0c90b170c457fe4656140750bef8331f0f7c195bf3acb378f8ec80a6a42a7441[.]exe

resource
0c90b170c457fe4656140750bef8331f0f7c195bf3acb378f8ec80a6a42a7441.exe
unpack001/$PLUGINSDIR/LangDLL.dll
unpack001/$PLUGINSDIR/System.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

0c90b170c457fe4656140750bef8331f0f7c195bf3acb378f8ec80a6a42a7441.exe

IMPHASH ced282d9b261d1462772017fe2f6972b
SHA256 0c90b170c457fe4656140750bef8331f0f7c195bf3acb378f8ec80a6a42a7441
MD5 4561965a5e1e66d75ebb16a45d098c43
SHA1 0a087a7b9d6bba373df97b176122e8e2c11c6cea
SHA512 617eaf92fe4c52fb3833cd348256558ebf9bef13325f2015af7fefd10a20ae65dd592298f3f330b370d7d22ccca2fcbfbc89f5866c2efef9c816efc86f3f4969
SSDEEP 24576:wD2EKNLaAYQNB24QAE4IBGTizPkY6/mMScs2:wD2EKNLCXN4IBKizPo/mMScs2
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

13074

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCreateKeyExA RegEnumKeyA RegQueryValueExA RegSetValueExA RegCloseKey RegDeleteValueA RegDeleteKeyA AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken SetFileSecurityA RegOpenKeyExA RegEnumValueA

shell32

SHGetFileInfoA SHFileOperationA SHGetPathFromIDListA ShellExecuteExA SHGetSpecialFolderLocation SHBrowseForFolderA

ole32

IIDFromString OleInitialize OleUninitialize CoCreateInstance CoTaskMemFree

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

SetClipboardData CharPrevA CallWindowProcA PeekMessageA DispatchMessageA MessageBoxIndirectA GetDlgItemTextA SetDlgItemTextA GetSystemMetrics CreatePopupMenu AppendMenuA TrackPopupMenu FillRect EmptyClipboard LoadCursorA GetMessagePos CheckDlgButton GetSysColor SetCursor GetWindowLongA SetClassLongA SetWindowPos IsWindowEnabled GetWindowRect GetSystemMenu EnableMenuItem RegisterClassA ScreenToClient EndDialog GetClassInfoA SystemParametersInfoA CreateWindowExA ExitWindowsEx DialogBoxParamA CharNextA SetTimer DestroyWindow CreateDialogParamA SetForegroundWindow SetWindowTextA PostQuitMessage SendMessageTimeoutA ShowWindow wsprintfA GetDlgItem FindWindowExA IsWindow GetDC SetWindowLongA LoadImageA InvalidateRect ReleaseDC EnableWindow BeginPaint SendMessageA DefWindowProcA DrawTextA GetClientRect EndPaint IsWindowVisible CloseClipboard OpenClipboard

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateFontIndirectA CreateBrushIndirect DeleteObject SetTextColor SelectObject

kernel32

GetExitCodeProcess WaitForSingleObject GetProcAddress GetSystemDirectoryA WideCharToMultiByte MoveFileExA ReadFile GetTempFileNameA WriteFile RemoveDirectoryA CreateProcessA CreateFileA GetLastError CreateThread CreateDirectoryA GlobalUnlock GetDiskFreeSpaceA GlobalLock SetErrorMode GetVersion lstrcpynA GetCommandLineA GetTempPathA lstrlenA SetEnvironmentVariableA ExitProcess GetWindowsDirectoryA GetCurrentProcess GetModuleFileNameA CopyFileA GetTickCount Sleep GetFileSize GetFileAttributesA SetCurrentDirectoryA SetFileAttributesA GetFullPathNameA GetShortPathNameA MoveFileA CompareFileTime SetFileTime SearchPathA lstrcmpiA lstrcmpA CloseHandle GlobalFree GlobalAlloc ExpandEnvironmentStringsA LoadLibraryExA FreeLibrary lstrcpyA lstrcatA FindClose MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA SetFilePointer GetModuleHandleA FindNextFileA FindFirstFileA DeleteFileA MulDiv

$PLUGINSDIR/LangDLL.dll

IMPHASH 274b99a815ba574d8c9e1712916d8b30
SHA256 d65875bb4bc121f81384d55fde90dd9eb9ad1878cd8a02bcb5c8a933c3987a61
MD5 61f69388ae89d61a3d838cbcf81b4f82
SHA1 e595c0236a373a6ac79c334dc183ee03ca8f8ecd
SHA512 21d34738cc21c1ef6b0ef1ac53659cdab224bbc20ea983f9a952a2cb4b5785a07bb18c0acf22a0d12a94795e1fc6d314f442c923bb1a93b675edac8c6aacf469
SSDEEP 48:im1CEhqneMPUptuMMNvimk2BAZuMTRCpYEvJdUJvR0JCof5dwe:F10pl9NLBAZuYtR0hd
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

5582

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 d09a8b3ade4ba4b7292c0b3da1bcb4b6c6e2012e0ccfd5e029a54af73a9e1b57
MD5 4ca4fd3fbefa2f6e87e6e9ee87d1c0b3
SHA1 7cdbeb5ff2b14b86af04e075d0ca651183ea5df4
SHA512 cf0f415a97fdc74568297fed4f1295d0d2aef487a308141144ef8d5f04c669ef4795c273e745b81065429adde113fcdedf4c22717a7aeef60fdcd8d4d46f97f8
SSDEEP 192:EPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4W:j7VpNo8gmOyRsVc4
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10529

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Bedsteborgerliges.ska

SHA256 985bf1956478234e4a23dfb5879601343e8cac69da4e52027cbca7ec5aa51332
MD5 4d3aed670f4cd4cf671739d8753cd6d3
SHA1 cdf9f4cbf0813c7c952e6c0e28294e2e6c5fcfb3
SHA512 98daecb274db71e739f7761dd8312a8938504421cb3a23de59437c8ddeb658c297d82063616f7ea04c5ee739c90a498a8c721ec7d8e86f35c05a5b6f839e9944
SSDEEP 768:mdVydb3ofc51+MAc7UTLTU+i6s2xydedCA1+z1R5LzXfgJ+k5Pk+tbAyHQZoAPqS:ma+14wdxEzJzXgnBnwGm
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Dagligvarer.Kno

SHA256 abfeedc931b73e224b45f156809e90681e59a5a6e166c36b855f17c500a618ff
MD5 859b9ceecb565db35f79d521111ddeae
SHA1 c81c74791685d19f0d58091fed7c386f7f9306a5
SHA512 b7867ab940f0bad39fc93969811bdddf5c5095b48b37e01e327fec6f35c8da058f246ad4036e06b40282f15a911a345820a63248b8f984cd3da7e859fd6fc89f
SSDEEP 6144:Bs8X1tO1h04qDLyuiPWwzd5e4wAwIi1ZRJjawG3:mZ6UbdOA/izRcx
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Dueful/case.jpg

SHA256 722de6404247b0a96bab46c7567661b352f5a8bf2b267e333930c4cad2613868
MD5 f68eeb6cacd594c1a6b662d2cd30ccec
SHA1 fc7ec71bab41e5df5dd6fb5a5105a512c7f74b53
SHA512 792d3ec7d5a112275382cf7b89f4a305cc2f9e4547d2c6329368553e139afdc20e377d197f7ea627d77e003607feb18c8f1343b049f47f9d4db926d29cccea78
SSDEEP 3072:IskG8wJzn5V9qqn0ZLsull85ijr0cBLUufuuspBo:Is8wJzP9qqnsE5ijQ4UquuEo
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Dueful/chinones.nua

SHA256 aad206388c03eac32671db151d2826ae968e98912b17f2945da07205dbe8ce38
MD5 7285ed87bce392319a3d54d811964fad
SHA1 2716195b1d0f5ce8ec4921feaa40a62baafdd7fa
SHA512 c339d48676963210d952073f8caa16ae856341f97cae4c9919a30ea051a45e2d41777a1ee3ea3b813ee2418d65b03704c3c2686cafe4b4601b877d50419d3fb0
SSDEEP 1536:mG/eiR9wzu4ClROIPQQC3VIzpMFuF641GthTKbR:kiR9jtzwmpLmcbR
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Dueful/dactylopteridae.arr

SHA256 b690cd825a409ad9a2df4ff48f881592ee6e20ec944459e61feeda083ec8b33a
MD5 5d36fb5fc32d9b57654b7d614af4276c
SHA1 f45346b9c57b886457180a0a838ce9b1d568b8ba
SHA512 55fceef462552cdf21da024eac786c2743f2817dcdcb9ff8bda51b71ab3b8586bd9498fb01e1fce0890b74c1ed569da1ab753ac3b8b0006106985f1e2d540d88
SSDEEP 192:8Uoq3zQFqh0nK2+NH92T16JssBnvezxgmcRkXtP1SUkfz:8KQFs0K2+NHO1DsBnvezxgmcR2h1Sffz
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Dueful/kupfernickel.txt

SHA256 d69b6c4c4a4a2855b26951ee8cefa64f80b915de17b686697b82af32b467bbad
MD5 448e02131260218207dc72e34d6af99b
SHA1 166fc591a2137814f1f2e63a555a26ba0eb22136
SHA512 58f15948e03d64bb44c606ff961540c0b8a1c9325a839de4733374673095d4c498d9c678c514eaef4c6a1b00ef5ae4dbb4b0147e6777919787aeabc88e5eedd6
MD5 SHA1 SHA512

NSIS installer

installer

Dueful/tabtype.mil

SHA256 20c00d941e6ff2066f43632f8f48178e3a8890047fb9097480ebac572c282854
MD5 46c8fa6a82d7917c5931bd82e7f520a5
SHA1 479c2b3798fce07e38aa3eebb198e89d6761347e
SHA512 c8c7b860ded8da1a0487de4792ce7653d95d86e8546a6f375ba8748eb33e79b4aa41bba7be8223f394c5f0f5f93cc114132a8732491af76b2bb6c04e983430df
SSDEEP 1536:mGpJHFZRTfIEdBVSuSnxoxbmrj8GuFkCX66PPUQl0ieAVHDBK:DppL+EUuMQbKIFVqmP/+i1h
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Dueful/vrkstedstids.nri

SHA256 12194de1af8bbc21b2dfa55ccbefb089b11820bf149919398301a515a7d9f539
MD5 5daedb2a984db5b0b5e7043acbea51df
SHA1 f159484d6cc0f5c5fa9ad35c76eba9436a5243bd
SHA512 22c088e47e3e700c6463d758d4f4fdbfc284286a4a3c92b15383313472ecd9aefee697507342796d48b286477f58842ad3fa2239bc1d1d3d8005e5c8ba0a1167
SSDEEP 768:UK4TVspxmqTulB2IaWA4lqbkE2pOhzXD/QLuaZR5/m0mSaXsiwu3tvxHqjG4jgLD:UK4/KWhaIdG4UczgY+oLS0+XpNr9L
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Waspishly.Lot

SHA256 61188e0bd3e6e9cf34237a9c1a9f6bd7580f0f00c6d97c69f727579a57ca44ed
MD5 44daf03bfb32aa2d3f3c9c26bef431de
SHA1 5275aac3ff05a317bb1c1ed0ea1482e529e4e0e2
SHA512 21674f99330da44f34e8df418033e3f940358cb0f01b69d7d8a1bf526b7790ca6cf9a1853cdfb692e1f82e35881ea84106ff8e8cf03112a5f2abfb11bb9e00b3
SSDEEP 1536:C2ILRc330xO3JEPUXnambJfP08V37rsHmdp3kjw31ruL06D2OJ/Qf1AeL:vLR/ht
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

0c90b170c457fe4656140750bef8331f0f7c195bf3acb378f8ec80a6a42a7441.exe

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/LangDLL.dll

kernel32

user32

gdi32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Bedsteborgerliges.ska

Dagligvarer.Kno

Dueful/case.jpg

Dueful/chinones.nua

Dueful/dactylopteridae.arr

Dueful/kupfernickel.txt

Dueful/tabtype.mil

Dueful/vrkstedstids.nri

Waspishly.Lot

Sharing

General

Malware Config

Signatures

File Explorer

0c90b170c457fe4656140750bef8331f0f7c195bf3acb378f8ec80a6a42a7441.exe

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/LangDLL.dll

kernel32

user32

gdi32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Bedsteborgerliges.ska

Dagligvarer.Kno

Dueful/case.jpg

Dueful/chinones.nua

Dueful/dactylopteridae.arr

Dueful/kupfernickel.txt

Dueful/tabtype.mil

Dueful/vrkstedstids.nri

Waspishly.Lot