3f416918bd125281304aad7b443c03de9fb8d3d22316ff0c47b5c18a1793bc70[.]exe

resource
3f416918bd125281304aad7b443c03de9fb8d3d22316ff0c47b5c18a1793bc70.exe
unpack001/$PLUGINSDIR/System.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

3f416918bd125281304aad7b443c03de9fb8d3d22316ff0c47b5c18a1793bc70.exe

IMPHASH 671f2a1f8aee14d336bab98fea93d734
SHA256 3f416918bd125281304aad7b443c03de9fb8d3d22316ff0c47b5c18a1793bc70
MD5 90b918dec9c9a4b5ece3cb7ecce2598e
SHA1 ae7be0d3f7edff1729df9386847d6fd25ff24ac6
SHA512 0f392ca832f969aa3c41f601577e53c10c235ad70b87986af5f5e20f27809141726f70c5c3133641dfbf975663fe73ef019c2251b2a3185a463ec4d2e8eed6ec
SSDEEP 12288:E3cAEjowS7yqMU5dECzVij70Y2RVX/lPIOZzZLDEvaSh2x0+tNADhZebeEkOQ:E3cAEjowSGqMUvFYjtOZzlK607fDl
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

13272

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueA RegEnumKeyA RegQueryValueExA RegSetValueExA RegCloseKey RegDeleteValueA RegDeleteKeyA AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken RegOpenKeyExA RegCreateKeyExA

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA SHFileOperationA ShellExecuteExA

ole32

OleUninitialize OleInitialize IIDFromString CoCreateInstance CoTaskMemFree

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create

user32

SetDlgItemTextA GetSystemMetrics CreatePopupMenu AppendMenuA OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcA GetMessagePos CheckDlgButton LoadCursorA SetCursor GetSysColor SetWindowPos GetWindowLongA IsWindowEnabled SetClassLongA GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassA SystemParametersInfoA CreateWindowExA GetDlgItemTextA DialogBoxParamA CharNextA ExitWindowsEx DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow ShowWindow wsprintfA SendMessageTimeoutA FindWindowExA IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint MessageBoxIndirectA CharPrevA PeekMessageA GetClassInfoA DispatchMessageA TrackPopupMenu

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor

kernel32

CreateFileA GetTempFileNameA ReadFile RemoveDirectoryA CreateProcessA CreateDirectoryA GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceA lstrcpynA SetErrorMode GetVersionExA lstrlenA GetCommandLineA GetTempPathA GetWindowsDirectoryA WriteFile ExitProcess CopyFileA GetCurrentProcess GetModuleFileNameA GetFileSize GetTickCount Sleep SetFileAttributesA GetFileAttributesA SetCurrentDirectoryA MoveFileA GetFullPathNameA GetShortPathNameA SearchPathA CompareFileTime SetFileTime CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc GetModuleHandleA LoadLibraryExA FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA MulDiv lstrcpyA MoveFileExA lstrcatA WideCharToMultiByte GetSystemDirectoryA GetProcAddress GetExitCodeProcess WaitForSingleObject SetEnvironmentVariableA

$PLUGINSDIR/System.dll

IMPHASH 240ca92ecc1c291801c451c447e16c12
SHA256 014f1dfeb842cf7265a3644bc6903c592abe9049bfc7396829172d3d72c4d042
MD5 12b140583e3273ee1f65016becea58c4
SHA1 92df24d11797fefd2e1f8d29be9dfd67c56c1ada
SHA512 49ffdfa1941361430b6acb3555fd3aa05e4120f28cbdf7ceaa2af5937d0b8cccd84471cf63f06f97cf203b4aa20f226bdad082e9421b8e6b62ab6e1e9fc1e68a
SSDEEP 192:gFiQJ77pJp17C8F1A5xjGNxrgFOgb7lrT/nC93:E7pJp48F2exrg5F/C
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10673

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Bryggerheste128.lyd

SHA256 432bf73db986527c23f8cca77b14eb4ef071d72ebdd6eeefa9ca79dff48049e6
MD5 798ab22da8ae95ced1f8739af1a02dcc
SHA1 8426a4170a177a4a0c4c426dc5a9ac4701e4e121
SHA512 2b661375f22a3547de746483078e1ae58ec01d57de322c995c72ade9013feed8ca6fec360b2a1dfb2050e0f35eb603161efd6d0cb64b43eef9d00cdc19849c9c
SSDEEP 384:lVBk+mR+atFzygIkeailVBDgEmFUUbuTKZGxjRTtzj3ZkyK+8S11cFgQ65dot:Z++arrkavEmEgORTt3ms8Emd/
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Coproductions213/Snvringen.Til

SHA256 bc47957b47665907be566bd39af10008c25e91421320b7a8265480a89c4ef5b2
MD5 80bd2b959753146ed9f4eb0d0927c7e8
SHA1 f9657de39da18b0341ae9ae69ee214fddaff47d5
SHA512 6eff511b7a33a0ead6d0b73b8d15af768c192589d11b7e4afaa616606b7bfd4e1104713a71e4c30959e23219363021b0df6d101f4a3f406a6b903d79f47d02d3
SSDEEP 768:rA1X7bIPzPPW4Y2Hvl/9W7mAMghdstIj0rmj4jr5T6K+vnKSvvI2UO70o+fWRBAG:aXubYo/WJNhfUr5TBYnKSLlvN
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Coproductions213/Undedicated119.vit

SHA256 a2f3fbf7c7b9dcf49bb018de89d1259f2f21f77bbc540ff0dd3ba492cf416e7c
MD5 ef4261dcd04f77611a3a1de40343a71c
SHA1 eb75467b507b7a7f9f452d08a79bb13f428ffbb7
SHA512 c2cfbbb02d691f9eb2feb5e3633a6528cc3e5359955eaa1816c33023487e533855e55403b649560aa8580bae33a682969059cc55c9d446f6b8ab02eac658acc9
SSDEEP 768:Y79V/7OdtU411IL9myi/wAvxcYxq2pDQ4kfWk+MM8AyLAJMu8k/M+UpORLf/zbW+:AmR8uZrxN50Hf9oLa6beGalDQvPbTmeR
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Coproductions213/hand.jpg

SHA256 6807b137577b302e64d2543df37423b1f68e2d71a0ae4872188cdbb58ea2cfed
MD5 b358902df060eb04da3d7206e2b88672
SHA1 68819b5957efac558a1f820da654776320935574
SHA512 9e857ffa049594c298300843733fa1623b5f3d9513b8b002241fac2654c7c82ebb521bc4d3049174d3b78f5915d475524a5313fa528ec81afffaa27ef81174bb
SSDEEP 192:L866d5e0AK3IjMPGSvsp8ZJ/NnckKY/Z9rPvxzoHA3ozBt:Ys0PGSQ8TNncE/ZlPJCt
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Coproductions213/naggers.arv

SHA256 ad2b53f491f7294b54db434ed67867fc6b0c962d987f20918ff0e33a06f53c55
MD5 6c0764c7cfb218dbf0ecb687260b0ba1
SHA1 1ca4841bda7351e92bfbca3b6952f23eff8b61b7
SHA512 9cb5d6db23239dafc1117d1daef7978ec528e37094588516b0b93f028352773bc5bca3c89dbc0e6d8ab728f8bd1c5a6104748b1535c1b83d71a814052de0373a
SSDEEP 1536:CRmfXIjyuE98wkdKqICS5tmiaKMZHiBawc+:f1u+ZUICCm31kDR
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Magtape.Inf

SHA256 5cc03c2246ccf58517923b64f977d6c3aea2d6d7cbbbee57daa96876a0f289ff
MD5 b5415fafe37d933b48424c30f8740695
SHA1 a3379c683c7c4bc4e7877692beb5f76953e9fa6b
SHA512 12418be02792ef5d3cea436f68ea54cbf6290fc45c1fbc7b3df0a0bb73f5766194ae554859d5135e82b6f4cbd16e9afde10ae4c89324616e32aeb12fb4bd5a99
SSDEEP 12288:wOeZNFwH/fMvbX4zrTuVb6U5VrzCyyYUMF:IXGfAXOU51zyo
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

3f416918bd125281304aad7b443c03de9fb8d3d22316ff0c47b5c18a1793bc70.exe

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Bryggerheste128.lyd

Coproductions213/Snvringen.Til

Coproductions213/Undedicated119.vit

Coproductions213/hand.jpg

Coproductions213/naggers.arv

Magtape.Inf

Sharing

General

Malware Config

Signatures

File Explorer

3f416918bd125281304aad7b443c03de9fb8d3d22316ff0c47b5c18a1793bc70.exe

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Bryggerheste128.lyd

Coproductions213/Snvringen.Til

Coproductions213/Undedicated119.vit

Coproductions213/hand.jpg

Coproductions213/naggers.arv

Magtape.Inf