827ad20e902
SSDEEP 96:z7GUxNkO6GR0t9GKKr1Zd8NHYVVHp4dEeY3kRnHdMqqyVgN63e:fXhHR0aTQN4gRHdMqJVgNp
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4231

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Alalite.par

SHA256 1b0cc5379f7ec1137e2c7b8d19fbee13d39f3906fb183472672f0dca747abb8b
MD5 9babc1a18440cd74b49c181754afb788
SHA1 020b6b876315578dc06cc2867c71030e46b81d6d
SHA512 7cf0095e44ef353c1c4e4c4314dad10358fbc39975cdbd01ad372fd36789447cc7e137faf026b2ef8c0bdfc733701f686139f6a8266c134f221b62c38c82ac32
SSDEEP 24:hbAu4f/DrS/IFsN+EqUwPVWnBJBNyzNSRz4yDO2CnvdCt7E8I0L:hbAn/XSAE2ufNyzNSRo2NE8
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Helioid11/Spejlgs.ubj

SHA256 fcde1e96c2abd35ddc6c368fb950df69f4faf48468288c1675d83d15efdb909c
MD5 69c40cf9eefd6f18bd2c9e40fcbb8d62
SHA1 6c2897596d573ed6e181841f9aef33a23bc929d1
SHA512 9c823d0c38ff5bcad2cda2240f9e30629beab90f2a23497168bed89747eac50841925f1e93461b6581ed4cf66acea51e75f9e54dc3e2905c34d8480c4c1015d3
SSDEEP 1536:qpOL86w5AvjPBTkVAoTAvyhoodBiyy0xnfeh:eOLPENL3B7xnWh
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Helioid11/Vrdihftet.Fds

SHA256 55f3bf23464b6f4a0fc5cf57028cdc7f108e9841399347cf29c2f8a4f24e1927
MD5 4f3407deb63e773409fc4c067a49cfa7
SHA1 063d8437395b019a0422a5dd9d29f2deed76dae0
SHA512 16ba5f68e0a67226104471cb51ca002ebaa923c27fec092aa06e6c66501e181b3906515863f1537baeca6e180284301c170100e4fff3961a5aa9a94524c8d2da
SSDEEP 192:HE5kiGeGJE7dAn4x+kN5PEC1i242wfY7UCVb9RlN:AkMGJE7dc4x+kN5PEGi24/nUb9RlN
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Helioid11/detribalizes.che

SHA256 e00a419c9417990e9bda1bfa18f5f581bb122c040ff55b9e568fd6ef37fcf95c
MD5 3fbbae88839eb3ee4c6dddff9c4bfb38
SHA1 556538d79a8da0478061627e0f190eb8aebd34c3
SHA512 a559f8b4613dbecaadda84c832bfb704c1161385f9ba43f8a1b2a95643ead42b67dcc7d13cd9408a0c277414e1b3d6400543838c54b17270c4375afbb38dc1e3
SSDEEP 768:FYLb7q19OkbXuMTAAMUBB2MVKfSW3iotinb51lyHNelE+dxz7ywoOeWvxtNoEGgw:QkeCsMBN5vsNA13HVQqfvFYUaUQUxb
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Helioid11/gennes.txt

SHA256 9fd3ca3dc36a34c7c1a3fa5bd5049b63cd6c5cdbbfae0e978348146cef872763
MD5 d12496cb10de733506d419aac71cd554
SHA1 31010c1b951e30989f67e044e5d65c8cd6fdea63
SHA512 d0b59c7063e4af8d836763e1362279a30623d196d7c708ddb8a7d55d63fbe13d0413f9ee636e152995a49e95a883507f4171b7f653a7d24900e9120161ae723f
MD5 SHA1 SHA512

NSIS installer

installer

Sclerotitic.Tek63

SHA256 ab16fe914f494a566ac21f568e1cfe72ec0adb7a7a09a71e4920fee68614c1e1
MD5 15f0370836cc462d7132d9f3e28970ad
SHA1 97a18189d4191a9ef8e0d80b5881431b9508b1be
SHA512 46dc8e8263acf3ac4fc9b7e7c689b5742475ca5e76f2f09608c81039e15182bd8fcc5b76003b80f68b234263f314cfa16ba19fc42bd77d50b08286046c4630da
SSDEEP 3072:AXcpZyPMOW1UgD61aL3r7jG6Peua7HgE5YASyOPvKwGhGiMK2o18mWBW1NHdiQQ:AMpLOW1UgOsLvHygEKYwjK2o18hW1FdG
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

c62df0729acd9f8e1b3b922113242fc75a746b15d184cbbcf7a429fe4730bd98.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/nsExec.dll

kernel32

user32

advapi32

generic

Alalite.par

Helioid11/Spejlgs.ubj

Helioid11/Vrdihftet.Fds

Helioid11/detribalizes.che

Helioid11/gennes.txt

Sclerotitic.Tek63

Sharing

General

Malware Config

Signatures

File Explorer

c62df0729acd9f8e1b3b922113242fc75a746b15d184cbbcf7a429fe4730bd98.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/nsExec.dll

kernel32

user32

advapi32

generic

Alalite.par

Helioid11/Spejlgs.ubj

Helioid11/Vrdihftet.Fds

Helioid11/detribalizes.che

Helioid11/gennes.txt

Sclerotitic.Tek63