001_215_EA2047939_202410210815[.]exe

resource
001_215_EA2047939_202410210815.exe

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

001_215_EA2047939_202410210815.exe

IMPHASH b78ecf47c0a3e24a6f4af114e2d1f5de
SHA256 963d35a92ffdbbdd35c71fc392a73ce49e242ca1b80f94204ef714cc42bbf8d0
MD5 25da279ad7ee7cc3b8d3e5cd5aa4b5b2
SHA1 d1fc6cbe8d8cca235ed29de6b109a0cb951eb5f3
SHA512 db074cfe6c006f194b8b4ca983fb83a88229beb229504c8eba07140fe490974e90dfe75b66b9c4d81bd319fdaaccc822473064771b7ac8d333012859f139498e
SSDEEP 12288:l9Zwb4/I1H06OdtVQuqilUSDFOIBETeVlCE7vkQymGwSW01hXqvjoaCi7lnsZz0W:/dPFtVtOIB+alCJmvulW6Nd0vu
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12559

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetEnvironmentVariableA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA GetFileAttributesA SetFileAttributesA GetWindowsDirectoryA GetTempPathA GetCommandLineA lstrlenA GetVersion SetErrorMode lstrcpynA ExitProcess GetFullPathNameA GlobalLock CreateThread GetLastError CreateDirectoryA CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA ReadFile WriteFile lstrcpyA MoveFileExA lstrcatA GetSystemDirectoryA GetProcAddress CloseHandle SetCurrentDirectoryA MoveFileA CompareFileTime GetShortPathNameA SearchPathA lstrcmpiA SetFileTime lstrcmpA ExpandEnvironmentStringsA GlobalUnlock GetDiskFreeSpaceA GlobalFree FindFirstFileA FindNextFileA DeleteFileA SetFilePointer GetPrivateProfileStringA FindClose MultiByteToWideChar FreeLibrary MulDiv WritePrivateProfileStringA LoadLibraryExA GetModuleHandleA GetExitCodeProcess WaitForSingleObject GlobalAlloc

user32

ScreenToClient GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard PostQuitMessage GetWindowRect EnableMenuItem CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndDialog RegisterClassA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx GetDC CreateDialogParamA SetTimer GetDlgItem SetWindowLongA SetForegroundWindow LoadImageA IsWindow SendMessageTimeoutA FindWindowExA OpenClipboard TrackPopupMenu AppendMenuA EndPaint DestroyWindow wsprintfA ShowWindow SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA

advapi32

RegDeleteKeyA SetFileSecurityA OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges RegOpenKeyExA RegEnumValueA RegDeleteValueA RegCloseKey RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

Associerendes.Lov

SHA256 fb8575b17a714bab821f43e25454975876348a6ccf9fb580f25351311d09690b
MD5 8dc34d1e450d9695f44738379365b189
SHA1 9e77d26860ba038a647b6670fd0ddd2c961d0666
SHA512 f842056d5dcd6f43c88ff6ba91eb6207d3fa48b4e38f050a756fbe3d281cf8483def8a4221f63407953d589be05a7505c31fc6df12a0ed77dd64581e27722f08
SSDEEP 6144:7EPmC9J6+YjuzdpXEFp9ClyeEKBpfJyE5djEkzPhISp+F9:72VSzSp0Fp9Yy7mpfJnYktIS89
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Kontokurantens.Unc

SHA256 d19add8d848501931650d9c2f77d4519b15ffe2399a161dac88ea99c07f1b62d
MD5 8a4da8bab6993bc24f8ba89b1a5035ba
SHA1 0266616ebaff76b9027bdf4a52742bbb6d7dbf90
SHA512 1f604a65b0fb4543feab6eb9584aab3c47c5ebcabf251492c7be827e3c5d547f310ff05354bf30837fe8192be427c1855ec22783a0be14db15b40b1f05a13c50
SSDEEP 1536:em3/0wJ5Bo29iuM2fkfAFr6+nw0JefyiwDs:/3/0EbiuRcot6Ocfyiwo
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

aktivitetsrunde.txt

SHA256 1527c27be377fb2efdb75e64ef88fee6b879712dec1ae6e8cca4e66188099784
MD5 a47de65b255d62e154e75208730b37d2
SHA1 9ad95c489eabdbcd12c02cd312c85d0c73a565f7
SHA512 206fb780ca6a6bea7b1da2aad8d1e8c38331ae5a03cc82fc181a6e13234dc4523033aa775a3f15c261fec74910ecaf622abac99444e8daa8b63ec35379fbe29a
MD5 SHA1 SHA512

NSIS installer

installer

discourteously.gam

SHA256 66d0440913a064549bf52dd102475a422a55a0a1a99a38c0445ccf84eb98c074
MD5 2afaf6367cf5833a8885999fefa5b44a
SHA1 58edfac56fd3bda98cad7f2a784f58cf0ccca5a9
SHA512 a769f552cd91ce7163fe25c6e785d3a225979a9e50805f031c05e52cf5f82fb1e582fe621c947c7b0709f9e627c6cf318cf899ca97cc2bc4a3d934b94c2279a4
SSDEEP 3072:TlwUufGWwltoSeWq5Xck5tiy5ScV95Cca+8aB5p0jsDytfuWoaP/ZTf:x3W045X/5tiyB8faB5p4sD22uN
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

psychograph.rut

SHA256 016de5bd5ceba70cd0041265f69be3bb6ff54d3dca19340ed44dc15317066e45
MD5 55dd84338306b8f361571d07e3d03f25
SHA1 5f086147b0ed6d4cbe40b6f81c1003eb07714b94
SHA512 045e39931094c1d423d69c4bef750cacf56e0def562162211f51f1b5e0c3e265acede7fc06979cfce68762a99180317419685e5542d3e44882b11116d1ee7fe8
SSDEEP 768:sx0eYUpSjZTH4Refp/ZwLfKCGhiKveAC4LjJNV8RHwnx/F0H0jbPYER9RLXLxFJi:8UhyD9meQZFRRbLXdDRseVQq4
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

strudsfjerenes.uns

SHA256 2d3371072047972236b2bad7280e34ba1fd041c99cd132bc0e1dd767d0afc471
MD5 9548f6f7a71852794789de0ac5fde451
SHA1 74c915e2c9c110929fd87c907be17930b0b66b24
SHA512 0468fca29c3f916cbc0b3b132ea24bb582ed0f0d4921523f5df6ee17f76709437d25324e08af3c43fcae8bd1b9f388e49b64ed3c8464062e7d099b0d6b9bc5de
SSDEEP 6144:QuopzWTN5dkmo9X81LoYHLr0FJfFYcRQOD:KkxkfDEC
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

unnamed.jpg

SHA256 9a602ebafc1f46aad7248f6da82938ce382de9ffbc6c472bd4848d4519ca67a8
MD5 762778dfe1b62d3430b44a32aedc03e0
SHA1 7317d9579f9f4c4bef82be64fb3dffb63160eec5
SHA512 b39a8f6dc07f3a4cfe3cf5e1563543ece2864feced28282356fa64d7d0b50fa43b70f57fc8a2c4424a553e14e6be526293d90f56c63994ec79f5520488ee0ccf
SSDEEP 384:dnSPb8riksvdEh0qrjVqIPrLgrpNQMUBWud20p:dnUwriksvMjrZqo3Up9U8ud20p
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Sharing

General

Malware Config

Signatures

File Explorer