Anfrage_244384[.]exe

resource
unpack001/$PLUGINSDIR/System.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

Anfrage_244384.exe

IMPHASH b78ecf47c0a3e24a6f4af114e2d1f5de
SHA256 eda014e3b658bfbbfd141c1459a3414d9ee8b7c139a3976fe732141fa9cf3f80
MD5 b03f23199ae987a7bce0ff1a0d742e3e
SHA1 f454c8de72926ee9f98db7056fa89f0c3ada9666
SHA512 01ccdc0f586a8926a56f0d3bfee91c5e882bff5df84cbb5363df6681fb62863a8075af8261bb72ecf2360d9d4dc4552dddb4e1ec1da002c24b9416ff0d3f95be
SSDEEP 24576:aCAoDyk/vnt3h1CzLuTIv08yZVk7ku8h7w6/t338euHdB4bU4VD4C:aCAfqvtx1UuTIMfg7ku8Vfx3/uHHSU4t
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

a1:2f:7f:ea:67:7d:42:54:4d:79:3f:df:86:4d:9f:ee:50:ec:64:ee:d5:eb:b7:e1:bd:b7:26:90:45:e4:c5:56

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=immechanical,O=immechanical,L=Montiers,C=FR

Chains

Nov 6, 2024

PE Signature issue

Digest

63:ee:bf:24:8e:3c:2b:ab:8d:b5:84:a5:06:99:22:47:ae:ff:1c:66

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=immechanical,O=immechanical,L=Montiers,C=FR

Chains

Nov 5, 2024

Minor OS version

0

Major OS version

4

Entry point

12707

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetEnvironmentVariableA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA GetFileAttributesA SetFileAttributesA GetWindowsDirectoryA GetTempPathA GetCommandLineA lstrlenA GetVersion SetErrorMode lstrcpynA ExitProcess GetFullPathNameA GlobalLock CreateThread GetLastError CreateDirectoryA CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA ReadFile WriteFile lstrcpyA MoveFileExA lstrcatA GetSystemDirectoryA GetProcAddress CloseHandle SetCurrentDirectoryA MoveFileA CompareFileTime GetShortPathNameA SearchPathA lstrcmpiA SetFileTime lstrcmpA ExpandEnvironmentStringsA GlobalUnlock GetDiskFreeSpaceA GlobalFree FindFirstFileA FindNextFileA DeleteFileA SetFilePointer GetPrivateProfileStringA FindClose MultiByteToWideChar FreeLibrary MulDiv WritePrivateProfileStringA LoadLibraryExA GetModuleHandleA GetExitCodeProcess WaitForSingleObject GlobalAlloc

user32

ScreenToClient GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard PostQuitMessage GetWindowRect EnableMenuItem CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndDialog RegisterClassA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx GetDC CreateDialogParamA SetTimer GetDlgItem SetWindowLongA SetForegroundWindow LoadImageA IsWindow SendMessageTimeoutA FindWindowExA OpenClipboard TrackPopupMenu AppendMenuA EndPaint DestroyWindow wsprintfA ShowWindow SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA

advapi32

RegDeleteKeyA SetFileSecurityA OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges RegOpenKeyExA RegEnumValueA RegDeleteValueA RegCloseKey RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/System.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 fa4ab1d6f79fd677433a31ada7806373a789d34328da46ccb0449bbf347bd73e
MD5 3f176d1ee13b0d7d6bd92e1c7a0b9bae
SHA1 fe582246792774c2c9dd15639ffa0aca90d6fd0b
SHA512 0a69124819b7568d0dea4e9e85ce8fe61c7ba697c934e3a95e2dcfb9f252b1d9da7faf8774b6e8efd614885507acc94987733eba09a2f5e7098b774dfc8524b6
SSDEEP 192:OPtkumJX7zB22kGwfy0mtVgkCPOsX1un:/702k5qpdsXQn
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

9995

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Angoragedernes/nilgedde.mes

SHA256 5a3b61a0bc8e81e756374d2a9ff5087fa4496543a635738aca8911e95d6340d9
MD5 df7a44909b03ab5bc45910b405d9977a
SHA1 3d0583a7dfb39e559827189e02123f2c983a21d5
SHA512 c2b4e951a185fc3fb75109b5caa554431c1517588d04b8f2ba865f75be448a0448364bcb84253c9b44579078787dda616f33666c0c1bf902ec644ebc9a6fe621
SSDEEP 768:E2oz5FNvncy2DZRau7W0sxOvPfSfpg5rWuWAAUIdde/FwPPMk/FOuyQv9biuPia6:opho02mYrKiKLFyJ1AIu2
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Angoragedernes/selefant.kri

SHA256 1d84f9462c244a4500c213df8dd79971b286392ca02bc536f5f6c3eebc94e7e3
MD5 b4c9fc75bab8c9f006a7d9ddbc249f79
SHA1 70d4047e7e3bb10cf237b82775c89a1d92700162
SHA512 2e2279cb3755ac5708abb30e8342235b7f0a24223e3d6f4b2b21b62e59012a5126adc1bd73d7b64e72634728decce7a049d3e6f5055f8d74e959bee54edbea4c
SSDEEP 768:nLoDoRi0SWvTrmnVqvh6dzfCaci65UhXqjMctTGA3QBgdRWqrw3q3LFPRvx7H155:DStBsLk6gsifeQIGA0iYRwvy8n
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Angoragedernes/speil.int

SHA256 b5a607f50c65e41b2bff7f852f27373177d326d9dfa1040e1c2b3af62f757bab
MD5 f3f6c6e37eab51d3b9b9c059c1eb874c
SHA1 401e5740ccfbc1da83bd9b426c11020c812986f2
SHA512 060b328595adaf9e85b390aa2aaceefe4c6197294b7c45594798755c5e04be1e2110f617b51e38d7df423cd807fa81b30702ce2548563980b9ca195ecf2c11a7
SSDEEP 1536:rbNZ/Rg8JCCgxT2eIgde/lBWTTBwGceukAdTYz91n6n:9NRg836IVLWHeGxKYQ
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Hemmeligt70.Bly

SHA256 4b029ecd2ce2eb26d9686573d7d891e689a717672bb8f76903bc44ec43da2955
MD5 ced0be5e2d0028efd3f1249ac1126ba3
SHA1 3902cd952ea81d8a7d9e0fc1f17972967ddd917d
SHA512 7f14e8fd856d1d1e2fd89c692685eb70c462bc1c202c4946cc1b0d27e59264278264c3c7ea72e63f9b9ba35c434faab305724827a4c8d63adbe78d8c4e4759fd
SSDEEP 768:hUm9EMv+RHOORqqYH3VEwnRnXNcmhdmPJPU9FLd86+qWhTeFVk6t6MmaEEXrDH9S:Om9chszXJlVdmPJuTWcJ6+3O9Rh
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Tingid.pig

SHA256 beed12f00b12156ff9fa63595de11a5c01493cf5f85488cb2e159cf1a8236778
MD5 f236a74f28f6f32f81f1347d9f129268
SHA1 d5be521661ee4bf3c186c3eaa0411dd5df6f3eba
SHA512 d6ad37ddf7b6b38b90f09186ac81c6a76f16f9a4613d6113f10d7b2a4f68129e570effc77a19b04f276277b7a569ebd5fd4a48d2e2e72cea8cee5a8f67cc5ef4
SSDEEP 1536:zGmPxn4XjZOVebnJjvYbTUBhGKcjnO/EeMHPm:Sm6zYVb849nH6
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

anya.por

SHA256 3965d74dbd296aa8e7524c773fe81fe63a78355145502153cb577e9cb136dda0
MD5 3ad8d5763ca124c7392d1f4f53d24f0e
SHA1 17d48ef1ab8d52a31821a069c225d45201535899
SHA512 ee8bde196a33297bfd4e51ed01e7d0178cf457497e822771d2be3c58a97681ac52cd19a2bbbb71220f06f6d936a6aa67966295df3c676104b9643f07cbe37ec8
SSDEEP 1536:i9EUBeeNEu//hQg77ea6OP/B1p7to4APRUYZAkxe:qFZO5u/B1pBo510
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

besiddertrang.gra

SHA256 fcd149788a3530e5e2cf5e17a09b1de51eb67b51f3e8941e7091f88b610373f1
MD5 8ab9852274fa64e09b5711a2e7d94aab
SHA1 2c39272b969040b4c185ee4a69a5f04fd1f7c0db
SHA512 6761208a22e8d93d70465e6dd9cf1b53826aa6bf0418dccb0a6e5816a183790a61ad67edcf52d21366975014701107563ce47a0465cee801300493aeb566cc69
SSDEEP 768:uFKWW9YiDlIMhmjVacve6tEvHBLNB3tQsrTpPH8mZLAUFwsahGF48hDpWRcKthwz:u5W9yMJLNbJ1CbFV3Gd6Ie48dPs
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

darbyite.txt

SHA256 72a2010cdb6ed407fca17cdb181d5f01801f16040c2c9443bd7cb5032cdaaef7
MD5 1560371431ceb91914af5b9d0d307ee1
SHA1 182b8979d4d0f9f26366653638a9c92fdaff0d56
SHA512 865ef0f7636149a47043183583635c2a4306bf49565166760672b88f0f9da89a529fe4166dff496327304e56a8a460b8113e5f3d58601c0b8a3efaabd792af3d
MD5 SHA1 SHA512

NSIS installer

installer

straffespark.Sek

SHA256 35be42786f6ef050a3baea615517e40958e6140a089e7d4a83283f1708994c03
MD5 301af874579f9ce64fce51a01f616625
SHA1 6d35516da84e4342c8e094023b60175bab5edceb
SHA512 3275c3b39115c29fe923c415d36f4932c279018994e636ce6606c5604b6fa5da984c7244be7017ac78204f6f8d90ae7706b1e729fad91eaeb3c2020a610755e4
SSDEEP 6144:fOiGjlSjER8DMKEzL4eNm6Vkg9XNf805ft+MODD+T:GCjEa4/zLD+05ek
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Anfrage_244384.exe

PE Signature issue

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Angoragedernes/nilgedde.mes

Angoragedernes/selefant.kri

Angoragedernes/speil.int

Hemmeligt70.Bly

Tingid.pig

anya.por

besiddertrang.gra

darbyite.txt

straffespark.Sek

Sharing

General

Malware Config

Signatures

File Explorer

Anfrage_244384.exe

PE Signature issue

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Angoragedernes/nilgedde.mes

Angoragedernes/selefant.kri

Angoragedernes/speil.int

Hemmeligt70.Bly

Tingid.pig

anya.por

besiddertrang.gra

darbyite.txt

straffespark.Sek