rTransferenciarealizada451236[.]exe

resource
unpack001/$PLUGINSDIR/System.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

rTransferenciarealizada451236.exe

IMPHASH 3abe302b6d9a1256e6a915429af4ffd2
SHA256 8085c17ea9441ff19ee1d021408ce2b159bdf4d53704a9afd180e76033c74415
MD5 12f32dc32a25a48db3aca40758745e80
SHA1 41f2c89b8c83b279633c641d1e266a3a2487294d
SHA512 b3e71933c26fc75dfa3aef0efc9ef375572df28cdba1b85dac9ecda062e572a6999dcbeec382b04e5a7d24e3485f5aa6852fad9e2d36fded55525fa8acf8dd9c
SSDEEP 24576:6x+rRnZt2HrJ1oAzm2ESD62HnQIQMOKOaeKX:6x+1nZcLHFzmnSW2HTzOKOwX
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

11:ed:ee:3e:9c:98:b6:2a:53:c7:44:bf:1a:f5:8e:5e:63:02:d2:47:99:39:19:15:d1:7e:24:a3:9c:29:50:8d

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Dimorphous,O=Dimorphous,L=Arlington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

10:9e:99:47:79:be:4f:b6:ed:05:72:80:2d:30:62:1a:10:27:5f:79

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Dimorphous,O=Dimorphous,L=Arlington,C=US

Chains

Oct 29, 2024

Minor OS version

0

Major OS version

4

Entry point

12731

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetTempPathA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess SetEnvironmentVariableA Sleep GetTickCount GetCommandLineA lstrlenA GetVersion SetErrorMode lstrcpynA GetDiskFreeSpaceA GlobalUnlock GetWindowsDirectoryA SetCurrentDirectoryA GetLastError CreateDirectoryA CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA ReadFile WriteFile lstrcpyA MoveFileExA lstrcatA GetSystemDirectoryA GetProcAddress GetExitCodeProcess WaitForSingleObject CompareFileTime SetFileAttributesA GetFileAttributesA GetShortPathNameA MoveFileA GetFullPathNameA SetFileTime SearchPathA CloseHandle lstrcmpiA CreateThread GlobalLock lstrcmpA FindFirstFileA FindNextFileA DeleteFileA SetFilePointer GetPrivateProfileStringA FindClose MultiByteToWideChar FreeLibrary MulDiv WritePrivateProfileStringA LoadLibraryExA GetModuleHandleA GlobalAlloc GlobalFree ExpandEnvironmentStringsA

user32

ScreenToClient GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard PostQuitMessage GetWindowRect EnableMenuItem CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndDialog RegisterClassA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx GetDC CreateDialogParamA SetTimer GetDlgItem SetWindowLongA SetForegroundWindow LoadImageA IsWindow SendMessageTimeoutA FindWindowExA OpenClipboard TrackPopupMenu AppendMenuA EndPaint DestroyWindow wsprintfA ShowWindow SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation ShellExecuteExA SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA SHFileOperationA

advapi32

AdjustTokenPrivileges RegCreateKeyExA RegOpenKeyExA SetFileSecurityA OpenProcessToken LookupPrivilegeValueA RegEnumValueA RegDeleteKeyA RegDeleteValueA RegCloseKey RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/System.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 b80a5cba69d1853ed5979b0ca0352437bf368a5cfb86cb4528edadd410e11352
MD5 c9473cb90d79a374b2ba6040ca16e45c
SHA1 ab95b54f12796dce57210d65f05124a6ed81234a
SHA512 eafe7d5894622bc21f663bca4dd594392ee0f5b29270b6b56b0187093d6a3a103545464ff6398ad32d2cf15dab79b1f133218ba9ba337ddc01330b5ada804d7b
SSDEEP 192:cPtkumJX7zBE2kGwfy9S9VkPsFQ1MZ1c:N7O2k5q9wA1MZa
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

9993

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Anklages.bod

SHA256 886b9aea37a0d8f21e3a9daeb974cff48197a47fe17279130576779e43ea44d5
MD5 beb0697ff747afd61850cf6c4221d5bd
SHA1 b36f5a97652154421dede2c9efa27c5bc48f696b
SHA512 a64adb44f9ea5395c3712f84fac6d124486f8589fd8f2f5e6afabc741e603651f405954aeb753da1ad67af3a05b7c39cbc552334cdf4c075b032c58967089790
SSDEEP 768:85nhJxzwEt9iIiklH+RybHpWf86+6Jl71/F4V/ay/b1kgPN0kfPvgJ95A9dqsFx/:7Et1jHF4h9exefjskVy6Ofnp44PcT+
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Sjipnings.Bou

SHA256 1809c967d2ab6bd088913e9911301528af8bed3f26dffc314146e07eeedfebef
MD5 2633331591c0e4d22bd7e67ffbea60dc
SHA1 d187f842d95b108267740be4658ecbd83591009d
SHA512 6319f8fa8559e8e9f32714be74fbdd0aba4536860f34781d07408b88818281cc34f1342d89b89e66ceb73e5be3d62e0c2d318812942ca2d5493b0597fc05e528
SSDEEP 3072:J0tpYx2QPaAOOjQV5872Px/Zl39hlCMBwPW1utBJC:J0cx2NAOOjQV5872P/lLlTBwPW1aBI
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Sprechstallmeisters/beggarliness.rab

SHA256 e8a6c6cc2f29488ee76e0e5f5751c8345d8fcfa58ae162f98e07ecbabf8f58b5
MD5 5066398dacf47b0581cbae543934824f
SHA1 f17d4884d4f1743e99e9cc2acb4927d3aac3f87c
SHA512 9b937a0d2a77da03244b4abebe2b015a55fb3acdf6e60587debdd5efbe90d62ea0353d3eb0e77f7eb4a34ff0afa6a85484a983b7c676e9ae821d6dc6a1559922
SSDEEP 1536:hnk5eUOtB6NJw8scQFwogPfCrb7iGRpPEG+sCLO6u:tktO8orbP/+su8
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Sprechstallmeisters/besindelse.del

SHA256 9fad11e966e65f071438182d65d5c366fdec1b2e6e55b62fac6d340ed6af8e3d
MD5 ba84ecd8b2559ecbecbde1432c367ece
SHA1 abffeadcfd7ed93b57d884a9437a62e19eb66d11
SHA512 3ec3b59c9f7fc3039bfdf8f902a79f147f9d2f4d691bdad62df9edc209061931469dc9857eac0f22ca94fe3a33681520cfcd1953ebbafe575bffab8263e6d52f
SSDEEP 1536:oXoLe735oOOBiucAvUul/HY2/XtMWRHrRLhamiX:o4LuJNOBizS/HtFMWRLbam2
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Sprechstallmeisters/bevidsthedsudvidelsen.und

SHA256 adc2099b40e08d64c7c12e43f0a4877f9c8b2593b86edb6eb6381049093aafee
MD5 2a6ffc736e96e911cc777df21dd9207c
SHA1 41fe98c7ac97ac97f444383e8838f63899ac6a85
SHA512 b5c391f6106950d37110144968b899fe6f929dbb00257657ba8e63fb1ffb024aebe3eb6b8c3f0e4c336b5d4156d9a1e88d882f14d04555006afd66175b59e95a
SSDEEP 768:Sr45/U0agoHI2U/gRdeMgkZhDARzPafwGkOyRuI6WFTPj4c2ciLTSXfkgzIWN2CV:z/3POxDyCo6yjXH
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Sprechstallmeisters/phonetism.ham

SHA256 7eb2dcf0349ad2a17d56426054a123ff8dd0ecf60a74fbf59267d1e94fc86b78
MD5 5dc04b53c924a15c430da960db73aa27
SHA1 d3367203e4f7eac0d40ea08bd7434db17cbfc2e8
SHA512 90c85bb1da20e01f111fef7270ff4827d268c86467de338524ebd0e7736d1b77bf1bc9c3fa1fa1ee75a10cf3e9df5680babf49c4fd52e65e2a7f88c665eb3bf8
SSDEEP 768:UEGD8pi+OnyGF8VOfpmIamQ+1r2xhgXPyxI+R/9d7jdr5oGEqsraoC8R55An+T7+:sy3E6xuqr5t3q4ls6
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Sprechstallmeisters/skovtursstemningernes.and

SHA256 4e8b0fa52dc775d52f34528f17e40bc3c7b645de8fcbd15a13e15c9d8c9343de
MD5 a5dc7826aad6e8f21b82862d3dce5e19
SHA1 de1a5a38d84e7e89047d7cd75ce21476756569ed
SHA512 c44443a2c1e5738af7ff276e80cce08e6e830e1258252c43bd501ac8b3fa23fe72d801f9bf4eee3baf8075996fc89d2b276bdbe30af421faebb0681922057db7
SSDEEP 768:r8/GPBxg6M7g7OzAqybt6Yan7KhA4wowv9w81X/W136VZ+iE8iTnqcfW/+YcM3kV:A6S6E+wB/Y1zzZ+K3dX
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Sprechstallmeisters/telcontar.txt

SHA256 981c4f156a8d30ae7b40e6b611114707b46d0ef7ba61d6ecd813267b99b0a6ff
MD5 6ef48e64e0432b3eeb16614315305eab
SHA1 7921fb890955694225ef254dad564ff42ea888b9
SHA512 d58f034e162b33134c21373b0e7e77adfc5b4a1e6b193baca8960f2c33828ce0349dfa2b415605877075c65730245e1af80049aafbf450a6e1906218e7574811
MD5 SHA1 SHA512

NSIS installer

installer

Windsorstols.Amb

SHA256 f7b461aaaf2803dbbd6fa372453c7407df6819a5ffd86816337c5bbf97bbe8b7
MD5 38a8352122df8f9efd4087664401cf27
SHA1 6b15b0dd6bf0cf9ffdd277cbe41e0f674f8a78e4
SHA512 d17f51537a4be75431c30c1e784a0c855933cec5154517e58ae71c679a34a441c4273142ea510eb6d58f816474cd3d8508959f94d45cfdd60c5ebc3b45a39be5
SSDEEP 3072:6Ndzktt0gTZl/NRbkb4uWI8VHtWPHK+I0Qpz2raHB9GcAq41N/h9b2aq:6NBktJtBQ2VHtqHDLYB1AqkNp8F
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

ankomsttidernes.obs

SHA256 75c184e5697a25e1fddb29321c1fe5670191041a26f7e5209264d4b948cdbda5
MD5 e709e62365caa58ef4be2f1d9d635944
SHA1 74c294cf4b723304883cf6812549e7584ed8ca44
SHA512 22f057add0fd2dc37f539b66e37e75aede5f59c255d878257b01adcd22889b129778fd194f43822599c38619a515e1c07e38601257ec872cf6c2cf7bd597ce06
SSDEEP 1536:aSSMNripeTi8tcwZ5DxukXUgVOrokqGykfq:aWJThqSXUHyh
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

rTransferenciarealizada451236.exe

PE Signature issue

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Anklages.bod

Sjipnings.Bou

Sprechstallmeisters/beggarliness.rab

Sprechstallmeisters/besindelse.del

Sprechstallmeisters/bevidsthedsudvidelsen.und

Sprechstallmeisters/phonetism.ham

Sprechstallmeisters/skovtursstemningernes.and

Sprechstallmeisters/telcontar.txt

Windsorstols.Amb

ankomsttidernes.obs

Sharing

General

Malware Config

Signatures

File Explorer

rTransferenciarealizada451236.exe

PE Signature issue

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Anklages.bod

Sjipnings.Bou

Sprechstallmeisters/beggarliness.rab

Sprechstallmeisters/besindelse.del

Sprechstallmeisters/bevidsthedsudvidelsen.und

Sprechstallmeisters/phonetism.ham

Sprechstallmeisters/skovtursstemningernes.and

Sprechstallmeisters/telcontar.txt

Windsorstols.Amb

ankomsttidernes.obs