d2473f318c1386699bdd8442cfe5455d44e18ec23d4b2482ffc82c7c227ab9ad[.]exe

resource
unpack001/$PLUGINSDIR/System.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

d2473f318c1386699bdd8442cfe5455d44e18ec23d4b2482ffc82c7c227ab9ad.exe

IMPHASH 3abe302b6d9a1256e6a915429af4ffd2
SHA256 d2473f318c1386699bdd8442cfe5455d44e18ec23d4b2482ffc82c7c227ab9ad
MD5 0b813c3349387a69277d7f8a0d20fe3d
SHA1 d0c4aa5fffba33d1f7c9c184cd3acb90f6a75650
SHA512 d3b46abc8583f2a12c4e202392e97679147c5d1a691e1525bcf771f89902902740e503f5856574c5e7b8ad1303036485193f48f989201cf25a1ca08c79dc8c34
SSDEEP 12288:F4FAe+jtbt1JcAfGWpfnuayZzCeFPEG6w//j:YAe+jtbt1JcAlnnGC+R/j
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

5c:64:a8:8a:11:25:c2:da:8e:1e:08:36:56:51:70:4a:3f:b8:f2:d7:34:e7:40:3e:ec:ee:85:24:71:ec:c4:47

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

OU=Addiment Achillea\ ,O=Parat,L=Waldachtal,ST=Baden-Württemberg,C=DE,1.2.840.113549.1.9.1=#0c2f4c6f67696b70726f6772616d6d6572696e6773617370656b7465744054727661726566616272696b6b656e2e526573

Chains

May 1, 2023

PE Signature issue

Digest

74:14:3a:4d:dd:e0:7b:d5:25:9f:d8:8d:51:ff:94:ad:bd:1e:e5:72

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

OU=Addiment Achillea\ ,O=Parat,L=Waldachtal,ST=Baden-Württemberg,C=DE,1.2.840.113549.1.9.1=#0c2f4c6f67696b70726f6772616d6d6572696e6773617370656b7465744054727661726566616272696b6b656e2e526573

Chains

Nov 11, 2024

Subject

OU=Addiment Achillea\ ,O=Parat,L=Waldachtal,ST=Baden-Württemberg,C=DE,1.2.840.113549.1.9.1=#0c2f4c6f67696b70726f6772616d6d6572696e6773617370656b7465744054727661726566616272696b6b656e2e526573

Serial Number

56:58:69:ff:32:36:e7:a0:d7:d3:d7:61:c2:b8:17:7d:f2:93:33:1a

Issuer

OU=Addiment Achillea\ ,O=Parat,L=Waldachtal,ST=Baden-Württemberg,C=DE,1.2.840.113549.1.9.1=#0c2f4c6f67696b70726f6772616d6d6572696e6773617370656b7465744054727661726566616272696b6b656e2e526573

Timespan

Feb 21, 2023 - Feb 20, 2026

Subject

OU=Addiment Achillea\ ,O=Parat,L=Waldachtal,ST=Baden-Württemberg,C=DE,1.2.840.113549.1.9.1=#0c2f4c6f67696b70726f6772616d6d6572696e6773617370656b7465744054727661726566616272696b6b656e2e526573

Serial Number

56:58:69:ff:32:36:e7:a0:d7:d3:d7:61:c2:b8:17:7d:f2:93:33:1a

Issuer

OU=Addiment Achillea\ ,O=Parat,L=Waldachtal,ST=Baden-Württemberg,C=DE,1.2.840.113549.1.9.1=#0c2f4c6f67696b70726f6772616d6d6572696e6773617370656b7465744054727661726566616272696b6b656e2e526573

Timespan

Feb 21, 2023 - Feb 20, 2026

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 23, 2017 - Mar 22, 2029

Minor OS version

0

Major OS version

4

Entry point

12777

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetTempPathA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess SetEnvironmentVariableA Sleep GetTickCount GetCommandLineA lstrlenA GetVersion SetErrorMode lstrcpynA GetDiskFreeSpaceA GlobalUnlock GetWindowsDirectoryA SetCurrentDirectoryA GetLastError CreateDirectoryA CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA ReadFile WriteFile lstrcpyA MoveFileExA lstrcatA GetSystemDirectoryA GetProcAddress GetExitCodeProcess WaitForSingleObject CompareFileTime SetFileAttributesA GetFileAttributesA GetShortPathNameA MoveFileA GetFullPathNameA SetFileTime SearchPathA CloseHandle lstrcmpiA CreateThread GlobalLock lstrcmpA FindFirstFileA FindNextFileA DeleteFileA SetFilePointer GetPrivateProfileStringA FindClose MultiByteToWideChar FreeLibrary MulDiv WritePrivateProfileStringA LoadLibraryExA GetModuleHandleA GlobalAlloc GlobalFree ExpandEnvironmentStringsA

user32

ScreenToClient GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard PostQuitMessage GetWindowRect EnableMenuItem CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndDialog RegisterClassA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx GetDC CreateDialogParamA SetTimer GetDlgItem SetWindowLongA SetForegroundWindow LoadImageA IsWindow SendMessageTimeoutA FindWindowExA OpenClipboard TrackPopupMenu AppendMenuA EndPaint DestroyWindow wsprintfA ShowWindow SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation ShellExecuteExA SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA SHFileOperationA

advapi32

AdjustTokenPrivileges RegCreateKeyExA RegOpenKeyExA SetFileSecurityA OpenProcessToken LookupPrivilegeValueA RegEnumValueA RegDeleteKeyA RegDeleteValueA RegCloseKey RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/System.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 a0cac4cf4852895619bc7743ebeb89f9e4927ccdb9e66b1bcd92a4136d0f9c77
MD5 b0c77267f13b2f87c084fd86ef51ccfc
SHA1 f7543f9e9b4f04386dfbf33c38cbed1bf205afb3
SHA512 f2b57a2eea00f52a3c7080f4b5f2bb85a7a9b9f16d12da8f8ff673824556c62a0f742b72be0fd82a2612a4b6dbd7e0fdc27065212da703c2f7e28d199696f66e
SSDEEP 192:4PtkiQJr7jHYT87RfwXQ6YSYtOuVDi7IsFW14Ll8CO:H78TQIgGCDp14LGC
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10469

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Bluetooth Suite help_HUN.chm

SHA256 098fce4f92a83a100b0b9b65d2d44d17d2c81ac688bfc5f650e2fdfc61c73d8c
MD5 3051a739bb5569a4740b65aa4fa59f9e
SHA1 4f89dee584612e3cdbbb9d766cbddeca65708058
SHA512 7c7d5218d0cacf01defac68c9e66177305533ab269c0aa7a78b561ff1cd81b40f0a2ad91018f6e0b7eaffa7f289ced53ee34a14a8842ec79cb3d9c6501013bb1
SSDEEP 1536:2eV+HBqsKGpvyYsR86GHN2G2LA/He8GayXqH1w6oq3Yo:jgHVIr86uNh22He8GRXS1w6oaYo
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Grundkoncept.Feh

SHA256 4050850254d585d19a617b4b988739238045e86385b32cded6455cff5edfd734
MD5 036a72115a57c72a5ad5c9cf97109e55
SHA1 bb35c9bd70872c0eb0019bee8f4239fbeb68e4f7
SHA512 2b6db62b5850b5888b221b9fa0bcdae5e68e7677b33a41b1fc662c78926697d5f4f8240299c67368a5a8aa5c993f3d4dfc254bbf62a86a64d3740a5be566c7a1
SSDEEP 192:TJmMN0EdObgQeHFYcLgoEWqaTw82h7V0GFykrWb+Oks/x:FHN1OFgFRgoEzaehC6ykrqf/x
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Scrivano.Sek

SHA256 9baa5cedc1143c1abec661f760c793c32448d682bacc9239fec7bc85b51db0bf
MD5 d8ef7410766df405afb2a2fe100d48c5
SHA1 85f5a6a476370227f1ccedf345b4aca6c844592f
SHA512 f2cf4a0262de9ee593119b72d5c17e9e1dfa538de2a5caffc67155a7cc9abd2ecdf7b3a74c7c10a5a7abfab65cb4228cf2d1bd5ffdc8de7de6e09b9fbbd2bf98
SSDEEP 3072:YFJwcsY59U+kwk0Mrme1qHMSeX7+rPRi0ejfoeU44Oq3KDt/WJGBN9HUS:YFJwxY5rkw5otADerG9ejf044j2BDUS
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

anycollseq.c

SHA256 b2830a264282ba361db7de8f8da797f8d5eaf38b47006f9f85b3ba887a043fd0
MD5 833073d62a8dc48d769cf78de7f5f459
SHA1 4fc185a31c5137fb86ae334bcb6891a8bb205bd8
SHA512 3664b5b5001f18cf1da9eaf5f7d6222b16abf92c2f6539dc3e149f961c487d72fcbb6a1391e962aa3a2d7eaa74167b81534cf90a97895f339c3a04970aae4a89
MD5 SHA1 SHA512

NSIS installer

installer

list-drag-handle-symbolic.svg

SHA256 7dec55f99b6fa48395b801ede687c47330e79c4045f48b7af673fb259f29ff32
MD5 1ba333f3e126d8a83ca3c6fcfb71fbc8
SHA1 d54f87c1937d6a08455c903b4e60f6b390a9c583
SHA512 aa2e2e617e28925b3c69c25e9cd87073d7346544cfda1b106d4a2198818f82895355b4f8fa6ef98242730565153c1ef3bdbdaf63864a3f186171ab81e3de342a
MD5 SHA1 SHA512

NSIS installer

installer

user-idle.png

SHA256 4e7f9241a3d4f1e41855b264424b6cb72e0b2c8b3ed4c4384d55136556858446
MD5 901308031b5624c2779848af45f0fe38
SHA1 726aa6fd0430499d0051a39ff7722c89dcb4e001
SHA512 026436fb0f5645a602140514505d687b0ace7460a0c65a8f925072d99bd124c8d4ae7fb5c3852dd64b6b1c67ba974d6fb12be064993721143ec8b76cd3a740b9
MD5 SHA1 SHA512

NSIS installer

installer

vmmouse.cat

SHA256 01619baf4e68b2bb949557f7ec871e7e6a1ad3dede6230fb83372ff0ae0a68ce
MD5 8945c78f744916bc7eb6a7a57051327e
SHA1 2ba36e895e143c92db593220c9eafe36d1084f64
SHA512 443f392fe06de1a0990d7d987871b5df1fbfd0ca7db7560d69aab6eeff3b0240bc1b4faa78e45c3bad0d1df329ac91e1715ecabcf9b9575a26f24a4dc4b7e6e7
SSDEEP 192:uaPD2IJC+EjmwBYyKaWFWQF8DU+YVqnajTgd:FLoPCFR6D+Vl3gd
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

d2473f318c1386699bdd8442cfe5455d44e18ec23d4b2482ffc82c7c227ab9ad.exe

PE Signature issue

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Bluetooth Suite help_HUN.chm

Grundkoncept.Feh

Scrivano.Sek

anycollseq.c

list-drag-handle-symbolic.svg

user-idle.png

vmmouse.cat

Sharing

General

Malware Config

Signatures

File Explorer

d2473f318c1386699bdd8442cfe5455d44e18ec23d4b2482ffc82c7c227ab9ad.exe

PE Signature issue

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Bluetooth Suite help_HUN.chm

Grundkoncept.Feh

Scrivano.Sek

anycollseq.c

list-drag-handle-symbolic.svg

user-idle.png

vmmouse.cat