d4403b301fd83b63921be53b6d3e9dfab987ff2aa133511b3b2e1a4dcc22cdc5[.]exe

resource
unpack001/$PLUGINSDIR/System.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

d4403b301fd83b63921be53b6d3e9dfab987ff2aa133511b3b2e1a4dcc22cdc5.exe

IMPHASH b40f29cd171eb54c01b1dd2683c9c26b
SHA256 d4403b301fd83b63921be53b6d3e9dfab987ff2aa133511b3b2e1a4dcc22cdc5
MD5 5a58e2348883014d1b494ab38035d4df
SHA1 b63e0dc98ca87974a735a00c3cb0531d4c2e49de
SHA512 5a0b99b841ec86581c8adfe8a6ec80ec64dc1361b0ded0e158f2f03536a2ad393aa19ebeb56d1f4f94cd64233c6e3ebad830db4bff216c35cc8dce70b57bd677
SSDEEP 12288:JSl6vY7dH2a0fHhfCEeRnVXCb95Feh2FCCMntz6I8128TsXULDh+gDBf6j4Ydcvs:slcY7dH2aShcVX09W2UVf+DLD1BbYGU
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

6c:52:9b:98:cf:ac:f6:b1:36:f7:ab:f3:73:fb:39:fb:0c:1f:d4:2a:22:1c:5c:a5:39:df:d7:53:37:99:53:ae

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Hageen,O=Hageen,L=Acton Beauchamp,C=GB

Chains

Oct 21, 2024

PE Signature issue

Digest

42:88:03:30:fc:6b:d3:07:c1:03:18:fb:79:a9:af:ef:a4:2f:3b:29

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Hageen,O=Hageen,L=Acton Beauchamp,C=GB

Chains

Oct 21, 2024

Minor OS version

0

Major OS version

4

Entry point

12508

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

Sleep GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA CompareFileTime SearchPathA GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess SetEnvironmentVariableA GetWindowsDirectoryA SetFileAttributesA lstrcmpiA SetErrorMode LoadLibraryA lstrlenA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrcpyA lstrcatA GetSystemDirectoryA GetVersion GetProcAddress WaitForSingleObject SetFileTime CloseHandle GlobalFree lstrcmpA ExpandEnvironmentStringsA GetExitCodeProcess GlobalAlloc GetModuleHandleA LoadLibraryExA GetCommandLineA GetTempPathA FreeLibrary FindFirstFileA FindNextFileA DeleteFileA SetFilePointer ReadFile FindClose GetPrivateProfileStringA WritePrivateProfileStringA MulDiv WriteFile MultiByteToWideChar

user32

CreateWindowExA EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard GetDC SystemParametersInfoA RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx DestroyWindow CreateDialogParamA SetTimer GetDlgItem wsprintfA SetForegroundWindow ShowWindow IsWindow LoadImageA SetWindowLongA SetClipboardData EmptyClipboard OpenClipboard EndPaint PostQuitMessage FindWindowExA SendMessageTimeoutA SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA

advapi32

RegCloseKey RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegEnumValueA RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

CoCreateInstance CoTaskMemFree OleInitialize OleUninitialize

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/System.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 3b6a5cb2a3c091814fce297c04fb677f72732fb21615102c62a195fdc2e7dfac
MD5 cf85183b87314359488b850f9e97a698
SHA1 6b6c790037eec7ebea4d05590359cb4473f19aea
SHA512 fe484b3fc89aeed3a6b71b90b90ea11a787697e56be3077154b6ddc2646850f6c38589ed422ff792e391638a80a778d33f22e891e76b5d65896c6fb4696a2c3b
SSDEEP 96:3IsUxO9udx4qYp7AJb76BykUbQMtHUOA5Iv+RnsrqeXV+d1g2IW9t2c+cEwF9oug:YVL7ikJb76BQUoUm+RnyXVYO2RvHoug
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

9922

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Kvstet.Fem

SHA256 0506b16971f1ce74e70823d3f78d50bb0b2395413af531a0f456c9a0bdcbc8e5
MD5 f4c8bf8763553e3b9153cb6e1d578c41
SHA1 440c72836e9e3037ec853ba3950d562ef44b7815
SHA512 9c3da943cb6868eadbe9c1c1f4a5e85022c556ce307e90c23875c7a0daa3c896a170a07a0abad2611cfc6af3fd57ae6b62834f40479529995dd92a90dcee1af6
SSDEEP 3072:dxBevP2paz0/VLYUC558g6uDM7SFbjsdDsIMQq38PIP4nGrtNltdohPkxcIrZWf:XWPia4/SUY58gNjs9ti8PW4nMFteh+0
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Stridulating/Hematomancy42.txt

SHA256 4f6eb70f672b677aaa6a534a1bfe8834e2608b72957d57df8089665816ddd90e
MD5 4da37058224bd7b59229bb611e105f39
SHA1 1da82b8c8f86e54f744aff64c798e84d1c70e4eb
SHA512 f839f7fbfedd517cf9a9c253ced6641f1d7cdb69694ba6ed939500ff99fe5247976c09ec915675d8691c04b80ba2f8e49068b4f916904bde994b4051abe3e98e
MD5 SHA1 SHA512

NSIS installer

installer

Stridulating/Hjortetakkens.pro

SHA256 838472456a1b5905bec73fe10a4afc9a09c01dfa3ff108deb1ceb57fac83718f
MD5 87a52f4e6ce72e090d982511c93e363e
SHA1 c6a263c8afd9d2fc60fc7a07a8449f8a8cbd713d
SHA512 1d1f3973faebb73c0989d3fc991adad9f444ca36f7ea2c5fc0443769fde9e11c6eb1cbd2c6143c5da9167f2176c298d169a828b466826a6fde68e61961387b58
SSDEEP 1536:+HOv/LhxM6cip+EE9wBy/PoHWvK5jnsujovmT:+uHLY6cQ+jPoHWi+O
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Stridulating/Hoodwinker.Unv

SHA256 106fbdca63a49c6da4e87ff17bfff0b25a6f4cbaf715a6e07b6ba5ea866ed6a3
MD5 91b37e4f58810425743d1863bd72406b
SHA1 520ddfee4f9aa51f87de63febfd307346149e644
SHA512 136d58f77ebfcfad50e5e55bf9acf4212ca82388ba240dd2f76d87207edc094034486d214978ec650b8c35fa3ad79f1fe187590a7878527df3b286835e0351e3
SSDEEP 1536:1dQJ5TuBZ7uGjP5UpYRVMerSuHq6oJMRg5DclEp8D0T6p08X7+M70UOTvVBxN3Fi:JpUI/O3aQ3F5inm7xB1NZJcKe2muTHs5
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Stridulating/Sluttidspunktets.ace

SHA256 6770149a0d8af75d3d8df950cf3d1a8475fc73e60ef9e3bd03ad04a2001035e7
MD5 27a799752643f5e96c57957dd115f836
SHA1 c25dbe476573cbb94df8cb43cbbb7446e57b5bd4
SHA512 fc46c8bd1186b0381e0f4679cb0844456dde98e62c47888c4eefdddc34c56274ab739c21c1dad4c75473a74a188698d9a268e07cd66c33464619ff6094ccf66f
SSDEEP 768:u96Aql7WmW/QZ5UqPOsuEcWbolkZgkyecaSgaGz+5Kap5nuXNw2Keaj9JB/MwBE5:u9f45EWn++Gxc
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Stridulating/crappin.fan

SHA256 4cbc5303baa96a022304acac34ad9cbf9db661e89bf603ca872b0f38e2c7f3b7
MD5 e2701f9b21e2e3383c23d42a8a80f0cd
SHA1 b48623eb7f31a6e559cb276cec52b8629f28688f
SHA512 c3d53de9228dbcc8498be846562a4630a35a321bab5344bd2ca4452b8c161405785a65ad2425b8764c0e95479f230fd8f78bf5501cad820deba8e5563621a122
SSDEEP 768:TL/dvXcDgOiWbzPnOh+6OfAUFYoesdGESv76fMFxWcghnE9+cCvNrsgR6W9R20sA:lvXw6mnTAV0cYJNNo15U8OifFoHNwhk
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Stridulating/legaliserende.tro

SHA256 3eb84177ebd5ca99880fee24652579f356008c29ff31e8e0f157693c3e16cc69
MD5 a372469d5ea672a9c76fdcfe1127b8df
SHA1 25129be715c8a42ececfc70330e29a8bb7d21e14
SHA512 15179350720dec225250a113603e1b7d9f11d7556365dcf61f150d775ddfdb930fd08079f6d933c108d3748e63118b5d5d7017b2f29657af6ff07eb826d36d20
SSDEEP 1536:U25888m6hmlnUIklhR+yzHuuFHQUdq8SWHztpMYIJ5+w:yzhmlUIkB+yzOuFwg3DHUn
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Stridulating/momentousments.afr

SHA256 705a96fff4440f49a231e8d17b289d97786ec373aa5b39fdad48b410dca53ea8
MD5 c6cca0bf9fb8cc569e1edbb70f5ab95e
SHA1 fa9a3e70d31a5009f0d63d88ea8d224763936862
SHA512 efa09455d16f63322bd81986aeccc65aeab92a601aa11eb68725afcb3f61965510ffea65bb87a89a0123263189e6a4200958582f135b3c5bb0a023fddda35911
SSDEEP 768:0Ecv8XSTGyX64S5RDgZMitDVajTqwbR8F9SuFEq4d8CA60r9UY74l8jc9hcCq1uC:VJdFl4QUHc9DvozcowpARAwhh1
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Stridulating/programdels.fla

SHA256 f7161357b945d6764d2c290af7f7290c1c00a08aaaac622b45e2719ac6a50968
MD5 b0f8a54823350c2f31d2bb230615afb1
SHA1 6f46b1e8491247556108d37809870f0c34fb0f7f
SHA512 957b98b57883b2d56186a2ac17582453d092f8ef84ac360d16c3e3ee4bc28100537df84d0f30ae880298657404e45ba29761814a5e3cf16c90510cb8175a63a3
SSDEEP 1536:1xH2QjimoGTRLqVL7X16QOrP2tPUW59mkVwjYtTj:/ImvRWd7DtP9xZtTj
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Stridulating/southwestern.gor

SHA256 1c0cc2363d16826b2c8d36d983e883e3d81e12df8456e3512bf80e7de28c9583
MD5 79ad4943801e304b83e39774d00ed227
SHA1 e3ed1c0c871e490194fad68584d401104e0d2bd6
SHA512 497dc447dd0bd52479445e7fce633427e17dcb02546e876b9ad6945a2c1186de20c26f7ea324ebb8608bf76b16846b738c8fba138004da07a7494e743e925481
SSDEEP 768:gzZPsA7rgqOMM2DrESpbi+XRztJVhKNzOCoav5rk3d+y8EOYGniroubgYhOxYBCD:gHhOEeCQrEOkQKv
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

d4403b301fd83b63921be53b6d3e9dfab987ff2aa133511b3b2e1a4dcc22cdc5.exe

PE Signature issue

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Kvstet.Fem

Stridulating/Hematomancy42.txt

Stridulating/Hjortetakkens.pro

Stridulating/Hoodwinker.Unv

Stridulating/Sluttidspunktets.ace

Stridulating/crappin.fan

Stridulating/legaliserende.tro

Stridulating/momentousments.afr

Stridulating/programdels.fla

Stridulating/southwestern.gor

Sharing

General

Malware Config

Signatures

File Explorer

d4403b301fd83b63921be53b6d3e9dfab987ff2aa133511b3b2e1a4dcc22cdc5.exe

PE Signature issue

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Kvstet.Fem

Stridulating/Hematomancy42.txt

Stridulating/Hjortetakkens.pro

Stridulating/Hoodwinker.Unv

Stridulating/Sluttidspunktets.ace

Stridulating/crappin.fan

Stridulating/legaliserende.tro

Stridulating/momentousments.afr

Stridulating/programdels.fla

Stridulating/southwestern.gor