e332eea4b6dc0e3623dc1aa6d33db82bec7264b4308b2d2d60f04feb8c4ce810[.]exe

resource
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll

resource
e332eea4b6dc0e3623dc1aa6d33db82bec7264b4308b2d2d60f04feb8c4ce810.exe

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

e332eea4b6dc0e3623dc1aa6d33db82bec7264b4308b2d2d60f04feb8c4ce810.exe

IMPHASH 671f2a1f8aee14d336bab98fea93d734
SHA256 e332eea4b6dc0e3623dc1aa6d33db82bec7264b4308b2d2d60f04feb8c4ce810
MD5 ac0e44d9ae12d9fb5184e7d092b32fd3
SHA1 2153ebdedda177192a35d4b1a49d6da6e47f6b40
SHA512 5aadedf0334395bbd59bb04f974b343f290cf3c14d36215b655de0a5d4aea3d87a574812445a56ef60aba6cf5d0362ac588a308192937d928a6853a0dd5ea19b
SSDEEP 6144:+cBvWb0yCv3l1Om9LuIjfEBzRzT4beuo3LlCN0i:LO0TPOqLF7KRzT4qTi
TLSH
T17F341216A270D487E571133099BB96BA9EE6FB2314B15B8F3FF4AF1C7C15360592A013
MD5 SHA1 SHA512 SSDEEP TLSH

Untrusted Codesign Signers

Codesigned binary was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

d3:a2:02:59:8c:fd:3c:6b:27:00:7e:b5:bb:e1:1b:79:76:59:b8:7f:fc:94:d9:3b:50:96:aa:f0:45:de:cb:7b:78:71:1f:13:ad:23:66:6e:d5:f2:d9:bd:34:ff:a3:31

Digest Algorithm

sha384

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Kontraherendes,OU=Wastries Averred\ ,O=Kontraherendes,C=FR,1.2.840.113549.1.9.1=#0c184b64656c69676573404c616573747279676f6e65732e536b

Chains

Mar 2, 2026

PE Signature issue

Digest

d3:a2:02:59:8c:fd:3c:6b:27:00:7e:b5:bb:e1:1b:79:76:59:b8:7f:fc:94:d9:3b:50:96:aa:f0:45:de:cb:7b:78:71:1f:13:ad:23:66:6e:d5:f2:d9:bd:34:ff:a3:31

Digest Algorithm

sha384

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Kontraherendes,OU=Wastries Averred\ ,O=Kontraherendes,C=FR,1.2.840.113549.1.9.1=#0c184b64656c69676573404c616573747279676f6e65732e536b

Chains

Mar 2, 2026

Minor OS version

0

Major OS version

4

Entry point

13218

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueA RegEnumKeyA RegQueryValueExA RegSetValueExA RegCloseKey RegDeleteValueA RegDeleteKeyA AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken RegOpenKeyExA RegCreateKeyExA

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA SHFileOperationA ShellExecuteExA

ole32

OleUninitialize OleInitialize IIDFromString CoCreateInstance CoTaskMemFree

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create

user32

SetDlgItemTextA GetSystemMetrics CreatePopupMenu AppendMenuA OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcA GetMessagePos CheckDlgButton LoadCursorA SetCursor GetSysColor SetWindowPos GetWindowLongA IsWindowEnabled SetClassLongA GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassA SystemParametersInfoA CreateWindowExA GetDlgItemTextA DialogBoxParamA CharNextA ExitWindowsEx DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow ShowWindow wsprintfA SendMessageTimeoutA FindWindowExA IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint MessageBoxIndirectA CharPrevA PeekMessageA GetClassInfoA DispatchMessageA TrackPopupMenu

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor

kernel32

CreateFileA GetTempFileNameA ReadFile RemoveDirectoryA CreateProcessA CreateDirectoryA GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceA lstrcpynA SetErrorMode GetVersionExA lstrlenA GetCommandLineA GetTempPathA GetWindowsDirectoryA WriteFile ExitProcess CopyFileA GetCurrentProcess GetModuleFileNameA GetFileSize GetTickCount Sleep SetFileAttributesA GetFileAttributesA SetCurrentDirectoryA MoveFileA GetFullPathNameA GetShortPathNameA SearchPathA CompareFileTime SetFileTime CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc GetModuleHandleA LoadLibraryExA FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA MulDiv lstrcpyA MoveFileExA lstrcatA WideCharToMultiByte GetSystemDirectoryA GetProcAddress GetExitCodeProcess WaitForSingleObject SetEnvironmentVariableA

$PLUGINSDIR/System.dll

IMPHASH 240ca92ecc1c291801c451c447e16c12
SHA256 014f1dfeb842cf7265a3644bc6903c592abe9049bfc7396829172d3d72c4d042
MD5 12b140583e3273ee1f65016becea58c4
SHA1 92df24d11797fefd2e1f8d29be9dfd67c56c1ada
SHA512 49ffdfa1941361430b6acb3555fd3aa05e4120f28cbdf7ceaa2af5937d0b8cccd84471cf63f06f97cf203b4aa20f226bdad082e9421b8e6b62ab6e1e9fc1e68a
SSDEEP 192:gFiQJ77pJp17C8F1A5xjGNxrgFOgb7lrT/nC93:E7pJp48F2exrg5F/C
TLSH
T15D425B0583618EF3F5965E3C00667E2F2B79BE3416F100A39FE34481A99A1CF99B5392
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10673

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/modern-wizard.bmp

SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
TLSH
T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$PLUGINSDIR/nsDialogs.dll

IMPHASH cfc8bb9e11188db414351d2620c98f39
SHA256 b2699fdfdab6a018fcc972806d12f71972de1861660bb6578935d62b1da06504
MD5 3cea4c9994912d8f3c3e8b6a814e810e
SHA1 c48d34a0981d4ab576c7a3ab566f5ddb94af5d86
SHA512 d317449f3c3115e279cff148c3e0bccc9b1d4ba82d1f85c0b99d7db657e85f752c0691d33f8024ada5850c993d0bdcbcc70b296b7cf33d7d14a67bc16ca3b4a3
SSDEEP 96:o417lf7AR1VhrfzBik0cxM2DjDf3GEkniJnifvcx4Lb8qndYv0PLE:oOl7wrLBn0REc0JxEdO0PLE
TLSH
T1D51207135A0444B3D9E2223A31AA2F2ED73C9324D0A27D02C777DE5A2BB43166D3E351
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

7513

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Brndingerne.aff

SHA256 4e7dc2cbc23bdd24f5e2f83e2f7b4a3a418549cddd95071537076af3d35ad14b
MD5 8e2326f6200855c83bac9db42ef452b3
SHA1 742270c78aad4c6bf6ab901e0ec09c4a5f2db3c1
SHA512 1338b6504c989ba7749b928fc36150e4bbc73acdc8a72d7ab0eab6a17666553825417283249118dafc00a754a0c494d0258712e0564c381cf6ac7e8d9a8bb95c
SSDEEP 96:cNw4VlwI4IsLCwD0BTrzjPTf8NPhDyHiFQg5jTqE5MzCQ8N:cNwa+fLChBTrzjDUxyCF35jTp5MzCQs
TLSH
T150832BEEC657F0BFD8A4085E603637CDF2C4C85D9D524151DAC36A79A517F9B318014D
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Repugnancy151.Yas

SHA256 e0d669eed3d1faa11e495a30bc3f0d9632ea632ca5092cbf49be0865a1ece6a3
MD5 a72ca6b092077f0618eda2a7411359b4
SHA1 99fa3add595a28d16dd586a37144debd29a7eae8
SHA512 dde0f428543c04fd06325b3bad852756350a75964eee3ac171355d23308dad1083d51cd933e651f4606a989d9732d0c05271ce387749c89c23bfe46bba43e8c1
SSDEEP 3072:O1BniJGzQSvQ7kd0L51JUyaTSK/Iqn7COUps:eiz4J8UyM/IqnlU6
TLSH
T1F6E3BF56DB16CDFACC07C538D4AD71E94C59B0164B0FE0FDE176A828C18B3E227256BA
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Slibningen20.Nnn

SHA256 fddceec78de2563a74184981e94320a866f21a667dd0c8a65a1c7aaaa7e3a759
MD5 cfe56e31a4cb21862a61c1d627fe0bb8
SHA1 6fa5cd688813073f14897777988c2d485f35185c
SHA512 fdce462a7d0c6f6d393e5c834a9df9dfe72c90c07bc4b4cc2897527d93e1855559483ccf3c8ad7c93ec6466ff3d3d881b5db45270d64eb65ae75228bdb259966
SSDEEP 3072:dHZ7vq/6nc70Yffb4CzT8Iwp0ujU+ZLeT12NpatrNLn+CFoH2PY:dE/mMnxP209I6E7atrltFoWw
TLSH
T130D3E0089EE7F0B2E526C17CC86A9750656C10BE603D4431ACFFA8D9401B5DF86F1E6B
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

markrens.sal

SHA256 34ec84085f2016f4a128164de6444e34097cd49f3e1e55419ea7b4e831091321
MD5 29b1948f527f0e80a50ba378845400a2
SHA1 07c2fb30922922a8f1f808a907ca238cf0175767
SHA512 3878d679d2258f247dd41e9bf20300db076646c4e8365b8d2bf8367eb80d2fb8e24a93ec03b861a1bc685359f140f2a939967d3f00d72d47c9971f094d333f3b
SSDEEP 48:MiHploGM7pWawcQup00SpfXOb2mHhKLuhV/sBK7lkL2wxol:vpihVWaJpKEvhKLwlsgZkLZI
TLSH
T1A953091BBCF21639C1F3D606032F9004F30E34EB6817BC18261A0A9107DB28647F9CE5
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

postanvisningers.fib

SHA256 6044c8b634066141ecd8c3ed1f55cbb97a7aef4721015d3330dbdc8b03cca9c1
MD5 dfae467b8b2795d4741e263aa556e655
SHA1 59f61719bfcccaaf4fcf15e77558a8f46846cc78
SHA512 bfcc4f72533a5de647a8f05b1a8fbed2522174e024afed07067d838a052b78ea6b37d38736f3d2e94127f49c0d0cb1151089e2d3ff8ac5dfa614d32dfe7b9d5e
SSDEEP 12:ZTw4qdTcEXoYkYXfX+lIL8tXsqLQXQXZLCEXQP4gjEifYYEdXYMXsD4+8LS0VtXm:ZTwZLlf5iEQpxAgpGodLsNWSkW
TLSH
T12C72D417643BEBDD0E09D035989B7ACCB079BAA50524B79CF844DD095E931AA444358E
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

subjektsprdikaters.tes

SHA256 7eae2cf23a7c794125baf87e0ad08b36eb686cc7c5d4a6072c3d44499c4a5f4b
MD5 598d33d3e6f87699d491912c520e13cb
SHA1 1ebd882595af0828c4471386273ff350e8ee85f6
SHA512 68c0f9f6da426c665780e3d88b293eab56680f1a26a125e1f4ccc59e2a2c9817f6a424aa2c97708503929fd48911892521e00d6097d46d4f50d8c92ac85dfdb2
TLSH
T1BD511273045D53C560D5BCEC09FE3906D8420474C8408111061C0F74510544A15F0420
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

e332eea4b6dc0e3623dc1aa6d33db82bec7264b4308b2d2d60f04feb8c4ce810.exe

PE Signature issue

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/modern-wizard.bmp

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

Brndingerne.aff

Repugnancy151.Yas

Slibningen20.Nnn

markrens.sal

postanvisningers.fib

subjektsprdikaters.tes

Sharing

General

Malware Config

Signatures

File Explorer

e332eea4b6dc0e3623dc1aa6d33db82bec7264b4308b2d2d60f04feb8c4ce810.exe

PE Signature issue

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/modern-wizard.bmp

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

Brndingerne.aff

Repugnancy151.Yas

Slibningen20.Nnn

markrens.sal

postanvisningers.fib

subjektsprdikaters.tes