DZ__0002[.]EXE[.]exe

resource
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll

resource
DZ__0002.EXE.exe

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

DZ__0002.EXE.exe

IMPHASH 3abe302b6d9a1256e6a915429af4ffd2
SHA256 e715ca77bca80baec611ba2f5982ce26a52211523f2db2115165e593b65ff6ef
MD5 3411fb6f74583251ac0f556d10d80fba
SHA1 87a1f01f1a44eaa39401f1d4e82b5dc6206d728f
SHA512 4063e792d0216ff9c394f2fbcabf11a8216eced6cf637800400aa81bb4089d04b6e475d83e5c2a2ae8a2aa20bd5ae79ed6c4a3b1d7a0cb7a11392d5dc3b9e06c
SSDEEP 24576:4zHGYjwFi+5iRK68N+myIwFWmrEECmcIQVtNT7C:4J8lYRKv+rtWUEEdQTNa
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned binary was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

9b:43:b4:a9:0b:b2:0a:5e:e6:d0:82:3b:4f:cb:3e:30:c5:f0:02:d2:82:ee:1f:fa:13:e8:4c:cd:17:79:c3:4b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Undergruppen,OU=Biporous Chilipebernes\ ,O=Undergruppen,L=Clarilaw,ST=England,C=GB

Chains

Sep 25, 2025

Minor OS version

0

Major OS version

4

Entry point

12812

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetTempPathA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess SetEnvironmentVariableA Sleep GetTickCount GetCommandLineA lstrlenA GetVersion SetErrorMode lstrcpynA GetDiskFreeSpaceA GlobalUnlock GetWindowsDirectoryA SetCurrentDirectoryA GetLastError CreateDirectoryA CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA ReadFile WriteFile lstrcpyA MoveFileExA lstrcatA GetSystemDirectoryA GetProcAddress GetExitCodeProcess WaitForSingleObject CompareFileTime SetFileAttributesA GetFileAttributesA GetShortPathNameA MoveFileA GetFullPathNameA SetFileTime SearchPathA CloseHandle lstrcmpiA CreateThread GlobalLock lstrcmpA FindFirstFileA FindNextFileA DeleteFileA SetFilePointer GetPrivateProfileStringA FindClose MultiByteToWideChar FreeLibrary MulDiv WritePrivateProfileStringA LoadLibraryExA GetModuleHandleA GlobalAlloc GlobalFree ExpandEnvironmentStringsA

user32

ScreenToClient GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard PostQuitMessage GetWindowRect EnableMenuItem CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndDialog RegisterClassA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx GetDC CreateDialogParamA SetTimer GetDlgItem SetWindowLongA SetForegroundWindow LoadImageA IsWindow SendMessageTimeoutA FindWindowExA OpenClipboard TrackPopupMenu AppendMenuA EndPaint DestroyWindow wsprintfA ShowWindow SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation ShellExecuteExA SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA SHFileOperationA

advapi32

AdjustTokenPrivileges RegCreateKeyExA RegOpenKeyExA SetFileSecurityA OpenProcessToken LookupPrivilegeValueA RegEnumValueA RegDeleteKeyA RegDeleteValueA RegCloseKey RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/System.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 a1390a78533c47e55cc364e97af431117126d04a7faed49390210ea3e89dd0e1
MD5 fbe295e5a1acfbd0a6271898f885fe6a
SHA1 d6d205922e61635472efb13c2bb92c9ac6cb96da
SHA512 2cb596971e504eaf1ce8e3f09719ebfb3f6234cea5ca7b0d33ec7500832ff4b97ec2bbe15a1fbf7e6a5b02c59db824092b9562cd8991f4d027feab6fd3177b06
SSDEEP 192:yPtkiQJr7V9r3Ftr87NfwXQ6whlgi62V7i77blbTc4DI:N7Vxr8IgLgi3sVc4
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10465

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsDialogs.dll

IMPHASH ebc2d915841be8afc8fa1ee9f6850960
SHA256 3cdf3e24c87666ed5c582b8b028c01ee6ac16d5a9b8d8d684ae67605376786ea
MD5 ab101f38562c8545a641e95172c354b4
SHA1 ec47ac5449f6ee4b14f6dd7ddde841a3e723e567
SHA512 72d4b6dc439f40b7d68b03353a748fc3ad7ed10b0401741c5030705d9b1adef856406075e9ce4f1a08e4345a16e1c759f636c38ad92a57ef369867a9533b7037
SSDEEP 96:o3W4JlD3c151V1gQoE8cxM2DjDf3GEst+Nt+jvcx4K8qndYv0PLE:o3p3ggQF8REskpxZdO0PLE
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

7513

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Dumpings.Dep

SHA256 21a396be0b2c8825f921e440c038868a4abea8a3b9d3ce772040f0089f76b227
MD5 81829ed229dbaf3cf05305eccf155784
SHA1 5f4ad13d08783a722c40e124c75776e1ddf8de3e
SHA512 7d3a750d5477fa45234b3be6ec484bd222ee6afc745b394a72e1442cfcc547f060e5fe67eae616935d235f1d1246100d30434eb7936ba7f9d2c35fb9a0abcb2f
SSDEEP 12288:0/sHNwSQrEC/d78TA8Q22wlaKoDdNabOdpIX9lm:0/sKLEC/d7F8J2wkTRobOrItlm
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Folkekulturens/Analysemodels/Invalideforsikring.rot

SHA256 ab492cf242807be7b4e5ba10a703ff3dbf3906d55176ce60715c7c1ac43ea949
MD5 527baa0410d81990dc232f2ab402ef62
SHA1 090397fb41d431f800e6dd51b42fec8da5fd6e40
SHA512 2904969658cd89743b1f59064ec8cba97c307c9dab7b2dabbf714503d7bc318445506c433338f6c441cc9c8ba5620d7571486f1c29e4b79c73dc1381af48cfb9
SSDEEP 384:daWU5AgJIFybRyAfIcqcr0eC8jmpMM8nUjj3fsd0kSVVTMhDDONg14qdR55k5qVI:bvuU
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Folkekulturens/Analysemodels/Mikrocomputeres202.txt

SHA256 a7679e52fded36aae09b22aadd085279241a5a0ab80918e6713fb5f3992ba1f0
MD5 f1ebfee3da1e94c4f51400c2e4f08e90
SHA1 2d11f2913b254b9ad2c8873f9697aca9c651b97c
SHA512 22e7cac8779f421a876aad23bbbf6f8dce295088eae7242911dafed34d784eecba7a6cd929292651939cfb272f876677b2949a4329470411d9f6acfa752fa799
MD5 SHA1 SHA512

NSIS installer

installer

Folkekulturens/Analysemodels/Recreantness156.txt

SHA256 abe3cc26a2e5d7a0602a2da4cb7c1842e6dbb4f2f98542d91ddf0652357b3a25
MD5 17cbfaf6c88fc3a85de72b2c1481c428
SHA1 30afd7a70350d6620f5e2844ba0d0c386f7f56d3
SHA512 34c146d6d3d276901b0f687d2920f2483fc279c92b39d796f84a729f0e534475412431f22aa1c162de9da09a9da93a6922c5c8e864c5b6e0891eef9c058cfdc8
MD5 SHA1 SHA512

NSIS installer

installer

Folkekulturens/Analysemodels/fremskyndende.ini

SHA256 ad33a6cdc9c9eccf3fc49a33cf7afad6981dd682b81944e57cdcfb38639d0bee
MD5 3785229d9e3163f588f4518b7ad4b719
SHA1 aa56ad41ee2110f5fa7d8969f094bfbdfadc03d3
SHA512 7852221cc4d28e41cdfe5ed0520e673f3048ca0ae95a840b75aee68c97f0a4cd80b65b79094b7f0585eb6aa76e2052bd1ced58533ed4e0911a2e8ea10831ab7d
MD5 SHA1 SHA512

NSIS installer

installer

Folkekulturens/Micklemote.Per

SHA256 187bdc8fb471e01b420ac39f2afd3b9868f0e63288bf1a93d8b598418d60dda1
MD5 c52e8b4e05c6088e55ef37d5c50b68f5
SHA1 417f4e99fea7383e1d12e7acf5092a7d60d62d51
SHA512 f9a4ee67729e3505979128bee182c2a32cb4abcb403f538873cbe7bd16454a8dd973845b28446f181c69cba70ace6023448e5496299d2b5d513d1ea8e9816fde
SSDEEP 384:U6KBfn4N64dDYI/2kSJR06gHkDoLJIHW9knNGZ7aiOwj5VG4w4ETSvruX0tIbt08:KfEH/MGyuKSYxs4
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

forvildede/Claudias/verdensrekord.ung

SHA256 c66027d36c8c19eefabc7075809cf5f4114002f86361275122c05681a8f0fe92
MD5 3a8b7b71ec5372e859b5c195cf06f2b0
SHA1 033579d2a9bd0be2db556bb11a715f07de648fe6
SHA512 f06945d38f889017d929084d9eeb41534590493c789e3759fb8864960bc7b34cce1f2d4910915b48ad0a823a37648fe2e5939b76c224856362561fd71859a843
SSDEEP 6144:2uQIiOCOaoasVoYgGoSpJA/VUqXXPY6Pe+5Iz4QB1VtgfuFR4N3y3qcquSjKicSq:Z
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

forvildede/gunrunner.txt

SHA256 f45bdd21d02ac34ba7ae46178e1a4009045d0634bef4ea24baae081c64e29031
MD5 8faea289eb6cdefd3de2b47554bb27b6
SHA1 dad1bb7534ac1cb230c29d364239fb63f3414c1b
SHA512 cfddb60fed8b45f27bbd99c30cf62a9079e553b7c65d342b7df51e89505a19cb19c540121e715fdaa8d6a1dd6eb62dfaa06d75db41ce72990132dca5f0b88b6a
MD5 SHA1 SHA512

NSIS installer

installer

forvildede/midtfarvands.rha

SHA256 2438ad775e839ab928916424bfa3adb96deccd089993500b8f1d5fd86551107d
MD5 e094767ba5ddeba6729cd291881f8b62
SHA1 50583288eeb9bfd55e28dfc34dc7f87e375eaacb
SHA512 bc102fd04b8364511bedd9c209fbd1c2bb0b16e187d9b4c851b68582aeda4e08c85149ede24d9d1859165a12cca2557b82fc1ad0a2d53efd971ffb086dd8faef
SSDEEP 24576:28epO9gql9VAZD1nLvm3k+5+yCM7b63zfYOmIqafurjqoGcSts2dnGocPFc7HXv+:L
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

forvildede/recurrent.ini

SHA256 dc411c97d7af8c1dd10073bb02d4ea8a5b69eab6d6ec1a43ce45acd1003c8924
MD5 2dfd0ec97a5065ed340eaf075772fc2f
SHA1 e537548715356a7530a0b80fec06a4dc4282863f
SHA512 3d0646da4f7e514e446b4fe7fc8490de942fa678166a26fee12516d606b480a2bed86f8f28b1118040a563103917cf28a54712ffc00c5031ed5c82f6589e6c81
MD5 SHA1 SHA512

NSIS installer

installer

forvildede/skobrstnings.ini

SHA256 8208718a87a53785d6eeea51a7b7c6f354793798c54cafd403cb91aedfa410bb
MD5 7eee312fa1b045db83e0b11480492ab8
SHA1 c2bd45b0353741c44751181a38e177fa093e264a
SHA512 04d230523233954baca99e0e2d311322718097e1c491baa4ec026e91b1ac9993b328632896f2578514f9c7aa9407a8bd3aa3661ffa71b13dbb25f6cee9938bbf
MD5 SHA1 SHA512

NSIS installer

installer

forvildede/ununifiable.ers

SHA256 74b7bddd4072754151df732b9f8b915c6b5bf3d1f57f9da57a7a81430ca8e291
MD5 8f3b8289a73aa72b68711bcea7be64dd
SHA1 84e903b930ee84746e2d9fc9ba022d3d0c7e0093
SHA512 fdd22afbf69e6c948847040aa1e18755b8acbc877be1a039bc62661b46763e87021e68094b2f04ad096759f6415aaab42107d1bdbf4337336e342abeca866e7a
SSDEEP 6144:p8ciuuTNPxArUgAyyzKW7WsGAZkpj49kQrJz5UdR8HdgnZjH6xZFKyjewtABjtDN:UNI
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

DZ__0002.EXE.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

Dumpings.Dep

Folkekulturens/Analysemodels/Invalideforsikring.rot

Folkekulturens/Analysemodels/Mikrocomputeres202.txt

Folkekulturens/Analysemodels/Recreantness156.txt

Folkekulturens/Analysemodels/fremskyndende.ini

Folkekulturens/Micklemote.Per

forvildede/Claudias/verdensrekord.ung

forvildede/gunrunner.txt

forvildede/midtfarvands.rha

forvildede/recurrent.ini

forvildede/skobrstnings.ini

forvildede/ununifiable.ers

Sharing

General

Malware Config

Signatures

File Explorer

DZ__0002.EXE.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

Dumpings.Dep

Folkekulturens/Analysemodels/Invalideforsikring.rot

Folkekulturens/Analysemodels/Mikrocomputeres202.txt

Folkekulturens/Analysemodels/Recreantness156.txt

Folkekulturens/Analysemodels/fremskyndende.ini

Folkekulturens/Micklemote.Per

forvildede/Claudias/verdensrekord.ung

forvildede/gunrunner.txt

forvildede/midtfarvands.rha

forvildede/recurrent.ini

forvildede/skobrstnings.ini

forvildede/ununifiable.ers