034d0ad83a1a41c3fb2be5110d68a545b2426a337006a7f34a2050a0c7a18b9a[.]exe

resource
034d0ad83a1a41c3fb2be5110d68a545b2426a337006a7f34a2050a0c7a18b9a.exe
unpack001/$PLUGINSDIR/System.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

034d0ad83a1a41c3fb2be5110d68a545b2426a337006a7f34a2050a0c7a18b9a.exe

IMPHASH e160ef8e55bb9d162da4e266afd9eef3
SHA256 034d0ad83a1a41c3fb2be5110d68a545b2426a337006a7f34a2050a0c7a18b9a
MD5 24d65daddfed0602d8c90b5dfa47b7bb
SHA1 c46f000d10a66687cefd4a8fee1c8b3e84afd4b9
SHA512 09e16a15e18eb08f45f964fa271365e688507d561fc8567ce9417a54283dfb0785ef5a379456bb44cea187d7a5951521347a3e6f139560327460dfd449a6fe33
SSDEEP 12288:OjkqENMhypm0dvksi4P60gnkwNpRp9gS1S:yEmh8rRkvc61k4s
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12516

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetTickCount GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA SearchPathA GetShortPathNameA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess SetEnvironmentVariableA GetWindowsDirectoryA GetTempPathA Sleep CloseHandle LoadLibraryA lstrlenA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA ReadFile lstrcpyA lstrcatA GetSystemDirectoryA GetVersion GetProcAddress GlobalAlloc CompareFileTime SetFileTime ExpandEnvironmentStringsA lstrcmpiA lstrcmpA WaitForSingleObject GlobalFree GetExitCodeProcess GetModuleHandleA SetErrorMode GetCommandLineA LoadLibraryExA FindFirstFileA FindNextFileA DeleteFileA SetFilePointer WriteFile FindClose WritePrivateProfileStringA MultiByteToWideChar MulDiv GetPrivateProfileStringA FreeLibrary

user32

CreateWindowExA EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard GetDC SystemParametersInfoA RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx DestroyWindow CreateDialogParamA SetTimer GetDlgItem wsprintfA SetForegroundWindow ShowWindow IsWindow LoadImageA SetWindowLongA SetClipboardData EmptyClipboard OpenClipboard EndPaint PostQuitMessage FindWindowExA SendMessageTimeoutA SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA

advapi32

RegCloseKey RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegEnumValueA RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

CoCreateInstance CoTaskMemFree OleInitialize OleUninitialize

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/System.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 484f8e9f194ed9016274ef3672b2c52ed5f574fb71d3884edf3c222b758a75a2
MD5 960a5c48e25cf2bca332e74e11d825c9
SHA1 da35c6816ace5daf4c6c1d57b93b09a82ecdc876
SHA512 cc450179e2d0d56aee2ccf8163d3882978c4e9c1aa3d3a95875fe9ba9831e07ddfd377111dc67f801fa53b6f468a418f086f1de7c71e0a5b634e1ae2a67cd3da
SSDEEP 192:jVL7iZJX76BiqsO7+UZEw+RlthVEoC0O3XB:g7ssOpZs/hS3X
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10027

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Bushgoats.Blo

SHA256 3b4e47623cdc186db36ad7ac1db3445df50d2f556354d10229295f7051026c0d
MD5 6e77b7f1b4e652e5361926c036bf70c3
SHA1 dfbea0a49ca17aa28cbbddd2d9f5b8cbb22bafa5
SHA512 9df8db291a13b7a03de3704b40e4cdce295cd48b7da6163e89e9073bc47f885b15d259bee6a70a60b7179db2a520d1b28d544ea5f5ddec42cf87e2feb934b5ac
SSDEEP 3072:NZflGdqytDB/Pwbxr5ATtuVNipralDx/F1eNIPYLkM1n6O9buZ52Gu5o7:NZ9kdDBXCxCTcfi9MoNSk6O9k2Gu58
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Gabardinevvet/Karensdagens.sko

SHA256 87541f27f5ec9559ee89b33a77dd6925861d41e783ea22463f50a81c9298e2d4
MD5 6c442a797e6f3d41271d91b97d265ba0
SHA1 6020a1777124aa323e10ffe4fb0811c864bbfbb6
SHA512 c54ada6e5c0d45d3375056c56fab67924609fef596690d37e20c6daef443fded2d1bd472f3b2cfe682be029f19ae9ffb3331cb6314475862e300269f6ec46f98
SSDEEP 1536:z3huHdQNpiptTdHGffBtUucjmA7LT/q906dWEwPLBfa:0dyUtBGxnm3P/q/dEh
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Gabardinevvet/Leprosed.Vag

SHA256 5897f5a1c3e7c08d7cbb45ab8a3cc2a0a1f6bb93608a268bc48ab78af3d40eaa
MD5 26803f0abe4db6f27cb799c65b5bc84e
SHA1 07d295d88f87c803672e8a66f5306104ad84a126
SHA512 ffd06cde273e4331b24b4374d77418833d391e3fac3a0f9c2c1b68723676effa8ec6d6dfcc0a5b856e9f370b58e68e32ddf4851988601773ca3c0ec606c6bdbb
SSDEEP 192:l5OTvejEPR/MDsId0B2Yj2sdZhRLjMXV8G7JR+LiompfewDnt4:XOTveja0Fd0oY5JL6vH+LiHpfewDG
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Gabardinevvet/images.jpg

SHA256 0859091fe29f8dd90e4c20e149c74f90d3989f9812650dd129d8777e7f95c07d
MD5 a7504ae13dd44714601fd3253419ccc5
SHA1 93816de5b648949d6299d51e5330233b8946e7df
SHA512 5a2d595f0ef8ef5dedbada8e859764e1ce10aedb40ae4d6b972f75ccf16bd3dfc451bfbe635ff986fd8d70f85a88254254fb8fb346eb33e95913b63117c324bb
MD5 SHA1 SHA512

NSIS installer

installer

Gabardinevvet/linwood.bar

SHA256 670fabe06679d73495f968c2774e9eff962aa15cddcc3413d1c21aca595f66b0
MD5 6e332e62c11f0d0c528955980647315d
SHA1 30e9e6f5b50c850ac0fe774d9aca98dfe1c6993b
SHA512 71512515e713d945ce682c8cc1dc2272e17ba607f858bd28bc72c8a25592fa8ae61ec300bee2888e2169261e9091dc125f04b274488d0dd8f2d3626e5820cbe6
SSDEEP 1536:ijgRcshnTaKhnKoh1JXwlnPIAEZaRO+layAdhi:i0WMPhTwOZaRO+lava
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Gabardinevvet/seksagesimas.fru

SHA256 38fc631b790e783ebb7cc837b2d263aef0d0679f587b56c9d55e31bcf510cfa4
MD5 84acd56b28e716dae9e67fd656c7a0d8
SHA1 4adf4111981a4c1d575336c90944fe4557a2d889
SHA512 7b837f66e186d718029fd0c64d70b964f23acb693772d92ebdd3315412f0060d0ff7700b4424f810f01ef113269a39a7e020efd7c9cdf079303c5ffad6035eb3
SSDEEP 48:UhAFRiTeI5rRA1WnVeHIvBus8bSeJrCXoJb5r/+4WAbET9PSuZpesC+Lhlm:viTeMragIHSCbSejJd7H9bEdZpeOL+
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Gabardinevvet/visitters.txt

SHA256 352800ce335abe1a1314683e1bd3bec5b1d381ef339e8f8e0d4e2aeb2b29f084
MD5 991aeff3afb17a165344645248ed0fde
SHA1 f60de7b26cf049cba337d18887151e948d419028
SHA512 01f6831631cff9cacb735ac10b4402868c2befdc7aa1ecc5e76af3252e934cebb3931705e2db4ddad54b941de6e92c3732ac82643a33f9fdb0cb30a792a89d03
MD5 SHA1 SHA512

NSIS installer

installer

034d0ad83a1a41c3fb2be5110d68a545b2426a337006a7f34a2050a0c7a18b9a.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Bushgoats.Blo

Gabardinevvet/Karensdagens.sko

Gabardinevvet/Leprosed.Vag

Gabardinevvet/images.jpg

Gabardinevvet/linwood.bar

Gabardinevvet/seksagesimas.fru

Gabardinevvet/visitters.txt

Sharing

General

Malware Config

Signatures

File Explorer

034d0ad83a1a41c3fb2be5110d68a545b2426a337006a7f34a2050a0c7a18b9a.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Bushgoats.Blo

Gabardinevvet/Karensdagens.sko

Gabardinevvet/Leprosed.Vag

Gabardinevvet/images.jpg

Gabardinevvet/linwood.bar

Gabardinevvet/seksagesimas.fru

Gabardinevvet/visitters.txt