21bca3ed380aff98138bc26cc631cfaa7eedd098e3da694e8eef350b23afceda[.]exe

resource
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsExec.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

21bca3ed380aff98138bc26cc631cfaa7eedd098e3da694e8eef350b23afceda.exe

IMPHASH 5f0c714c36e6cc016b3a1f4bc86559e4
SHA256 21bca3ed380aff98138bc26cc631cfaa7eedd098e3da694e8eef350b23afceda
MD5 caef1be333db06e88325e3cf82c27fe1
SHA1 24d30b606727d8739c0fcd8f5d0d6c76dfdf7a3c
SHA512 e93bb19b775af0d2928230baa2541f538adb72ff51ff0b8d92cc7c3bcbbbdef6535729d22c190d0b914c281dc1479364745cb073e43ecc0e6ab8af45ca94da3b
SSDEEP 12288:n/v3K20gS7RPJddE9MVl01amNw3I372nX2ixR5dwG36OoZf+:n/CWS7XoKmNw3s2nh5dVKON
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

42:7c:84:e3:7e:73:1a:b3:f7:50:8e:eb:71:ce:7e:d1:2c:f0:a1:df:f2:1d:df:3d:5c:46:af:64:cc:00:01:83

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Olycook Meddelelsernes Derivedness\ ,O=Lithofracteur,L=Saint-Léger-de-Rotes,ST=Normandie,C=FR

Chains

Oct 9, 2024

Minor OS version

0

Major OS version

4

Entry point

13181

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCreateKeyExA RegEnumKeyA RegQueryValueExA RegSetValueExA RegCloseKey RegDeleteValueA RegDeleteKeyA AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken SetFileSecurityA RegOpenKeyExA RegEnumValueA

shell32

SHGetFileInfoA SHFileOperationA SHGetPathFromIDListA ShellExecuteExA SHGetSpecialFolderLocation SHBrowseForFolderA

ole32

IIDFromString OleInitialize OleUninitialize CoCreateInstance CoTaskMemFree

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

SetClipboardData CharPrevA CallWindowProcA PeekMessageA DispatchMessageA MessageBoxIndirectA GetDlgItemTextA SetDlgItemTextA GetSystemMetrics CreatePopupMenu AppendMenuA TrackPopupMenu FillRect EmptyClipboard LoadCursorA GetMessagePos CheckDlgButton SetWindowPos SetCursor GetSysColor SetClassLongA GetWindowLongA IsWindowEnabled GetWindowRect GetSystemMenu EnableMenuItem RegisterClassA ScreenToClient EndDialog GetClassInfoA SystemParametersInfoA CreateWindowExA ExitWindowsEx DialogBoxParamA CharNextA SetTimer DestroyWindow CreateDialogParamA SetForegroundWindow SetWindowTextA PostQuitMessage SendMessageTimeoutA ShowWindow wsprintfA GetDlgItem FindWindowExA IsWindow GetDC SetWindowLongA LoadImageA InvalidateRect ReleaseDC EnableWindow BeginPaint SendMessageA DefWindowProcA DrawTextA GetClientRect EndPaint IsWindowVisible CloseClipboard OpenClipboard

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateFontIndirectA CreateBrushIndirect DeleteObject SetTextColor SelectObject

kernel32

GetExitCodeProcess WaitForSingleObject GetProcAddress GetSystemDirectoryA WideCharToMultiByte MoveFileExA ReadFile GetTempFileNameA WriteFile RemoveDirectoryA CreateProcessA CreateFileA GetLastError CreateThread CreateDirectoryA GlobalUnlock GetDiskFreeSpaceA GlobalLock SetErrorMode GetVersionExA lstrcpynA GetCommandLineA GetTempPathA lstrlenA SetEnvironmentVariableA ExitProcess GetWindowsDirectoryA GetCurrentProcess GetModuleFileNameA CopyFileA GetTickCount Sleep GetFileSize GetFileAttributesA SetCurrentDirectoryA SetFileAttributesA GetFullPathNameA GetShortPathNameA MoveFileA CompareFileTime SetFileTime SearchPathA lstrcmpiA lstrcmpA CloseHandle GlobalFree GlobalAlloc ExpandEnvironmentStringsA LoadLibraryExA FreeLibrary lstrcpyA lstrcatA FindClose MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA SetFilePointer GetModuleHandleA FindNextFileA FindFirstFileA DeleteFileA MulDiv

$PLUGINSDIR/System.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 c7a20bcaa0197aedddc8e4797bbb33fdf70d980f5e83c203d148121c2106d917
MD5 792b6f86e296d3904285b2bf67ccd7e0
SHA1 966b16f84697552747e0ddd19a4ba8ab5083af31
SHA512 97edc3410b88ca31abc0af0324258d2b59127047810947d0fb5e7e12957db34d206ffd70a0456add3a26b0546643ff0234124b08423c2c9ffe9bdec6eb210f2c
SSDEEP 192:rFiQJ771Jt17C8F1A5xjGNNvgFOiLb7lrT/L93:X71Jt48F2eNvgFF/L
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10673

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsExec.dll

IMPHASH e269b6260a93a17ceff5184b3982ded8
SHA256 10675f13abaee592f14382349aa35d82fb52aab4e27eef61d0c83dec1f6b73da
MD5 5aa38904acdcc21a2fb8a1d30a72d92f
SHA1 a9ce7d1456698921791db91347dba0489918d70c
SHA512 f04740da561d7cd0dea5e839c9e1c339d4a3e63944d3566c94c921a3d170a69918a32dff3f3b43f13d55cc25a2dbb4c21104f062c324308ac5104179766402a3
SSDEEP 96:AOBtEB2flLkatAthPZJoi9jpfW/er6cBbcB/NFyVOHd0+uHwEX:AhB2flXAVJtjf6cBbcB/N8Ved0PZ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4231

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Duane.ano

SHA256 295b56ecbbbbb146b2d9631646852ba6b63a107cc85179d5a4cbfe17c06c7d2c
MD5 66fb10043cd94f1662f3d7fa5f5cd9bb
SHA1 b2d74daab4450936f05a08e17a8da6cb97645fc5
SHA512 081a9f3187cb2baea15660cc03eb1ea2dfa1af5098ec50618e0d22f1abc0137fe3d0cf07f46a2d6213f79bf63ccea120e2df67951f731f0242b009ff000d5e5c
SSDEEP 768:sU7Lb/rQ6yHwu7XeQ7P/RuOvN16UhiRUFrWJqSbQnfRGAozNtAqC6il3FfJQr33C:sU1GzO66vqFwQ8CRY3S5
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Grasserer.Bri

SHA256 6303b6a73b990565fce4f6276e43658d5d95725b1bdc0c27cc0595c8dd7255da
MD5 a2899fc45a109c52db12de101c9697b9
SHA1 9cb76354f50e36819a01bf8a146592f998f8c679
SHA512 614d3d8b6ed0eee292fb8c417a7a0cc17ddaab187643afb2ed0148459574a7d337edb2fca378a23c2e0b722a172f0701b99cd60f3ebe172f9d7a493b238c04a8
SSDEEP 3072:TqPXZd55k4QN5DiCwclghabavHs5a8K4unGiaLwC7eG4pbMOm68xPA4R7CA3g:WBHm4L0yYbl5vHunGiwpv4R8NzNCgg
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Prelimit4/Brystprotesers/sublimeringens.ops

SHA256 627e28b651a9fb3069de789b98c22ae82d8355f2be96c987574a7721331de435
MD5 ef218f638fd792449999379bc7cf2668
SHA1 715d012ba77a0af40316a13d7a5d0880a3d121f5
SHA512 cffb7a14442ba2b3cc3d92733615d3893c62c1e6af79fa76bc73cc66ce7266979671f2d14ac9aaab785327229f615f31b191da8afce55b8536a21808054c8410
SSDEEP 1536:ewjhMVWmvBKOcztsozGU1bXwPoBbAsPYkidgm7:ewjhcKz/xwPoBbkd/7
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Prelimit4/nausity.chr

SHA256 ea583d418ae9dde206988ec755822c0d71b80ead861851759ef5212eecaa445c
MD5 3351bc33a547bfa56f63cef1d5050b1f
SHA1 a4a066fe8ffaf8095e3588ba94043e6f79b1a8e8
SHA512 b383f0c7edba6f63f01758a1c615391b1b0372fd263254457c2ed31ba94b9a2492fccebcbc48488d4105ed788b745503603a42ca94ff09077241cfa42b7869bb
SSDEEP 768:LU4jrlb5rOBm+P49j5YJ2AY3b3YhSmWx0UclrGaWp2KHjk:9UjLu0YF2w
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Prelimit4/nondevelopmentally.aut

SHA256 1aaf798ccca8bd0a0a4b6acd2303c7f8709a1b19fc25b79abcf84fec31308873
MD5 90689285a80eadfe472f9eaf817e949c
SHA1 2d720b2f924df767a49ff03d13f93f51e87afe93
SHA512 5ebcd5378792aa04126283c5a767b009dfe1ac80da3170efc0f6401f7403fb74f97a4a2b9ae85e26532a2ac3ec84745e98209198f11419343c1d553d9c27f375
SSDEEP 768:KIamLWbLHPY/W94Qv73sKtbgpXYnwllDz7M0838QoG+MeGzZU8C+Y3kuimvnGilJ:Scp+sH3+Yge5fv
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Prelimit4/romancing.txt

SHA256 bfff6cf1103fd307ad53ac99fa378c182632a6f62e51f7d60bfa51880175b6db
MD5 07598eda7ef0452665e749e413c53747
SHA1 17b6e8c9c0c6f8a7d456d47e9deb81a556670396
SHA512 fa0166c617ddc12b1a154fe6bfadacca0a452ddf2f04f8838565109048cb1f4dd9fc2d6a17ca06d40b82e77e91547dddf767c8cb70d54d6a4f682244a3a2f331
MD5 SHA1 SHA512

NSIS installer

installer

Prelimit4/startvrdiernes.vap

SHA256 0938024ede3f5c41719da898a99bba1c4cbdf28e4672dbb39d9059057d52a46f
MD5 d143ee2e8a8d24162de1266feff6450e
SHA1 90e4280b0fa0ab74b32f6a65f12c5799d87ca5b4
SHA512 b7a79ac233b1aba93b0c3114871d971f8db6724583fcc3e2e827da589bf683a6730bf7e25f642850b674dd2ceeb12649f2ea0ca805307732ce93ddf6b3e613c3
SSDEEP 768:fDC7wCG/PfTT4+aNkcgdpzT3E6bi0UxGwK2/Ktt/2DSD8VPEWi+p6eufVMih/NvC:FNwE5tErKLMuILpNySPJrHu+XXB
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Upanishad/Studieaktiviteter.Aza

SHA256 6ff2a4a2f33ccc87c7ea8b1205f9af1c9082c5b523d5c1a4cafb3c571afde3ce
MD5 b2e55d194a82bc2905ee8ef25aa4c6a2
SHA1 61139778b77e06dff3349534361602253fe1ce0a
SHA512 ea7ce5ca3350ff8e66c8ce09a11e924b67434f93c29aa7c2725f9629496f92de24b4f8aa7e43670a89d803593e38e224ca39e52ab9bbfeb104d33d83314ea10b
SSDEEP 384:OpwEuz5t2Ktz2qOlAEDCPrDZZcumqPl9vXPUCXWJER1Wr4fdQ+:OCEuzHrt6ZTuPrG0l9vMaRty+
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Upanishad/embrasures/floorer.tag

SHA256 b280d7087a755ccbb73c972a5ba588419ed58adab1a0ca3fee735d988c25ff83
MD5 512709a80ab80603bdca8df3160071c4
SHA1 809fc71ba63155d2ea33ecc29770ceb237c5f012
SHA512 97999fc4a436250adbd7734816c77eab40ae6535ea10c7e7c2c2d95bb4d5345f231bb7a12fc1c5cc64419e978265df284e1010feb9115895de089fea0829d689
SSDEEP 768:4rvPGqk4VyhWxzXz+yWsirTraGRmH+W4bHJuS2VwKX9ryqYsr4Pg9vZYDG9EAPyM:+3YqzNsycmigmvORYBQTR9gg8E
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

21bca3ed380aff98138bc26cc631cfaa7eedd098e3da694e8eef350b23afceda.exe

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/nsExec.dll

advapi32

user32

kernel32

generic

Duane.ano

Grasserer.Bri

Prelimit4/Brystprotesers/sublimeringens.ops

Prelimit4/nausity.chr

Prelimit4/nondevelopmentally.aut

Prelimit4/romancing.txt

Prelimit4/startvrdiernes.vap

Upanishad/Studieaktiviteter.Aza

Upanishad/embrasures/floorer.tag

Sharing

General

Malware Config

Signatures

File Explorer

21bca3ed380aff98138bc26cc631cfaa7eedd098e3da694e8eef350b23afceda.exe

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/nsExec.dll

advapi32

user32

kernel32

generic

Duane.ano

Grasserer.Bri

Prelimit4/Brystprotesers/sublimeringens.ops

Prelimit4/nausity.chr

Prelimit4/nondevelopmentally.aut

Prelimit4/romancing.txt

Prelimit4/startvrdiernes.vap

Upanishad/Studieaktiviteter.Aza

Upanishad/embrasures/floorer.tag