2[.]exe | Triage™

resource
2.exe

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

2.exe

IMPHASH ced282d9b261d1462772017fe2f6972b
SHA256 134be2720dc277e7be61620837bfd47e02892d9641294cbe4457d7bae4510a19
MD5 6e62c2f3acd34a6cf4eee9f493ceb3a1
SHA1 dc025bd9290f738c1870f7d9861da95af549dfd0
SHA512 20beb4e7572a1026603399676dc55573105f2359d418aa504f73a8486337b1843ab9ea8db6ccd3bd11b05ff2686b3cefdadbbef321d7da546da9a733b7c626e9
SSDEEP 12288:G0mnA1zxuAL9BFGFx6Dpu/ay+xSnliR6r9t3DSDb4NF:uA1zxumVoIDIikcu3ewb
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

13128

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCreateKeyExA RegEnumKeyA RegQueryValueExA RegSetValueExA RegCloseKey RegDeleteValueA RegDeleteKeyA AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken SetFileSecurityA RegOpenKeyExA RegEnumValueA

shell32

SHGetFileInfoA SHFileOperationA SHGetPathFromIDListA ShellExecuteExA SHGetSpecialFolderLocation SHBrowseForFolderA

ole32

IIDFromString OleInitialize OleUninitialize CoCreateInstance CoTaskMemFree

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

SetClipboardData CharPrevA CallWindowProcA PeekMessageA DispatchMessageA MessageBoxIndirectA GetDlgItemTextA SetDlgItemTextA GetSystemMetrics CreatePopupMenu AppendMenuA TrackPopupMenu FillRect EmptyClipboard LoadCursorA GetMessagePos CheckDlgButton GetSysColor SetCursor GetWindowLongA SetClassLongA SetWindowPos IsWindowEnabled GetWindowRect GetSystemMenu EnableMenuItem RegisterClassA ScreenToClient EndDialog GetClassInfoA SystemParametersInfoA CreateWindowExA ExitWindowsEx DialogBoxParamA CharNextA SetTimer DestroyWindow CreateDialogParamA SetForegroundWindow SetWindowTextA PostQuitMessage SendMessageTimeoutA ShowWindow wsprintfA GetDlgItem FindWindowExA IsWindow GetDC SetWindowLongA LoadImageA InvalidateRect ReleaseDC EnableWindow BeginPaint SendMessageA DefWindowProcA DrawTextA GetClientRect EndPaint IsWindowVisible CloseClipboard OpenClipboard

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateFontIndirectA CreateBrushIndirect DeleteObject SetTextColor SelectObject

kernel32

GetExitCodeProcess WaitForSingleObject GetProcAddress GetSystemDirectoryA WideCharToMultiByte MoveFileExA ReadFile GetTempFileNameA WriteFile RemoveDirectoryA CreateProcessA CreateFileA GetLastError CreateThread CreateDirectoryA GlobalUnlock GetDiskFreeSpaceA GlobalLock SetErrorMode GetVersion lstrcpynA GetCommandLineA GetTempPathA lstrlenA SetEnvironmentVariableA ExitProcess GetWindowsDirectoryA GetCurrentProcess GetModuleFileNameA CopyFileA GetTickCount Sleep GetFileSize GetFileAttributesA SetCurrentDirectoryA SetFileAttributesA GetFullPathNameA GetShortPathNameA MoveFileA CompareFileTime SetFileTime SearchPathA lstrcmpiA lstrcmpA CloseHandle GlobalFree GlobalAlloc ExpandEnvironmentStringsA LoadLibraryExA FreeLibrary lstrcpyA lstrcatA FindClose MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA SetFilePointer GetModuleHandleA FindNextFileA FindFirstFileA DeleteFileA MulDiv

Chromonemal.Opg

SHA256 73a4a59e35863571281154449961ab2a81ff47c3baa341d7de100287a0043274
MD5 65171ebd8fd8c699770edee943ff09f1
SHA1 dc17dd3e384f06c03015b136cc068c2973673981
SHA512 f0f1c8a7dfa94feb7fc7e170ad4abfde9a4bc7d7af1a5c4cd763ca93484256a6a37fd5fb515345987af8daaedd812cfb3e0f5944ccdb0ee4983a0a71da53a144
SSDEEP 1536:02be3lIq1gxBdV5jNQpNwrZHHoVmbclOHoEah/B66z:0OEj1EV5oYdIV2cXhwk
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Reventure175.rau

SHA256 4ef506f3004da7023f846c4c9df140dba2959a4121126df0b745cee1b6075c10
MD5 4c42111a959676142cc26fabb980f8ce
SHA1 9b116e5b480fa0a780c84a7a7a25024fb5b560f5
SHA512 ba87ee797233f4403a76062ff55c06ffc461f241a308163d3074da60e8e7d7767c4806932e8fc66294f24406b8d53a00f3b22706cfe54c20a5480bd8f9482c3d
SSDEEP 768:fNTRU9vwKWPFcYjl1ZiZmoonErYtA5SOBCAQ+VlUalGuDqN50A2JPI7Wr:zdACCVS5w1
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Stikprvestandardafvigelsens.Lgn

SHA256 222afe763d83a4f8e09f820bf1dc20b8aef212ec7503e07d60941f4661f4fc9b
MD5 b861cf3da394f7f9973e55ad07eedc61
SHA1 08f5a734f3cf625e52abf462216fba82be10a430
SHA512 41203f0af9147cf432c4ed85670f2f2d422cc49cbf67720bf69de97e16697f813c40cbbbf50500745eedd925aca2c3411007303d160b3e52b4fe71c2084f471d
SSDEEP 6144:NlElC5tKcXxuK04kPMQ9WREvpzYARElauLkIPihckYWK9:clC5tZXhaMQ9OEviP4MR759
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

farces.abs

SHA256 8fe26e648bbd59f1fd58b58f2cb6d844dcb022b52359942af356eec234439ec5
MD5 39d7d9c41567d30b11d9bdf4f4c5f404
SHA1 b9dd414f21761bd54164cd8d8e5669b29865725f
SHA512 bce9c287764fa834d43c4aaecc436d956d465f9264fd37032b2031859941d1cbe25095db628ea4a4d59bb14a0d5c1159cf707597eb335546dafeb604af10be1b
SSDEEP 1536:v19k6Y4HcZZCLw3P+wI3Ce73UMC+yuk/Qd5FYvVv4l:N9k6Y48Zcs/y+MCDupvp
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

synligeres.txt

SHA256 883ed1efefb02c2128cd08379668c2b165d9061b9bb700914d8ed79417a41549
MD5 79829893b66eb30226601a7af4594e46
SHA1 b1bd43bc39cb9c6d93dd09330f6e39ec080927f6
SHA512 eb63bd6b890f5d245bcdb445129560544514b8f4dca76a30f426134e09727fbcd980c31e29ec3bc6fbb390c093ea1f16d58fced4f6940a83f1e182eea9ddf6af
MD5 SHA1 SHA512

NSIS installer

installer

underbindingerne.kon

SHA256 2ef82cd3b5d96a82a6f5c2d8fe492c5420c3e73f0d91e7ce06439fbcd34bf0b7
MD5 e12c2ed61039d654a6cc14c288787456
SHA1 64a21caf0c1d430b2ba852df870532a9e42e546e
SHA512 39146f58596a53ad607ca10639b984c535d6540efacaf72c86c231bf04fc7c6f0394fd4b3238d7d9d25af067f940b0d1b3b225acc1555d2048f8640663bca6ca
SSDEEP 768:5nOwMnUxkMC3Hx0093n7pKe+FHK3uyPhECGT98GnATODvZ/84cNYCsC584+sJa:5E28LfXGn4I3s
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Sharing

General

Malware Config

Signatures

File Explorer