3[.]exe | Triage™

resource
unpack001/$PLUGINSDIR/nsExec.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

3.exe

IMPHASH e160ef8e55bb9d162da4e266afd9eef3
SHA256 c3f967c4659e6e10c8f8ab14d7900f3917ff98111d72e65954ff1c84c853fa30
MD5 b12fcafcafe31d82b9577e460eb964f8
SHA1 58fbad4f11e59247da39a217e2c5dce1673e3f9a
SHA512 d3def66c6ea0501733b2c5bed2a3e3e4342a5bafe44fd3960ea533dd746e1e70e05966e89069270ad04f86f887032501da85d67efb9600dc44f9d6ef3ef673a4
SSDEEP 24576:y1O73OLeshQvkIvlD6qhMTkHppllemxT18b7Ifzfz:SzCsvOQAHXD/xT18b6Tz
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

45:b0:e8:38:87:03:f2:43:e7:a3:bd:41:d7:dc:84:45:ea:9e:ab:59:02:6a:a6:98:43:12:8b:f1:b0:91:f6:c6

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Semisolemnity,OU=Perityphlitis Conversation Slangism\ ,O=Semisolemnity,L=Monteille,ST=Normandie,C=FR,1.2.840.113549.1.9.1=#0c1b50726f6772616d70756e6b7473404f7073746e696e67656e2e7269

Chains

Jan 21, 2025

Minor OS version

0

Major OS version

4

Entry point

12489

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetTickCount GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA SearchPathA GetShortPathNameA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess SetEnvironmentVariableA GetWindowsDirectoryA GetTempPathA Sleep CloseHandle LoadLibraryA lstrlenA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA ReadFile lstrcpyA lstrcatA GetSystemDirectoryA GetVersion GetProcAddress GlobalAlloc CompareFileTime SetFileTime ExpandEnvironmentStringsA lstrcmpiA lstrcmpA WaitForSingleObject GlobalFree GetExitCodeProcess GetModuleHandleA SetErrorMode GetCommandLineA LoadLibraryExA FindFirstFileA FindNextFileA DeleteFileA SetFilePointer WriteFile FindClose WritePrivateProfileStringA MultiByteToWideChar MulDiv GetPrivateProfileStringA FreeLibrary

user32

CreateWindowExA EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard GetDC SystemParametersInfoA RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx DestroyWindow CreateDialogParamA SetTimer GetDlgItem wsprintfA SetForegroundWindow ShowWindow IsWindow LoadImageA SetWindowLongA SetClipboardData EmptyClipboard OpenClipboard EndPaint PostQuitMessage FindWindowExA SendMessageTimeoutA SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA

advapi32

RegCloseKey RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegEnumValueA RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

CoCreateInstance CoTaskMemFree OleInitialize OleUninitialize

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/nsExec.dll

IMPHASH 6b7d154c806f1e47db325229c300c6df
SHA256 030bcfa82e3bb424835a5fa53a3ff17ab08557d3bbeea4815313036fc4bdafe1
MD5 14f5984b926208de2aafb55dd9971d4a
SHA1 e5afe0b80568135d3e259c73f93947d758a7b980
SHA512 e9ec97dd57ead871789d49ed38d9fde5f31d3cb2547810cae49a736e06b9f9b28cf8efea825eb83c3e07d880ee798abfb9069c6957416d5973c83e4531814e27
SSDEEP 96:k7GUaYNwCLuGFctpiKFlYJ8hH4RVHpwdEeY3kRlDr6dMqqyVgNJ38:Wygp3FcHi0xhYMR8dMqJVgN
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4231

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Brystende.hvi

SHA256 dce97de5913dbf40aaf4a4c3b749d6ada19bc5b42ea0d9cb0c526dd3c8fc6097
MD5 002c0a555416ba156ac9e4041f656807
SHA1 d84cea43846da482c6ec57bba17c6f4845067bf9
SHA512 e80a7eb01ab6479417a1100417319ccc118fa6c71acf5b5f6c0e0bfe92c75ba64f758a30303a5f60027c2a7c0e38315b3b6f24bf2d43ff8d31180268baebdda1
SSDEEP 6144:HE7YeeNi5sb/ZVRiZQr6gLCYTlhORwfyg8X98sxj9f64CZlBUjdn94ivB:HE7yiG/M4t2yyg6x964Eyn93B
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Minimumshjdens.Leg

SHA256 02282a6123ba973fbd7393fb8057dedb44378d1e3e95201e6875da2251b7a463
MD5 966bca9e1216cd72bcae7864c75a0b36
SHA1 0a9d8185b63faf52a020bfa934573df46da4ebc7
SHA512 698601029944715faed8b1a376c25ccbbf277e5d5a77145e07c0dfed8257f4e3cba27489bef4e98c31531647080acf9b5e9c3cb5517308f7d95b80e81c945ab0
SSDEEP 1536:i8K3msyZoXG0zNuqAtwVwGSk2t6FRVMT/q0yI2Kf3EysyS7CE9F+mN:yW5Z7D0wGSCFRVf0T2Kf4lGEb1N
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Staudebedet/Marmion/trlasternes.txt

SHA256 5e54882bd0fbe7fef36dd2dc46bd410714ae20e1af38a8180fcef1a3e21bfdfa
MD5 41eba6cef0d51e844e19771963d661de
SHA1 70c39dbe7044fa2609e2a1a700c7d7cb97a45453
SHA512 7af9cd94aa540284aa63a7e050688b952bd16b72de3e236ccf7ee67e040fd1899e998ccb61074e854de5d51e99af53e7c7f122a5602da965a5c10148c1cfc014
MD5 SHA1 SHA512

NSIS installer

installer

Staudebedet/Marmion/undervisningsdisketter.sen

SHA256 d1dbc5bcd2793f704087c6b965a63e919376fd6ae011ff28e19085f02988b50e
MD5 03b9440ce79b2d48ede2a6c32be47778
SHA1 e7ebab9d20408e4ff40ee15bc207d97dcccd3ccd
SHA512 69ec528d38735fdeadace2e52d047556d34cf1eb08b1ff21febd2b25f4a3b802db4b0f37d2a1b3a39b99ef50caa936bde16d4ddd0299b288c9b1118aceac2ebe
SSDEEP 768:k6gSS7V/UtlkGRAUSzJhWck9X4oECXHHxzY7hBjnfHF6o1F2bRNoCM7JXTPTSF1h:qKiderwHfJOPgDhrbG6w4
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Staudebedet/Marmion/vgtskaale.cos

SHA256 e505737cfe5aef385255ea3ff342de7eeb8b21aaef6a38b9a95e0ac10a7565ae
MD5 c4f3f6332493587cd4ede1356895971d
SHA1 62377964d6c5b800a0ebb1c211957ab1c900727c
SHA512 eef57be2f902b21975b3ac2f74129ff9ce5c3c670b7c4697049a96db9cc5d224404efd1bf850cf6accd74f42af2d70084dcc616807d07f4d514ec17ed3aa5f2c
SSDEEP 768:bykAO6GfukVamgVSD6AUQKn/TM9C+WmKDPDC1pYId8OW3YZnNT8YOxMA+8y3dmzj:bcf3nCARJh
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Staudebedet/remarshaled.bun

SHA256 7cf79173ec140424db39f0154d2caac89546a5bb5331dbd2b304ee340b091ec6
MD5 e434a4952e378770750c995c5c52118c
SHA1 b737aa4453d32505f5a5c12a3b8a36bb367db26a
SHA512 4bda5da1eac80d68a5d5d1d88dbdcba718f64edb3368d5ab65efb2fab7ccb8abe7f8f56934732079ec77f899979658d0f366ce11ab46a88eb0e059673af1126f
SSDEEP 768:bKWIpKk+ny3Ob+vF6/Zj4hPKa5qs1ECfPGH5UGRkAw5ap7k+tHWMMGOMkUi+6sT3:QzZxNhDnEVdjIQv
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Staudebedet/ribbeborts.ska

SHA256 bb9ec433b77f9110e64b3d9591e1cfdd47413fc2c6f080be5aa98026597e00c7
MD5 f2ee19ca29418b155010cf537c103d17
SHA1 97ecef6569551924f10ee9187a7d80cc1df11fa9
SHA512 dca4ee23d3ef9168c223a986b15915383b66002c3d64c97c9610776a1b7a7b7bdcf743954363f8bb7d83ef8c7a2f396833e8ac6d2e001b5072a73f9a4bf2010e
SSDEEP 768:TwFCDJUjCfF5lMLxjdDJMw9BZbL7IkWSzB2yXZqjR30WaswzRxjpY/G1MwF5rRIY:YVbipXw
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

inspect.ran

SHA256 c6573711e415fb1707b9445a00c7bdfeb70e4ed407057290e41dea459a8f8b38
MD5 ea198d2a8207d145f19808ca4c81ae9c
SHA1 84a1b8ef3cde9512989f5cd71c5bb5ac8d332c9d
SHA512 09caeeb067284ed8c162c3bed6e25f4cedb491f1850c341d7a3df27f87571181c2458abb7bcd79b6521fa86c8986bd53de2afb4499439c2f45c1b98d4dc7a39f
SSDEEP 768:qL+QVgTJieQ5RoOBoPrekohSE3UcIh5ajnpWPlNjnsaN7RDXskoHGKvozkxg3e57:l5xhy5
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

3.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/nsExec.dll

kernel32

user32

advapi32

generic

Brystende.hvi

Minimumshjdens.Leg

Staudebedet/Marmion/trlasternes.txt

Staudebedet/Marmion/undervisningsdisketter.sen

Staudebedet/Marmion/vgtskaale.cos

Staudebedet/remarshaled.bun

Staudebedet/ribbeborts.ska

inspect.ran

Sharing

General

Malware Config

Signatures

File Explorer

3.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/nsExec.dll

kernel32

user32

advapi32

generic

Brystende.hvi

Minimumshjdens.Leg

Staudebedet/Marmion/trlasternes.txt

Staudebedet/Marmion/undervisningsdisketter.sen

Staudebedet/Marmion/vgtskaale.cos

Staudebedet/remarshaled.bun

Staudebedet/ribbeborts.ska

inspect.ran