8fa0116efbd18a4d7be8be0aae4bdabae5934e86d923f5db6bb8ef3a916b3101[.]exe

resource
8fa0116efbd18a4d7be8be0aae4bdabae5934e86d923f5db6bb8ef3a916b3101.exe
unpack001/$PLUGINSDIR/nsExec.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

8fa0116efbd18a4d7be8be0aae4bdabae5934e86d923f5db6bb8ef3a916b3101.exe

IMPHASH b78ecf47c0a3e24a6f4af114e2d1f5de
SHA256 8fa0116efbd18a4d7be8be0aae4bdabae5934e86d923f5db6bb8ef3a916b3101
MD5 9fcf97beb7fa92d40e8624ac460c6abb
SHA1 0051a4d406c8d1c76095169152fa633e2d35af41
SHA512 6aaee34c7b72b6bf7438c2f51dd5eebcc867629c52faff67b47d40b1d706b36c4b89efa0741146421dbeb8b3615304e7621b99e73f697ab7b4a13d65787b9c7e
SSDEEP 12288:b9j6I8jtEj1PsUwmM3AEdCvW/UGeOjv2oi7Kf/MQCQNX:b9jr8jtEKUwTdx/UEvYKMQC8
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12505

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetEnvironmentVariableA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA GetFileAttributesA SetFileAttributesA GetWindowsDirectoryA GetTempPathA GetCommandLineA lstrlenA GetVersion SetErrorMode lstrcpynA ExitProcess GetFullPathNameA GlobalLock CreateThread GetLastError CreateDirectoryA CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA ReadFile WriteFile lstrcpyA MoveFileExA lstrcatA GetSystemDirectoryA GetProcAddress CloseHandle SetCurrentDirectoryA MoveFileA CompareFileTime GetShortPathNameA SearchPathA lstrcmpiA SetFileTime lstrcmpA ExpandEnvironmentStringsA GlobalUnlock GetDiskFreeSpaceA GlobalFree FindFirstFileA FindNextFileA DeleteFileA SetFilePointer GetPrivateProfileStringA FindClose MultiByteToWideChar FreeLibrary MulDiv WritePrivateProfileStringA LoadLibraryExA GetModuleHandleA GetExitCodeProcess WaitForSingleObject GlobalAlloc

user32

ScreenToClient GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard PostQuitMessage GetWindowRect EnableMenuItem CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndDialog RegisterClassA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx GetDC CreateDialogParamA SetTimer GetDlgItem SetWindowLongA SetForegroundWindow LoadImageA IsWindow SendMessageTimeoutA FindWindowExA OpenClipboard TrackPopupMenu AppendMenuA EndPaint DestroyWindow wsprintfA ShowWindow SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA

advapi32

RegDeleteKeyA SetFileSecurityA OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges RegOpenKeyExA RegEnumValueA RegDeleteValueA RegCloseKey RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/nsExec.dll

IMPHASH 46f8b6973f33717335c0f6d8087de67b
SHA256 7fafaf28fa6eb7604c61ef816cdd3e5097a0e17695bef0bf9116b6558aa68967
MD5 ae164b9dd3591a987b0d71dc255c4654
SHA1 41198cb28a31a0ffc3d14540e61a4840800681cc
SHA512 57fad70b175fa4f1a525fe413c8bcd87cd66b97053056c91ca912e6796ad19cc613437f49c52adf5ca20c2c54f4c0ef2a41df50cfabe0645de7e6016b5cd05f6
SSDEEP 96:kD7GUxNkO6GR0t9GKKr1Zd8NHYVVHp4dEeY3kRnHdMqqyVgNe43e:kPXhHR0aTQN4gRHdMqJVgNef
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4231

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Bosteder5.soc

SHA256 663b4e1b70d0572ca79034a955e81e0a5d4e52a836d7ac1026fbe17cc2be9f0d
MD5 7af79e0608deb4f46e746b5fbd6908a5
SHA1 99d4efb9b81607be7dda20d6fb02342e5bd4b86b
SHA512 d5fca91e37258c807da1a793cf5f23a51c198af36e7df166dd04221c9e272ecfa9aab8db067539d7c0889d82c45b98bfa722d686b092376bc2fef21078e243be
SSDEEP 768:2f3EqX0OrPTBy+CNIgFEe2wY5vTl2gZF96H/fvatJW+xc:2fnrrofD27552m6cEmc
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Filstruktur.txt

SHA256 eb5686b63dfec371a5eff96338aa45d48d24bb6191fc4a71265ff3d3eecd3ab0
MD5 14b2ba6b25c5154bbe98c4bb4cf8e012
SHA1 fa3fd2c0b8a357a0ea6c64f2adfe572ca34f9b71
SHA512 bb209f68a4541ae4861c1601e5fb063e6a3f39774e7d26249239c696a477e1d0efaf890a5d84eb6e4d9686d81cb69c83978634da24bf558fffe65735ed0e3978
MD5 SHA1 SHA512

NSIS installer

installer

Frigidaire.Smu

SHA256 4ae616d55ca5351a0929942b57e723e14388c00347e84f4fdd9cf5829963b5db
MD5 73149ddf2a711920b211068573536395
SHA1 8bc834b0a611fc0abcbe4246bad4a88a691f96d4
SHA512 f6cee808a1917bda9b9960d0b0bde0ee4868ca085a69b808828cb9f12db7993e1f4fb44456836463f00d6080c57c43ec6054b3f9f3256a5eb353e8c9adf8cd14
SSDEEP 6144:FOTIewo4uek6Fur/wKwHET5OSMR2A6sZx6iHP+bTPss:gmuL6YIKwOqR2AHv+bTPL
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Omstemmendes/radrense.txt

SHA256 db3f81b326cf0dcf5d8a38e867bbf368959d4f67c27dc39c596a3c6f4b69065e
MD5 e88351a7652507319b2ce3f5eb17e867
SHA1 d3fcf4c26066593f89f3515298c62a80d0efb491
SHA512 d21653240f23a3bd2406f2811fa3c57bb417282b4c19988202191316be87fe677b6319f9d1117740f7e3743eee0447ade84746d2e66674f2c30730838f9eb42e
MD5 SHA1 SHA512

NSIS installer

installer

Omstemmendes/undergivelsens.ini

SHA256 43ac7b5a05027dd9639e635a8e8f6f6637063171f773de8602aacd8466efb0c5
MD5 b76c3b1a86ddbe87a853d54df73ad611
SHA1 77514c61877ad3985d15c02bf05090a382ef8370
SHA512 6984b7e7606725e08be46a6addc59b5001691c7459fea25d310fe4213772648f0b4bbed1eaa6ab6f1f3ef5c2da2d26ff38466a4a5f2a7bd469db224fa766ed7a
MD5 SHA1 SHA512

NSIS installer

installer

Phonetist.rep

SHA256 8bea279eea12ed0a17352e74808eca312b0971b0fabca6b22e0d1bfeb539e890
MD5 253faa8bc9f61b6117e1dbb099fdce9f
SHA1 98250520784061e89b5f8958b996addeb43ea394
SHA512 f6ee424af0763960674cafb7ff8e705381c63c1b3363fec1b145c47ea36f30f46446c5cf679ff231c06d21c92def1afd0e53304d319a2c6bdd8234cbac0b4000
SSDEEP 1536:vaBv24EzBKJxpHnmVLe/2OaG7gQ5wnPctHV:vaN2d2pHnmVCOOcOwna1
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

copaline.unc

SHA256 8f33936bd5da93b03c85282354f2c2736d3c2407f25799a72b6eb5529136f873
MD5 c57ad1cb17546065d4e8bcae0d6bbf73
SHA1 231129e90ba890ba58ea905b99879ae8d1d91f33
SHA512 0ebe93c5a43c14b4f6af121a5e9b00fb1b4c4658dd1c36454fed66b5ccc025a1a9c5c2acd1fb7c72893553b868a0f5e11564330748eca49699f5a0641edecd3e
SSDEEP 768:kBhC9+hFUXqgZsLTW9+JnHcTq8SFSXyqQ7Tep1uxuJBr8xgFg0DAti1MQOpNWl2w:e0xnlitI7f5QnE
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

destemper.txt

SHA256 83aa86a26954217cca633fe71a892993880684df10df0de50f93777062b3cc7f
MD5 1a41fbfe561273dcfb46b9a0fa9baf8f
SHA1 82e4f5dc604eb4cb66b9379a83ebcee3891a1783
SHA512 748da99d7e9665da5a539f97cbe0001fddd679402d75af9187d6eb07c5cd27b1d9597a7b0f1bc63ecb5fb339c7d1829d40466579f34e187c172ac182f15a0f2d
MD5 SHA1 SHA512

NSIS installer

installer

ferske.kap

SHA256 cfce78811bc6ea4f2332631b8af5bf276df663eda7015e9da06b4fa403f2189c
MD5 f8f28aba451155d4c507db59c34c3ee2
SHA1 be654672563cf98e0070e34164a30b05d9d7d781
SHA512 fdc9c337d0a0339e81b97a906a51d91318762a8406f75ed3275124d77c3031af15c8777091dc27498dd403a85e7307d6536a6fe86c2ace7edb550c71ad2488ff
SSDEEP 768:EEHKj+VfDBz8gv8pGDSnr8edtvO9pckHqh0B74T1DHmC866LyApLI5cXiY+WQaad:EEq0zeDO6qo6S1U/s2GebpKl/ye0Y
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

kalorimetre.txt

SHA256 f0b7e7c37febb52da54857b426ad1ab108900566c37af33f593694ce75a4bbb6
MD5 d4ddaf63b28e0ebaaa4dfe92e98e5a5a
SHA1 a2b5d092e93f0f187b2f7eb91ed39f49e93407b0
SHA512 5ae54925a06da3fcd7f3286cee179cfbd964cc9d90fdeee95ad5ce1ce73a133f26943cfb8b6e84a4d97914911a466b1dbb0d5c38b7931a495100e733bf61d157
MD5 SHA1 SHA512

NSIS installer

installer

klehusene.txt

SHA256 c98c81ce34dde1f66ce0c88166f1d4f4af04f6d6b61d40cb914ab5605c9aefa3
MD5 73e626bbcd6899df339d641d9ac4c7b2
SHA1 60dbe77ef06e8d73f25280a2a2512ad6b5472ddb
SHA512 4381efbc1d655123b49810f23341d0a87f1d1fef6170324a1f628da707e9bbe4d77937858ae14a087ada346e62cedf5a22c0f009f70d5b3e84075ae8a741697d
MD5 SHA1 SHA512

NSIS installer

installer

potenseredes.txt

SHA256 9c18f84e4a5672f4f4124118dd933040736d512045f266bfa2d4c61fb4dc20b9
MD5 5d6517100585c761dc0269c584763458
SHA1 45fe89a90d68cb966be1b6744303bc873b765a77
SHA512 7aa2d3579a78a21623383c3bdd33a4816747e3236c6a2535dab30717a35d929f8325e150dfa48a9c8ed8517af10efa62ef3f309adf9f562de8addf5e57263a6c
MD5 SHA1 SHA512

NSIS installer

installer

8fa0116efbd18a4d7be8be0aae4bdabae5934e86d923f5db6bb8ef3a916b3101.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/nsExec.dll

kernel32

user32

advapi32

generic

Bosteder5.soc

Filstruktur.txt

Frigidaire.Smu

Omstemmendes/radrense.txt

Omstemmendes/undergivelsens.ini

Phonetist.rep

copaline.unc

destemper.txt

ferske.kap

kalorimetre.txt

klehusene.txt

potenseredes.txt

Sharing

General

Malware Config

Signatures

File Explorer

8fa0116efbd18a4d7be8be0aae4bdabae5934e86d923f5db6bb8ef3a916b3101.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/nsExec.dll

kernel32

user32

advapi32

generic

Bosteder5.soc

Filstruktur.txt

Frigidaire.Smu

Omstemmendes/radrense.txt

Omstemmendes/undergivelsens.ini

Phonetist.rep

copaline.unc

destemper.txt

ferske.kap

kalorimetre.txt

klehusene.txt

potenseredes.txt