e7a36fadad357adadb8a4135a3294fbb42de472adbb573c20fa7f7efc6c0e921[.]exe

resource
unpack001/$PLUGINSDIR/nsExec.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

e7a36fadad357adadb8a4135a3294fbb42de472adbb573c20fa7f7efc6c0e921.exe

IMPHASH e160ef8e55bb9d162da4e266afd9eef3
SHA256 e7a36fadad357adadb8a4135a3294fbb42de472adbb573c20fa7f7efc6c0e921
MD5 ed8fb567b8dbdd912221f3b9668ebd22
SHA1 955348abd953e80ee7769975b7c75cc858986366
SHA512 338947b43dd6ff207ffb3131235ad8007be7bd631604b9aa8aac6f5ec9d32afa90fc4cee7f274c77081178df0334355abdac881f884c05c1d666e0b9c9367fe2
SSDEEP 12288:vQeEJFJYJbJPeJyxJxWJiJfJcJWJSJaJ2J/JSJFJ8JjJcJHJQJoXJSJAhwjJTJZe:jEJFJYJbJPeJyxJxWJiJfJcJWJSJaJ2m
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

53:aa:c6:54:f3:dd:09:9d:bb:07:b4:c1:26:70:37:15:61:67:d7:04:da:f1:dd:cc:c5:76:6f:f3:69:ec:0c:64

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Timm,OU=Chetvert Smdedes\ ,O=Timm,L=Rochester,ST=New York,C=US,1.2.840.113549.1.9.1=#0c1d556e6465727072657061726564405265616e6f696e746d656e742e4973

Chains

Mar 7, 2025

Minor OS version

0

Major OS version

4

Entry point

12472

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetTickCount GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA SearchPathA GetShortPathNameA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess SetEnvironmentVariableA GetWindowsDirectoryA GetTempPathA Sleep CloseHandle LoadLibraryA lstrlenA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA ReadFile lstrcpyA lstrcatA GetSystemDirectoryA GetVersion GetProcAddress GlobalAlloc CompareFileTime SetFileTime ExpandEnvironmentStringsA lstrcmpiA lstrcmpA WaitForSingleObject GlobalFree GetExitCodeProcess GetModuleHandleA SetErrorMode GetCommandLineA LoadLibraryExA FindFirstFileA FindNextFileA DeleteFileA SetFilePointer WriteFile FindClose WritePrivateProfileStringA MultiByteToWideChar MulDiv GetPrivateProfileStringA FreeLibrary

user32

CreateWindowExA EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard GetDC SystemParametersInfoA RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx DestroyWindow CreateDialogParamA SetTimer GetDlgItem wsprintfA SetForegroundWindow ShowWindow IsWindow LoadImageA SetWindowLongA SetClipboardData EmptyClipboard OpenClipboard EndPaint PostQuitMessage FindWindowExA SendMessageTimeoutA SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA

advapi32

RegCloseKey RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegEnumValueA RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

CoCreateInstance CoTaskMemFree OleInitialize OleUninitialize

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/nsExec.dll

IMPHASH 6b7d154c806f1e47db325229c300c6df
SHA256 cd8496a3802378391ec425dec424a14f5d30e242f192ec4eb022d767f9a2480f
MD5 51e63a9c5d6d230ef1c421b2eccd45dc
SHA1 c499cdad5c613d71ed3f7e93360f1bbc5748c45d
SHA512 c23d713c3c834b3397c2a199490aed28f28d21f5781205c24df5e1e32365985c8a55be58f06979df09222740ffa51f4da764ebc3d912cd0c9d56ab6a33cab522
SSDEEP 96:W7GUaYNwCLuGFctpiKFlYJ8hH4RVHpwdEeY3kRlDr6dMqqyVgN738:Iygp3FcHi0xhYMR8dMqJVgN
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4231

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Brnaba.txt

SHA256 16fddf0d82aa1263194fe7c92459a6cf21dddb1f1ae5a4e5a099865db126614f
MD5 aced15fd55d311d663ecc7b5f386b8e2
SHA1 a7f36fd33206209cb0e5e39643ec8c6773d5ed3b
SHA512 7f27a00eda246719e5f8fa521ac9499002dfdb36f6e661e13797c863520d84d14f43b5f717b176bbbefcb4b62b671a14292c59df288c55628ca08868bbccfbd3
MD5 SHA1 SHA512

NSIS installer

installer

Kaldesignalerne.Asq

SHA256 9cfab18a39cbbdd3313a5b09560bdb8e15fe68125670b04b28a70429547ed4ac
MD5 426a48fa1ac5d0c6614e919230a165cc
SHA1 ac690dfdc70747a952236f0cb0637fb909d25024
SHA512 73b865f83f52a54c925392165673846c12caa0632db4e9e8ef64af5e80fca4326c46c095138cdddca1dcf6c53c10f721a33d84c8b44e6b620cbab766936cd415
SSDEEP 6144:zbu+LkH+aSph4VIQvB0tz2F0RlS8vBT2Eshj3i2aJMiNSR9o8/73YqZ7nX:1cSuj+z2F0Rppxshj34J9IX3nZbX
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Krblings.Udp

SHA256 9d73643cf485e0534e1cdf7c403fb1dfc1b369f3e0e5ffe0bce1fd2059b5e02b
MD5 9837b7fc04059d1fd370965105f814a2
SHA1 4bd4fb6d110d4b4ed57528dcc6ff1fcc973d9215
SHA512 6b549ef5d4bb64c74a29725019a5d268fc83de4046e2222fcd0ee63c4472bbd4fb7b487b271808747ea50208764a42acd41882098f186e55f2e0084e63871e65
SSDEEP 1536:cjm9OipO/0S70WFhbShNcAeaKYM19ZUO2zT2lu:c695E86/AlKYq9ncT2lu
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Unloveliest183.jpg

SHA256 2cb79365771956854acead63102b019737f5c99a5a10da94d2969638cc23e825
MD5 f32b2f6007a74312b5f0cb1aa5b26680
SHA1 bc3dc7eb50efa53ce2fc46a32c5f995048bd85b3
SHA512 ebe3120e79d07f3d1d775940adf00e099afd6f3273d49c2d600fee1ace2c175c9e01cbe9eb3d83ef7d033f129c5d562983f19b1d7cd327763a92e9a246eb94f3
SSDEEP 192:LqBD2cMKYD6M3QJxtEns0OU16nK3HXJ2UgU:eBDnM6MgDtEEUknqYUL
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

blinkenberg.txt

SHA256 fa760065782306b4b9e082086166d25eada402a3332c771c48f4ede9d5dc7e53
MD5 2b51e420aa9188a74db9d853c1225b5c
SHA1 b1aa913bbe9c576f1c7917ae2e18f4f5c4b54164
SHA512 574581b87211289cc809f0bf97e968e5bc070c95b20e92adc4315404a3e632754291bbe3b3af1894441855bd25c797ff52adf968dc0a73f710f199017caf37e6
MD5 SHA1 SHA512

NSIS installer

installer

fllesbrn.txt

SHA256 fcd285bff12244da3cf356243beaceb8db8b2868320d371d1059408ad02a0caa
MD5 6620e9c5c35f1feaafc525a49ff31080
SHA1 969ab64f04bcdcab9088f1f2fa6a8209db33e8fd
SHA512 a3238fd4843c3407cd07c014444f2557d7064f53a074f58be97230a7cc7d81e0c7d09dd25b9110c5568466e2f9aa10eb11129ed143e07f63763eb5fe3da75ed9
MD5 SHA1 SHA512

NSIS installer

installer

sensible.jpg

SHA256 6d1974e15c49647f2ba907d7d233cb04d2f9d9c77cfb6b4255b577fe95d54b19
MD5 86647e5bc7c82f155c5cb0ec05f40e9f
SHA1 e0946f26733aa05fceae067377622c083af88c8d
SHA512 7c812d119382c9135195ddd18106fc6b465982d36c7815680c52de2c0a40dc8e569ffbf32e87af8ba10a71670a01cab30d0d36ce49db599473ec10cdaceff992
SSDEEP 768:6+UnjpGM4h/Q0kf7jWCXOi/vWYjc/Gv33xxMatfqxi/fftvoEP:6+UjpB4K0kjjWKOi/vWYjOUHXtfqAXvP
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

e7a36fadad357adadb8a4135a3294fbb42de472adbb573c20fa7f7efc6c0e921.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/nsExec.dll

kernel32

user32

advapi32

generic

Brnaba.txt

Kaldesignalerne.Asq

Krblings.Udp

Unloveliest183.jpg

blinkenberg.txt

fllesbrn.txt

sensible.jpg

Sharing

General

Malware Config

Signatures

File Explorer

e7a36fadad357adadb8a4135a3294fbb42de472adbb573c20fa7f7efc6c0e921.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/nsExec.dll

kernel32

user32

advapi32

generic

Brnaba.txt

Kaldesignalerne.Asq

Krblings.Udp

Unloveliest183.jpg

blinkenberg.txt

fllesbrn.txt

sensible.jpg