Forreste[.]exe | Triage™

resource
unpack001/$PLUGINSDIR/System.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

Forreste.exe

IMPHASH 3abe302b6d9a1256e6a915429af4ffd2
SHA256 0c3b34493099cbbfbf51b25a4befe93e8d1b92008884500f91c66e2bd00dee1f
MD5 b6bcb5405a50ef97d57ae2b43ad5d01e
SHA1 2c8288be420bdb1b53438f07cbcdec259f47bd0d
SHA512 1a0eeea2ce4608fc4e0ae67b94f6c137de873b5c0da735c22a2e295dd9577aa1f6ba85ecd0193d771289d417a1d9cc758ea5cf8284cf3f2e3272571414cc9391
SSDEEP 24576:5x+rg0PyXjILtPkoAzuyn/pBF62HnQIQMOKOaeKg:5x+s0PyXjIxPkFzucp22HTzOKOwg
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

f0:a9:17:76:2f:fb:2b:0a:4c:5e:c1:40:06:8a:21:1d:3f:49:36:66:3b:76:74:67:ac:e6:aa:93:88:b2:9b:05

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Skrivekommandoers,O=Skrivekommandoers,L=Celeste,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

3b:da:ad:78:fd:2a:c0:73:5b:3c:e1:0d:67:bc:7a:43:0b:35:e4:c3

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Skrivekommandoers,O=Skrivekommandoers,L=Celeste,C=US

Chains

Oct 29, 2024

Minor OS version

0

Major OS version

4

Entry point

12731

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetTempPathA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess SetEnvironmentVariableA Sleep GetTickCount GetCommandLineA lstrlenA GetVersion SetErrorMode lstrcpynA GetDiskFreeSpaceA GlobalUnlock GetWindowsDirectoryA SetCurrentDirectoryA GetLastError CreateDirectoryA CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA ReadFile WriteFile lstrcpyA MoveFileExA lstrcatA GetSystemDirectoryA GetProcAddress GetExitCodeProcess WaitForSingleObject CompareFileTime SetFileAttributesA GetFileAttributesA GetShortPathNameA MoveFileA GetFullPathNameA SetFileTime SearchPathA CloseHandle lstrcmpiA CreateThread GlobalLock lstrcmpA FindFirstFileA FindNextFileA DeleteFileA SetFilePointer GetPrivateProfileStringA FindClose MultiByteToWideChar FreeLibrary MulDiv WritePrivateProfileStringA LoadLibraryExA GetModuleHandleA GlobalAlloc GlobalFree ExpandEnvironmentStringsA

user32

ScreenToClient GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard PostQuitMessage GetWindowRect EnableMenuItem CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndDialog RegisterClassA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx GetDC CreateDialogParamA SetTimer GetDlgItem SetWindowLongA SetForegroundWindow LoadImageA IsWindow SendMessageTimeoutA FindWindowExA OpenClipboard TrackPopupMenu AppendMenuA EndPaint DestroyWindow wsprintfA ShowWindow SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation ShellExecuteExA SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA SHFileOperationA

advapi32

AdjustTokenPrivileges RegCreateKeyExA RegOpenKeyExA SetFileSecurityA OpenProcessToken LookupPrivilegeValueA RegEnumValueA RegDeleteKeyA RegDeleteValueA RegCloseKey RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/System.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 b80a5cba69d1853ed5979b0ca0352437bf368a5cfb86cb4528edadd410e11352
MD5 c9473cb90d79a374b2ba6040ca16e45c
SHA1 ab95b54f12796dce57210d65f05124a6ed81234a
SHA512 eafe7d5894622bc21f663bca4dd594392ee0f5b29270b6b56b0187093d6a3a103545464ff6398ad32d2cf15dab79b1f133218ba9ba337ddc01330b5ada804d7b
SSDEEP 192:cPtkumJX7zBE2kGwfy9S9VkPsFQ1MZ1c:N7O2k5q9wA1MZa
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

9993

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Anklages.bod

SHA256 886b9aea37a0d8f21e3a9daeb974cff48197a47fe17279130576779e43ea44d5
MD5 beb0697ff747afd61850cf6c4221d5bd
SHA1 b36f5a97652154421dede2c9efa27c5bc48f696b
SHA512 a64adb44f9ea5395c3712f84fac6d124486f8589fd8f2f5e6afabc741e603651f405954aeb753da1ad67af3a05b7c39cbc552334cdf4c075b032c58967089790
SSDEEP 768:85nhJxzwEt9iIiklH+RybHpWf86+6Jl71/F4V/ay/b1kgPN0kfPvgJ95A9dqsFx/:7Et1jHF4h9exefjskVy6Ofnp44PcT+
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Fuldkommengjorde.Syg

SHA256 bd3c369deedf2d8fec77f93765ed600fd6b5c0b150bbdf5843c09b9dcab6fd03
MD5 cdf5c0f9c9f43e3f5db749e39d62c3e4
SHA1 150014ce763e242b2f04fc92931148837d6727dd
SHA512 bd85c01e2a856ff70846b3d2f3aceae90aab8c2144c643f106604e3799f9cf52667e857b43777b8226b888f632b8b6052b68d57a4546be94c9368d2a8eca380d
SSDEEP 3072:xd91kN+gStHRc09FqHacCZ3DXOLAE9zxX5cX97:xd91kNLSlRc0TqHVCZ3DXOvxJct
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Relationslogikkens/Mikrofilmens/besindelse.del

SHA256 9fad11e966e65f071438182d65d5c366fdec1b2e6e55b62fac6d340ed6af8e3d
MD5 ba84ecd8b2559ecbecbde1432c367ece
SHA1 abffeadcfd7ed93b57d884a9437a62e19eb66d11
SHA512 3ec3b59c9f7fc3039bfdf8f902a79f147f9d2f4d691bdad62df9edc209061931469dc9857eac0f22ca94fe3a33681520cfcd1953ebbafe575bffab8263e6d52f
SSDEEP 1536:oXoLe735oOOBiucAvUul/HY2/XtMWRHrRLhamiX:o4LuJNOBizS/HtFMWRLbam2
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Relationslogikkens/Mikrofilmens/bevidsthedsudvidelsen.und

SHA256 adc2099b40e08d64c7c12e43f0a4877f9c8b2593b86edb6eb6381049093aafee
MD5 2a6ffc736e96e911cc777df21dd9207c
SHA1 41fe98c7ac97ac97f444383e8838f63899ac6a85
SHA512 b5c391f6106950d37110144968b899fe6f929dbb00257657ba8e63fb1ffb024aebe3eb6b8c3f0e4c336b5d4156d9a1e88d882f14d04555006afd66175b59e95a
SSDEEP 768:Sr45/U0agoHI2U/gRdeMgkZhDARzPafwGkOyRuI6WFTPj4c2ciLTSXfkgzIWN2CV:z/3POxDyCo6yjXH
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Relationslogikkens/Mikrofilmens/phonetism.ham

SHA256 7eb2dcf0349ad2a17d56426054a123ff8dd0ecf60a74fbf59267d1e94fc86b78
MD5 5dc04b53c924a15c430da960db73aa27
SHA1 d3367203e4f7eac0d40ea08bd7434db17cbfc2e8
SHA512 90c85bb1da20e01f111fef7270ff4827d268c86467de338524ebd0e7736d1b77bf1bc9c3fa1fa1ee75a10cf3e9df5680babf49c4fd52e65e2a7f88c665eb3bf8
SSDEEP 768:UEGD8pi+OnyGF8VOfpmIamQ+1r2xhgXPyxI+R/9d7jdr5oGEqsraoC8R55An+T7+:sy3E6xuqr5t3q4ls6
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Relationslogikkens/Mikrofilmens/skovtursstemningernes.and

SHA256 4e8b0fa52dc775d52f34528f17e40bc3c7b645de8fcbd15a13e15c9d8c9343de
MD5 a5dc7826aad6e8f21b82862d3dce5e19
SHA1 de1a5a38d84e7e89047d7cd75ce21476756569ed
SHA512 c44443a2c1e5738af7ff276e80cce08e6e830e1258252c43bd501ac8b3fa23fe72d801f9bf4eee3baf8075996fc89d2b276bdbe30af421faebb0681922057db7
SSDEEP 768:r8/GPBxg6M7g7OzAqybt6Yan7KhA4wowv9w81X/W136VZ+iE8iTnqcfW/+YcM3kV:A6S6E+wB/Y1zzZ+K3dX
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Relationslogikkens/Mikrofilmens/telcontar.txt

SHA256 981c4f156a8d30ae7b40e6b611114707b46d0ef7ba61d6ecd813267b99b0a6ff
MD5 6ef48e64e0432b3eeb16614315305eab
SHA1 7921fb890955694225ef254dad564ff42ea888b9
SHA512 d58f034e162b33134c21373b0e7e77adfc5b4a1e6b193baca8960f2c33828ce0349dfa2b415605877075c65730245e1af80049aafbf450a6e1906218e7574811
MD5 SHA1 SHA512

NSIS installer

installer

Relationslogikkens/ankomsttidernes.obs

SHA256 75c184e5697a25e1fddb29321c1fe5670191041a26f7e5209264d4b948cdbda5
MD5 e709e62365caa58ef4be2f1d9d635944
SHA1 74c294cf4b723304883cf6812549e7584ed8ca44
SHA512 22f057add0fd2dc37f539b66e37e75aede5f59c255d878257b01adcd22889b129778fd194f43822599c38619a515e1c07e38601257ec872cf6c2cf7bd597ce06
SSDEEP 1536:aSSMNripeTi8tcwZ5DxukXUgVOrokqGykfq:aWJThqSXUHyh
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Relationslogikkens/beggarliness.rab

SHA256 e8a6c6cc2f29488ee76e0e5f5751c8345d8fcfa58ae162f98e07ecbabf8f58b5
MD5 5066398dacf47b0581cbae543934824f
SHA1 f17d4884d4f1743e99e9cc2acb4927d3aac3f87c
SHA512 9b937a0d2a77da03244b4abebe2b015a55fb3acdf6e60587debdd5efbe90d62ea0353d3eb0e77f7eb4a34ff0afa6a85484a983b7c676e9ae821d6dc6a1559922
SSDEEP 1536:hnk5eUOtB6NJw8scQFwogPfCrb7iGRpPEG+sCLO6u:tktO8orbP/+su8
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

wilhelm.Spu

SHA256 c7f519cc5699b6d49d9b4acb21dab3de3125270a82594d7a2c1caed7a1a0176b
MD5 b102f621152ec71e1e2d2faf4f81f6fc
SHA1 2ea9ebece51972e3c678401c3eb1688568908559
SHA512 40f7832e1523ff1a3c0c9af12ed1271571868dece4a7917531b0c45419f18e87a018ae3a1744ab91ca9d843de524b486ff11750ab5ce3fd3c24363fdb9decd76
SSDEEP 6144:a7tyk5SzY60EB06Gn4Y5+CX9xEmlpmh2VpYL6kweRsRjXx6PnvBzr:aH9CwpYLQx6h3
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Forreste.exe

PE Signature issue

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Anklages.bod

Fuldkommengjorde.Syg

Relationslogikkens/Mikrofilmens/besindelse.del

Relationslogikkens/Mikrofilmens/bevidsthedsudvidelsen.und

Relationslogikkens/Mikrofilmens/phonetism.ham

Relationslogikkens/Mikrofilmens/skovtursstemningernes.and

Relationslogikkens/Mikrofilmens/telcontar.txt

Relationslogikkens/ankomsttidernes.obs

Relationslogikkens/beggarliness.rab

wilhelm.Spu

Sharing

General

Malware Config

Signatures

File Explorer

Forreste.exe

PE Signature issue

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Anklages.bod

Fuldkommengjorde.Syg

Relationslogikkens/Mikrofilmens/besindelse.del

Relationslogikkens/Mikrofilmens/bevidsthedsudvidelsen.und

Relationslogikkens/Mikrofilmens/phonetism.ham

Relationslogikkens/Mikrofilmens/skovtursstemningernes.and

Relationslogikkens/Mikrofilmens/telcontar.txt

Relationslogikkens/ankomsttidernes.obs

Relationslogikkens/beggarliness.rab

wilhelm.Spu