f3ef0cc3468403e333638c5e6aad94b99c14cc5f6f864c49bd90a67d0366bc02[.]exe

resource
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll

resource
f3ef0cc3468403e333638c5e6aad94b99c14cc5f6f864c49bd90a67d0366bc02.exe

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

f3ef0cc3468403e333638c5e6aad94b99c14cc5f6f864c49bd90a67d0366bc02.exe

IMPHASH e9c0657252137ac61c1eeeba4c021000
SHA256 f3ef0cc3468403e333638c5e6aad94b99c14cc5f6f864c49bd90a67d0366bc02
MD5 739e07697671b960fdaabca66751e167
SHA1 51c0c7e9196a73d9aef4c42f2fba1e4cb9416cff
SHA512 74c55604988dbd99151ac1cf2945524112a649bdd5fa2abf54f0db1b8446b8ed24861bdd287c921e3a053f6f6c57d1611963587d1f3aac2716496d44d696d244
SSDEEP 6144:K6dQC6a5KqBFf+hhTGeT7HTl2FV08pGoJPsZWknmwhYPEh:dNBFf+HGsmu8VJ0lmwt
TLSH
T1D894027367C7ECA7D66505B28CB2ABD023F06F915A41160B3654FA791C322DB860BDCB
MD5 SHA1 SHA512 SSDEEP TLSH

Untrusted Codesign Signers

Codesigned binary was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

03:c1:91:7d:bc:12:27:ba:94:be:75:57:29:3b:55:9b:50:1d:48:2d:5b:7c:dd:e9:73:59:6c:3b:20:8a:7d:43:57:e6:7b:2b:50:36:a7:2f:f3:3f:a7:28:ab:17:c3:6b

Digest Algorithm

sha384

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Styrkelses,OU=Flekstiden Penslings\ ,O=Styrkelses,C=FR

Chains

Feb 4, 2026

PE Signature issue

Digest

35:4c:f6:64:8f:76:f5:8b:a5:3d:b9:57:78:27:06:f9:9d:9e:7c:ec:fe:5a:c9:cb:b1:1c:b5:82:7f:0f:6b:8f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Styrkelses,OU=Flekstiden Penslings\ ,O=Styrkelses,C=FR

Chains

Feb 4, 2026

Minor OS version

0

Major OS version

4

Entry point

12853

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetTempPathA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess SetEnvironmentVariableA Sleep GetTickCount GetCommandLineA lstrlenA GetVersion SetErrorMode lstrcpynA GetDiskFreeSpaceA GlobalUnlock GetWindowsDirectoryA SetFileAttributesA GetLastError CreateDirectoryA CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA ReadFile WriteFile lstrcpyA MoveFileExA lstrcatA GetSystemDirectoryA GetProcAddress GetExitCodeProcess WaitForSingleObject CompareFileTime SetFileTime GetFileAttributesA SetCurrentDirectoryA MoveFileA GetFullPathNameA GetShortPathNameA SearchPathA CloseHandle lstrcmpiA CreateThread GlobalLock lstrcmpA DeleteFileA FindFirstFileA FindNextFileA FindClose SetFilePointer GetPrivateProfileStringA WritePrivateProfileStringA MulDiv MultiByteToWideChar FreeLibrary LoadLibraryExA GetModuleHandleA GlobalAlloc GlobalFree ExpandEnvironmentStringsA

user32

GetSystemMenu SetClassLongA EnableMenuItem IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard ScreenToClient GetWindowRect GetDlgItem GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA GetDC ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect EndDialog RegisterClassA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx LoadImageA CreateDialogParamA SetTimer SetWindowTextA SetForegroundWindow ShowWindow SetWindowLongA SendMessageTimeoutA FindWindowExA IsWindow AppendMenuA TrackPopupMenu CreatePopupMenu DrawTextA EndPaint DestroyWindow wsprintfA PostQuitMessage

gdi32

SelectObject SetTextColor SetBkMode CreateFontIndirectA CreateBrushIndirect DeleteObject GetDeviceCaps SetBkColor

shell32

SHGetSpecialFolderLocation ShellExecuteExA SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA SHFileOperationA

advapi32

AdjustTokenPrivileges RegCreateKeyExA RegOpenKeyExA SetFileSecurityA OpenProcessToken LookupPrivilegeValueA RegEnumValueA RegDeleteKeyA RegDeleteValueA RegCloseKey RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ord17 ImageList_Destroy

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/System.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 ac9dfe3b35ea4b8932536ed7406c29a432976b685cc5322f94ef93df920fede7
MD5 0063d48afe5a0cdc02833145667b6641
SHA1 e7eb614805d183ecb1127c62decb1a6be1b4f7a8
SHA512 71cbbcaeb345e09306e368717ea0503fe8df485be2e95200febc61bcd8ba74fb4211cd263c232f148c0123f6c6f2e3fd4ea20bdecc4070f5208c35c6920240f0
SSDEEP 192:qPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4U:F7VpNo8gmOyRsVc4
TLSH
T1CB326D5503504AF3E996863C00263BBFAF796A2095F14D53CFA394C0FE2E5C9AD78352
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10529

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsDialogs.dll

IMPHASH ebc2d915841be8afc8fa1ee9f6850960
SHA256 8d4b1c275fd1cd0782a265080b56d1aec8d1c93edca5ef3b050d1d20d7b61f33
MD5 6e64e5d5f9498058a300b26b8741d9d5
SHA1 837ce28e5e02788da63a7f1d8f20207d2b0bf523
SHA512 f53514d36021d79f85df2494d403f03589b3ad848889b9224f962cc932ef740f127131a914c7171ad8136ca1ef631285ea1c80576db18ccf8ea56940eb00ea1e
SSDEEP 96:oWW4JlD3c151V1gQoE8cxM2DjDf3GEst+Nt+jvcx4P8qndYv0PLE:oWp3ggQF8REskpx8dO0PLE
TLSH
T1D11209135A4455B3C9E7223A31AA2F2ECB3CA324A0627D02C777DE162BB42166D3E355
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

7513

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Anskueliggrende1/luxemburger.sku

SHA256 040d312ce0cdf55fb5564de562f28202cb5f4786adcd05eda25cb725b5da1252
MD5 a5d8424b50ff3b1735d76584807f647a
SHA1 8eb3bb25a6ef99a05c759c3eae4ed00dbc47d91b
SHA512 acaa1faf24292b4e723c018329b6c8426e62a98f7b84531b9d04fea991762b10c7180a30c22cc68fd80668db7ec6ad4a8cde4b133ba800419d2cc9e9c669c4e7
TLSH
T1465180D41CD5FB5E512EE4D4604C1DDF545047B55C168525D748159981C0014055D7B9
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

Anskueliggrende1/prognosearbejderne.dat

SHA256 afedda99bd4ef117fdba16f5d0532f076953eece5c9f4b8089b702e71f13b2b9
MD5 26d111ca8d35371e8c3e1faad60cd759
SHA1 af48cc294f8676fa3bc0eaed37e5dcb96271c7e6
SHA512 fd776e73e7e601ede090c79c18f4bd7fea6dbf49ead92071bbd6f7f52297f648b6456d89e7c43942f5edacc30e217e9a1ac14b6bd3c0c0f089475919abfa4f5f
SSDEEP 6:LnnMSnnGnm+0UnjnMncMmCnnnqe+8nens8gnan87sn2nKwCnn2nWnOnganCnynQY:TntwfgFnEsTs8InC9kChk50gvBGlnh/
TLSH
T187A17DC92760B8684137F50D4720ACDC8C0D3D2AA5571CA5583E0D890107A808657989
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Anskueliggrende1/weam.oak

SHA256 a7931adb4820879b4b7a195d9a2607a6836c83931e42b76ac6f2d1613f1651e0
MD5 3f5f15f8599a7a03a3cead6b9ed2a28e
SHA1 0881e9e552c76425f3c5ed123ec206a8352d6250
SHA512 64688856da7b23e998c0730da1cff4e0b22ce73049b732d727a18e847e42375b80f77260ab125c270441de9c53d60e915f47118e888c8d978fc4e7f6474c2cad
SSDEEP 24:axyhkXLmPmmqQgBD2uTeLzBoWZtxEX3rT1TX/sLj6+G7i/:pkbmPmIgxpeOOtxEX7ZTX/sLlG7i/
TLSH
T1A61283607CB08F4B8774C04EC328054A0202C976E8D4BC6894D0B8C07E024BC83B29BB
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Conjuration.Pal0

SHA256 22be6e533390235d81790bb9b4f1dde0bcf1e4a13a9342fee1af504023f0f173
MD5 cc54cf6d604e7a591e0a28cd7aa01a2c
SHA1 b61c5a9c2907359669cb5b97cc5079e1321018d9
SHA512 deaa6813c7a4eca3350d7d08af7fd3d4928e6a2ce198b40dd9ab81d74adba7e73d41f83fa225a720f4c8d36481f6fe8417981e5b80e41c8d2f9e5a78d413d292
SSDEEP 768:inqv5Du5F+jau2Bg2TKtCe+8arTHYwHwPJfuIpA09NE6v:Hv5DqFblKw9pqJNE6v
TLSH
T1B733AE17D3238CFBCE864538C9AC71A58CA5705A4B4FE1FEB1395408814B6E73760BAA
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Cosmogonist255.ele

SHA256 74bd1112d23b3734a4452f53b3e4e66536acff89a29103e7f18ece544434fcff
MD5 4ca4aabe7382458c3fe11a371cc9d48e
SHA1 ad4b117790e1c41f8cd5b510803c4fe8b210f130
SHA512 796cca7fb37b72024ec0f3d716151ab6c4fb3d61feca9fb66a9e1372e0a4bc14b153f62feefd80a4f93873872fc85b786cd266b6f8cfd8842663edaa4871bea0
SSDEEP 6:2fAKzkgjeM8AfkCjkUGfaffjSfm/0fHzRfMzUj4fqz2suEka:KltJ8Afkg8+ym+ZMQj44jue
TLSH
T149917DE0EE514B13D4C43E4D4D650DAB910B85329062CA19D70D1B15BFF50030C309B4
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Personalechefer219.gan

SHA256 cabbd0422326dd38ba725dd7da775619f83cce235d534d620e383f5ef258d554
MD5 b5f5e49c2dd3fab6ab7b2ee31c24022a
SHA1 6ff068f9e3b75b646ae8852dd549faf66d06c810
SHA512 69aa56e35bfcf80004c33adcfd393641f615aac01ca73ad20ddded092cf00fa08feee4531ad4655e39c2078295d8cc4620d77d53340066a21ea8e6e2304cdfee
SSDEEP 12:dL/SObxLGcf3Nciclccn5ioLaxcMP4l20IlQHJRHydvL3LwoS8:h6mGIu5h/MP4l5XIdTbwJ8
TLSH
T101F1DC82C8B661007BA3BBAD8A86888F215014CC7D07E2428ECF2D36011058CAC44596
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Triphibious.rin

SHA256 aeed3a481e99aee016c2e6b14c1b435d706af5f9ff6ebec0b251221d5240b790
MD5 5f11b4a9aa4bc9aa0bcf6ec153c858c9
SHA1 0ab7877ec5bb899d71a330fa2c057b7125c7c97d
SHA512 7bb59836eaac27b30d4982c0c87078187d8bce0d857d3068139f2ebf617cd4a82fbb1f0dbb0efb67e2ab8dc4bce7a9b337661dc8ee5ba804617b5a22d8fa27de
SSDEEP 6144:7wuqQv0hNe1Xg15WWkZIFkdEr/q4dERDkmxpYj5Mabp:suqQshQ1w15THeCcTYSC
TLSH
T1A124D0C6E58528EDDC216B77C90C2DFE72837C33BAC1599F721F8F2345A06B64958886
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

cinderman.ste

SHA256 772152794fa73885b5cd4f746eb9eaf4b3b9b8731963752625eabc114e24c61b
MD5 53c872ca6edce9f3e611309bb78d55d8
SHA1 ae25a627706724c45dca0460eb46df073f6677c9
SHA512 c0b16596f4f99d3f537368fd74dd022409d8873be8cea316a6ee0408c72fe95509545b5589cfb9c57aa2e42f3349b98a129ca51709d9ee68db7c139a2cc0b3a4
SSDEEP 12:Lk4QyLiJqkCFuiORkvHYnJiKuiEc07LOWosOI:Lk49WPCz+sW+vfO1I
TLSH
T166C1C0B4AD2A1A950B3A0B067134494B40DF798D1F11B07A1A701C3A3BD401361D0778
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

creamer.per

SHA256 5a04a7c59643b48034a684785e65b2e5f371c813284a8a64f2f2887f473511ed
MD5 1f4cf4bb75b6678c9d9043611767ac2b
SHA1 96cfa2b5d19f482299316ba0ed98c1b301d1e007
SHA512 b5645fb63c499e74c389c75a63307f57e9aea6978b231aa3adbc231dfb631d6b568763318560a16c7d118d06e384b8be151672a056a7252e4c1ffaf3e2de0b31
SSDEEP 12:eqQ8mUjYDKU8DS2UwEiSYLeKAfcsW4NiuyoHFqL:xQ8mUEOIBiSVKAfFWHolU
TLSH
T170F15C0CA828E3EF62CDE801D6364D4A802982CB20A33F788EC9A4B4C00202274C108B
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

gunvor.tau

SHA256 53a067c9413cfedeb977cdb17dfcb190728f1d9a818e4d07ee0e34379f62922f
MD5 ae09f2f06c3b0a5850c43b768fbaa157
SHA1 e707def2f42ced475e40c5dd411fed4cb5e35f14
SHA512 15a9b6434c563cbdf7ebe3b745f328e0164bbe500424fa2c25f302f49595751c23fd6ea754d42f21f03b7004a74e1a47165a3d75af5fdd9c47e218f23f4de8a7
SSDEEP 12:4p61sBXPFj/LUkjsEPRw1Qlwrn1jYi6wHwjuvCt2jh:49B/hjrPE7NTPPh
TLSH
T1D9C16A9341110D29D19F1028D4C17C07D338D44366C3C8CCC203DD3D03970D5112BED0
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

f3ef0cc3468403e333638c5e6aad94b99c14cc5f6f864c49bd90a67d0366bc02.exe

PE Signature issue

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

Anskueliggrende1/luxemburger.sku

Anskueliggrende1/prognosearbejderne.dat

Anskueliggrende1/weam.oak

Conjuration.Pal0

Cosmogonist255.ele

Personalechefer219.gan

Triphibious.rin

cinderman.ste

creamer.per

gunvor.tau

Sharing

General

Malware Config

Signatures

File Explorer

f3ef0cc3468403e333638c5e6aad94b99c14cc5f6f864c49bd90a67d0366bc02.exe

PE Signature issue

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

Anskueliggrende1/luxemburger.sku

Anskueliggrende1/prognosearbejderne.dat

Anskueliggrende1/weam.oak

Conjuration.Pal0

Cosmogonist255.ele

Personalechefer219.gan

Triphibious.rin

cinderman.ste

creamer.per

gunvor.tau