Stadigheder43[.]exe

resource
unpack001/$PLUGINSDIR/System.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

Stadigheder43.exe

IMPHASH 3abe302b6d9a1256e6a915429af4ffd2
SHA256 2fba62d26b23162edc673374335d575688b00d1467d936618793d28ec3729ad6
MD5 aa160f24e5670e39abcc8a33c6f51f2f
SHA1 eb8f77c8f6c5699614e304d8e7f8a3950ba41a4a
SHA512 8261633df47cad2dab42508a8f1c9d421b0b0c91d62a8b08bf3787c19b7116f3f091791800983bcd9d75d92b0097c08c670a38963ef4effd04e70ffc4cb9565e
SSDEEP 24576:2x+rcb2ZkoncoAzPLqt62HnQIQMOKOaeKf:2x+4b2SoncFzPLH2HTzOKOwf
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

cc:17:7c:9f:e6:37:05:7d:48:2c:8a:5d:ea:d4:d2:d3:93:79:bd:b0:16:30:3c:00:ab:d5:34:ee:ad:a2:fc:32

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Outlot,O=Outlot,L=Glendale,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

0c:b3:49:26:c3:7c:c5:2c:75:fb:d4:f0:9f:2a:5c:26:4a:10:35:a5

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Outlot,O=Outlot,L=Glendale,C=US

Chains

Oct 29, 2024

Minor OS version

0

Major OS version

4

Entry point

12731

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetTempPathA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess SetEnvironmentVariableA Sleep GetTickCount GetCommandLineA lstrlenA GetVersion SetErrorMode lstrcpynA GetDiskFreeSpaceA GlobalUnlock GetWindowsDirectoryA SetCurrentDirectoryA GetLastError CreateDirectoryA CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA ReadFile WriteFile lstrcpyA MoveFileExA lstrcatA GetSystemDirectoryA GetProcAddress GetExitCodeProcess WaitForSingleObject CompareFileTime SetFileAttributesA GetFileAttributesA GetShortPathNameA MoveFileA GetFullPathNameA SetFileTime SearchPathA CloseHandle lstrcmpiA CreateThread GlobalLock lstrcmpA FindFirstFileA FindNextFileA DeleteFileA SetFilePointer GetPrivateProfileStringA FindClose MultiByteToWideChar FreeLibrary MulDiv WritePrivateProfileStringA LoadLibraryExA GetModuleHandleA GlobalAlloc GlobalFree ExpandEnvironmentStringsA

user32

ScreenToClient GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard PostQuitMessage GetWindowRect EnableMenuItem CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndDialog RegisterClassA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx GetDC CreateDialogParamA SetTimer GetDlgItem SetWindowLongA SetForegroundWindow LoadImageA IsWindow SendMessageTimeoutA FindWindowExA OpenClipboard TrackPopupMenu AppendMenuA EndPaint DestroyWindow wsprintfA ShowWindow SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation ShellExecuteExA SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA SHFileOperationA

advapi32

AdjustTokenPrivileges RegCreateKeyExA RegOpenKeyExA SetFileSecurityA OpenProcessToken LookupPrivilegeValueA RegEnumValueA RegDeleteKeyA RegDeleteValueA RegCloseKey RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/System.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 b80a5cba69d1853ed5979b0ca0352437bf368a5cfb86cb4528edadd410e11352
MD5 c9473cb90d79a374b2ba6040ca16e45c
SHA1 ab95b54f12796dce57210d65f05124a6ed81234a
SHA512 eafe7d5894622bc21f663bca4dd594392ee0f5b29270b6b56b0187093d6a3a103545464ff6398ad32d2cf15dab79b1f133218ba9ba337ddc01330b5ada804d7b
SSDEEP 192:cPtkumJX7zBE2kGwfy9S9VkPsFQ1MZ1c:N7O2k5q9wA1MZa
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

9993

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Aftalepartneres126.Lse

SHA256 c6585eb48e08bb87bd867304558ee17b31c0f63b0fa5b6045837be224e48c214
MD5 d562317ca7317cc93432c5ddb379481e
SHA1 6261ab4a46933a7516cf0ad0c2143ad49033215d
SHA512 e968cbc807251368c93d032cb71dd4221707635a3d1e45873ac1b9e37a78871354af5750321bc739c18e6cd39e5adce1654320b41c96f0f83b9a31abb39643a2
SSDEEP 3072:KQx7AbNLGWF44Z0HRHDtIlwoCfmbGGeiknagQz2:KaONLGWF4I0HRjtIioCfmaGela9i
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Anklages.bod

SHA256 886b9aea37a0d8f21e3a9daeb974cff48197a47fe17279130576779e43ea44d5
MD5 beb0697ff747afd61850cf6c4221d5bd
SHA1 b36f5a97652154421dede2c9efa27c5bc48f696b
SHA512 a64adb44f9ea5395c3712f84fac6d124486f8589fd8f2f5e6afabc741e603651f405954aeb753da1ad67af3a05b7c39cbc552334cdf4c075b032c58967089790
SSDEEP 768:85nhJxzwEt9iIiklH+RybHpWf86+6Jl71/F4V/ay/b1kgPN0kfPvgJ95A9dqsFx/:7Et1jHF4h9exefjskVy6Ofnp44PcT+
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Contemplating.mod

SHA256 4e91b55ac251afdba5a78b0684959fe6d0521e47846cd46aceedeb0077e48a6a
MD5 796748a217e198b0ca9efb33711094b7
SHA1 2cb3c1b8856dd60ec4b575b207bcc1d660c7d2b3
SHA512 f1c2d81ca518f1662554d870cb8070504b882d91ca59045716d41f37082b829e56e9411a5764f80f132f96be6b186b1e78bbf6e3006d1de20080a3e230db4b37
SSDEEP 3072:/xtVLmzgvcqMrUr//HxGRZqKIfnlSFA2jdonow3mqUPhEkNIJgjlSZScHArM:UzuIrUr/JGRwJvgFvj2mlEkNmKI
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Erindlevs/besindelse.del

SHA256 9fad11e966e65f071438182d65d5c366fdec1b2e6e55b62fac6d340ed6af8e3d
MD5 ba84ecd8b2559ecbecbde1432c367ece
SHA1 abffeadcfd7ed93b57d884a9437a62e19eb66d11
SHA512 3ec3b59c9f7fc3039bfdf8f902a79f147f9d2f4d691bdad62df9edc209061931469dc9857eac0f22ca94fe3a33681520cfcd1953ebbafe575bffab8263e6d52f
SSDEEP 1536:oXoLe735oOOBiucAvUul/HY2/XtMWRHrRLhamiX:o4LuJNOBizS/HtFMWRLbam2
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Erindlevs/bevidsthedsudvidelsen.und

SHA256 adc2099b40e08d64c7c12e43f0a4877f9c8b2593b86edb6eb6381049093aafee
MD5 2a6ffc736e96e911cc777df21dd9207c
SHA1 41fe98c7ac97ac97f444383e8838f63899ac6a85
SHA512 b5c391f6106950d37110144968b899fe6f929dbb00257657ba8e63fb1ffb024aebe3eb6b8c3f0e4c336b5d4156d9a1e88d882f14d04555006afd66175b59e95a
SSDEEP 768:Sr45/U0agoHI2U/gRdeMgkZhDARzPafwGkOyRuI6WFTPj4c2ciLTSXfkgzIWN2CV:z/3POxDyCo6yjXH
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Erindlevs/phonetism.ham

SHA256 7eb2dcf0349ad2a17d56426054a123ff8dd0ecf60a74fbf59267d1e94fc86b78
MD5 5dc04b53c924a15c430da960db73aa27
SHA1 d3367203e4f7eac0d40ea08bd7434db17cbfc2e8
SHA512 90c85bb1da20e01f111fef7270ff4827d268c86467de338524ebd0e7736d1b77bf1bc9c3fa1fa1ee75a10cf3e9df5680babf49c4fd52e65e2a7f88c665eb3bf8
SSDEEP 768:UEGD8pi+OnyGF8VOfpmIamQ+1r2xhgXPyxI+R/9d7jdr5oGEqsraoC8R55An+T7+:sy3E6xuqr5t3q4ls6
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Erindlevs/skovtursstemningernes.and

SHA256 4e8b0fa52dc775d52f34528f17e40bc3c7b645de8fcbd15a13e15c9d8c9343de
MD5 a5dc7826aad6e8f21b82862d3dce5e19
SHA1 de1a5a38d84e7e89047d7cd75ce21476756569ed
SHA512 c44443a2c1e5738af7ff276e80cce08e6e830e1258252c43bd501ac8b3fa23fe72d801f9bf4eee3baf8075996fc89d2b276bdbe30af421faebb0681922057db7
SSDEEP 768:r8/GPBxg6M7g7OzAqybt6Yan7KhA4wowv9w81X/W136VZ+iE8iTnqcfW/+YcM3kV:A6S6E+wB/Y1zzZ+K3dX
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Erindlevs/telcontar.txt

SHA256 981c4f156a8d30ae7b40e6b611114707b46d0ef7ba61d6ecd813267b99b0a6ff
MD5 6ef48e64e0432b3eeb16614315305eab
SHA1 7921fb890955694225ef254dad564ff42ea888b9
SHA512 d58f034e162b33134c21373b0e7e77adfc5b4a1e6b193baca8960f2c33828ce0349dfa2b415605877075c65730245e1af80049aafbf450a6e1906218e7574811
MD5 SHA1 SHA512

NSIS installer

installer

ankomsttidernes.obs

SHA256 75c184e5697a25e1fddb29321c1fe5670191041a26f7e5209264d4b948cdbda5
MD5 e709e62365caa58ef4be2f1d9d635944
SHA1 74c294cf4b723304883cf6812549e7584ed8ca44
SHA512 22f057add0fd2dc37f539b66e37e75aede5f59c255d878257b01adcd22889b129778fd194f43822599c38619a515e1c07e38601257ec872cf6c2cf7bd597ce06
SSDEEP 1536:aSSMNripeTi8tcwZ5DxukXUgVOrokqGykfq:aWJThqSXUHyh
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

beggarliness.rab

SHA256 e8a6c6cc2f29488ee76e0e5f5751c8345d8fcfa58ae162f98e07ecbabf8f58b5
MD5 5066398dacf47b0581cbae543934824f
SHA1 f17d4884d4f1743e99e9cc2acb4927d3aac3f87c
SHA512 9b937a0d2a77da03244b4abebe2b015a55fb3acdf6e60587debdd5efbe90d62ea0353d3eb0e77f7eb4a34ff0afa6a85484a983b7c676e9ae821d6dc6a1559922
SSDEEP 1536:hnk5eUOtB6NJw8scQFwogPfCrb7iGRpPEG+sCLO6u:tktO8orbP/+su8
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Stadigheder43.exe

PE Signature issue

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Aftalepartneres126.Lse

Anklages.bod

Contemplating.mod

Erindlevs/besindelse.del

Erindlevs/bevidsthedsudvidelsen.und

Erindlevs/phonetism.ham

Erindlevs/skovtursstemningernes.and

Erindlevs/telcontar.txt

ankomsttidernes.obs

beggarliness.rab

Sharing

General

Malware Config

Signatures

File Explorer

Stadigheder43.exe

PE Signature issue

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Aftalepartneres126.Lse

Anklages.bod

Contemplating.mod

Erindlevs/besindelse.del

Erindlevs/bevidsthedsudvidelsen.und

Erindlevs/phonetism.ham

Erindlevs/skovtursstemningernes.and

Erindlevs/telcontar.txt

ankomsttidernes.obs

beggarliness.rab