01dcd38c47e4a0560bb9a6ff1fbdc84599c3761d20cf7fec96a16d916e894795[.]exe

resource
unpack001/$PLUGINSDIR/nsExec.dll

resource
01dcd38c47e4a0560bb9a6ff1fbdc84599c3761d20cf7fec96a16d916e894795.exe

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

01dcd38c47e4a0560bb9a6ff1fbdc84599c3761d20cf7fec96a16d916e894795.exe

IMPHASH 3abe302b6d9a1256e6a915429af4ffd2
SHA256 01dcd38c47e4a0560bb9a6ff1fbdc84599c3761d20cf7fec96a16d916e894795
MD5 6666c6c737f90b2005a59b8ffb9c9c27
SHA1 fc0217fb97e0189712f908c234cb8393c72c0b67
SHA512 0f2076375e23b2dceb7c6431d3ca00eab0a50d7783f0e4145522b5f3a9a45ff1a9ee20f487286c10cee7629f558c0cc54c35bb0b24986028c0d654eea20d26f3
SSDEEP 12288:W3vQsC5SKvA6YeC5L4Zifej9I7wftMJablIzD3rwU5Zw6IfCX:4WSK/zItfcftOeIzD7jd0CX
TLSH
T15BF412A1F255C8EBE86626F45C7FEE102152AA5E9471060F229B7B2A75F3383006F54F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

9d:79:3e:3f:03:82:6d:bd:0c:2a:dd:6d:29:7a:48:ed:e4:1f:e8:62:88:7a:2c:0c:e3:1b:ce:25:91:b8:a9:6b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Innervating,L=Billingsley,ST=England,C=GB,1.2.840.113549.1.9.1=#0c194a6f6e696e61405661736b626172686564656e3233362e526f

Chains

May 27, 2026

CN=Innervating,L=Billingsley,ST=England,C=GB,1.2.840.113549.1.9.1=#0c194a6f6e696e61405661736b626172686564656e3233362e526f

Minor OS version

0

Major OS version

4

Entry point

12785

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetTempPathA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess SetEnvironmentVariableA Sleep GetTickCount GetCommandLineA lstrlenA GetVersion SetErrorMode lstrcpynA GetDiskFreeSpaceA GlobalUnlock GetWindowsDirectoryA SetCurrentDirectoryA GetLastError CreateDirectoryA CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA ReadFile WriteFile lstrcpyA MoveFileExA lstrcatA GetSystemDirectoryA GetProcAddress GetExitCodeProcess WaitForSingleObject CompareFileTime SetFileAttributesA GetFileAttributesA GetShortPathNameA MoveFileA GetFullPathNameA SetFileTime SearchPathA CloseHandle lstrcmpiA CreateThread GlobalLock lstrcmpA FindFirstFileA FindNextFileA DeleteFileA SetFilePointer GetPrivateProfileStringA FindClose MultiByteToWideChar FreeLibrary MulDiv WritePrivateProfileStringA LoadLibraryExA GetModuleHandleA GlobalAlloc GlobalFree ExpandEnvironmentStringsA

user32

ScreenToClient GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard PostQuitMessage GetWindowRect EnableMenuItem CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndDialog RegisterClassA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx GetDC CreateDialogParamA SetTimer GetDlgItem SetWindowLongA SetForegroundWindow LoadImageA IsWindow SendMessageTimeoutA FindWindowExA OpenClipboard TrackPopupMenu AppendMenuA EndPaint DestroyWindow wsprintfA ShowWindow SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation ShellExecuteExA SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA SHFileOperationA

advapi32

AdjustTokenPrivileges RegCreateKeyExA RegOpenKeyExA SetFileSecurityA OpenProcessToken LookupPrivilegeValueA RegEnumValueA RegDeleteKeyA RegDeleteValueA RegCloseKey RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/nsExec.dll

IMPHASH 46f8b6973f33717335c0f6d8087de67b
SHA256 370e47364561fa501b1300b056fb53fae12b1639fdf5f113275bee03546081c0
MD5 0a6f707fa22c3f3e5d1abb54b0894ad6
SHA1 610cb2c3623199d0d7461fc775297e23cef88c4e
SHA512 af0c8ca0c892f1b757fbd700061f3d81417dff11d89bdff45e977de81ad51c97862406cf7e230e76cf99497f93f57bf09609740953cd81b0d795465ac2623ea8
SSDEEP 96:e97GUxNkO6GR0t9GKKr1Zd8NHYVVHp4dEeY3kRnHdMqqyVgN0u3e:eBXhHR0aTQN4gRHdMqJVgN0N
TLSH
T130D1097675E22EB3C50ECA353C527A2B57F8C8111B9401549B938BD238C5EB3EA39282
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4231

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Aulu.Nel

SHA256 fdc92e112ec54de406e8843313af57f3bce2aaea24c417666b8cda78ffd4d224
MD5 63f0ba41766f04506332ffde8d320b74
SHA1 f881e9ee28fbd54db2d4a9a20e62a0988f9c3eb4
SHA512 e40ced3555277a80ffe128d4f20e18ac9d1914ee4a35406fbf66b464bf68787818347af803066d7bfba94588fd851d43d67b7321583fd088493886672ffe8ab6
SSDEEP 12288:izOQ+/cT47OVQ7MGX3+VzFJ3tmPgeKJjSCnCPDMNbrqB:iqLET7VQA2C5J3geCQx2B
TLSH
T14E8401B5BA4E734EF7F0893BC095A91962E2F20991F35BF705275F192EE004387AE854
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Infidelistic80/elatine.txt

SHA256 8d782f794769977a9cce1bb41eee2c823a8ed9885891fda4ad7ecd9416e91dad
MD5 7c8bbbbbd4ce07a433991ff5a6dd3c8f
SHA1 d2e99832e8ff5bb520f4803795f2a84652d7295e
SHA512 c9ea28e0a1a4bd4d5a061c1b14c6bccbf42d0226b6c4ae104d24d9394a4e318e3079f215f870a040e5363a65e26818e3c7ef9012d1c76da23251fee238b3ef1a
TLSH
T116E0C02BA0467D5ACA5A8A9DB605184BAB98D344CD37411D7D98C7680E0092CC3BD74D
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

Infidelistic80/ennoblements.txt

SHA256 b81086f66132c6a265daab286817db1b4a788305b3d597ec2b1682d38df70d09
MD5 95a638449d468aeb5674f14e060b5374
SHA1 a2fb0afa958f1bd11d72e88ad71617a874839274
SHA512 4d1574b07ddc6f878c4f6ea8e58b9d44698e34c017dc59831c1d2331f663c6a49740cc46f8a300f953599a7ff5fe83946af6cfa4a50d1fabb2a928fffee3ee38
TLSH
T1E6E02D779902088206BA42C195CD88AB8163321AC50460E4B0CC8727AE04986F73902C
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

Infidelistic80/perched.int

SHA256 c2a2c8a330736524c9186acdbcd1a940958deaec11fb13cd2d57d9a60bf588bc
MD5 3c6a07e810fae3ec63b28f05619f6442
SHA1 6082f7f6f3c371c5956e735f5b1d860a8cbf2a48
SHA512 5dd63e500200e542132c3c4cca94566cd09a8d982f6524cf54a9635027b9af39e60d5ebb0f2d7cd62112ea8dcc3a7ead3ca898acdb3367e8119d08e31c18f70a
SSDEEP 768:euaE9gvX40GLNadYV7TGIkP18af/r4HTBiqeRnr4QxCGlkzd6W9dF1+dyO92o2nU:XAF5zL
TLSH
T199061261DE8DD3181F45127B824230648F17E6B27F57154BD00E7465A4FA3C9898ABFD
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Infidelistic80/reservationsgebyrerne.ini

SHA256 61cfc592e8915b42593689d10cd208ac99a7007b6466798b2b00bebf7b462fce
MD5 d5ae405c95e3ee0119533cf5b7d59fc9
SHA1 7229999753b164bc22fd12cef2512d37ac06db7c
SHA512 e5b17da75209c52db4981e0005033574ce1f2f84d235fee2615d5cc6909b7be946639af46c7d2c7140552e05f1e5e935fdb815711d0f03565b7ef2a60b223b39
TLSH
T163F05401973052B30F881B2FBCF11E8D025F174DD95E44E617E28B3960A2C6C92F5B32
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

Innutrition202.mac

SHA256 6f3313fa704834e4949d4a13910f399d3aeec6d5b75b678086186150d6b8e649
MD5 97c021f851150d48886b1a103671ae32
SHA1 2084dca0951bdb75d697d677552ae99d8e1c7dad
SHA512 f8063c1c1f0ed80eb406572d4318328d26e2390d1780d112a6f4e17f151bacc425e66a6ff3da1858b78b37747faf541f6b8ca846b9402cb0449a481e54ada801
SSDEEP 6144:nA1VrmcOaZ6wLCKfTghMfZfzAN185kctxXbi9+6+jQ3xtFrpL:V
TLSH
T1F065F17C8AD1255643E59CCE39CC7513C308B48818F5641F2A78DA2C18DEED1BADDE9D
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Milos159.gay

SHA256 5756986588ebf52b3da9a67918b496a1eb52528deb923bf90059ed122579c4b5
MD5 fea5922a583c9d946cc45c8a38e36edb
SHA1 b0c5c8829ad127ad0999f26b9bebe87529cac3fb
SHA512 2d9c9128067f6af0c0fe1b71bb296b48a76cb23ecfc2bca6d4e94318fb709fb956267c693542bf6e393f75127a7274ae9b847344cbb7a74335e486e8c16bb55b
SSDEEP 1536:CDunOUmQfV6EsOEmsSbr44hSk+kVUViVwX8TVxJSZyJU1d:I
TLSH
T196750168248877EF9E1DBE4CF272041B8D799848DA0C55C0ED8B664FE53EE8BB4470C2
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Subdiapasonic208.For

SHA256 d660d97dd5e2c4ab186885ed02be36cb8594716baa96ab58c444081795bf9314
MD5 5a91bab4fa7a74bb1182f6dbef78b6d2
SHA1 57f4e907cdded7b19f99b747ce666226f4569857
SHA512 2e4c55cba7949eacd47bceea11c391f98dc7f2508f11a7f7556c3d9a02c24517affd79d3017a3cd8c19f8e740852fe69a44f765f234cc24c65dfe16ed88bdc08
SSDEEP 1536:dLSr4BtXmgsPGu5VHJBhDc4uk80ioRxaCunOkR:xfXr+Lxr5DRJo
TLSH
T10933E0C56A562BFD8BDC127E97C90A111F518E3CA271D592458B637D32C9200CB2EFE9
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

boragineous.ini

SHA256 9f03bd97e2b7f658fd0a5f722de5d27d0ecce2723fd8140304c5393695b12249
MD5 ad12b2435a576778e93bffce77436c47
SHA1 f1a1d8399140eb332b265a1c6e661fee8b72723e
SHA512 78ea15f3d786e66b17ebf80c045bbd9ca4dd6e2d571b3e9103dfb27af29b3a44619f99459172dcd199e65a44c50110453c11007e841114867e22b582a0a692ee
TLSH
T19DF090F0C4E52AAA888A0CE23CB02C801102860C9A2848F0BB49094FA2040CCE3BA9A5
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

effuso.ini

SHA256 744cd4ab90b5bbd6a2dc981e7a8513b4f706873bdb73779893072f79010851a5
MD5 69bc4ea499ace843498842fa20929e52
SHA1 e8f7a5a97fbd41c5d19662646659a1209e59a225
SHA512 84c3514d3f8299e8637be314ee33de769cdf40bac7b963bb750161f565a3939e7a1a5bc105d35b9d6fd9a3e4de1bd9d88906cbb1bd79253d253fbcf6ac90ba86
TLSH
T163D0EB00CA426B177A4023C8219234A702ED871A8C2787A8C088108F3AEB03ACF4E00C
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

01dcd38c47e4a0560bb9a6ff1fbdc84599c3761d20cf7fec96a16d916e894795.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/nsExec.dll

kernel32

user32

advapi32

generic

Aulu.Nel

Infidelistic80/elatine.txt

Infidelistic80/ennoblements.txt

Infidelistic80/perched.int

Infidelistic80/reservationsgebyrerne.ini

Innutrition202.mac

Milos159.gay

Subdiapasonic208.For

boragineous.ini

effuso.ini

Sharing

General

Malware Config

Signatures

File Explorer

01dcd38c47e4a0560bb9a6ff1fbdc84599c3761d20cf7fec96a16d916e894795.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/nsExec.dll

kernel32

user32

advapi32

generic

Aulu.Nel

Infidelistic80/elatine.txt

Infidelistic80/ennoblements.txt

Infidelistic80/perched.int

Infidelistic80/reservationsgebyrerne.ini

Innutrition202.mac

Milos159.gay

Subdiapasonic208.For

boragineous.ini

effuso.ini