7fd5435121f2cb4320b1bc49400152ec3fecce7f5ce0acce56f32c327126c970[.]exe

resource
7fd5435121f2cb4320b1bc49400152ec3fecce7f5ce0acce56f32c327126c970.exe
unpack001/$PLUGINSDIR/System.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

7fd5435121f2cb4320b1bc49400152ec3fecce7f5ce0acce56f32c327126c970.exe

IMPHASH e9c0657252137ac61c1eeeba4c021000
SHA256 7fd5435121f2cb4320b1bc49400152ec3fecce7f5ce0acce56f32c327126c970
MD5 f3a3332b13baa50c41644b86efdf0fe4
SHA1 f3b91aa55b8dce62cb614e2a43d8e3973b1d47b6
SHA512 46808e4d79d0d1fbe2835456daf31e0de9e8f296b7863f38400eaa03fbf33be450f92df16f9b77ac5bb95aa33a97d484c1c678891c6e13b151f9cb7865c99be7
SSDEEP 98304:EH//4Q0gBDcLaUgZLGTVCfjemnYMjgfRQ14dewsjdis7xGC4tIf/Yapu5koUe:0BD4aUgZLhj3gZj67xHRnFpu5kPe
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12872

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetTempPathA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess SetEnvironmentVariableA Sleep GetTickCount GetCommandLineA lstrlenA GetVersion SetErrorMode lstrcpynA GetDiskFreeSpaceA GlobalUnlock GetWindowsDirectoryA SetFileAttributesA GetLastError CreateDirectoryA CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA ReadFile WriteFile lstrcpyA MoveFileExA lstrcatA GetSystemDirectoryA GetProcAddress GetExitCodeProcess WaitForSingleObject CompareFileTime SetFileTime GetFileAttributesA SetCurrentDirectoryA MoveFileA GetFullPathNameA GetShortPathNameA SearchPathA CloseHandle lstrcmpiA CreateThread GlobalLock lstrcmpA DeleteFileA FindFirstFileA FindNextFileA FindClose SetFilePointer GetPrivateProfileStringA WritePrivateProfileStringA MulDiv MultiByteToWideChar FreeLibrary LoadLibraryExA GetModuleHandleA GlobalAlloc GlobalFree ExpandEnvironmentStringsA

user32

GetSystemMenu SetClassLongA EnableMenuItem IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard ScreenToClient GetWindowRect GetDlgItem GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA GetDC ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect EndDialog RegisterClassA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx LoadImageA CreateDialogParamA SetTimer SetWindowTextA SetForegroundWindow ShowWindow SetWindowLongA SendMessageTimeoutA FindWindowExA IsWindow AppendMenuA TrackPopupMenu CreatePopupMenu DrawTextA EndPaint DestroyWindow wsprintfA PostQuitMessage

gdi32

SelectObject SetTextColor SetBkMode CreateFontIndirectA CreateBrushIndirect DeleteObject GetDeviceCaps SetBkColor

shell32

SHGetSpecialFolderLocation ShellExecuteExA SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA SHFileOperationA

advapi32

AdjustTokenPrivileges RegCreateKeyExA RegOpenKeyExA SetFileSecurityA OpenProcessToken LookupPrivilegeValueA RegEnumValueA RegDeleteKeyA RegDeleteValueA RegCloseKey RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ord17 ImageList_Destroy

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/System.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 ac9dfe3b35ea4b8932536ed7406c29a432976b685cc5322f94ef93df920fede7
MD5 0063d48afe5a0cdc02833145667b6641
SHA1 e7eb614805d183ecb1127c62decb1a6be1b4f7a8
SHA512 71cbbcaeb345e09306e368717ea0503fe8df485be2e95200febc61bcd8ba74fb4211cd263c232f148c0123f6c6f2e3fd4ea20bdecc4070f5208c35c6920240f0
SSDEEP 192:qPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4U:F7VpNo8gmOyRsVc4
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10529

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Capuan/geometri.cya

SHA256 027b544d8e1f0a9cc480b455943cdb8b7f2e1e6fe64fa4e84c5fb22f58e75534
MD5 8e1ecd1cad1a69ba46f3589d3ee05fcd
SHA1 511fe3218234dfd061c85834e32694d500a2d8ca
SHA512 d4e8d21b29799a2fd6aa6b254b0e5f1e212f2ceff6244d3ae1641f460a88fd39ec32ab04e3787be6c313abc85b76a2ecc90fa697c58b9899aee59b16452d98f7
SSDEEP 384:H5J4r26NPfk3R0omoj53ZOmVFPACwEygLw6:b4igfY3wEy9
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Driftsforstyrrelse/Farisismen24.opt

SHA256 895776946cc4e8956593c9b8cba36b3d0523f921c419f2a68c58c82fc5ba8c8b
MD5 ef47ba5ba9823e8c3469035cf70773d2
SHA1 21d1961813ba8babf395c3afe324487ee355578f
SHA512 e78ea0ca2e615ef745fde2a8d1fe07f7216e253057805091e0e91a4e7cd780ba8c5e33f2dfa6283104d7a2eed606deaae1e82345135cba914ecab32b9c5ccf27
SSDEEP 1536:29Atz1Dww/YItq3ys1yNe3uRHiOnU2E74SEH:29AtzV/2yFauRHcoH
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Driftsforstyrrelse/Louisianians31.mon

SHA256 689f1c7b21d424488e2f82f5e1cf663d41be2b8402853953b723f457d91f5c2f
MD5 f4a704dd6599aa965f753cf4aff41544
SHA1 27f6166a11011bf9340b9477d469a5e39b67cf5b
SHA512 f2ec79c777ca0349ba727c2292026c83c3ccb0f84c807431a859db7196248c95e17dfe13ea081f3020bf12f14001d58824f6ee0aee770ded6beb7d94e082c082
SSDEEP 48:zEuB7ok0LmcrzKI9XjvjvGWt/nSz4DP6FIB/IoZt/V:4uBsk0ac1jvqcD6QhV
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Driftsforstyrrelse/Rottet.fed

SHA256 3921ed66814a1199a488e44fdd72c224d4ad9505f3ea9d111e046704b37483b3
MD5 6865de99fa19a6862df5c404de274f27
SHA1 4efbd7e416c513c7b2516052efd42db502306c35
SHA512 f46bdcb2a29ba7ecd780c181230e573d3d0d7c55bfc06cad641fa764f90068afb6a3f7fc14af1ba725a168ef212cba93f6530fe7c0d0ee0c78b5a5b729f41b3d
SSDEEP 768:vodpoBR9G/El4UjO+zHLgOWJmrzfhDM2QY2RSbSL8nMzcUqbFuPYVTmTy2MekyEc:W2pzkDkzfhAtNbKANtv4U
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Driftsforstyrrelse/Somewhatness9.Bie

SHA256 200ad6e107078b2c0ed3b29aa5ce0f7e4ae26e80a8aa25aea2bb487b2f20ae66
MD5 8f6ac9baca244a9fe17e755f881c8fc5
SHA1 8c1b08ce1996a597904283f8be8fe677abb592d9
SHA512 78b5924ecc3cb0648b5511638af98eb1e00d8a150ca84f574cac9de04f7bd50d95e2a33c981f1f0467eb898d6d9c34978264b178f57b016a106cec8f82643922
SSDEEP 1536:GvWaiD1khghhBlYPnsfL3qy0IPazqk8R4JIZoyvUv8fUc/SzqJH3G69/BKhoS64z:GcD1kEVqy0IPaQ7ZhjNaIH37/f8
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Driftsforstyrrelse/genls.med

SHA256 9207608eb008266b5f27efaf786a1b6d2c4b611f484f62b5ff31d764c0225923
MD5 bca0c962216d9b512e1fee1f72eba35b
SHA1 ff228246a15fa291474df13f96c51a6bbe03fdbe
SHA512 848bebce00d0968884ac1a54bc220da34fadaa072f403434741dfc3f9843eb3848864184f1f38daeb013ce0bfee1bdc09679e80f2eab9c8cc67aba3816e0548a
SSDEEP 384:6tYghFWWJicOfl9hdYo9Gvdjh1rjjKlsru8a/3FPzYnaIgapZvHcFe/0C2vqW8IP:NyJicyhlodh1jKlP/3FcRseqD
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Kdgrydens/Farisismen24.opt

SHA256 895776946cc4e8956593c9b8cba36b3d0523f921c419f2a68c58c82fc5ba8c8b
MD5 ef47ba5ba9823e8c3469035cf70773d2
SHA1 21d1961813ba8babf395c3afe324487ee355578f
SHA512 e78ea0ca2e615ef745fde2a8d1fe07f7216e253057805091e0e91a4e7cd780ba8c5e33f2dfa6283104d7a2eed606deaae1e82345135cba914ecab32b9c5ccf27
SSDEEP 1536:29Atz1Dww/YItq3ys1yNe3uRHiOnU2E74SEH:29AtzV/2yFauRHcoH
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Kdgrydens/Imu.Gla

SHA256 4fd8b4e320029b4934a877cd932abacf6a86aabb78dddb264e7f752c8949a9ab
MD5 498a8d2ff2582c3230061db8c034e542
SHA1 fd90a6c047c4545728e60fea23dda445618ab56f
SHA512 ef9cbd701c76595a6f9b2c04c79c2430227ca6d23b6a6716892cc28c8a8b2fd40a98af9a46af0ef824f886d9916d8046221710f7f6ac8f35b2f8a4dd24a86b56
SSDEEP 98304:SDcLaUgZLGTVCfjemnYMjgfRQ14dewsjdis7xGC4tIl:SD4aUgZLhj3gZj67xHRl
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Kdgrydens/Louisianians31.mon

SHA256 689f1c7b21d424488e2f82f5e1cf663d41be2b8402853953b723f457d91f5c2f
MD5 f4a704dd6599aa965f753cf4aff41544
SHA1 27f6166a11011bf9340b9477d469a5e39b67cf5b
SHA512 f2ec79c777ca0349ba727c2292026c83c3ccb0f84c807431a859db7196248c95e17dfe13ea081f3020bf12f14001d58824f6ee0aee770ded6beb7d94e082c082
SSDEEP 48:zEuB7ok0LmcrzKI9XjvjvGWt/nSz4DP6FIB/IoZt/V:4uBsk0ac1jvqcD6QhV
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Kdgrydens/Micrometers.Cam

SHA256 8dfa258211eeb70eb2dafe04758756bfbcbece83013eb853ceca71b22928e91d
MD5 de8a813ce4fd2b0cc978241ab06a18ec
SHA1 ff3712b5d4d5ad5c5229af56800710de26ca2d1e
SHA512 8f06e206f7f58aa9bdc36425589c2afafdf42986e1ad1102e5b38a1717cc2e354a1a8564a9a7fcb2dd74e22e214000af2184c04c2758da37eaf89c9567bf63ae
SSDEEP 6144:VKZHDLgRwDXlRryEnqgwg7MfFR0bs0A5SmatP+jiCn41/OfGmlYc:Vkx1hyE6gyQbLARxjiC4KGy
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Kdgrydens/Rottet.fed

SHA256 3921ed66814a1199a488e44fdd72c224d4ad9505f3ea9d111e046704b37483b3
MD5 6865de99fa19a6862df5c404de274f27
SHA1 4efbd7e416c513c7b2516052efd42db502306c35
SHA512 f46bdcb2a29ba7ecd780c181230e573d3d0d7c55bfc06cad641fa764f90068afb6a3f7fc14af1ba725a168ef212cba93f6530fe7c0d0ee0c78b5a5b729f41b3d
SSDEEP 768:vodpoBR9G/El4UjO+zHLgOWJmrzfhDM2QY2RSbSL8nMzcUqbFuPYVTmTy2MekyEc:W2pzkDkzfhAtNbKANtv4U
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Kdgrydens/Somewhatness9.Bie

SHA256 200ad6e107078b2c0ed3b29aa5ce0f7e4ae26e80a8aa25aea2bb487b2f20ae66
MD5 8f6ac9baca244a9fe17e755f881c8fc5
SHA1 8c1b08ce1996a597904283f8be8fe677abb592d9
SHA512 78b5924ecc3cb0648b5511638af98eb1e00d8a150ca84f574cac9de04f7bd50d95e2a33c981f1f0467eb898d6d9c34978264b178f57b016a106cec8f82643922
SSDEEP 1536:GvWaiD1khghhBlYPnsfL3qy0IPazqk8R4JIZoyvUv8fUc/SzqJH3G69/BKhoS64z:GcD1kEVqy0IPaQ7ZhjNaIH37/f8
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Kdgrydens/genls.med

SHA256 9207608eb008266b5f27efaf786a1b6d2c4b611f484f62b5ff31d764c0225923
MD5 bca0c962216d9b512e1fee1f72eba35b
SHA1 ff228246a15fa291474df13f96c51a6bbe03fdbe
SHA512 848bebce00d0968884ac1a54bc220da34fadaa072f403434741dfc3f9843eb3848864184f1f38daeb013ce0bfee1bdc09679e80f2eab9c8cc67aba3816e0548a
SSDEEP 384:6tYghFWWJicOfl9hdYo9Gvdjh1rjjKlsru8a/3FPzYnaIgapZvHcFe/0C2vqW8IP:NyJicyhlodh1jKlP/3FcRseqD
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Kdgrydens/geometri.cya

SHA256 027b544d8e1f0a9cc480b455943cdb8b7f2e1e6fe64fa4e84c5fb22f58e75534
MD5 8e1ecd1cad1a69ba46f3589d3ee05fcd
SHA1 511fe3218234dfd061c85834e32694d500a2d8ca
SHA512 d4e8d21b29799a2fd6aa6b254b0e5f1e212f2ceff6244d3ae1641f460a88fd39ec32ab04e3787be6c313abc85b76a2ecc90fa697c58b9899aee59b16452d98f7
SSDEEP 384:H5J4r26NPfk3R0omoj53ZOmVFPACwEygLw6:b4igfY3wEy9
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Kdgrydens/icona.ico

SHA256 e35efd069097efced37eb9a320f9d1519558c61b3c6b606e659a28b0432adf35
MD5 43ab379a4f5eb535beefa8769d0f145c
SHA1 b5beda93edab6d45fc87c74406f28575ae3ba633
SHA512 27b864e0c981cbc385505ab031a5bf245f8da6588a7762447305a72e8513f904a4509eb104e6a75eb279d364ef853b936405e3b12c6f63082cb2f33d674826a0
SSDEEP 6144:gKk30jClLCugYQs0Om0TmZi6ZYMdCZcZtaW22ibSd4MoX1DXI5nR9mx2KdQJf6mC:ghdCugMm0TWNIJpbIu945c2iAWeO
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Kdgrydens/nsis.nsi

SHA256 4d2145f9211995a99f9828752ef15f9789ada25b8ceb1ef135cfe9d2abd5479f
MD5 118ae093faa03bdc13a832b55cefb2de
SHA1 022999fa13cba8abcf66c5e866c941547e7aeb33
SHA512 07d35e1e7319dc0271d4cd467a3597a36ed27a00cb115381a01ddde7c316d311b70345db04bc84e4d660732a4616967ae407812252cfc9e053bc82bd5a406032
SSDEEP 192:tVcb8h0g8jt9vETUdc0OcVgW6Bw2uYcJIt:t7unsYKFcVgDzcJw
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Kdgrydens/semiriddle.flg

SHA256 1b09158404a448b8b8da21415d6d3ff844658bf441b5a5fb4c651b2b1f5f5809
MD5 98b0761197297ab236bc284e2b596c55
SHA1 d84b6fcbc7822ac3617af2e06807f24b6cb09501
SHA512 6ab83d66e4e5874688f7a64c133ef3514ce355936cd66895efe8249e316e2c87195b82ff4e7780180ba3b58c097196aa58736ba6a9365cc36943c6ac8d78a71d
SSDEEP 768:E6Ak6TqKI8qNenRhDkU13nK/Owzmzj63GMIrCDVOAqiVyycSsOR2D+uFFO8ukH1m:a/TnkUFupj/vM9PV
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Kdgrydens/tekstilarbejderens.txt

SHA256 68f09accae0df5988df3aacfff32c8025f07a266367ad77e1614814b2a05c98f
MD5 dceb38a26ffeab28d24d304205dd1cfd
SHA1 7c3cd56a0e4a2a768d14ea41d88d163c8a3e66dd
SHA512 27469f330e5f57d253084536619caed2f220cc1aab74b476c175faa24467301ba0dd1cc52e9f2f15b5052f0cfc397a4c95b7147c7bd6369ecacd7319ff2bcae5
MD5 SHA1 SHA512

NSIS installer

installer

Skattedepartementernes/Micrometers.Cam

SHA256 8dfa258211eeb70eb2dafe04758756bfbcbece83013eb853ceca71b22928e91d
MD5 de8a813ce4fd2b0cc978241ab06a18ec
SHA1 ff3712b5d4d5ad5c5229af56800710de26ca2d1e
SHA512 8f06e206f7f58aa9bdc36425589c2afafdf42986e1ad1102e5b38a1717cc2e354a1a8564a9a7fcb2dd74e22e214000af2184c04c2758da37eaf89c9567bf63ae
SSDEEP 6144:VKZHDLgRwDXlRryEnqgwg7MfFR0bs0A5SmatP+jiCn41/OfGmlYc:Vkx1hyE6gyQbLARxjiC4KGy
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

7fd5435121f2cb4320b1bc49400152ec3fecce7f5ce0acce56f32c327126c970.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Capuan/geometri.cya

Driftsforstyrrelse/Farisismen24.opt

Driftsforstyrrelse/Louisianians31.mon

Driftsforstyrrelse/Rottet.fed

Driftsforstyrrelse/Somewhatness9.Bie

Driftsforstyrrelse/genls.med

Kdgrydens/Farisismen24.opt

Kdgrydens/Imu.Gla

Kdgrydens/Louisianians31.mon

Kdgrydens/Micrometers.Cam

Kdgrydens/Rottet.fed

Kdgrydens/Somewhatness9.Bie

Kdgrydens/genls.med

Kdgrydens/geometri.cya

Kdgrydens/icona.ico

Kdgrydens/nsis.nsi

Kdgrydens/semiriddle.flg

Kdgrydens/tekstilarbejderens.txt

Skattedepartementernes/Micrometers.Cam

Sharing

General

Malware Config

Signatures

File Explorer

7fd5435121f2cb4320b1bc49400152ec3fecce7f5ce0acce56f32c327126c970.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Capuan/geometri.cya

Driftsforstyrrelse/Farisismen24.opt

Driftsforstyrrelse/Louisianians31.mon

Driftsforstyrrelse/Rottet.fed

Driftsforstyrrelse/Somewhatness9.Bie

Driftsforstyrrelse/genls.med

Kdgrydens/Farisismen24.opt

Kdgrydens/Imu.Gla

Kdgrydens/Louisianians31.mon

Kdgrydens/Micrometers.Cam

Kdgrydens/Rottet.fed

Kdgrydens/Somewhatness9.Bie

Kdgrydens/genls.med

Kdgrydens/geometri.cya

Kdgrydens/icona.ico

Kdgrydens/nsis.nsi

Kdgrydens/semiriddle.flg

Kdgrydens/tekstilarbejderens.txt

Skattedepartementernes/Micrometers.Cam