cee3ae54c0f49335db69551733260a6e0bb7f72089b126b14a09d44722bbdc8f[.]exe

resource
unpack001/$PLUGINSDIR/nsExec.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

cee3ae54c0f49335db69551733260a6e0bb7f72089b126b14a09d44722bbdc8f.exe

IMPHASH 4f67aeda01a0484282e8c59006b0b352
SHA256 cee3ae54c0f49335db69551733260a6e0bb7f72089b126b14a09d44722bbdc8f
MD5 a30468384472782c5b2fc6a439f641bb
SHA1 2695582dda03035b463e939b1a2577505e9a2766
SHA512 c2cee48e6c124cbcd2a09e0d0381f38d2602522a5b57577b039aaeb43e4611313c1865c00a98cabacd1edca8b43bbcbad0f6fbb8594c0c36bf4438c57708eaa4
SSDEEP 12288:g93jlsINtJD2SoxlyLpJdNLNrDv7ucLrv70:g93jlsyUSQ8LpJdNLNrjNPvY
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

cb:cf:fc:4f:cf:6d:81:be:0e:ac:15:52:65:f2:35:ca:7d:88:7e:ec:27:1b:04:81:96:1f:85:dd:5e:48:76:59

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Efterslag,OU=Undervisningsprogram Svinerier Valutahandleres\ ,O=Efterslag,L=San Diego,ST=California,C=US,1.2.840.113549.1.9.1=#0c1e50656c79636f677261706879405465726d696e6f6c6f6769736b2e53746a

Chains

Dec 12, 2024

Minor OS version

0

Major OS version

4

Entry point

12843

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CopyFileA Sleep GetTickCount CreateFileA GetFileSize GetModuleFileNameA ReadFile GetFileAttributesA SetFileAttributesA ExitProcess SetEnvironmentVariableA GetWindowsDirectoryA GetTempPathA GetCommandLineA lstrlenA GetVersion GetCurrentProcess GetFullPathNameA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread GetLastError CreateDirectoryA CreateProcessA RemoveDirectoryA GetTempFileNameA WriteFile lstrcpyA MoveFileExA lstrcatA GetSystemDirectoryA GetProcAddress CloseHandle SetCurrentDirectoryA MoveFileA CompareFileTime GetShortPathNameA SearchPathA lstrcmpiA SetFileTime lstrcmpA ExpandEnvironmentStringsA lstrcpynA SetErrorMode GlobalFree FindFirstFileA FindNextFileA DeleteFileA SetFilePointer GetPrivateProfileStringA FindClose MultiByteToWideChar FreeLibrary MulDiv WritePrivateProfileStringA LoadLibraryExA GetModuleHandleA GetExitCodeProcess WaitForSingleObject GlobalAlloc

user32

ScreenToClient GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard PostQuitMessage GetWindowRect EnableMenuItem CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndDialog RegisterClassA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx GetDC CreateDialogParamA SetTimer GetDlgItem SetWindowLongA SetForegroundWindow LoadImageA IsWindow SendMessageTimeoutA FindWindowExA OpenClipboard TrackPopupMenu AppendMenuA EndPaint DestroyWindow wsprintfA ShowWindow SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA

advapi32

RegDeleteKeyA SetFileSecurityA OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges RegOpenKeyExA RegEnumValueA RegDeleteValueA RegCloseKey RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/nsExec.dll

IMPHASH 46f8b6973f33717335c0f6d8087de67b
SHA256 3e3d516d4f28948a474704d5dc9907dbe39e3b3f98e7299f536337278c59c5c9
MD5 b648c78981c02c434d6a04d4422a6198
SHA1 74d99eed1eae76c7f43454c01cdb7030e5772fc2
SHA512 219c88c0ef9fd6e3be34c56d8458443e695badd27861d74c486143306a94b8318e6593bf4da81421e88e4539b238557dd4fe1f5bedf3ecec59727917099e90d2
SSDEEP 96:U7GUxNkO6GR0t9GKKr1Zd8NHYVVHp4dEeY3kRnHdMqqyVgNN3e:mXhHR0aTQN4gRHdMqJVgNE
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4231

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Marsken.Ank

SHA256 7af7afd5dafd279406fa57f31e56f4d92721423733a2fb32c0434b09bbce127c
MD5 f53eeac9a2c8712c7783bdf13e401b2b
SHA1 cfed633d70a8a260a8003f2164b4d1789d6be308
SHA512 50f9b78fa28a1d83cbaac44cdbc6110218b814faf91a1539ac1888e2167f7d66be5dd005d8d3eb8ded0dd34cbc7a03e062d62d01f151ddb9bfbda5bb40b6c70b
SSDEEP 6144:tJfRjspFVtoY3ChqpHSTeoUcUee4qdHTrTlnFnJVGaanAh:tBKpFVtoYyYATtUcULpdH3T/GaanAh
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Southernise233.Bul

SHA256 5e33b1687632ded7ba4a2e2c16e088f28faaa7308ffd5c4d8b022dfb049e91d2
MD5 1f45559fcfff86c51f4abda260d0b9b3
SHA1 f8bb784bb245d615b755cd5d7b6344e3a6d9fad2
SHA512 d6fb73428e776c7094a1a217c7859ad43d276067b1fbf3ea5870fe20bffbeca1ad134a0d73a8c853db17f33d3000bb759316ed93e8910b86e53b7ec0e6162eae
SSDEEP 1536:DjNks2ErfhdpphCyq/KDKG9GDIVvt9FLtUOuaeZNwXa:DhN7rfhdpp1qCH+IpEee0Xa
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Udfring53.lev

SHA256 9091fb5a1b166d03c61848505a440e8b33aca701de691d7e4eb8fbfe7379fcaf
MD5 b4834640df9710a3741e667024766f83
SHA1 b392e116f95a0388b7d82c7bd453fd4b3aabe9b6
SHA512 76396f26f236de394ee3c2441073bf59107f61393e87d730cc70e989582361aacdaea20e59ea49cc0f125fa6a8405823b17a5d24ec111391e83647fc3687f48c
SSDEEP 768:soeSIeBIi+CIHPx0zCnX4uXSmBKjtdYKffNFYu5bA+KNiyvYFxUT:G
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Ungallantness.kok

SHA256 9f10026e2214ca3c9c59a9af9913c2ef9c01ac32efb3a7db3a2bec568809904c
MD5 5acf4982dbf490ad4ae83c7d1856e89c
SHA1 66fe8a2b3323ed8cf74fbf6c681d0aa3496a6185
SHA512 b1bfb5a4fa9b1b7841254161f9347adc44e3269d13ab7e703a2ec009b95844442e66312436835185e7779673c2e5553659bd85f4b141e5cf907eee9198ec1f82
SSDEEP 768:nHrNCx0tE2B2CS9/Nq7r2Cr5WHOKjzQT:rt
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Yaply50.txt

SHA256 e58319c2fcc8c30c70969bed761493afd5b7f29d12fdbd1d96c0bbd93efc6db2
MD5 c271d6423649c301105c8a2eca25f9e4
SHA1 cfac3739c43482547d096c88670fa646fb62a56c
SHA512 b04bbdba8afb3d93d6e10c9ea838ec3b2d3798cb0f8c383c44329fa35b4f6e72b4023fb1a6adafe49af258cd876a5bb0a019c742353936eb6c60601937eaf04d
MD5 SHA1 SHA512

NSIS installer

installer

rancheria.pro

SHA256 1b795733ffc880d3decd0a23bd3ccb22ac6a80eea5729d407336d891f0523884
MD5 b34fc802327d0f5f02281fd236bd67c6
SHA1 e7e1e1e5288f16b42fb8b5a62c9b33a4b8d02341
SHA512 dd170f304175543b07eabe1f09d0548dbe9c332074a0493d1bc4400494356104e16d47c684eb04a04447283427612b1eae5c40bbb42e087f77fe72c841b9db7b
SSDEEP 768:oASe3amtYNbHv0lnDzgcAUOkEuypx/zSFad:
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

cee3ae54c0f49335db69551733260a6e0bb7f72089b126b14a09d44722bbdc8f.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/nsExec.dll

kernel32

user32

advapi32

generic

Marsken.Ank

Southernise233.Bul

Udfring53.lev

Ungallantness.kok

Yaply50.txt

rancheria.pro

Sharing

General

Malware Config

Signatures

File Explorer

cee3ae54c0f49335db69551733260a6e0bb7f72089b126b14a09d44722bbdc8f.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/nsExec.dll

kernel32

user32

advapi32

generic

Marsken.Ank

Southernise233.Bul

Udfring53.lev

Ungallantness.kok

Yaply50.txt

rancheria.pro