scan[.]exe | Triage™

resource
scan.exe
unpack001/$PLUGINSDIR/System.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

scan.exe

IMPHASH 671f2a1f8aee14d336bab98fea93d734
SHA256 1da2a52ea89a09f4950642ee586e398c4cf117a1f0dd50bb1362f635a6720f53
MD5 a7e92ba8320c1ca427dc81efd76dc566
SHA1 e320bfff52a9b18128624b33021698df51fc8a52
SHA512 41c7f88dd2ae80cd21dc2ca35dffa1818c51c1d357262ef99cf6a30e71131da52aa00e804839ea1e22ca60b0a89cf2fa31098c58e0352949df1ad831731d85db
SSDEEP 12288:DnVbe7PYad+y0qXl4a/0jpLVGvNQ70JE8vHA:DnVbe7PYajS60jx74HA
TLSH
T177A412A2B274D86BC85256F3C632A8F61BF08E15D82517AB4F007EFE75740520E2B797
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

13186

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueA RegEnumKeyA RegQueryValueExA RegSetValueExA RegCloseKey RegDeleteValueA RegDeleteKeyA AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken RegOpenKeyExA RegCreateKeyExA

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA SHFileOperationA ShellExecuteExA

ole32

OleUninitialize OleInitialize IIDFromString CoCreateInstance CoTaskMemFree

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create

user32

SetDlgItemTextA GetSystemMetrics CreatePopupMenu AppendMenuA OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcA GetMessagePos CheckDlgButton LoadCursorA SetCursor GetSysColor SetWindowPos GetWindowLongA IsWindowEnabled SetClassLongA GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassA SystemParametersInfoA CreateWindowExA GetDlgItemTextA DialogBoxParamA CharNextA ExitWindowsEx DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow ShowWindow wsprintfA SendMessageTimeoutA FindWindowExA IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint MessageBoxIndirectA CharPrevA PeekMessageA GetClassInfoA DispatchMessageA TrackPopupMenu

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor

kernel32

CreateFileA GetTempFileNameA ReadFile RemoveDirectoryA CreateProcessA CreateDirectoryA GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceA lstrcpynA SetErrorMode GetVersionExA lstrlenA GetCommandLineA GetTempPathA GetWindowsDirectoryA WriteFile ExitProcess CopyFileA GetCurrentProcess GetModuleFileNameA GetFileSize GetTickCount Sleep SetFileAttributesA GetFileAttributesA SetCurrentDirectoryA MoveFileA GetFullPathNameA GetShortPathNameA SearchPathA CompareFileTime SetFileTime CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc GetModuleHandleA LoadLibraryExA FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA MulDiv lstrcpyA MoveFileExA lstrcatA WideCharToMultiByte GetSystemDirectoryA GetProcAddress GetExitCodeProcess WaitForSingleObject SetEnvironmentVariableA

$PLUGINSDIR/System.dll

IMPHASH 240ca92ecc1c291801c451c447e16c12
SHA256 7fb0f8d452fefaac789986b933df050f3d3e4feb8a8d9944ada995f572dcdca1
MD5 dd87a973e01c5d9f8e0fcc81a0af7c7a
SHA1 c9206ced48d1e5bc648b1d0f54cccc18bf643a14
SHA512 4910b39b1a99622ac8b3c42f173bbe7035ac2f8d40c946468e7db7e2868a2da81ea94da453857f06f39957dd690c7f1ba498936a7aaa0039975e472376f92e8f
SSDEEP 192:VFiQJ77pJp17C8F1A5xjGNxrgFOgb7lrT/993:97pJp48F2exrg5F/9
TLSH
T1C5425C1583618EF3F5961E3C00667E2F2B79BE3416F100A39FE34481A99A1CF99B5392
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10673

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Cipherdom/teaboards.skr

SHA256 a70db6a23ebdface7eb467339e38edb8f941a7f81339c49f7fdeca84134f9bd0
MD5 f6c1f133ae51606861d425b6f6332801
SHA1 181f6dc76b417464880d0d4bd2f6f70fad790889
SHA512 1c3c11dc076bb2083ffeb2b5425b4dabcd7b66fbcedc079c19babf9aadacf64596ac9a4764977638dae5c82dddcca3606382c33b2cb0f76e5f9df676ec2b5cfb
SSDEEP 48:suqvPbIA28a8sKfFLPEOZcebiKHmNpajcGioSQwqgK/AEOORRCFbjJvbxKS:sVb3RDseFTDcAKAqqFD3RRExL
TLSH
T1B85328B1BD3AC61BF52578490A0B4D7AE83BED18C5812483CF257B12C1E8C014BA7D01
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Cipherdom/tracer.lim

SHA256 6703e4fbcfe3b6ed82e3e57d888458620d3aa6f970252b63be7ccfa726305350
MD5 306e4efbe3cb428b153d9074743d2cbe
SHA1 375304e2e291441baac72aeba7197b61e0f4676f
SHA512 a445965324ae89d4489fded317fa30e361e4e7b6999cee9f5dffe0fb8022f155cca630f4ceef667845ce65d98636b46549488f17f1108e7ff6fa9fb9ee345673
SSDEEP 48:oJEBW0ACr9OaKNDchdO3Gh/tVwYPe94o0CCwf0kH4vNLWn:tBWAMNwhlpe9B0CCK8Wn
TLSH
T15F533A9463EB2E34694419713ADA4AD6D0FD62E9631432514303FE4B34CDCDE2A83C4C
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Leveringssikkerheds.Ove

SHA256 41fd0411ee2289ebd79eebacf06adac340eaa1cbdf1537b91091fa13f2799afb
MD5 f9d30eb729eb0c641c632e8727de024e
SHA1 48cc4f5ae83922facaa557f4164cf3d00da3d550
SHA512 140a8851507dd7efa65cbbac953409d8e1b2fe05cae837bc45d3cb566005f1143c49fcef7bb49303b9f446d07b71eb32d832f7bfd06df957835bab0911a2d599
SSDEEP 6144:z+l7RIqplZOfChHcQgCOzW53SLA3zLO4AGKG:KRNOq5cDz03SLAXO4fF
TLSH
T1E044E0893F276511C3CB42B1DE1AE98F27023EB99F57D4A7D87CB79B809C12826D5D08
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Skihop.scr

SHA256 d6d85a2c6db3d717997bb14fa1354aab2b89fbc21032c821d823cdfb396a2571
MD5 7d5a59237576df796b319511e5ad1c87
SHA1 ba170ef37e9993bb51cb97cec45e5fa6efba0d0f
SHA512 d5af0150cb47e66ac4fd28a02c7109b235f837f8c562761ef2f9380582261105b7dae0b0b10eb85813543fd9ce0108acf4a342638f6e0de37f332a3c0fd762a0
SSDEEP 12:v7DZvDCuqH4EGMJ7DT++5mjA+D1GCdJDnpF6l:jZ+iMR/+s8kgrpFK
TLSH
T1DB5223D4D4CBC13E01C31D040B960095B3117759B1E014F86A0810B249282AC31DC186
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

dematerialiserendes.bad

SHA256 98c37f637e7780e548bb0b56f0151d19a9434b2eb57ad843d913718a4c27f35a
MD5 51c888f908e792106807f36999b7dfc1
SHA1 57f55c04c9363805c7d8348112c4bf504998d424
SHA512 1e4953f451a3c2d7cbbf9318b521740bae6e036c9e36705b6fc8ea9135222a8a2b41886eb349e25fff61d73d10c9654b5a1482a84f32058791f5169251191453
SSDEEP 96:ResNHZY3dGnVMHcKplUK+JyESB2kA3wEn/2GtQ:RPNH+wnqceUX0ES8kA3T/2GtQ
TLSH
T1EA936CA20C9E5045D8A70CFF6A619ED2B5A887541721354E03762EC17F0A7E5D0BB8A0
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

fortabelsen.Nyk

SHA256 41ef4f65976a5f60a47472425d91a5e90a1c59701e817f3d672d0da78f7d5867
MD5 1a68e3d55e60ae7d4faccea51ad38af2
SHA1 324b63393ed06e3f58cc90eeca5a731394011d55
SHA512 3379765cf07be9cd09c3c2437377f0157999d09e1b1cf4b27be6399add12b73654751210ec4a4a6e1cb7a30b1df847bcc45279102caf10b7b974e71dd3bd992a
SSDEEP 768:OAo4xL1gYSaK5AFqfmQJNYlxJOp5eyJ9+1op0LROkqy82XRanMO5:L1SaF8NYnJOp5t/QwR2X6
TLSH
T1FF33AF57E7898CFEC813C638C5AE62954CAA60054F4FD0ED6239B854C1D71E327346AF
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

scan.exe

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Cipherdom/teaboards.skr

Cipherdom/tracer.lim

Leveringssikkerheds.Ove

Skihop.scr

dematerialiserendes.bad

fortabelsen.Nyk

Sharing

General

Malware Config

Signatures

File Explorer

scan.exe

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Cipherdom/teaboards.skr

Cipherdom/tracer.lim

Leveringssikkerheds.Ove

Skihop.scr

dematerialiserendes.bad

fortabelsen.Nyk