32fe770e37884a2ac6c7b1e58f7d201a74326bae4fd9be175a863d595d2b5e64[.]exe

resource
32fe770e37884a2ac6c7b1e58f7d201a74326bae4fd9be175a863d595d2b5e64.exe
unpack001/$PLUGINSDIR/nsExec.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

32fe770e37884a2ac6c7b1e58f7d201a74326bae4fd9be175a863d595d2b5e64.exe

IMPHASH b78ecf47c0a3e24a6f4af114e2d1f5de
SHA256 32fe770e37884a2ac6c7b1e58f7d201a74326bae4fd9be175a863d595d2b5e64
MD5 18a1223e31bae0f76993e5d1cd9531f6
SHA1 e7725a65b8f5952b9bdf52a0fd12d8fb96fa0df4
SHA512 932e4c297a55e1e9534ecf7efe74b6373a2a52bc34b71da681de08be5e57be24f3a4168c79f189c4d5dbd1b77282f2e17e6a7e24cfd47596c60761dcc5b19cfb
SSDEEP 12288:b9jwVqaTirDOOiPtV7VxjkE0jv2oi7Kf/MQCQNf:b9jiOWtvxjkEovYKMQC8
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12505

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetEnvironmentVariableA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA GetFileAttributesA SetFileAttributesA GetWindowsDirectoryA GetTempPathA GetCommandLineA lstrlenA GetVersion SetErrorMode lstrcpynA ExitProcess GetFullPathNameA GlobalLock CreateThread GetLastError CreateDirectoryA CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA ReadFile WriteFile lstrcpyA MoveFileExA lstrcatA GetSystemDirectoryA GetProcAddress CloseHandle SetCurrentDirectoryA MoveFileA CompareFileTime GetShortPathNameA SearchPathA lstrcmpiA SetFileTime lstrcmpA ExpandEnvironmentStringsA GlobalUnlock GetDiskFreeSpaceA GlobalFree FindFirstFileA FindNextFileA DeleteFileA SetFilePointer GetPrivateProfileStringA FindClose MultiByteToWideChar FreeLibrary MulDiv WritePrivateProfileStringA LoadLibraryExA GetModuleHandleA GetExitCodeProcess WaitForSingleObject GlobalAlloc

user32

ScreenToClient GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard PostQuitMessage GetWindowRect EnableMenuItem CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndDialog RegisterClassA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx GetDC CreateDialogParamA SetTimer GetDlgItem SetWindowLongA SetForegroundWindow LoadImageA IsWindow SendMessageTimeoutA FindWindowExA OpenClipboard TrackPopupMenu AppendMenuA EndPaint DestroyWindow wsprintfA ShowWindow SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA

advapi32

RegDeleteKeyA SetFileSecurityA OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges RegOpenKeyExA RegEnumValueA RegDeleteValueA RegCloseKey RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/nsExec.dll

IMPHASH 46f8b6973f33717335c0f6d8087de67b
SHA256 7fafaf28fa6eb7604c61ef816cdd3e5097a0e17695bef0bf9116b6558aa68967
MD5 ae164b9dd3591a987b0d71dc255c4654
SHA1 41198cb28a31a0ffc3d14540e61a4840800681cc
SHA512 57fad70b175fa4f1a525fe413c8bcd87cd66b97053056c91ca912e6796ad19cc613437f49c52adf5ca20c2c54f4c0ef2a41df50cfabe0645de7e6016b5cd05f6
SSDEEP 96:kD7GUxNkO6GR0t9GKKr1Zd8NHYVVHp4dEeY3kRnHdMqqyVgNe43e:kPXhHR0aTQN4gRHdMqJVgNef
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4231

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Barothermogram.Upr

SHA256 056f551f53fbc53b8cdff908b1ec964a889380c9f32a17d716f74648530e7849
MD5 8d8d04ee075c2f13f0271c8cc25daaae
SHA1 5ada5f61d91f3839dacfb4f325b272d762e5eff5
SHA512 b34d171d199a44c44b9343c32b79e7a3c229363a72c808c5a5f6b0396c0b5dceafbd05b514dd3993d2b2063f184671745acd06db4ee3ced1826af4062cbb4126
SSDEEP 1536:+AJNh/1faPGhz3Qd90wRtY7TXKWcpq1JudXllg:NxNmk3Qd9JY36WFX
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Bosteder5.soc

SHA256 663b4e1b70d0572ca79034a955e81e0a5d4e52a836d7ac1026fbe17cc2be9f0d
MD5 7af79e0608deb4f46e746b5fbd6908a5
SHA1 99d4efb9b81607be7dda20d6fb02342e5bd4b86b
SHA512 d5fca91e37258c807da1a793cf5f23a51c198af36e7df166dd04221c9e272ecfa9aab8db067539d7c0889d82c45b98bfa722d686b092376bc2fef21078e243be
SSDEEP 768:2f3EqX0OrPTBy+CNIgFEe2wY5vTl2gZF96H/fvatJW+xc:2fnrrofD27552m6cEmc
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Filstruktur.txt

SHA256 eb5686b63dfec371a5eff96338aa45d48d24bb6191fc4a71265ff3d3eecd3ab0
MD5 14b2ba6b25c5154bbe98c4bb4cf8e012
SHA1 fa3fd2c0b8a357a0ea6c64f2adfe572ca34f9b71
SHA512 bb209f68a4541ae4861c1601e5fb063e6a3f39774e7d26249239c696a477e1d0efaf890a5d84eb6e4d9686d81cb69c83978634da24bf558fffe65735ed0e3978
MD5 SHA1 SHA512

NSIS installer

installer

Udvidende129/Grnsalte/undergivelsens.ini

SHA256 43ac7b5a05027dd9639e635a8e8f6f6637063171f773de8602aacd8466efb0c5
MD5 b76c3b1a86ddbe87a853d54df73ad611
SHA1 77514c61877ad3985d15c02bf05090a382ef8370
SHA512 6984b7e7606725e08be46a6addc59b5001691c7459fea25d310fe4213772648f0b4bbed1eaa6ab6f1f3ef5c2da2d26ff38466a4a5f2a7bd469db224fa766ed7a
MD5 SHA1 SHA512

NSIS installer

installer

Udvidende129/potenseredes.txt

SHA256 9c18f84e4a5672f4f4124118dd933040736d512045f266bfa2d4c61fb4dc20b9
MD5 5d6517100585c761dc0269c584763458
SHA1 45fe89a90d68cb966be1b6744303bc873b765a77
SHA512 7aa2d3579a78a21623383c3bdd33a4816747e3236c6a2535dab30717a35d929f8325e150dfa48a9c8ed8517af10efa62ef3f309adf9f562de8addf5e57263a6c
MD5 SHA1 SHA512

NSIS installer

installer

Udvidende129/radrense.txt

SHA256 db3f81b326cf0dcf5d8a38e867bbf368959d4f67c27dc39c596a3c6f4b69065e
MD5 e88351a7652507319b2ce3f5eb17e867
SHA1 d3fcf4c26066593f89f3515298c62a80d0efb491
SHA512 d21653240f23a3bd2406f2811fa3c57bb417282b4c19988202191316be87fe677b6319f9d1117740f7e3743eee0447ade84746d2e66674f2c30730838f9eb42e
MD5 SHA1 SHA512

NSIS installer

installer

copaline.unc

SHA256 8f33936bd5da93b03c85282354f2c2736d3c2407f25799a72b6eb5529136f873
MD5 c57ad1cb17546065d4e8bcae0d6bbf73
SHA1 231129e90ba890ba58ea905b99879ae8d1d91f33
SHA512 0ebe93c5a43c14b4f6af121a5e9b00fb1b4c4658dd1c36454fed66b5ccc025a1a9c5c2acd1fb7c72893553b868a0f5e11564330748eca49699f5a0641edecd3e
SSDEEP 768:kBhC9+hFUXqgZsLTW9+JnHcTq8SFSXyqQ7Tep1uxuJBr8xgFg0DAti1MQOpNWl2w:e0xnlitI7f5QnE
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

destemper.txt

SHA256 83aa86a26954217cca633fe71a892993880684df10df0de50f93777062b3cc7f
MD5 1a41fbfe561273dcfb46b9a0fa9baf8f
SHA1 82e4f5dc604eb4cb66b9379a83ebcee3891a1783
SHA512 748da99d7e9665da5a539f97cbe0001fddd679402d75af9187d6eb07c5cd27b1d9597a7b0f1bc63ecb5fb339c7d1829d40466579f34e187c172ac182f15a0f2d
MD5 SHA1 SHA512

NSIS installer

installer

ferske.kap

SHA256 cfce78811bc6ea4f2332631b8af5bf276df663eda7015e9da06b4fa403f2189c
MD5 f8f28aba451155d4c507db59c34c3ee2
SHA1 be654672563cf98e0070e34164a30b05d9d7d781
SHA512 fdc9c337d0a0339e81b97a906a51d91318762a8406f75ed3275124d77c3031af15c8777091dc27498dd403a85e7307d6536a6fe86c2ace7edb550c71ad2488ff
SSDEEP 768:EEHKj+VfDBz8gv8pGDSnr8edtvO9pckHqh0B74T1DHmC866LyApLI5cXiY+WQaad:EEq0zeDO6qo6S1U/s2GebpKl/ye0Y
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

kalorimetre.txt

SHA256 f0b7e7c37febb52da54857b426ad1ab108900566c37af33f593694ce75a4bbb6
MD5 d4ddaf63b28e0ebaaa4dfe92e98e5a5a
SHA1 a2b5d092e93f0f187b2f7eb91ed39f49e93407b0
SHA512 5ae54925a06da3fcd7f3286cee179cfbd964cc9d90fdeee95ad5ce1ce73a133f26943cfb8b6e84a4d97914911a466b1dbb0d5c38b7931a495100e733bf61d157
MD5 SHA1 SHA512

NSIS installer

installer

klehusene.txt

SHA256 c98c81ce34dde1f66ce0c88166f1d4f4af04f6d6b61d40cb914ab5605c9aefa3
MD5 73e626bbcd6899df339d641d9ac4c7b2
SHA1 60dbe77ef06e8d73f25280a2a2512ad6b5472ddb
SHA512 4381efbc1d655123b49810f23341d0a87f1d1fef6170324a1f628da707e9bbe4d77937858ae14a087ada346e62cedf5a22c0f009f70d5b3e84075ae8a741697d
MD5 SHA1 SHA512

NSIS installer

installer

snefnugs.Syt

SHA256 133f4d4a021471dd0d85890c53f742ea1ce898aba1bf7c5086c51433de5faa08
MD5 d23247c9435e3254dda4a66afacbefe9
SHA1 8d4e2692142a751d6faddce704f025e36ef4f8a9
SHA512 081e3397ce79115a2890e3c58eee72b348f8db6d90b712c97b2f73548918a2a0f6b6e8aee05356a133c2d3de0c061d1d69be1196d360bce16f77e8d53b4e0661
SSDEEP 6144:rPM0eCHPMtKpbWMzHOdKZqwZ5XTozzkaRYus9dlZkMzU73bZMmhEpU:RLHPnWuudWPQzzY7lZky43bopU
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

32fe770e37884a2ac6c7b1e58f7d201a74326bae4fd9be175a863d595d2b5e64.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/nsExec.dll

kernel32

user32

advapi32

generic

Barothermogram.Upr

Bosteder5.soc

Filstruktur.txt

Udvidende129/Grnsalte/undergivelsens.ini

Udvidende129/potenseredes.txt

Udvidende129/radrense.txt

copaline.unc

destemper.txt

ferske.kap

kalorimetre.txt

klehusene.txt

snefnugs.Syt

Sharing

General

Malware Config

Signatures

File Explorer

32fe770e37884a2ac6c7b1e58f7d201a74326bae4fd9be175a863d595d2b5e64.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/nsExec.dll

kernel32

user32

advapi32

generic

Barothermogram.Upr

Bosteder5.soc

Filstruktur.txt

Udvidende129/Grnsalte/undergivelsens.ini

Udvidende129/potenseredes.txt

Udvidende129/radrense.txt

copaline.unc

destemper.txt

ferske.kap

kalorimetre.txt

klehusene.txt

snefnugs.Syt