86b6cfdcb0feccdea122debf61b51c1756e53def13a4468637539264ec35d208[.]exe

resource
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsExec.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

86b6cfdcb0feccdea122debf61b51c1756e53def13a4468637539264ec35d208.exe

IMPHASH b78ecf47c0a3e24a6f4af114e2d1f5de
SHA256 86b6cfdcb0feccdea122debf61b51c1756e53def13a4468637539264ec35d208
MD5 4a0c104a8b44b6607bf92dc24972db67
SHA1 7950f8f92c4778f16e7f10313233ea6ddec0b990
SHA512 a142af9a7c5c9221f185245ca3834432cdc5a19bca51c15d27ce51bdbf8c609e5dc75241e58616f84c3001685b923696b7ca04e97e13c54212739ed2f68e9698
SSDEEP 6144:AC2Evn/IvIrb2mU/Vy5NkiQETBtCK1A/Dsz0KIS8QxNRuv0j1JtX7PXjrnCgLa55:VnC8CmU/MjkoBtCKmwxNEgzjLEcvB0
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

05:e7:b3:7a:ce:06:74:8a:7f:2c:7f:a4:0c:6b:06:63:68:fa:78:ca:a1:56:80:79:ef:62:c0:9c:46:47:44:a4

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Brugerantallene Kunstmuseets\ ,O=Sickles,L=Fort Worth,ST=Texas,C=US

Chains

Oct 8, 2024

Minor OS version

0

Major OS version

4

Entry point

12505

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetEnvironmentVariableA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA GetFileAttributesA SetFileAttributesA GetWindowsDirectoryA GetTempPathA GetCommandLineA lstrlenA GetVersion SetErrorMode lstrcpynA ExitProcess GetFullPathNameA GlobalLock CreateThread GetLastError CreateDirectoryA CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA ReadFile WriteFile lstrcpyA MoveFileExA lstrcatA GetSystemDirectoryA GetProcAddress CloseHandle SetCurrentDirectoryA MoveFileA CompareFileTime GetShortPathNameA SearchPathA lstrcmpiA SetFileTime lstrcmpA ExpandEnvironmentStringsA GlobalUnlock GetDiskFreeSpaceA GlobalFree FindFirstFileA FindNextFileA DeleteFileA SetFilePointer GetPrivateProfileStringA FindClose MultiByteToWideChar FreeLibrary MulDiv WritePrivateProfileStringA LoadLibraryExA GetModuleHandleA GetExitCodeProcess WaitForSingleObject GlobalAlloc

user32

ScreenToClient GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard PostQuitMessage GetWindowRect EnableMenuItem CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndDialog RegisterClassA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx GetDC CreateDialogParamA SetTimer GetDlgItem SetWindowLongA SetForegroundWindow LoadImageA IsWindow SendMessageTimeoutA FindWindowExA OpenClipboard TrackPopupMenu AppendMenuA EndPaint DestroyWindow wsprintfA ShowWindow SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA

advapi32

RegDeleteKeyA SetFileSecurityA OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges RegOpenKeyExA RegEnumValueA RegDeleteValueA RegCloseKey RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/System.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 4c86b238e64ecfaabe322a70fd78db229a663ccc209920f3385596a6e3205f78
MD5 375e8a08471dc6f85f3828488b1147b3
SHA1 1941484ac710fc301a7d31d6f1345e32a21546af
SHA512 5ba29db13723ddf27b265a4548606274b850d076ae1f050c64044f8ccd020585ad766c85c3e20003a22f356875f76fb3679c89547b0962580d8e5a42b082b9a8
SSDEEP 192:MPtkumJX7zB22kGwfy0mtVgkCPOs91un:9702k5qpds9Qn
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

9995

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsExec.dll

IMPHASH 46f8b6973f33717335c0f6d8087de67b
SHA256 482536968672d70279a5204060ff84ace25237f24b1bdf3b02e289d50ea5450c
MD5 4bbc9d77ef7f748f8c85750c3a445f0a
SHA1 d57a8304bb44ccdb3163b880b3c1bb213461399d
SHA512 b9430939daab0c8b7e77b96f2f7f85e8e1abd9f43eccbdf94078f77ef05b31a2a31f04ca3a2eff5aa7cc965029ed437af2eb100c197ef51f128ca827ad20e902
SSDEEP 96:z7GUxNkO6GR0t9GKKr1Zd8NHYVVHp4dEeY3kRnHdMqqyVgN63e:fXhHR0aTQN4gRHdMqJVgNp
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4231

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Alalite.par

SHA256 1b0cc5379f7ec1137e2c7b8d19fbee13d39f3906fb183472672f0dca747abb8b
MD5 9babc1a18440cd74b49c181754afb788
SHA1 020b6b876315578dc06cc2867c71030e46b81d6d
SHA512 7cf0095e44ef353c1c4e4c4314dad10358fbc39975cdbd01ad372fd36789447cc7e137faf026b2ef8c0bdfc733701f686139f6a8266c134f221b62c38c82ac32
SSDEEP 24:hbAu4f/DrS/IFsN+EqUwPVWnBJBNyzNSRz4yDO2CnvdCt7E8I0L:hbAn/XSAE2ufNyzNSRo2NE8
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Wanderoo.Gru

SHA256 8e83c00deb3d95a9dfcb5df23de2c4d996d597dd3fa641cacba5159bc5942f0a
MD5 ffba3988254666c3690789dc07801525
SHA1 0e252a63376071d7f640feda5f10937798344b59
SHA512 7353fcbff84f47683e7eeae482edd0fef14e9b442b8578910d4a65d18e7c98ea165f1c1bec1dbe5ad27d25ed9e64af721ec1097fed032a10dcb9f8053bf2b0e5
SSDEEP 192:TT3M+INtRLfpTNe/073Jqku8wWUd5GafBVD:fLINtxfpTNS0VqnfWUdYUZ
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

faderbindings/Spejlgs.ubj

SHA256 fcde1e96c2abd35ddc6c368fb950df69f4faf48468288c1675d83d15efdb909c
MD5 69c40cf9eefd6f18bd2c9e40fcbb8d62
SHA1 6c2897596d573ed6e181841f9aef33a23bc929d1
SHA512 9c823d0c38ff5bcad2cda2240f9e30629beab90f2a23497168bed89747eac50841925f1e93461b6581ed4cf66acea51e75f9e54dc3e2905c34d8480c4c1015d3
SSDEEP 1536:qpOL86w5AvjPBTkVAoTAvyhoodBiyy0xnfeh:eOLPENL3B7xnWh
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

faderbindings/detribalizes.che

SHA256 e00a419c9417990e9bda1bfa18f5f581bb122c040ff55b9e568fd6ef37fcf95c
MD5 3fbbae88839eb3ee4c6dddff9c4bfb38
SHA1 556538d79a8da0478061627e0f190eb8aebd34c3
SHA512 a559f8b4613dbecaadda84c832bfb704c1161385f9ba43f8a1b2a95643ead42b67dcc7d13cd9408a0c277414e1b3d6400543838c54b17270c4375afbb38dc1e3
SSDEEP 768:FYLb7q19OkbXuMTAAMUBB2MVKfSW3iotinb51lyHNelE+dxz7ywoOeWvxtNoEGgw:QkeCsMBN5vsNA13HVQqfvFYUaUQUxb
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

faderbindings/gennes.txt

SHA256 9fd3ca3dc36a34c7c1a3fa5bd5049b63cd6c5cdbbfae0e978348146cef872763
MD5 d12496cb10de733506d419aac71cd554
SHA1 31010c1b951e30989f67e044e5d65c8cd6fdea63
SHA512 d0b59c7063e4af8d836763e1362279a30623d196d7c708ddb8a7d55d63fbe13d0413f9ee636e152995a49e95a883507f4171b7f653a7d24900e9120161ae723f
MD5 SHA1 SHA512

NSIS installer

installer

vandtrdning.Rod

SHA256 9fd1b1f5d10e6e9e979c01090e389d84677e43948a9409313221e16c83f09297
MD5 60f48dc4a31c11afba07248f0fd0c635
SHA1 9196386de066cb44476bc9e95c1994fbf35f5db6
SHA512 80516ed40da382ed7366d73a578b5aac9eaa792d1530714ed78a79201f81a3305dee014274d9bf67e747958847b8ec922cff0d097e3d15ebc284aa152f1f5c4e
SSDEEP 3072:DkRa2kQSoXsNvU1xCivJZotbVj/r4RsV1rVGhH0hPQ3Tdi:H4XsNOKtAsV1uUG3Bi
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

86b6cfdcb0feccdea122debf61b51c1756e53def13a4468637539264ec35d208.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/nsExec.dll

kernel32

user32

advapi32

generic

Alalite.par

Wanderoo.Gru

faderbindings/Spejlgs.ubj

faderbindings/detribalizes.che

faderbindings/gennes.txt

vandtrdning.Rod

Sharing

General

Malware Config

Signatures

File Explorer

86b6cfdcb0feccdea122debf61b51c1756e53def13a4468637539264ec35d208.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/nsExec.dll

kernel32

user32

advapi32

generic

Alalite.par

Wanderoo.Gru

faderbindings/Spejlgs.ubj

faderbindings/detribalizes.che

faderbindings/gennes.txt

vandtrdning.Rod