FACTURA-0055[.]exe

resource
unpack001/$PLUGINSDIR/System.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

FACTURA-0055.exe

IMPHASH ced282d9b261d1462772017fe2f6972b
SHA256 e8b0ae0b538855299301ba758e7064d59a05e75ac8469156dac3cbab4b56c937
MD5 f7a24870d5299a3f89dae6a25c3889a6
SHA1 5e352f6f8fa9eefb48048309daeaf985aeb64321
SHA512 ee234cac02ed83eed3f82b1707e02c30299a81d12fb02fe119aea512629576ff1bbf160a515e0df117d3ae92fab0956c4e12d4dc2b3a2a45bc239f3e48ecb8e0
SSDEEP 24576:EiGFaq43NvCH2BLmBVfdywujTrlC6hBrlhJ/QOeal:EiGFu3Nv2Vy/dC+FlhJ/qal
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

46:5f:5a:25:64:58:88:c1:26:e1:73:1d:4b:2a:34:9d:b6:a3:aa:0c:e9:0d:b7:50:4c:08:b9:75:61:fa:7c:f7

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Klagede Daktyliske\ ,L=Tranquillity,ST=California,C=US,1.2.840.113549.1.9.1=#0c1a4f7574776172647340556e6174726f706869656435332e466172

Chains

Oct 9, 2024

PE Signature issue

Digest

71:2b:75:47:33:05:e0:05:57:88:f7:aa:d2:93:61:00:a4:7a:f6:ff

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Klagede Daktyliske\ ,L=Tranquillity,ST=California,C=US,1.2.840.113549.1.9.1=#0c1a4f7574776172647340556e6174726f706869656435332e466172

Chains

Oct 9, 2024

Minor OS version

0

Major OS version

4

Entry point

13128

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCreateKeyExA RegEnumKeyA RegQueryValueExA RegSetValueExA RegCloseKey RegDeleteValueA RegDeleteKeyA AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken SetFileSecurityA RegOpenKeyExA RegEnumValueA

shell32

SHGetFileInfoA SHFileOperationA SHGetPathFromIDListA ShellExecuteExA SHGetSpecialFolderLocation SHBrowseForFolderA

ole32

IIDFromString OleInitialize OleUninitialize CoCreateInstance CoTaskMemFree

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

SetClipboardData CharPrevA CallWindowProcA PeekMessageA DispatchMessageA MessageBoxIndirectA GetDlgItemTextA SetDlgItemTextA GetSystemMetrics CreatePopupMenu AppendMenuA TrackPopupMenu FillRect EmptyClipboard LoadCursorA GetMessagePos CheckDlgButton GetSysColor SetCursor GetWindowLongA SetClassLongA SetWindowPos IsWindowEnabled GetWindowRect GetSystemMenu EnableMenuItem RegisterClassA ScreenToClient EndDialog GetClassInfoA SystemParametersInfoA CreateWindowExA ExitWindowsEx DialogBoxParamA CharNextA SetTimer DestroyWindow CreateDialogParamA SetForegroundWindow SetWindowTextA PostQuitMessage SendMessageTimeoutA ShowWindow wsprintfA GetDlgItem FindWindowExA IsWindow GetDC SetWindowLongA LoadImageA InvalidateRect ReleaseDC EnableWindow BeginPaint SendMessageA DefWindowProcA DrawTextA GetClientRect EndPaint IsWindowVisible CloseClipboard OpenClipboard

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateFontIndirectA CreateBrushIndirect DeleteObject SetTextColor SelectObject

kernel32

GetExitCodeProcess WaitForSingleObject GetProcAddress GetSystemDirectoryA WideCharToMultiByte MoveFileExA ReadFile GetTempFileNameA WriteFile RemoveDirectoryA CreateProcessA CreateFileA GetLastError CreateThread CreateDirectoryA GlobalUnlock GetDiskFreeSpaceA GlobalLock SetErrorMode GetVersion lstrcpynA GetCommandLineA GetTempPathA lstrlenA SetEnvironmentVariableA ExitProcess GetWindowsDirectoryA GetCurrentProcess GetModuleFileNameA CopyFileA GetTickCount Sleep GetFileSize GetFileAttributesA SetCurrentDirectoryA SetFileAttributesA GetFullPathNameA GetShortPathNameA MoveFileA CompareFileTime SetFileTime SearchPathA lstrcmpiA lstrcmpA CloseHandle GlobalFree GlobalAlloc ExpandEnvironmentStringsA LoadLibraryExA FreeLibrary lstrcpyA lstrcatA FindClose MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA SetFilePointer GetModuleHandleA FindNextFileA FindFirstFileA DeleteFileA MulDiv

$PLUGINSDIR/System.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 269d232712c86983336badb40b9e55e80052d8389ed095ebf9214964d43b6bb1
MD5 34442e1e0c2870341df55e1b7b3cccdc
SHA1 99b2fa21aead4b6ccd8ff2f6d3d3453a51d9c70c
SHA512 4a8c57fb12997438b488b862f3fc9dc0f236e07bb47b2bce6053dcb03ac7ad171842f02ac749f02dda4719c681d186330524cd2953d33cb50854844e74b33d51
SSDEEP 192:jPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4I:u7VpNo8gmOyRsVc4
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10529

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Dbt.gds

SHA256 40d51ec1f992208fc04995cc4046a6d8e58b3f66c98b9ef28d068104446f4945
MD5 58810c02fbab0a4b1b2e4f25427b67ad
SHA1 ca0d4c2b68a6e7ea9dff245414ab93a52b6e7dd3
SHA512 6a5b34505dea12fd345b1c80abd8cd8978e9803127212ba42c1b6dc2df497cc2d13530b1836cbb37b24860e2a0466647a3e774536f4710201f2949e5b2a15c30
SSDEEP 6144:MaKE8u8EI2oCmEkRdzFG2MNAMDz9gOOM/D:Mb9z2OO5NntgI
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Preintercourse/Kaukas.Udv

SHA256 8f2105a22271c3892906eb4160d4fc86b78e9d96554d28e196b8b8f7f2a8f84a
MD5 13b7bf80bd5e860e3518d8b90935458b
SHA1 263598708cca55dbb2847b2655ef70b070b44202
SHA512 6da10c4a5202f91c4acfd7005093afb305cfe9fbb028ef56adfde48b00c9d2e7b08a4dc6b7eabb5f880bcc023edbf78d8a28fbc0164cb73fb7747287aae11a63
SSDEEP 1536:OPJTwDSYt5E+uNse4ObP0QtEpom3IFIDovKU0OC4FIhHt8B0i91Duv0Qv9UfRO9X:OP4tFImVL8P3DIwk3qOhZwxCLa9dGNSY
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Preintercourse/computerskrmen.dem

SHA256 b3e34975017c193d4672bec42bc52b55f8ae1f1d5f30d56dcfd0b3a4242c3be4
MD5 580d05e679e74b036b55ca8e5ff32769
SHA1 10175c43ab7b725fffcf770eb2c3555e91d3ba13
SHA512 0e26f0084bed372785a5e8c8be3a0717074aa52c2e8b5413fa9f2cb8deed40bf8bdbf15c411effa432a8b96e50ae6085e8f90a97350827afaa1be1ab4b3e1643
SSDEEP 768:bgBMgq+aLnwfPnz/Km1iLGyDPiU55NCk+T93YpnK77oTpvYP3knePjlW0kwNGL+q:XQ3wvosOsCpxFJrXSBmHzTu58UR
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Preintercourse/predictors.dut

SHA256 c65f223375c6dfe8ce71213d5dd24f39cde31f772d2c66521bf07b21be45e6c1
MD5 2a500e1219c4894e2d45c32c5a5a11fd
SHA1 ac9a88de4c84e1eb8a535e1061cbc6584380d24e
SHA512 89ed91af91cf969fe7ec087ee107b52959582615efb2ab72a21d6c3820e5bdda78ee02eb39bb323fd996d85510627387616df8917b12052a62d288d8e9448596
SSDEEP 768:8mGX5iY6YFC1hSNYG8n6aCKBHwcX7e3ZNrt7qNIxKpGEopKfWOO72cDEDQ+7IF5i:m5ittaAwW6q8KH13QyOgs2w
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Preintercourse/receptionssekretrer.bin

SHA256 7390780c6fb1f7b57c950a11ae287127cb6144ce9ad1c26e8c242badb685729b
MD5 5465b75724c031b21c018f7d72941f72
SHA1 98176b27a41a35401a96d0aac0859eec25a4c5fe
SHA512 7084191b13ff854943dee9fb6ddc1d7f89d06055ff4da7e04da1c359b557ac22762209b8dfe061f3af628df077e1d1d1009e9f9a18e3c9441aee7fd4fdff1688
SSDEEP 1536:f6KFImN7hPg1fMcZ9pkK6m1rmkrDAji7VW9EgfrY:PyMtabPE+7ctfM
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Preintercourse/serenissimi.txt

SHA256 1e8abb4a5e85595b0ef2fc73e9012eddfe1bcb7363e90a2ea46f561dd3742f93
MD5 b089bd0cbc944de0b1023e6ce9318bd3
SHA1 715fa74e243d5c3419519e7371ed1836c9bcfa4a
SHA512 a164eb2ab02e612e9f96531006c4a71b8d6e8ea6444d86907cb15ef2c1aab4680eaf3bb580c6a1d5b89a3f454f3e532242fc1de2b71a9fff56f812f6e4638885
MD5 SHA1 SHA512

NSIS installer

installer

FACTURA-0055.exe

PE Signature issue

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Dbt.gds

Preintercourse/Kaukas.Udv

Preintercourse/computerskrmen.dem

Preintercourse/predictors.dut

Preintercourse/receptionssekretrer.bin

Preintercourse/serenissimi.txt

Sharing

General

Malware Config

Signatures

File Explorer

FACTURA-0055.exe

PE Signature issue

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Dbt.gds

Preintercourse/Kaukas.Udv

Preintercourse/computerskrmen.dem

Preintercourse/predictors.dut

Preintercourse/receptionssekretrer.bin

Preintercourse/serenissimi.txt