dd37002352fdc8e8a56a23ea19ba146f907d3d807f1ac0131954cf0922a2a100

resource
dd37002352fdc8e8a56a23ea19ba146f907d3d807f1ac0131954cf0922a2a100
unpack001/$PLUGINSDIR/System.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

IMPHASH b78ecf47c0a3e24a6f4af114e2d1f5de
SHA256 dd37002352fdc8e8a56a23ea19ba146f907d3d807f1ac0131954cf0922a2a100
MD5 67d75bb670fc40d5a7b404bc55fed626
SHA1 e1e084cf07b55f06d7e03d815ca0e0a4775333e7
SHA512 b045020b63bc8728f431e10ba273fdbe2658c9efc325ab75dd31ac83d343d51925bde26fec7ae9b4eaef343ed311442930e8710344c36994327d8fe800453952
SSDEEP 12288:kcAVddRgtwamaqxOUrIj15nW5jf8zHaM9I31BiXEHnW:Sddiz0OAY5nW5jf82ziXE2
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12505

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetEnvironmentVariableA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA GetFileAttributesA SetFileAttributesA GetWindowsDirectoryA GetTempPathA GetCommandLineA lstrlenA GetVersion SetErrorMode lstrcpynA ExitProcess GetFullPathNameA GlobalLock CreateThread GetLastError CreateDirectoryA CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA ReadFile WriteFile lstrcpyA MoveFileExA lstrcatA GetSystemDirectoryA GetProcAddress CloseHandle SetCurrentDirectoryA MoveFileA CompareFileTime GetShortPathNameA SearchPathA lstrcmpiA SetFileTime lstrcmpA ExpandEnvironmentStringsA GlobalUnlock GetDiskFreeSpaceA GlobalFree FindFirstFileA FindNextFileA DeleteFileA SetFilePointer GetPrivateProfileStringA FindClose MultiByteToWideChar FreeLibrary MulDiv WritePrivateProfileStringA LoadLibraryExA GetModuleHandleA GetExitCodeProcess WaitForSingleObject GlobalAlloc

user32

ScreenToClient GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard PostQuitMessage GetWindowRect EnableMenuItem CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndDialog RegisterClassA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx GetDC CreateDialogParamA SetTimer GetDlgItem SetWindowLongA SetForegroundWindow LoadImageA IsWindow SendMessageTimeoutA FindWindowExA OpenClipboard TrackPopupMenu AppendMenuA EndPaint DestroyWindow wsprintfA ShowWindow SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA

advapi32

RegDeleteKeyA SetFileSecurityA OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges RegOpenKeyExA RegEnumValueA RegDeleteValueA RegCloseKey RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/System.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 98bcd1dd88642f4dd36a300c76ebb1ddfbbbc5bfc7e3b6d7435dc6d6e030c13b
MD5 b8992e497d57001ddf100f9c397fcef5
SHA1 e26ddf101a2ec5027975d2909306457c6f61cfbd
SHA512 8823b1904dccfaf031068102cb1def7958a057f49ff369f0e061f1b4db2090021aa620bb8442a2a6ac9355bb74ee54371dc2599c20dc723755a46ede81533a3c
SSDEEP 192:PPtkumJX7zB22kGwfy0mtVgkCPOs81un:E702k5qpds8Qn
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

9995

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Espalieres/Irrationaliteternes.Lav

SHA256 23b55d1dd872c8319478c5aec22cdeee30309f8f9e7bf351b04584b866e23725
MD5 d660d2935a7123d90a4130bf66d7f5c4
SHA1 01cb9548e3229721b462553cc08f7a4e4bc87eba
SHA512 65b216f3bbae6d6a804c670cb1c87e67be65985bad293cb5a0717d02c0302579a2c34ca4ff849fa94573b115a280dd98aea889e1571433f2190622b7b109b371
SSDEEP 192:vqI6uJ5JWMjZqa4biHH3RmKzgayQ1iUDsIRIMuaoR4u:ioNLZAiHHYKztrYUDsvM/oR4u
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Espalieres/Rutebilchauffrens/formelens.edg

SHA256 a341a2ff59ed37457d7f4126ded4a72f8a8f421a6b478de1949c3547fc0a572e
MD5 38a2c06d3dd6466718161dd5d37e0b44
SHA1 2148a5b4cb5e5fdc7d70b070336c9b787616b415
SHA512 152af755b7fe875ebf404bea2537e473e9db53c9627df057eb71479eae579e7f552184d65cce5270dd1cf5f237222b581e73773dd0d240ce50de76200c57e981
SSDEEP 1536:Kju7rz1w7cAEmRgU6bKuMbyuFkHM7cwt5kZcfL4:KYvE1EHouMbyurIG
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Espalieres/Rutebilchauffrens/tabouret.txt

SHA256 5c4acd0f8a8c5543bc10433ee726611fe84a64f1b4db77ddfc5e687826b3cabe
MD5 7dec89adff8fba5d338411d9d6e8b19d
SHA1 20582b4cd7bb05ac22c16da393249b1f9c65957f
SHA512 c63656fb4f25db1470606ce64e1b4a570830dc0c53ae6758c245f30c77c3ed17c5bce757c6cc58b2d502e4ee438c84e6fc2c5616ef2f800e6cb70ff4a1f3a728
MD5 SHA1 SHA512

NSIS installer

installer

Espalieres/angeyok.tro

SHA256 d3aa40c30baf2ff666b22d3ba4c1fcdb27cdf96f27181f2a3376d04f44da96a2
MD5 a6fcfc9a13b3802a6d08c2552c6c642b
SHA1 f9ba4381e9f5ea0a6515f7714215766a6c13107a
SHA512 03d4cf731353d52104aa3239e511338bbbab105b657620be1c10a97651d637c674aa27a4f7f43d00d8a7188c98d6ccc93277766581588d57e99d7f83bc294fe2
SSDEEP 1536:ap4Rp9qVv1jWB9+mNOq+KECZUdzPh+rwgkk8foN+:xqJxWB9px9ElRp+kZv
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Laparocolostomy.Blo

SHA256 e162320229157e80f2cffb5beb61f810364ffec96aaf51577ffa35ce1318f2d2
MD5 30044a493b45c14cb57439600380ad07
SHA1 eaa093ff0dbc03d8f270297774293ad9c5a8d07b
SHA512 394b122321d65647d1d627b946332101a1e8bff40e96052917bab451ef1757eaf42e9bb97407c8978b026c76b65b0cdb278979ee9070c21605d3642b3fea83ce
SSDEEP 6144:J6EA81jOZI0DWuPqtTvaSqdqv3RAL0/Wm7sjbFHYD9fW5FUZbsf1L9QIU8x:83IzvSSqG3qLkX7CSD9O5FUxsfeW
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer