Payment receipt 2[.]bat[.]exe

resource
Payment receipt 2.bat.exe
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

Payment receipt 2.bat.exe

IMPHASH 671f2a1f8aee14d336bab98fea93d734
SHA256 2babb5268496a4b5231d8d58e3f84ebe220ab2ddea277ec9910bdbdffb572f4d
MD5 3238874df93198525df1c1a03cc4b75e
SHA1 498b7141a37239f11edcb5f477a5c62f2dc167b8
SHA512 f540de49269648bc853025ea0b19bdf672a1a9e68eff8fecf7eeb7929080802fc7d189777484e1dc72101c6e17032b5da3b007a930d120f9782fd4c3282af993
SSDEEP 6144:kcBvWb0Pv8SNUzKRdCb1J49OYTczmB/doLcPCkT:tO0PESSK6xJQJTnxifkT
TLSH
T1394412A5B270D4F3D2735BF09E731A779BB9EF14129146833B45BB2E7C37A408A4A502
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

13218

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueA RegEnumKeyA RegQueryValueExA RegSetValueExA RegCloseKey RegDeleteValueA RegDeleteKeyA AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken RegOpenKeyExA RegCreateKeyExA

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA SHFileOperationA ShellExecuteExA

ole32

OleUninitialize OleInitialize IIDFromString CoCreateInstance CoTaskMemFree

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create

user32

SetDlgItemTextA GetSystemMetrics CreatePopupMenu AppendMenuA OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcA GetMessagePos CheckDlgButton LoadCursorA SetCursor GetSysColor SetWindowPos GetWindowLongA IsWindowEnabled SetClassLongA GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassA SystemParametersInfoA CreateWindowExA GetDlgItemTextA DialogBoxParamA CharNextA ExitWindowsEx DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow ShowWindow wsprintfA SendMessageTimeoutA FindWindowExA IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint MessageBoxIndirectA CharPrevA PeekMessageA GetClassInfoA DispatchMessageA TrackPopupMenu

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor

kernel32

CreateFileA GetTempFileNameA ReadFile RemoveDirectoryA CreateProcessA CreateDirectoryA GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceA lstrcpynA SetErrorMode GetVersionExA lstrlenA GetCommandLineA GetTempPathA GetWindowsDirectoryA WriteFile ExitProcess CopyFileA GetCurrentProcess GetModuleFileNameA GetFileSize GetTickCount Sleep SetFileAttributesA GetFileAttributesA SetCurrentDirectoryA MoveFileA GetFullPathNameA GetShortPathNameA SearchPathA CompareFileTime SetFileTime CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc GetModuleHandleA LoadLibraryExA FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA MulDiv lstrcpyA MoveFileExA lstrcatA WideCharToMultiByte GetSystemDirectoryA GetProcAddress GetExitCodeProcess WaitForSingleObject SetEnvironmentVariableA

$PLUGINSDIR/System.dll

IMPHASH 240ca92ecc1c291801c451c447e16c12
SHA256 014f1dfeb842cf7265a3644bc6903c592abe9049bfc7396829172d3d72c4d042
MD5 12b140583e3273ee1f65016becea58c4
SHA1 92df24d11797fefd2e1f8d29be9dfd67c56c1ada
SHA512 49ffdfa1941361430b6acb3555fd3aa05e4120f28cbdf7ceaa2af5937d0b8cccd84471cf63f06f97cf203b4aa20f226bdad082e9421b8e6b62ab6e1e9fc1e68a
SSDEEP 192:gFiQJ77pJp17C8F1A5xjGNxrgFOgb7lrT/nC93:E7pJp48F2exrg5F/C
TLSH
T15D425B0583618EF3F5965E3C00667E2F2B79BE3416F100A39FE34481A99A1CF99B5392
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10673

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/modern-wizard.bmp

SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
TLSH
T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$PLUGINSDIR/nsDialogs.dll

IMPHASH cfc8bb9e11188db414351d2620c98f39
SHA256 b2699fdfdab6a018fcc972806d12f71972de1861660bb6578935d62b1da06504
MD5 3cea4c9994912d8f3c3e8b6a814e810e
SHA1 c48d34a0981d4ab576c7a3ab566f5ddb94af5d86
SHA512 d317449f3c3115e279cff148c3e0bccc9b1d4ba82d1f85c0b99d7db657e85f752c0691d33f8024ada5850c993d0bdcbcc70b296b7cf33d7d14a67bc16ca3b4a3
SSDEEP 96:o417lf7AR1VhrfzBik0cxM2DjDf3GEkniJnifvcx4Lb8qndYv0PLE:oOl7wrLBn0REc0JxEdO0PLE
TLSH
T1D51207135A0444B3D9E2223A31AA2F2ED73C9324D0A27D02C777DE5A2BB43166D3E351
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

7513

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Brndingerne.aff

SHA256 4e7dc2cbc23bdd24f5e2f83e2f7b4a3a418549cddd95071537076af3d35ad14b
MD5 8e2326f6200855c83bac9db42ef452b3
SHA1 742270c78aad4c6bf6ab901e0ec09c4a5f2db3c1
SHA512 1338b6504c989ba7749b928fc36150e4bbc73acdc8a72d7ab0eab6a17666553825417283249118dafc00a754a0c494d0258712e0564c381cf6ac7e8d9a8bb95c
SSDEEP 96:cNw4VlwI4IsLCwD0BTrzjPTf8NPhDyHiFQg5jTqE5MzCQ8N:cNwa+fLChBTrzjDUxyCF35jTp5MzCQs
TLSH
T150832BEEC657F0BFD8A4085E603637CDF2C4C85D9D524151DAC36A79A517F9B318014D
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Dirty.lit

SHA256 013450e6ac910dd59878ef1072956b4a8eda72a426e294e92fda770116bf7c36
MD5 851173cb9c62b29a87a201e6d713d856
SHA1 3845cbc64abdb3d87035cc5e23779066bfc3f57e
SHA512 4116f95eaf27a347f5895f40ca679f10ea7fd11bb9e763ead076a170eceec7290d1c7a6753f3d490d26ac19e66d07c943e5e08dc4e9d9eb15cf990a52258b182
SSDEEP 1536:cPh4ONQ+RVQaxKFnxBxizZE9GCy5mbMDv9CwOOXK/TK7NEb1Gd+xpS:yNNlVQaxKdxPimGbmbMxCwOOmXGt
TLSH
T115D3AF91D7669CFACC03C43CD9AD21A98D2470119B4FE4FDA036E919C2872E367747BA
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Gonocoele.Spe

SHA256 4f2096ee09f1d2415a63b7545341f68227d734f342d6c9f096b9edb57d734621
MD5 e94f451899ba7dd6d9e28edfb7464e47
SHA1 5802a0bd7b73969137f6810f6b88311f92574026
SHA512 75c04d9490cdfb3c7652fb6408b6f640d42969533f475d4966467c1fe4e5f16bbcc2c2998fe3450fb633234833a7bf2b7311818f8327b5d779fdabe58d33dbe3
SSDEEP 3072:S8CluKGqIT1dmWNdYI0BTftT+rQQuoEcN/R5JnbPQdaTclHg:S8mI5dmWu51TIQfcNjJnulHg
TLSH
T15F04D08C8ED6F0A6CED1FB3D62E1992FB49520212FD59D913C2155F4A632AEC2017C7D
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

markrens.sal

SHA256 34ec84085f2016f4a128164de6444e34097cd49f3e1e55419ea7b4e831091321
MD5 29b1948f527f0e80a50ba378845400a2
SHA1 07c2fb30922922a8f1f808a907ca238cf0175767
SHA512 3878d679d2258f247dd41e9bf20300db076646c4e8365b8d2bf8367eb80d2fb8e24a93ec03b861a1bc685359f140f2a939967d3f00d72d47c9971f094d333f3b
SSDEEP 48:MiHploGM7pWawcQup00SpfXOb2mHhKLuhV/sBK7lkL2wxol:vpihVWaJpKEvhKLwlsgZkLZI
TLSH
T1A953091BBCF21639C1F3D606032F9004F30E34EB6817BC18261A0A9107DB28647F9CE5
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

postanvisningers.fib

SHA256 6044c8b634066141ecd8c3ed1f55cbb97a7aef4721015d3330dbdc8b03cca9c1
MD5 dfae467b8b2795d4741e263aa556e655
SHA1 59f61719bfcccaaf4fcf15e77558a8f46846cc78
SHA512 bfcc4f72533a5de647a8f05b1a8fbed2522174e024afed07067d838a052b78ea6b37d38736f3d2e94127f49c0d0cb1151089e2d3ff8ac5dfa614d32dfe7b9d5e
SSDEEP 12:ZTw4qdTcEXoYkYXfX+lIL8tXsqLQXQXZLCEXQP4gjEifYYEdXYMXsD4+8LS0VtXm:ZTwZLlf5iEQpxAgpGodLsNWSkW
TLSH
T12C72D417643BEBDD0E09D035989B7ACCB079BAA50524B79CF844DD095E931AA444358E
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

subjektsprdikaters.tes

SHA256 7eae2cf23a7c794125baf87e0ad08b36eb686cc7c5d4a6072c3d44499c4a5f4b
MD5 598d33d3e6f87699d491912c520e13cb
SHA1 1ebd882595af0828c4471386273ff350e8ee85f6
SHA512 68c0f9f6da426c665780e3d88b293eab56680f1a26a125e1f4ccc59e2a2c9817f6a424aa2c97708503929fd48911892521e00d6097d46d4f50d8c92ac85dfdb2
TLSH
T1BD511273045D53C560D5BCEC09FE3906D8420474C8408111061C0F74510544A15F0420
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

Payment receipt 2.bat.exe

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/modern-wizard.bmp

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

Brndingerne.aff

Dirty.lit

Gonocoele.Spe

markrens.sal

postanvisningers.fib

subjektsprdikaters.tes

Sharing

General

Malware Config

Signatures

File Explorer

Payment receipt 2.bat.exe

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/modern-wizard.bmp

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

Brndingerne.aff

Dirty.lit

Gonocoele.Spe

markrens.sal

postanvisningers.fib

subjektsprdikaters.tes