ea5a8634885c44fcda935373a2d418ef8c32fedd810962b5d703f168ef69ed0b[.]exe

resource
unpack001/$PLUGINSDIR/System.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

ea5a8634885c44fcda935373a2d418ef8c32fedd810962b5d703f168ef69ed0b.exe

IMPHASH 671f2a1f8aee14d336bab98fea93d734
SHA256 ea5a8634885c44fcda935373a2d418ef8c32fedd810962b5d703f168ef69ed0b
MD5 fd34638e9b719812b6051902f4504722
SHA1 55b6b198cc54de68cbdea030f60d966f92344305
SHA512 4b5dd7b8e2ec1f1a2c77e28a601f338d766889f473dd90c2f68a5855f8b40ad08cd3412cc3cd1340a85bbad61a33fd622ba5beeb76dbec556df74c35db7375b2
SSDEEP 12288:/rgjBLiIK2WVy/YqpuarhMk1+H9MC2ugcYVkwbSReUhXmmwMRzcLSIHm:/0jBiIK2R/5puatx1+dMCnPmr8XjZcWf
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

76:72:4b:c6:02:0b:3e:ac:f6:c6:4c:51:20:32:33:d3:7b:c1:c1:a4:24:43:f2:93:8f:7b:10:f3:30:44:9c:2a

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Udskre,O=Udskre,L=La Pine,C=US

Chains

Oct 14, 2024

PE Signature issue

Digest

7a:d1:e5:05:31:fb:15:0b:3b:35:ba:37:5a:64:f1:34:8e:96:c4:90

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Udskre,O=Udskre,L=La Pine,C=US

Chains

Oct 14, 2024

Minor OS version

0

Major OS version

4

Entry point

13186

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueA RegEnumKeyA RegQueryValueExA RegSetValueExA RegCloseKey RegDeleteValueA RegDeleteKeyA AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken RegOpenKeyExA RegCreateKeyExA

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA SHFileOperationA ShellExecuteExA

ole32

OleUninitialize OleInitialize IIDFromString CoCreateInstance CoTaskMemFree

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create

user32

SetDlgItemTextA GetSystemMetrics CreatePopupMenu AppendMenuA OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcA GetMessagePos CheckDlgButton LoadCursorA SetCursor GetSysColor SetWindowPos GetWindowLongA IsWindowEnabled SetClassLongA GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassA SystemParametersInfoA CreateWindowExA GetDlgItemTextA DialogBoxParamA CharNextA ExitWindowsEx DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow ShowWindow wsprintfA SendMessageTimeoutA FindWindowExA IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint MessageBoxIndirectA CharPrevA PeekMessageA GetClassInfoA DispatchMessageA TrackPopupMenu

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor

kernel32

CreateFileA GetTempFileNameA ReadFile RemoveDirectoryA CreateProcessA CreateDirectoryA GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceA lstrcpynA SetErrorMode GetVersionExA lstrlenA GetCommandLineA GetTempPathA GetWindowsDirectoryA WriteFile ExitProcess CopyFileA GetCurrentProcess GetModuleFileNameA GetFileSize GetTickCount Sleep SetFileAttributesA GetFileAttributesA SetCurrentDirectoryA MoveFileA GetFullPathNameA GetShortPathNameA SearchPathA CompareFileTime SetFileTime CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc GetModuleHandleA LoadLibraryExA FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA MulDiv lstrcpyA MoveFileExA lstrcatA WideCharToMultiByte GetSystemDirectoryA GetProcAddress GetExitCodeProcess WaitForSingleObject SetEnvironmentVariableA

$PLUGINSDIR/System.dll

IMPHASH 240ca92ecc1c291801c451c447e16c12
SHA256 7fb0f8d452fefaac789986b933df050f3d3e4feb8a8d9944ada995f572dcdca1
MD5 dd87a973e01c5d9f8e0fcc81a0af7c7a
SHA1 c9206ced48d1e5bc648b1d0f54cccc18bf643a14
SHA512 4910b39b1a99622ac8b3c42f173bbe7035ac2f8d40c946468e7db7e2868a2da81ea94da453857f06f39957dd690c7f1ba498936a7aaa0039975e472376f92e8f
SSDEEP 192:VFiQJ77pJp17C8F1A5xjGNxrgFOgb7lrT/993:97pJp48F2exrg5F/9
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10673

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Depositumsbeviset13.aeo

SHA256 998841dd33bca886b07b4fd30026ceaa1b829e3c6ee665e3a6828aa4001e4290
MD5 1860e7a68e34d4935ba87527ccc5b1d1
SHA1 6f2b74ff16063ac1fc8f968ba1e2e231999e5064
SHA512 cd24d3b417b026bd6aed7b04c21c3fe9813066aeb8737b4163487d3e7bed6c7d84ad47052f67249a32cd966bb953679390e317e891bfa76223dbba4176e90bbf
SSDEEP 6144:MGZriy736Uhv1qn4kBm3sBotYqdfCi5QtcBmM+:Jiy7KUv1q4kBmnYqdfCi0CF+
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Nedskringens165.bge

SHA256 50dcd403ad710f799dffce77387dbf1dbdf3c492f6e85cad64b2976c580ad6ad
MD5 e3606943070abdcfc961e47d90699607
SHA1 c7615dd3745f445d94087b280417cfa44c0195f6
SHA512 e81b420fb5f4957bbf1e1e24799752d4b74d946a9ffb6b76bd1aeb0cbd460c53a40546f52fd27ef4e219bf85f59f573243de85ac637e73aabb7403653adac86a
SSDEEP 768:qj7bYltCvcTH7BDyPMckurYNhx/s6/eyoEkhfh8aPCdz0e7RmeHEQ0SuKFkB5hta:II9RlafRn0m6XRihTSSy+pdyTgQjZ
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Skovsavens.Lac

SHA256 2de54295d8bdb1f599ad84a8e07e4af3942b17834427890356caff422bff6923
MD5 5ed0c781294dc7d4600096aeec3f2443
SHA1 b12b44273b8003be94ce9cdaedd3f0ea7a5a246d
SHA512 8db0e145c03d25d7dfb75cef756e5d35e40638cc3118b975de0c2fa11215f46a3c2b85ea42bffae902fc510a6b0ea60df1ca9f7a265c61773e3d548a1c895a34
SSDEEP 3072:BE3wZO2IQF1uDsV+XhNe5K6sLqxktjBpw3h:BE0Oxm1EsVYUj0qWt9pw3h
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Unridably.opr

SHA256 05e2f5a6672eb9cbca87996dbe4056240d85cc7c621d83e1bf75ade12df408ef
MD5 6b0ae74c9a26839f4b5f590b755a5f3b
SHA1 6d7ba6a29f41f8f64dab2154b2ba674a48d25414
SHA512 7cc1be717acbf2b9892861a0e64d11dff78fd16cec53487e96f95a2c75a772d9fb5ec94399f4340f8bc240d1c527eb3a563e000ea062661212d649676b96d4a0
SSDEEP 768:Ew9lwmgRX7sLbY0/b+aE40Z1KnruDG0Y/kwQKC0qawAWMvKTnGHjCxqScBN3PRtI:EMs6OXAI87Pm1ybjaCFrY+6
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

dimpsy.clu

SHA256 03761a54bc2b3fdc0dd33d3d2304f8adda40a0c326b1b5ab317bfbf73c369d8c
MD5 9683a3d88606c03220ac0a80ca991bb1
SHA1 7873ccd42b97fac0b15398d79d5824a88e342817
SHA512 791194e2fae49ff19132b49beb955bb53f827dbbe3c52c7217cf6e66f63b6f66d906311fa534ae3d1f7c54a454f34a4cea750b21396b203310315c8e328d2c1a
SSDEEP 768:oD5IBGP0UgqsHHEUxUr9KPtXwRQ9q3QtsXS361zv1+r6TKExsQ5PN61wlRZQL/6L:VFWSeckPmawPZWsrQTM+qlRrZNc
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

hampton.ant

SHA256 9025a4909bf51d92657b21f3dfa849f3e337f44b7abdaadb0b568c654f7ac1ec
MD5 ccf68c7d2a707b209f7464de6bac1365
SHA1 69bf3873438a9f0d1b3655cf9ea6006a0f0f4823
SHA512 af6471d4204524031dd136f436e1a173e4e7997e8f8d373d6335c176f5aef83922105635e200033ec7381939d0e50158a47c9df8dc61824104f8640694c76c90
SSDEEP 768:k7dV2NN1kXUyo0VKmim7+aMTGMKFMMp1qo9s1s8rFT10vi/5CKyhZ9cb6EIipueG:QgEMqMbFAFy0Gy6t2N9mvT/X4
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

phytosociologically.txt

SHA256 5b770847a5ca554185d21dee630bc3aae4f9d185c0f2cbd803afdfa10b30c750
MD5 600be4ac955fb7547eca07fb12946717
SHA1 07e53393bb0591c274599e56657c760e00a0e84b
SHA512 12b81430df0d4c57e9ba803ce1228752ae2b127fb4fed07767107466b5283b9a1cb91966305aab2a5e65a7771729676d5c16c040ab30393a2748a115205e779d
MD5 SHA1 SHA512

NSIS installer

installer

ea5a8634885c44fcda935373a2d418ef8c32fedd810962b5d703f168ef69ed0b.exe

PE Signature issue

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Depositumsbeviset13.aeo

Nedskringens165.bge

Skovsavens.Lac

Unridably.opr

dimpsy.clu

hampton.ant

phytosociologically.txt

Sharing

General

Malware Config

Signatures

File Explorer

ea5a8634885c44fcda935373a2d418ef8c32fedd810962b5d703f168ef69ed0b.exe

PE Signature issue

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Depositumsbeviset13.aeo

Nedskringens165.bge

Skovsavens.Lac

Unridably.opr

dimpsy.clu

hampton.ant

phytosociologically.txt