acdda22ea40a289e3a1ff725de7a933415bf6c143dc60cdb296fe17d36d894ac[.]exe

resource
acdda22ea40a289e3a1ff725de7a933415bf6c143dc60cdb296fe17d36d894ac.exe
unpack001/$PLUGINSDIR/LangDLL.dll
unpack001/$PLUGINSDIR/System.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

acdda22ea40a289e3a1ff725de7a933415bf6c143dc60cdb296fe17d36d894ac.exe

IMPHASH ced282d9b261d1462772017fe2f6972b
SHA256 acdda22ea40a289e3a1ff725de7a933415bf6c143dc60cdb296fe17d36d894ac
MD5 45ade5a7d2ba48cc791547736965f440
SHA1 37fb98d6b79231cdaf6b4b6f88f38e575a67742f
SHA512 d89fec7cd5d4c0868daa57eaae1fb92b899ec2cf26ddefe0267da8f347b99aece88b8d7901af8dff6d815c3e69cff657573663cf8a07693fb64c1f3f6ad116e7
SSDEEP 24576:wD2EKyq5H7X3y6MBGYrNizPkY6/mMScs2:wD2EKyGH7ny6MBBizPo/mMScs2
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

13074

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCreateKeyExA RegEnumKeyA RegQueryValueExA RegSetValueExA RegCloseKey RegDeleteValueA RegDeleteKeyA AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken SetFileSecurityA RegOpenKeyExA RegEnumValueA

shell32

SHGetFileInfoA SHFileOperationA SHGetPathFromIDListA ShellExecuteExA SHGetSpecialFolderLocation SHBrowseForFolderA

ole32

IIDFromString OleInitialize OleUninitialize CoCreateInstance CoTaskMemFree

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

SetClipboardData CharPrevA CallWindowProcA PeekMessageA DispatchMessageA MessageBoxIndirectA GetDlgItemTextA SetDlgItemTextA GetSystemMetrics CreatePopupMenu AppendMenuA TrackPopupMenu FillRect EmptyClipboard LoadCursorA GetMessagePos CheckDlgButton GetSysColor SetCursor GetWindowLongA SetClassLongA SetWindowPos IsWindowEnabled GetWindowRect GetSystemMenu EnableMenuItem RegisterClassA ScreenToClient EndDialog GetClassInfoA SystemParametersInfoA CreateWindowExA ExitWindowsEx DialogBoxParamA CharNextA SetTimer DestroyWindow CreateDialogParamA SetForegroundWindow SetWindowTextA PostQuitMessage SendMessageTimeoutA ShowWindow wsprintfA GetDlgItem FindWindowExA IsWindow GetDC SetWindowLongA LoadImageA InvalidateRect ReleaseDC EnableWindow BeginPaint SendMessageA DefWindowProcA DrawTextA GetClientRect EndPaint IsWindowVisible CloseClipboard OpenClipboard

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateFontIndirectA CreateBrushIndirect DeleteObject SetTextColor SelectObject

kernel32

GetExitCodeProcess WaitForSingleObject GetProcAddress GetSystemDirectoryA WideCharToMultiByte MoveFileExA ReadFile GetTempFileNameA WriteFile RemoveDirectoryA CreateProcessA CreateFileA GetLastError CreateThread CreateDirectoryA GlobalUnlock GetDiskFreeSpaceA GlobalLock SetErrorMode GetVersion lstrcpynA GetCommandLineA GetTempPathA lstrlenA SetEnvironmentVariableA ExitProcess GetWindowsDirectoryA GetCurrentProcess GetModuleFileNameA CopyFileA GetTickCount Sleep GetFileSize GetFileAttributesA SetCurrentDirectoryA SetFileAttributesA GetFullPathNameA GetShortPathNameA MoveFileA CompareFileTime SetFileTime SearchPathA lstrcmpiA lstrcmpA CloseHandle GlobalFree GlobalAlloc ExpandEnvironmentStringsA LoadLibraryExA FreeLibrary lstrcpyA lstrcatA FindClose MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA SetFilePointer GetModuleHandleA FindNextFileA FindFirstFileA DeleteFileA MulDiv

$PLUGINSDIR/LangDLL.dll

IMPHASH 274b99a815ba574d8c9e1712916d8b30
SHA256 d65875bb4bc121f81384d55fde90dd9eb9ad1878cd8a02bcb5c8a933c3987a61
MD5 61f69388ae89d61a3d838cbcf81b4f82
SHA1 e595c0236a373a6ac79c334dc183ee03ca8f8ecd
SHA512 21d34738cc21c1ef6b0ef1ac53659cdab224bbc20ea983f9a952a2cb4b5785a07bb18c0acf22a0d12a94795e1fc6d314f442c923bb1a93b675edac8c6aacf469
SSDEEP 48:im1CEhqneMPUptuMMNvimk2BAZuMTRCpYEvJdUJvR0JCof5dwe:F10pl9NLBAZuYtR0hd
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

5582

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 d09a8b3ade4ba4b7292c0b3da1bcb4b6c6e2012e0ccfd5e029a54af73a9e1b57
MD5 4ca4fd3fbefa2f6e87e6e9ee87d1c0b3
SHA1 7cdbeb5ff2b14b86af04e075d0ca651183ea5df4
SHA512 cf0f415a97fdc74568297fed4f1295d0d2aef487a308141144ef8d5f04c669ef4795c273e745b81065429adde113fcdedf4c22717a7aeef60fdcd8d4d46f97f8
SSDEEP 192:EPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4W:j7VpNo8gmOyRsVc4
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10529

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Bedsteborgerliges.ska

SHA256 985bf1956478234e4a23dfb5879601343e8cac69da4e52027cbca7ec5aa51332
MD5 4d3aed670f4cd4cf671739d8753cd6d3
SHA1 cdf9f4cbf0813c7c952e6c0e28294e2e6c5fcfb3
SHA512 98daecb274db71e739f7761dd8312a8938504421cb3a23de59437c8ddeb658c297d82063616f7ea04c5ee739c90a498a8c721ec7d8e86f35c05a5b6f839e9944
SSDEEP 768:mdVydb3ofc51+MAc7UTLTU+i6s2xydedCA1+z1R5LzXfgJ+k5Pk+tbAyHQZoAPqS:ma+14wdxEzJzXgnBnwGm
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Nonlitigated.Sal

SHA256 2354652489cfeac41dad7db6a496b8d99dee665a72de8eae2991f1a17d5482c0
MD5 c829b0a69cf024a10d329d43ffb151f0
SHA1 44ac819b28de3e923526ce678ae148d9a3dcd77e
SHA512 65c38a3838b3bcad326aef65862f8a30d119c4a849ca83ec3df62bfe2e9aa169491b0ac127204a81bb464a85f73cb25e633be319cad5f916200e918eb79835b4
SSDEEP 6144:TmzQTEAvww8mezwh/28KL9yD4gQcERCBZJkPz9:TDT7v+mez4H69yD4N3z9
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

case.jpg

SHA256 722de6404247b0a96bab46c7567661b352f5a8bf2b267e333930c4cad2613868
MD5 f68eeb6cacd594c1a6b662d2cd30ccec
SHA1 fc7ec71bab41e5df5dd6fb5a5105a512c7f74b53
SHA512 792d3ec7d5a112275382cf7b89f4a305cc2f9e4547d2c6329368553e139afdc20e377d197f7ea627d77e003607feb18c8f1343b049f47f9d4db926d29cccea78
SSDEEP 3072:IskG8wJzn5V9qqn0ZLsull85ijr0cBLUufuuspBo:Is8wJzP9qqnsE5ijQ4UquuEo
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

chinones.nua

SHA256 aad206388c03eac32671db151d2826ae968e98912b17f2945da07205dbe8ce38
MD5 7285ed87bce392319a3d54d811964fad
SHA1 2716195b1d0f5ce8ec4921feaa40a62baafdd7fa
SHA512 c339d48676963210d952073f8caa16ae856341f97cae4c9919a30ea051a45e2d41777a1ee3ea3b813ee2418d65b03704c3c2686cafe4b4601b877d50419d3fb0
SSDEEP 1536:mG/eiR9wzu4ClROIPQQC3VIzpMFuF641GthTKbR:kiR9jtzwmpLmcbR
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

dactylopteridae.arr

SHA256 b690cd825a409ad9a2df4ff48f881592ee6e20ec944459e61feeda083ec8b33a
MD5 5d36fb5fc32d9b57654b7d614af4276c
SHA1 f45346b9c57b886457180a0a838ce9b1d568b8ba
SHA512 55fceef462552cdf21da024eac786c2743f2817dcdcb9ff8bda51b71ab3b8586bd9498fb01e1fce0890b74c1ed569da1ab753ac3b8b0006106985f1e2d540d88
SSDEEP 192:8Uoq3zQFqh0nK2+NH92T16JssBnvezxgmcRkXtP1SUkfz:8KQFs0K2+NHO1DsBnvezxgmcR2h1Sffz
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

kupfernickel.txt

SHA256 d69b6c4c4a4a2855b26951ee8cefa64f80b915de17b686697b82af32b467bbad
MD5 448e02131260218207dc72e34d6af99b
SHA1 166fc591a2137814f1f2e63a555a26ba0eb22136
SHA512 58f15948e03d64bb44c606ff961540c0b8a1c9325a839de4733374673095d4c498d9c678c514eaef4c6a1b00ef5ae4dbb4b0147e6777919787aeabc88e5eedd6
MD5 SHA1 SHA512

NSIS installer

installer

luksurisestes.Fun

SHA256 fef0dd6a00d23d9f0618b5ee5cf9332bcd1c3762db2d1f271658a3bda4332196
MD5 485af48bd52d30ba5a618873183695d5
SHA1 b4dcb9a547bd283db940355acbf0a7aa9f9ab894
SHA512 8def4fc3503d6e50bb74b81424188a1dbe15b4f2e79796cbfa0488efd989f404bfb342520c563bb855fa1a50f79b7f3409372f3239a1f7d89357cc5e902ffa32
SSDEEP 1536:CrbpcOC8JO6i0REKkE5k2x25sIAaPKiFQBq/9XhgcP3mf+2vZjeQ7tIr:wwyBf4
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

tabtype.mil

SHA256 20c00d941e6ff2066f43632f8f48178e3a8890047fb9097480ebac572c282854
MD5 46c8fa6a82d7917c5931bd82e7f520a5
SHA1 479c2b3798fce07e38aa3eebb198e89d6761347e
SHA512 c8c7b860ded8da1a0487de4792ce7653d95d86e8546a6f375ba8748eb33e79b4aa41bba7be8223f394c5f0f5f93cc114132a8732491af76b2bb6c04e983430df
SSDEEP 1536:mGpJHFZRTfIEdBVSuSnxoxbmrj8GuFkCX66PPUQl0ieAVHDBK:DppL+EUuMQbKIFVqmP/+i1h
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

vrkstedstids.nri

SHA256 12194de1af8bbc21b2dfa55ccbefb089b11820bf149919398301a515a7d9f539
MD5 5daedb2a984db5b0b5e7043acbea51df
SHA1 f159484d6cc0f5c5fa9ad35c76eba9436a5243bd
SHA512 22c088e47e3e700c6463d758d4f4fdbfc284286a4a3c92b15383313472ecd9aefee697507342796d48b286477f58842ad3fa2239bc1d1d3d8005e5c8ba0a1167
SSDEEP 768:UK4TVspxmqTulB2IaWA4lqbkE2pOhzXD/QLuaZR5/m0mSaXsiwu3tvxHqjG4jgLD:UK4/KWhaIdG4UczgY+oLS0+XpNr9L
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

acdda22ea40a289e3a1ff725de7a933415bf6c143dc60cdb296fe17d36d894ac.exe

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/LangDLL.dll

kernel32

user32

gdi32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Bedsteborgerliges.ska

Nonlitigated.Sal

case.jpg

chinones.nua

dactylopteridae.arr

kupfernickel.txt

luksurisestes.Fun

tabtype.mil

vrkstedstids.nri

Sharing

General

Malware Config

Signatures

File Explorer

acdda22ea40a289e3a1ff725de7a933415bf6c143dc60cdb296fe17d36d894ac.exe

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/LangDLL.dll

kernel32

user32

gdi32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Bedsteborgerliges.ska

Nonlitigated.Sal

case.jpg

chinones.nua

dactylopteridae.arr

kupfernickel.txt

luksurisestes.Fun

tabtype.mil

vrkstedstids.nri