Fignen234[.]exe | Triage™

resource
Fignen234.exe
unpack001/$PLUGINSDIR/System.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

Fignen234.exe

IMPHASH b40f29cd171eb54c01b1dd2683c9c26b
SHA256 feaabdf9165e508294f7006308b85802672ee6d7fac58ce4b3c92f6cb63334cc
MD5 f71ca6bd7ede3a21cf722ffe4112e594
SHA1 e45d7fb3c3f224c47ad6e26b101fef648aa22b63
SHA512 ab3d60930e10bc49fd0c9cf54215ba59641238cd486bf796000e14b4605de2373441f5ec76777d14e943cf1f9bc54ff30c1c2de829b19b941fd639da77cc620e
SSDEEP 12288:DMUVNauikWJNEay+ZfXDKqdMN559ClR9FzS/s+ZHmkHN3HiPCpfBVx:I/YW++ZfX72N559JHnHpHiwV
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12555

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

Sleep GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA CompareFileTime SearchPathA GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess SetEnvironmentVariableA GetWindowsDirectoryA SetFileAttributesA lstrcmpiA SetErrorMode LoadLibraryA lstrlenA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrcpyA lstrcatA GetSystemDirectoryA GetVersion GetProcAddress WaitForSingleObject SetFileTime CloseHandle GlobalFree lstrcmpA ExpandEnvironmentStringsA GetExitCodeProcess GlobalAlloc GetModuleHandleA LoadLibraryExA GetCommandLineA GetTempPathA FreeLibrary FindFirstFileA FindNextFileA DeleteFileA SetFilePointer ReadFile FindClose GetPrivateProfileStringA WritePrivateProfileStringA MulDiv WriteFile MultiByteToWideChar

user32

CreateWindowExA EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard GetDC SystemParametersInfoA RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx DestroyWindow CreateDialogParamA SetTimer GetDlgItem wsprintfA SetForegroundWindow ShowWindow IsWindow LoadImageA SetWindowLongA SetClipboardData EmptyClipboard OpenClipboard EndPaint PostQuitMessage FindWindowExA SendMessageTimeoutA SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA

advapi32

RegCloseKey RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegEnumValueA RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

CoCreateInstance CoTaskMemFree OleInitialize OleUninitialize

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/System.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 3b6a5cb2a3c091814fce297c04fb677f72732fb21615102c62a195fdc2e7dfac
MD5 cf85183b87314359488b850f9e97a698
SHA1 6b6c790037eec7ebea4d05590359cb4473f19aea
SHA512 fe484b3fc89aeed3a6b71b90b90ea11a787697e56be3077154b6ddc2646850f6c38589ed422ff792e391638a80a778d33f22e891e76b5d65896c6fb4696a2c3b
SSDEEP 96:3IsUxO9udx4qYp7AJb76BykUbQMtHUOA5Iv+RnsrqeXV+d1g2IW9t2c+cEwF9oug:YVL7ikJb76BQUoUm+RnyXVYO2RvHoug
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

9922

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Believe.inc

SHA256 86a20f66e506879de69a2e354d00572755f12b7eecfab9131570def24e77f082
MD5 c5877563068b66eafce98648af993c1b
SHA1 06315d839e29aa292ef2a068fa7c8e20b2a35ca0
SHA512 adc70f868d1f0c4c444f5628473e4bdd23ae4b86b98214935a7a4c74d7af396be2c5d570a91c7f4cb551878e1b3553e78708ea9d610c43aedc15ccb7ee48641a
SSDEEP 768:s1zMhPtg6mOkvjM2z3rtb8+KZ4slqGrEaNR305W+IK/+UhSON/o2Yy6g:rhVgvZW+KZ4APGbB+4V6g
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Cyclose/cuttlefish.kic

SHA256 40c15d6718f1313730993407d7995e2813a98726b8451ccdff578ddf040401f0
MD5 64c019efee01ac4c46f8c827a7d954ac
SHA1 3cfa56b1d6f7f106234852f23335f7cd99333702
SHA512 2c6baa03e40825ec1bb85b3951a17ffc86fd7f714df9598ee42cfdff24adba5ba1a81dd7297de7f4693949631f96bd07938b7349782bd0bd2419e6e9cfb31e2a
SSDEEP 96:8kJtW1Hi2zDyuCmzPWfKDKfnJTOE9XxTcIVKlV:HKC2fyDyQKDK/hOE9XBOV
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Dramatiserende.Sof

SHA256 b2314927e1137468fa3d6af0e8a141eb2ba6f248e5720c71963d654208846607
MD5 b75bd1ca1df68d129a6864bbb6b73b5d
SHA1 952aa621fc453b598e3c8854be5a1231e35342b4
SHA512 26ed258c204648c90207f11fcfb199b73901d45c07823f937f2c2ef674c38185815b6912d0b1678ba550d7dca608f4ebee5d48a292e5aff0c8643ef907d0d858
SSDEEP 3072:kZ8eYYoOV82Fxjl2V240Rr2FHMy8GqmRqe:C8eYYoOV86jl2VV0RAHMy4Eqe
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Emneomraader.beb

SHA256 7d706e9392170b31b727d738837ada33d8d906973924001a7e0fbc68dbd85ee6
MD5 d74d978a711f0778c54fe633ae4902e9
SHA1 96b73d5c015eba38c8828067d68b77d4222b0389
SHA512 992b19ac31190b3bfeb3180d825c209bf50d22955b820853a8ec08b93147c4542c38b4d2dcf0bba3fdd655420e31f3bfdbcc2c03f64d8a7cb2a42d27850fe3f6
SSDEEP 3072:usirg+IsO9uIz+Bg/oMenPgp/t0RUuE1NC5X7eBMVRva5lqeh/f8i0Q:usiJIhuNgUY/09XiBMba5lbZfR0
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Generation.txt

SHA256 21a9305bda1cf9f1e1f9ecc7116da6aa84dcdaa7165caf488bc64f3e55820d8f
MD5 ce9bdf77607e519d876ae31a6cb2812c
SHA1 aed23a2b0b2c07e4914854e79b504fc454fd550a
SHA512 1b5914b42afe04061fdbaf318713c614fa9682d58d71905f35292fd716f27b123a9a18656d99f7292495c67806c16b4899e8758fc8f81e6e97573979682099d7
MD5 SHA1 SHA512

NSIS installer

installer

Servanten.Mes

SHA256 5974096158aece94d4643572dd6104b6d9d7344d8906016a040c9ef0ea7f7625
MD5 5a8f5dd7c4eaa91a16ae4b7f1405ebe6
SHA1 8c372ab65e6a19a52b94a2bfd72c54a3c16c0785
SHA512 c2fbad7e670ed522aeed646611b9fd5381d4ff87dfb3729c9ddf1b497eef37b7261b47ba8c66230d7d6c3918ee1f39e0d1bd5e69932d7cf31b61e94bca933813
SSDEEP 3072:z7V89y06W8B2/VNiOfuEVWlbPzL3BiguaWNFy7jsENZIsNhwNCa/RSliWKTjqvsX:/1N+E7j3NZIsNhaCao3C3vbB4Da
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Fignen234.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Believe.inc

Cyclose/cuttlefish.kic

Dramatiserende.Sof

Emneomraader.beb

Generation.txt

Servanten.Mes

Sharing

General

Malware Config

Signatures

File Explorer

Fignen234.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Believe.inc

Cyclose/cuttlefish.kic

Dramatiserende.Sof

Emneomraader.beb

Generation.txt

Servanten.Mes