doc002209025[.]exe

resource
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll

resource
doc002209025.exe

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

doc002209025.exe

IMPHASH 9a16e282eba7cc710070c0586c947693
SHA256 88147aad7aa96d552ff975e54a28a013be2a82510226daf9e5bba144912e8ac3
MD5 f419a6881410fba775cffeda26e4017b
SHA1 532c6eb2fcac8f5f424ae24ca854ccd999f87fe2
SHA512 154923ecf7187ff1280486f8922410e330d4ba38225a378d20e6f5be7e7f5c39a54c39446475145e0d283f45852a8378376e9240373e38255401015286fecc1f
SSDEEP 24576:vu9v6qLY9IEpgXRC3CXe+zmFdyuQsqTom7p0DvM:Kv6qLAVgXQaec7uQ+m764
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned binary was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

a1:4d:d7:00:74:09:77:13:cf:5a:da:02:5b:80:fc:d8:98:5e:b5:21:f7:8c:74:1e:76:ff:b9:dc:59:7c:90:19

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Litigationist,OU=Chaquetas Niveauforskellene\ ,O=Litigationist,L=Dampniat,ST=Nouvelle-Aquitaine,C=FR

Chains

Sep 25, 2025

PE Signature issue

Digest

cc:a4:77:0d:d9:36:63:e4:58:34:1c:d1:63:cd:5e:68:de:fb:3f:5e

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Litigationist,OU=Chaquetas Niveauforskellene\ ,O=Litigationist,L=Dampniat,ST=Nouvelle-Aquitaine,C=FR

Chains

Sep 25, 2025

Minor OS version

0

Major OS version

4

Entry point

13277

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueA RegEnumKeyA RegQueryValueExA RegSetValueExA RegCloseKey RegDeleteValueA RegDeleteKeyA AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken RegOpenKeyExA RegCreateKeyExA

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA SHFileOperationA ShellExecuteExA

ole32

OleUninitialize OleInitialize IIDFromString CoCreateInstance CoTaskMemFree

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create

user32

SetDlgItemTextA GetSystemMetrics CreatePopupMenu AppendMenuA OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcA GetMessagePos CheckDlgButton LoadCursorA SetCursor GetSysColor SetWindowPos GetWindowLongA IsWindowEnabled SetClassLongA GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassA SystemParametersInfoA CreateWindowExA GetDlgItemTextA DialogBoxParamA CharNextA ExitWindowsEx DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow ShowWindow wsprintfA SendMessageTimeoutA FindWindowExA IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint MessageBoxIndirectA CharPrevA PeekMessageA GetClassInfoA DispatchMessageA TrackPopupMenu

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor

kernel32

CreateFileA GetTempFileNameA ReadFile RemoveDirectoryA CreateProcessA CreateDirectoryA CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceA lstrcpynA SetErrorMode GetVersionExA lstrlenA GetCommandLineA GetTempPathA GetWindowsDirectoryA SetEnvironmentVariableA WriteFile CopyFileA GetCurrentProcess GetModuleFileNameA GetLastError GetFileSize GetTickCount Sleep SetFileAttributesA GetFileAttributesA SetCurrentDirectoryA MoveFileA GetFullPathNameA GetShortPathNameA SearchPathA CompareFileTime SetFileTime CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc GetModuleHandleA LoadLibraryExA FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA MulDiv lstrcpyA MoveFileExA lstrcatA WideCharToMultiByte GetSystemDirectoryA GetProcAddress GetExitCodeProcess WaitForSingleObject ExitProcess

$PLUGINSDIR/System.dll

IMPHASH 240ca92ecc1c291801c451c447e16c12
SHA256 a44ca08afb3f6bafd76aa35c259f3d599fe34f6f49ea5118626c1c1a540b0f03
MD5 81e268e27dbbcadbf116b5a9402195ab
SHA1 bd2b701b2e5e279786e179bceee2dc132a2afc37
SHA512 784115c69df4a6f180efb4d48cf5c6e8c2393b8ce9aa664f192abf5a260984880c668dd0f93564126d2fc718130570c4f6224d1373d73bcb8343f04f6ede25de
SSDEEP 192:VFiQJ77pJp17C8F1A5xjGNxrgFOgb7lrT/d93:97pJp48F2exrg5F/d
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10673

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsDialogs.dll

IMPHASH cfc8bb9e11188db414351d2620c98f39
SHA256 7853be9190489ba84dae8232e9a967cec02d941732cb4137bc9ae6a392e89fb8
MD5 3fbd78c889fa40a2e5567b980c57b7db
SHA1 303564bfa6fd5ab7a65d35ae1cd14a05643b6b5d
SHA512 95ccd599cdacb1128aa35694aa5428f12f50a20d95bb500e9b180b3ab322b1870ae301f77f7ca0e8674c78742a1eb5c82ba3cee05c67d3d961a695563c8c1514
SSDEEP 96:oX7lf7AR1VhrfzBik0cxM2DjDf3GEkniJnifvcx418qndYv0PLE:oXl7wrLBn0REc0JxedO0PLE
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

7513

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Khoums/Bijectively.cov

SHA256 943fb659b7cfa50834cfe5ae90a62cbf1dbe0d59fc80490e29f7985212104399
MD5 7258b58209339f7b900062b8ad282b3e
SHA1 53bf7d2e2867c0767c4737e852f06dbccdf7313c
SHA512 4c03726e593d1715c9857e413a612e5097ac192737f97cfebbe6e7631c576f6f16972e90ea19fa37d8a66f4febfcac5211a20d5c0d1092a494fdcf6ba24cd4f6
SSDEEP 768:tGEc+gTUpnak7nY8Z+ehaZoqNzclA+wxK/c8nB2znotim:B
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Khoums/Kvikslvtermometrenes.pro

SHA256 f2fae98d55d4143e6520e8ff5dc51a1469269cd2510f2b4d563807e7e65c30e1
MD5 894764a9e45f4fcef60d21dd29eb5659
SHA1 d53f20938689756f40a1b6490b163acded449b0a
SHA512 935868bf9714dc49d2f831df75f4d9cfdee12be8b915acc7b4ac31f2594d9a9816cc6b80977c1d6497a95c3d7fa316a951eb549ed57da6d7a9a5b2c7704c4c33
SSDEEP 1536:gLlRDPDyMt507HWpgGO6+VsAN2y1i8m0E3nCVhQhnQXqFpPi8ihn8SNsukiU1vHi:b
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Khoums/Riant.Bat

SHA256 1c90924c67272b9dffe75de4483983c12dde5d70b25d3c3a7b935209fb84fa42
MD5 84576452c833d1823934f6ccd1f714c2
SHA1 87eafd9fb78d18c1dbe5590f9216bbc0e287a076
SHA512 688d5e151e54c4b9bf70c369f3b2fb0f0c79866cb9ce0ee27e60ae74593a73ac8f4f5fb1272e569c9f3389fc0481ff2ef5af601c03f4ea15c991ab73a192b311
SSDEEP 768:UdH6U3ZmgBykwcEko7wRClttTfz9Q8py0z9m/rkf0hQhsih:mCgBMDDVrm6y0zErxQh5h
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Khoums/Vasoganglion132.ini

SHA256 3f72ca4e289d6a5d2572c7990f8e6c1a8c44a247a8764ce6ea868ab771966a90
MD5 24b367d16a1251dda65781925f301e41
SHA1 d87147cc57ff8285d9b61c94f65ca8483b51ba81
SHA512 3a50539c8ab40b3b3b1aa46459bfabec006a617cfab90ea386645d1f022c9236e9a98d50d9414a778fa2f48a2eb52e6f791ff13acf94db2b4206da3d3ef8ef24
MD5 SHA1 SHA512

NSIS installer

installer

Khoums/alkymistiske.ini

SHA256 e6d86f472c44911cd5de61f249bca154f0d713e2aef2ec56e68b6a33f033ce40
MD5 c9d4be0e73d54c07a952376eeb05f43e
SHA1 02fe9ddf838f02716cec9d139b65ac57fedec099
SHA512 296f8ba8a67b239feb0749c2b448daaee1d5194dcd97c0663d1187ac2bfb0d86af6d1b7c87bd088f4942464f099f17ea566be3b64d0753a37f690e943e5d3257
MD5 SHA1 SHA512

NSIS installer

installer

Khoums/anglicism.sne

SHA256 24bf5ad8e162ec2e26e7e82760e6810dab04d27813599232ef6b3f8d48bf99f4
MD5 02e95ed3d5847e325a6ffc4bdbb55396
SHA1 095fddf350dc3c401f0a6ac83b9aa4b4f9306ad3
SHA512 41d69faf1b9511d040a7c69b6f4c1c80611d2ef8e6a9c040267e79b69de89f2fe8ddecf1cca2b2bc7d0dd9f6e488e4eca3ab477d4a3d64649dcb621ebf794e88
SSDEEP 12288:LfsZ7o5ZnaS/WqqsPIyfSCSB4CwP1A5f08qdwQGV2UsFvhx5oSfHQ2pQVNrRnzau:+
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Khoums/choripetalous.ini

SHA256 6b18f436195e77b11eaa0aec2a2dde372952105ea91709ca00cddabd4ed72abe
MD5 a3b9b17fc811ba32ee083d4c3916c3c8
SHA1 d81ae9645644ba08f9297e97fd336b47eb0994d6
SHA512 2260404749224089fb25686ae433570101666c9b1028453aa7a270ab4e8f11a0aefe140ebc9c11ae1b2ee67f3c589b816b6b0004a8e06b9f432d8fc40b90ee89
MD5 SHA1 SHA512

NSIS installer

installer

Khoums/glatkrsel.jpg

SHA256 465395428ab4c42c9cd2f9b0c59b1707e7fac31efacae31715a2847aa57fcbd3
MD5 e58dfecdcfaeaab52a23638e59da9a85
SHA1 28d2d6b87ffb3b71e15d2d35b3eb7d0506db0db7
SHA512 1a17dc902c35883fb6fb98b8f33534a7bc14f45774d9bbad16ca5477249603ca45b28123d8626cbf72f1f38d97ede22501248ee7969ef75d2955925fa20e5634
SSDEEP 384:sKQIxoRDceZiQoIFnSSKt1jWtpGPqsjJKvtHYRm:sZYoRYe4FKIWQFcEm
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Khoums/hemmelige.jpg

SHA256 f8775c02fc892e18a1a3ca1a52513a62d6587d25d5ef1ab47c7e3fba0182c6da
MD5 124f8a2e7151c374ae6929a1fc8b5c65
SHA1 36f046af6bfbe4ae0141d23e6eca7f9e7e021281
SHA512 ad080247c81ebbef3aaf33c97270c5a31fe4bb1a629cc5930862da5f06ffef8e88f8e7e528c0de529b940b546b08f83a10431545c3661e38a05524c796d55f9d
SSDEEP 768:vM76ATpzLFeb+EhZha7+x9hl6sWPNz6yMdTrWoP:U7DpKhZH9hl6s06NTrW+
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Khoums/irrationalizes.ini

SHA256 289e1516a1f0cb2c0300356f0ae760d8fc83b4176e26ecc11d19682455824ab8
MD5 fd476393331695e69b17a874fdf573bd
SHA1 aaa8cc02a94c5996e8976306b869cb49b27229f5
SHA512 3917e67b21eacfba6801bff6f26096c00fdce2ca934b0d36e14a6de858da87c60224c4308e04d4fbe7b38b89700248932e9a63c27146ea90a31270df00f4e38e
MD5 SHA1 SHA512

NSIS installer

installer

Khoums/mesaconic.sob

SHA256 8614fbfa7fcad57d9c314b95c0cf9e7eed54baa457a806b26b8448f9b5af5a2f
MD5 2bc3ec8a83ad650acda602e82623aad1
SHA1 8c62a18b70ec3195c14e844721b578fcc070ce91
SHA512 6a8b493255637d3a8ab88c53827188710833f019d891bd2eb8132787531f619eaeb89c6507e537816aaf0a16e2fc05f4a5f7ed30ae6dc89b488b3d21fda463ff
SSDEEP 6144:wiwPdTdyOmgQfqVIOXHTpYVpLpHnJ/O7/9L9pMJsu+EOc1rebO:1
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Khoums/patter.txt

SHA256 990e3010eb1eb2d7f9c736016d5e2ec4d5af4b5f2f5cb2dbfb9ba5340bb3f334
MD5 14c29aa0b6a1626565b1767778cc7be2
SHA1 09e8f669274da63aa00b35ec395f4a4fa5890a5d
SHA512 c1a6028a355dcd671154d041376d3b3db0606db79a6e1a948e1a3c6a56c457eb3fa70ef245b520a81f9bfb893d81a03bc7da35f4581a54a5f58a766622358fbf
MD5 SHA1 SHA512

NSIS installer

installer

Khoums/sjlehal.jpg

SHA256 2efee78da871e94ce57ecbb0b3c3ce20e8fd08255359427949863d94b3596e59
MD5 5c641d6b1159a2a40bb287a1c2f9bf23
SHA1 3fb7e632dbfc19bfec45b50c226602d9e6535c61
SHA512 5e68682d15faeee75b7f56954aaec66b5e984acc0f2db37401ee1a12b70fe617f5634d418eb36c38945ae4c5edb2ffc27c25217febcc4dc1c650196bfd7f76e3
SSDEEP 3072:4RGdIVfYQ7ut03T23kjIhap7pDwDfYwZ+ySTTP9lmIZws6+T:IGdCLOkT3Ym7p0Df3LAVgLaT
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Khoums/vrelserne.txt

SHA256 479e6b2ab95cf13ba6939ab259ce688bbb8e2ab2875e9a866431e868757a1ab8
MD5 ecf9c96e5263555377b815fb2e80aff2
SHA1 fb39ba59473fe6e9ac423b80b31a02d0694982e6
SHA512 45df487a8f348cd4b3b706118129b67c92e298f34e797a1e5ec1e95dd90c782a583e398edc7e4e737b9f015774ee6a0b44ad786e6505480e5220279dd0f3f7ee
MD5 SHA1 SHA512

NSIS installer

installer

Phenosal.Bet

SHA256 aeeb87a4f22d8a674ef2674cbf031cf6758bcf5632b4c101ef8a97dd7eeffd36
MD5 a5acd72c831e2b7c12d5f00e02d1944f
SHA1 69df09371ab0d9e740aa4b1409d2916e8cca75ca
SHA512 c24dcf587f176ed7fb7e5eccfff0419607fc6a342a02d9108464f7dd4a8a21f24e78ed58d8fc664d58df50783c8743b95cf196d7b0057fe88e7db974c3d6db3d
SSDEEP 6144:qQjOx4GeQnPvbxW4aQXMw38MMv7YVj+pFh3nGLjMQ+wguFEa:/p8hxXPqv7YliP+jMQ+wKa
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

doc002209025.exe

PE Signature issue

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

Khoums/Bijectively.cov

Khoums/Kvikslvtermometrenes.pro

Khoums/Riant.Bat

Khoums/Vasoganglion132.ini

Khoums/alkymistiske.ini

Khoums/anglicism.sne

Khoums/choripetalous.ini

Khoums/glatkrsel.jpg

Khoums/hemmelige.jpg

Khoums/irrationalizes.ini

Khoums/mesaconic.sob

Khoums/patter.txt

Khoums/sjlehal.jpg

Khoums/vrelserne.txt

Phenosal.Bet

Sharing

General

Malware Config

Signatures

File Explorer

doc002209025.exe

PE Signature issue

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

Khoums/Bijectively.cov

Khoums/Kvikslvtermometrenes.pro

Khoums/Riant.Bat

Khoums/Vasoganglion132.ini

Khoums/alkymistiske.ini

Khoums/anglicism.sne

Khoums/choripetalous.ini

Khoums/glatkrsel.jpg

Khoums/hemmelige.jpg

Khoums/irrationalizes.ini

Khoums/mesaconic.sob

Khoums/patter.txt

Khoums/sjlehal.jpg

Khoums/vrelserne.txt

Phenosal.Bet