c10aac838dd326d74fcc69eeae41117036ac26b858285fa0da034cba44762f7a[.]exe

resource
unpack001/$PLUGINSDIR/System.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

c10aac838dd326d74fcc69eeae41117036ac26b858285fa0da034cba44762f7a.exe

IMPHASH 4f67aeda01a0484282e8c59006b0b352
SHA256 c10aac838dd326d74fcc69eeae41117036ac26b858285fa0da034cba44762f7a
MD5 2b78431a8969c829339ed0da29004757
SHA1 c09051c5f433348c6cf5b5c0781af877f44212d2
SHA512 3530aaad10469254279ffd782e61d4254cb73f5b9c2527f1a4a38f0424d5acb3a860d29b7ed9b4b619a98ab3b20742f0c3705321afb026b4b6e8c57dc052fabf
SSDEEP 24576:+o8RUr/5+1g8UJT4l8at7kEeTg/ITSZOG+1Mjb2WsQbd38TRAn9:+h+/0S8S0OeXITSI1Mjvsa4i9
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

17:8d:41:82:aa:a9:02:67:cf:7e:96:20:e4:1c:ae:af:f2:3f:d0:64:b7:90:32:3d:48:7b:dc:ba:f2:92:7f:a6

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Bordroom,O=Bordroom,L=Harwick,C=US

Chains

Dec 5, 2024

PE Signature issue

Digest

b9:65:cb:45:8e:e0:70:8b:ac:62:cb:62:d4:b4:0e:07:bb:90:e6:dd

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Bordroom,O=Bordroom,L=Harwick,C=US

Chains

Dec 5, 2024

Minor OS version

0

Major OS version

4

Entry point

12991

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CopyFileA Sleep GetTickCount CreateFileA GetFileSize GetModuleFileNameA ReadFile GetFileAttributesA SetFileAttributesA ExitProcess SetEnvironmentVariableA GetWindowsDirectoryA GetTempPathA GetCommandLineA lstrlenA GetVersion GetCurrentProcess GetFullPathNameA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread GetLastError CreateDirectoryA CreateProcessA RemoveDirectoryA GetTempFileNameA WriteFile lstrcpyA MoveFileExA lstrcatA GetSystemDirectoryA GetProcAddress CloseHandle SetCurrentDirectoryA MoveFileA CompareFileTime GetShortPathNameA SearchPathA lstrcmpiA SetFileTime lstrcmpA ExpandEnvironmentStringsA lstrcpynA SetErrorMode GlobalFree FindFirstFileA FindNextFileA DeleteFileA SetFilePointer GetPrivateProfileStringA FindClose MultiByteToWideChar FreeLibrary MulDiv WritePrivateProfileStringA LoadLibraryExA GetModuleHandleA GetExitCodeProcess WaitForSingleObject GlobalAlloc

user32

ScreenToClient GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard PostQuitMessage GetWindowRect EnableMenuItem CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndDialog RegisterClassA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx GetDC CreateDialogParamA SetTimer GetDlgItem SetWindowLongA SetForegroundWindow LoadImageA IsWindow SendMessageTimeoutA FindWindowExA OpenClipboard TrackPopupMenu AppendMenuA EndPaint DestroyWindow wsprintfA ShowWindow SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA

advapi32

RegDeleteKeyA SetFileSecurityA OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges RegOpenKeyExA RegEnumValueA RegDeleteValueA RegCloseKey RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/System.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 fa4ab1d6f79fd677433a31ada7806373a789d34328da46ccb0449bbf347bd73e
MD5 3f176d1ee13b0d7d6bd92e1c7a0b9bae
SHA1 fe582246792774c2c9dd15639ffa0aca90d6fd0b
SHA512 0a69124819b7568d0dea4e9e85ce8fe61c7ba697c934e3a95e2dcfb9f252b1d9da7faf8774b6e8efd614885507acc94987733eba09a2f5e7098b774dfc8524b6
SSDEEP 192:OPtkumJX7zB22kGwfy0mtVgkCPOsX1un:/702k5qpdsXQn
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

9995

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Brudgomme/saddleback.jer

SHA256 eb781b87f06cbbb43e36413f70a97528dff827a3da9575e56142324f9cf43477
MD5 fb3375e7cb0698df507062161a26885f
SHA1 5e98c5e6f50a1b57b1e72b412d9632603ff954ef
SHA512 949fb9f863eb2ec85b84c4db3e4ea023f1c3fc09cb79fe52b58569c616fc28f2e0d095db535c3b80ef44ce4f75ea4752313f4f20a3e3a61e49163fce8078b79b
SSDEEP 768:kn4C0nabowYKKucVjMHtvH3Eq1Zg5c+0o4u1uLlOxRuYP9aVsVL/e3ec6Axhe7rO:zAzhHNuZla85OxXCm
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Forsvarsministrene/Overhates.txt

SHA256 037ee7216549b3d566f3d53e5801d45adacf332f937fb43bd5a5e3f0df9662a6
MD5 3a44600b8b24f5cc7ef13b014c5fc8e6
SHA1 dabc64c2788c61476c159bf60e27a0385b761223
SHA512 02985e9f575b10700a6c8fe167db6ebd81e1b8de758dfab47bb01ab7fe568525c17e933aa2db98673e1a43eb3ef63cab6e97d59fe1b1d52e3484737e0d9b4cbe
MD5 SHA1 SHA512

NSIS installer

installer

Forsvarsministrene/Protaspis.sol

SHA256 d1e27b338c60688975ae1bb239d860e30490a7feb5aeb1df1dad87244dd073ac
MD5 eada66a6285325455f7e0780c000cb65
SHA1 125a71abf2adccfe6e4bb3d7bf80cac064f71690
SHA512 669ba190147018b4cba35d6cde23d00683e73de0c70b60c1aa03edec2c7cc629da73a7495db05cf4151e100c339c76afd87a3d179fe98045ed38b02a7a478fb1
SSDEEP 768:OFl7dydtg1PEAqjKsB0peIl0LVJmpGgJQZwWmkYvYTDjBlqndyzkEV5ndnGVa76E:hdKCZmTCLm4TyycJrcYKLdL59NBGa
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Forsvarsministrene/barbecue.ste

SHA256 6884cda80715f73c9d9aa9ad45b9bde3d9965d2009270ba685b30dd21421c04d
MD5 43eb990b1be1b4570969a310174d319f
SHA1 beae29db714c0576f1ba9256e64f1a0a015b3e84
SHA512 c0fbe88619a7bc3bb8f6cbc8b77b4c1e21a2afb8a92b1df4324c20980c5cf6362cb75b7d065391437147ba746a933ebbd51167e4df2b94477298a87331e15c75
SSDEEP 768:+0WlDZ0cyMp2n0GbzqUGvbn/eHiEmNAXxM4cCQHkR1WuFkHnvVG26UZRR15NykM4:b0/vvkPqdcKMyJAnrZpdZ
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Forsvarsministrene/paradiset.cho

SHA256 f917e97748dee607abcc405fa70d7614b2f96675914b64ae7fd6ac299bcf220b
MD5 34495288f83eb902ac00567354e11253
SHA1 f421e0a307361c05a9534639d2b3a446f4673baf
SHA512 e2de646c75526dda1b22aebff7b7991dec89d351012fa21d925046ef5dd78abd2d999acaae7c8ba33747480d3c921cdab05d98839af3a552063070a3b4c48496
SSDEEP 1536:qIRuZM0E+SCsypSaDWDKQreAN/Ge8+QM8+cj4WHOlXtZ:pRuPs3DKYc5+QM1KW
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Forsyneenes.Oms

SHA256 6abcb47aee8a2120422c246de8c03b6a01a04b431bec3e906a5bc1297b7d74bc
MD5 274fb510c29f8d4455002be77288131e
SHA1 b32b89fea5cd3527e0eed372e8e39a86531c865b
SHA512 347c665d7e99f536ed6e5cf1cfef00af8fd40eda43042e09a28c1780517347ab066b17c7533fd1dca279813277c97dfec9c2116e51db9f4e3e1c73b0c24ddd2d
SSDEEP 6144:GwXhFBgBHfn9LmvuRhFnvx1z4GvhBdI1/QKrulObwrH8rii28xe90oaQ6BYiFJ:O10GJ4tulOeYpBkaoa9PJ
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Freakouts.mis

SHA256 6401066b34d5fd3c9103c01112200e109a78a3dc584b7e55392b7a45020a76b0
MD5 1ef716deb3ad336e09abc68798eefb78
SHA1 15e56dd29e83d44626e46f219aa1efc8fec6fb73
SHA512 6bd0842fe87e9c7467249673485392d1a718b84a757be8ab94f4323f5be358c0975a7e5bc4f74af2ef69f5db46ad00dce3dda9bbd20c2a6ce9d364883a40e7f9
SSDEEP 1536:WQqatwb3BquFonZ0MZGDfw/Ams7/cTCDEhqR9:prwTBq1ZPGD4/xsDEh8
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Kavalerens188.equ

SHA256 7d60978d18793a119bb47b0d702e2d1efae28514eb46e9f96d75bb6fda4ecf99
MD5 93c85b7e4c86f442491ff2d5f5b3fe0b
SHA1 893ee5dc579da377dce95f9decaf57438f967112
SHA512 a0d6b52554f688e47986ffa6b3885393f47a5d51895dc40219bdb1c838609755b1a801e446b926b44ab6c2f4b8a05a183d3c6bbf0d16ca84802cb5dbca1581c9
SSDEEP 1536:iKHVhskoaFMrwPuNqw8hbEZ1EvgaKCiIklf3:JHcP9+w8hb8IQ
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Komponnkr.Tok

SHA256 5d03ddf30aba8bbf73cdca6306fb9a3147c4862c514c1ee8c7d1b680c782dd39
MD5 b7832ad2ab09886cd2ef522834f98d9c
SHA1 8065f02b75fb64b473f4d2639a7979e259cd2174
SHA512 257ccc8a6541ebae7fa47b2bb3b7723eb90bed8b68cb3fb6bfc8528daf1e736ccfad8c8d6a98c6f580a2845bea31e823e5011134d67facffa1c5b4fd087bba7a
SSDEEP 1536:FdxtDxEepm0mgEeyIhPnO0BACj/73YG9OmZA/sI53ieUSF7c54uce:F4L0xhPnLyhrmZfIjUSAce
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

c10aac838dd326d74fcc69eeae41117036ac26b858285fa0da034cba44762f7a.exe

PE Signature issue

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Brudgomme/saddleback.jer

Forsvarsministrene/Overhates.txt

Forsvarsministrene/Protaspis.sol

Forsvarsministrene/barbecue.ste

Forsvarsministrene/paradiset.cho

Forsyneenes.Oms

Freakouts.mis

Kavalerens188.equ

Komponnkr.Tok

Sharing

General

Malware Config

Signatures

File Explorer

c10aac838dd326d74fcc69eeae41117036ac26b858285fa0da034cba44762f7a.exe

PE Signature issue

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Brudgomme/saddleback.jer

Forsvarsministrene/Overhates.txt

Forsvarsministrene/Protaspis.sol

Forsvarsministrene/barbecue.ste

Forsvarsministrene/paradiset.cho

Forsyneenes.Oms

Freakouts.mis

Kavalerens188.equ

Komponnkr.Tok