ca59e14180c4b88c328f4704724a32c82295a9324bcbb9bf146a895f2f8eaa66[.]exe

resource
unpack001/$PLUGINSDIR/System.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

ca59e14180c4b88c328f4704724a32c82295a9324bcbb9bf146a895f2f8eaa66.exe

IMPHASH 671f2a1f8aee14d336bab98fea93d734
SHA256 ca59e14180c4b88c328f4704724a32c82295a9324bcbb9bf146a895f2f8eaa66
MD5 880321afc15e4ba38ce4c6c4e0a512e4
SHA1 b3b15390ccc25cf74df2aea1a20269e06b54a6d7
SHA512 4939777bc3b5ea2968df32a32eb47a7a168c531a2d2c7ae40a9c3bd6c2758f59042ba51a9d8a870be881b673385dff97164ac27a901d748f413c71bb824e24fe
SSDEEP 12288:irgjBLiIK2WVy/YqpuSKSKl/oSRHW2ugcYdUsr5aoWy8ihXmmwMRzcLSIHB:i0jBiIK2R/5puSsJoSknqUO5DXjZcWIh
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

0a:b1:ab:e9:ea:b5:86:18:06:fa:dc:71:cd:7f:03:16:93:c3:61:d2:b7:5d:d0:89:7b:8d:e5:ce:c7:ec:ad:54

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Komplexe,O=Komplexe,L=Jourgnac,C=FR

Chains

Nov 5, 2024

PE Signature issue

Digest

9c:c7:1e:d0:95:d3:e5:ce:2e:ea:5f:87:df:77:4f:c9:0b:ff:83:f0

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Komplexe,O=Komplexe,L=Jourgnac,C=FR

Chains

Nov 5, 2024

Minor OS version

0

Major OS version

4

Entry point

13186

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueA RegEnumKeyA RegQueryValueExA RegSetValueExA RegCloseKey RegDeleteValueA RegDeleteKeyA AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken RegOpenKeyExA RegCreateKeyExA

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA SHFileOperationA ShellExecuteExA

ole32

OleUninitialize OleInitialize IIDFromString CoCreateInstance CoTaskMemFree

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create

user32

SetDlgItemTextA GetSystemMetrics CreatePopupMenu AppendMenuA OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcA GetMessagePos CheckDlgButton LoadCursorA SetCursor GetSysColor SetWindowPos GetWindowLongA IsWindowEnabled SetClassLongA GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassA SystemParametersInfoA CreateWindowExA GetDlgItemTextA DialogBoxParamA CharNextA ExitWindowsEx DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow ShowWindow wsprintfA SendMessageTimeoutA FindWindowExA IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint MessageBoxIndirectA CharPrevA PeekMessageA GetClassInfoA DispatchMessageA TrackPopupMenu

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor

kernel32

CreateFileA GetTempFileNameA ReadFile RemoveDirectoryA CreateProcessA CreateDirectoryA GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceA lstrcpynA SetErrorMode GetVersionExA lstrlenA GetCommandLineA GetTempPathA GetWindowsDirectoryA WriteFile ExitProcess CopyFileA GetCurrentProcess GetModuleFileNameA GetFileSize GetTickCount Sleep SetFileAttributesA GetFileAttributesA SetCurrentDirectoryA MoveFileA GetFullPathNameA GetShortPathNameA SearchPathA CompareFileTime SetFileTime CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc GetModuleHandleA LoadLibraryExA FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA MulDiv lstrcpyA MoveFileExA lstrcatA WideCharToMultiByte GetSystemDirectoryA GetProcAddress GetExitCodeProcess WaitForSingleObject SetEnvironmentVariableA

$PLUGINSDIR/System.dll

IMPHASH 240ca92ecc1c291801c451c447e16c12
SHA256 7fb0f8d452fefaac789986b933df050f3d3e4feb8a8d9944ada995f572dcdca1
MD5 dd87a973e01c5d9f8e0fcc81a0af7c7a
SHA1 c9206ced48d1e5bc648b1d0f54cccc18bf643a14
SHA512 4910b39b1a99622ac8b3c42f173bbe7035ac2f8d40c946468e7db7e2868a2da81ea94da453857f06f39957dd690c7f1ba498936a7aaa0039975e472376f92e8f
SSDEEP 192:VFiQJ77pJp17C8F1A5xjGNxrgFOgb7lrT/993:97pJp48F2exrg5F/9
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10673

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Nedskringens165.bge

SHA256 50dcd403ad710f799dffce77387dbf1dbdf3c492f6e85cad64b2976c580ad6ad
MD5 e3606943070abdcfc961e47d90699607
SHA1 c7615dd3745f445d94087b280417cfa44c0195f6
SHA512 e81b420fb5f4957bbf1e1e24799752d4b74d946a9ffb6b76bd1aeb0cbd460c53a40546f52fd27ef4e219bf85f59f573243de85ac637e73aabb7403653adac86a
SSDEEP 768:qj7bYltCvcTH7BDyPMckurYNhx/s6/eyoEkhfh8aPCdz0e7RmeHEQ0SuKFkB5hta:II9RlafRn0m6XRihTSSy+pdyTgQjZ
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Poikilocytosis.Pos

SHA256 2b664675c1073a32c7e2da6908cdc5a0066a407e6a99aa810d0dd0f0502a79be
MD5 06137efb6b0cbe81ea99b5ab845b4ee0
SHA1 a1b48a1016e5e166a9770fb545f085464c4fcc49
SHA512 63f656d09d88399ba9ea80bee2fad0e19cbff88e4e691c79c3ca818baab8f96b166adb922cd991354da3b66046e191ae398175a74fab88449d9755a26ea1ce7b
SSDEEP 6144:Oqt7W9EzM3fKKzo/T1R7BHKA0mBPuno+uetwhCi7TuomX+Nbd:OqZzhKA09nTiCi7TPmXSbd
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

afsg/Effulged/Unridably.opr

SHA256 05e2f5a6672eb9cbca87996dbe4056240d85cc7c621d83e1bf75ade12df408ef
MD5 6b0ae74c9a26839f4b5f590b755a5f3b
SHA1 6d7ba6a29f41f8f64dab2154b2ba674a48d25414
SHA512 7cc1be717acbf2b9892861a0e64d11dff78fd16cec53487e96f95a2c75a772d9fb5ec94399f4340f8bc240d1c527eb3a563e000ea062661212d649676b96d4a0
SSDEEP 768:Ew9lwmgRX7sLbY0/b+aE40Z1KnruDG0Y/kwQKC0qawAWMvKTnGHjCxqScBN3PRtI:EMs6OXAI87Pm1ybjaCFrY+6
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

afsg/Effulged/dimpsy.clu

SHA256 03761a54bc2b3fdc0dd33d3d2304f8adda40a0c326b1b5ab317bfbf73c369d8c
MD5 9683a3d88606c03220ac0a80ca991bb1
SHA1 7873ccd42b97fac0b15398d79d5824a88e342817
SHA512 791194e2fae49ff19132b49beb955bb53f827dbbe3c52c7217cf6e66f63b6f66d906311fa534ae3d1f7c54a454f34a4cea750b21396b203310315c8e328d2c1a
SSDEEP 768:oD5IBGP0UgqsHHEUxUr9KPtXwRQ9q3QtsXS361zv1+r6TKExsQ5PN61wlRZQL/6L:VFWSeckPmawPZWsrQTM+qlRrZNc
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

afsg/Effulged/hampton.ant

SHA256 9025a4909bf51d92657b21f3dfa849f3e337f44b7abdaadb0b568c654f7ac1ec
MD5 ccf68c7d2a707b209f7464de6bac1365
SHA1 69bf3873438a9f0d1b3655cf9ea6006a0f0f4823
SHA512 af6471d4204524031dd136f436e1a173e4e7997e8f8d373d6335c176f5aef83922105635e200033ec7381939d0e50158a47c9df8dc61824104f8640694c76c90
SSDEEP 768:k7dV2NN1kXUyo0VKmim7+aMTGMKFMMp1qo9s1s8rFT10vi/5CKyhZ9cb6EIipueG:QgEMqMbFAFy0Gy6t2N9mvT/X4
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

afsg/Effulged/phytosociologically.txt

SHA256 5b770847a5ca554185d21dee630bc3aae4f9d185c0f2cbd803afdfa10b30c750
MD5 600be4ac955fb7547eca07fb12946717
SHA1 07e53393bb0591c274599e56657c760e00a0e84b
SHA512 12b81430df0d4c57e9ba803ce1228752ae2b127fb4fed07767107466b5283b9a1cb91966305aab2a5e65a7771729676d5c16c040ab30393a2748a115205e779d
MD5 SHA1 SHA512

NSIS installer

installer

afsg/Maceration.Don

SHA256 2752c291e3f3e7fdb23b90fb935430a9b3a747a7f774e3e1d4adb4d5fa370c1a
MD5 69736c7593f2e64adc465994adc7609d
SHA1 e7e150ea5517bd8087fe02ecfd87296c7b770634
SHA512 a123577f9c1ffe27991bbb1ae27248ee3b840ff030486f0393bf9e14fbc1d44e4bb73a255317aa1d1626c0ed50194be37817c77871102bcdc6f4a22ceaae9a67
SSDEEP 3072:9FjfiifRIT2V7Fw53ycBUweaUvb2fMi4hv59Fy4VTYQ8Hh:9FzHfRIT27q53yc6wLcbuyRy4VTYQ8Hh
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

ca59e14180c4b88c328f4704724a32c82295a9324bcbb9bf146a895f2f8eaa66.exe

PE Signature issue

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Nedskringens165.bge

Poikilocytosis.Pos

afsg/Effulged/Unridably.opr

afsg/Effulged/dimpsy.clu

afsg/Effulged/hampton.ant

afsg/Effulged/phytosociologically.txt

afsg/Maceration.Don

Sharing

General

Malware Config

Signatures

File Explorer

ca59e14180c4b88c328f4704724a32c82295a9324bcbb9bf146a895f2f8eaa66.exe

PE Signature issue

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Nedskringens165.bge

Poikilocytosis.Pos

afsg/Effulged/Unridably.opr

afsg/Effulged/dimpsy.clu

afsg/Effulged/hampton.ant

afsg/Effulged/phytosociologically.txt

afsg/Maceration.Don