7101c5945c026bef41d2cbf5bb5865976af92b56d326336b89523c385680f2aa[.]exe

resource
unpack001/$PLUGINSDIR/System.dll

resource
7101c5945c026bef41d2cbf5bb5865976af92b56d326336b89523c385680f2aa.exe

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

7101c5945c026bef41d2cbf5bb5865976af92b56d326336b89523c385680f2aa.exe

IMPHASH 3abe302b6d9a1256e6a915429af4ffd2
SHA256 7101c5945c026bef41d2cbf5bb5865976af92b56d326336b89523c385680f2aa
MD5 f8b1a6f2a7bab6ffdef1e78a48e7a7fa
SHA1 baa1a354622fde5fa03e28bc3eb4f15433a96e5d
SHA512 d6b5ebb90f8ca94506af568b9d33c16abcae43840e7e5bce3e40078af9a5aad7a49470ac1a502e3376536e7bd74a0efaacf1555ef00b5ac2a07ed1210e830505
SSDEEP 6144:+8dWR9kvIuX9RdmKeG7oguuK9kMu9nliHxcUG3ARyQfVKrFj1L1Or2YzKN3:nMRavIsoKpoFJu9g43ARy0VKrROrvo3
TLSH
T13E54131271A1CCF7C3A82372893A6B6C4EFACD492180730BBBD47F0AAD737515926657
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

5e:87:d0:de:31:5f:90:ef:c3:a0:35:51:7d:1b:dc:3c:39:be:ca:23:84:04:06:c3:91:85:f5:fc:bd:af:9a:db

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Farinometer,OU=Rushen skoddens\ ,O=Farinometer,C=DE,1.2.840.113549.1.9.1=#0c19426f6f6b6b656570696e67404f70727573746564652e507265

Chains

Jun 4, 2026

CN=Farinometer,OU=Rushen skoddens\ ,O=Farinometer,C=DE,1.2.840.113549.1.9.1=#0c19426f6f6b6b656570696e67404f70727573746564652e507265

Minor OS version

0

Major OS version

4

Entry point

12750

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetTempPathA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess SetEnvironmentVariableA Sleep GetTickCount GetCommandLineA lstrlenA GetVersion SetErrorMode lstrcpynA GetDiskFreeSpaceA GlobalUnlock GetWindowsDirectoryA SetCurrentDirectoryA GetLastError CreateDirectoryA CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA ReadFile WriteFile lstrcpyA MoveFileExA lstrcatA GetSystemDirectoryA GetProcAddress GetExitCodeProcess WaitForSingleObject CompareFileTime SetFileAttributesA GetFileAttributesA GetShortPathNameA MoveFileA GetFullPathNameA SetFileTime SearchPathA CloseHandle lstrcmpiA CreateThread GlobalLock lstrcmpA FindFirstFileA FindNextFileA DeleteFileA SetFilePointer GetPrivateProfileStringA FindClose MultiByteToWideChar FreeLibrary MulDiv WritePrivateProfileStringA LoadLibraryExA GetModuleHandleA GlobalAlloc GlobalFree ExpandEnvironmentStringsA

user32

ScreenToClient GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard PostQuitMessage GetWindowRect EnableMenuItem CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndDialog RegisterClassA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx GetDC CreateDialogParamA SetTimer GetDlgItem SetWindowLongA SetForegroundWindow LoadImageA IsWindow SendMessageTimeoutA FindWindowExA OpenClipboard TrackPopupMenu AppendMenuA EndPaint DestroyWindow wsprintfA ShowWindow SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation ShellExecuteExA SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA SHFileOperationA

advapi32

AdjustTokenPrivileges RegCreateKeyExA RegOpenKeyExA SetFileSecurityA OpenProcessToken LookupPrivilegeValueA RegEnumValueA RegDeleteKeyA RegDeleteValueA RegCloseKey RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/System.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 904fd5481d72f4e03b01a455f848dedd095d0fb17e33608e0d849f5196fb6ff8
MD5 55a26d7800446f1373056064c64c3ce8
SHA1 80256857e9a0a9c8897923b717f3435295a76002
SHA512 04b8ab7a85c26f188c0a06f524488d6f2ac2884bf107c860c82e94ae12c3859f825133d78338fd2b594dfc48f7dc9888ae76fee786c6252a5c77c88755128a5b
SSDEEP 192:MPtkumJX7zBE2kGwfy9S9VkPsFQ1Mx1c:97O2k5q9wA1Mxa
TLSH
T1F2324C15031086F3E1D2853D682B39AB2FB969118AF04E438FB35952EE347C7AD79352
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

9993

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Demilancer/Bilagsmaterialet

SHA256 db0f3772c9295fe40f06c6812bdc28558fb3cc9c90c9ed012988023371ec8c60
MD5 f83bc65f38c48a1633e7242089a9b395
SHA1 cd29b3dbcf1dab08a656e3c22f41e42ee389cd8e
SHA512 8ce73d794c181cf14f4c3107d2284d61da4252c6a44862bb0ca08f85af292d7acf46986dd6399ce3485c7f9bfcaa5b4a17a8b385364412721cdb99a600ef5e7c
SSDEEP 384:F3xC3+ZJg2kugAuZSJyI36dLUBUNEhjBzpAOSZPPPhQ3DgJvhVj:DCuQbAmPvLUBSgBCOSbQghVj
TLSH
T198C29E86C375ACFEDD0BC538C8AE11E74AD420266B8FD8BE60697558C10F2D66734397
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Demilancer/Possodie.aag

SHA256 3d302a50b36ec4e397e2ceba8ab93e92b2d2a047d56d81075b125d735f17c467
MD5 5fbe71db499bcae8159909d144d57ef4
SHA1 ca9d177d2daa2e8d57403168712eb392b0b875f9
SHA512 aa9fa55eeb3d50a07f545fe313b5df3e5ec68dd68f79c8c4b1d368b3c20c877987bdb9f94b5e66790fe6cd77890807826fcbd37e12688bfade615b9f7f11f155
SSDEEP 12:0OnCOp0QcfIkOOm2RPOmytOcO8VTVYOWOH:06p0Qcf4O8mywzcxYKH
TLSH
T120222B00464997E61213E0A74502F27D7D40F89CC5C144AEC22B2982FE75AD86794BB0
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Demilancer/adjudanturerne.prg

SHA256 0d5218628cc428947050f228d5b590d762ad1f0a794bcc6be7197101ea7f36bc
MD5 f65181dfba068f14fc94bb32fcd89e82
SHA1 f98138f484893b5afb5cfdeeb752f0f63288c9e3
SHA512 d49ac183fc8c4234e0bdd304105495e503b82f69fa4481dcf0e89996b2ad68ae8c403c7a86624857df94662c6e3bc5ead5190534eca1e337fb62abdeef1e99c2
SSDEEP 24:LF8vTV6Rlj0aprAVszjRqyppd5uTvvTge3UsKuD0v1IqDU1:LATMR5pcejkyppWTHUcwuDcIqDU1
TLSH
T18CC24E8EEA94661F0F1E1AE0D457AF20D3BC121A6A4A2A0F33554FD0091C2FD03AC85F
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Demilancer/africanist.til

SHA256 5181193c6b65de5187358d57ca62cc0cafbd6942c654bbee11487a8b24585974
MD5 ab41a136502a8845f8a4149883556ae5
SHA1 9018a26d02d676dbc05cb38744eff25f7a4e9712
SHA512 ff88add8e5e3eeaafb0c618cfd2def3789743c2b197010bcc6c3bb679d330fb645d92ba476f58bf621f25ce6381d4e0834615b6c99d44bbb096feb98bb045b1a
SSDEEP 48:TIsXlmlODNkI10H/xPUs6FmHzMr7RfRHL:TIsXAXY0BOFuzC9Rr
TLSH
T1FD7307ED2471CA4C47B9417DE7187C062C62A7F86DA51AB639ACC25F930A0A1208F87F
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Demilancer/anacyclus.ref

SHA256 9248bcbf7e526bf2e6ab44c37dd5313c11e45e1d1776fefde9e1002fe443d0a0
MD5 5e3f2cc90601a34f8a450e139e38ac4b
SHA1 7c691663eff59abff8e09350201be018426e6f88
SHA512 926c13848cb45fbfbfc0b6349dc45cdc3457ae7f338fdb2bcc4f426edc032378870ec07854bbfa133e5adc953577f4a3a9b9ed7068aefa5dda012621a73e216a
SSDEEP 48:1BKjdTjC3Dskkw5WgGGlaUtg5PpZg9nbBLfwyvd:1BKZC3Dsdw5b8U+5R0NLfxd
TLSH
T102834AB20E28E75D2F7231B803F3897E65EE5238CD04592CC769CE31428D896590F60B
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Demilancer/successionssynspunkts.stj

SHA256 89297f463e822150c5a306335f87573a3fba91992db3d87b60a0eb420638c8a2
MD5 094139c6c423e09ef7eebbfb12657c6a
SHA1 10be594f41e6557019c207e51273b14d3a200d7b
SHA512 b7838c98699ebea5f9be0f222288328a590162b2dbe6d9e79e91f3b7e0b70960892fadd0e2a76f92c6cd0d20cb5e0228a8a5551a331781bc37c38be0b1905309
SSDEEP 48:+qAeWZ82dJen1QoW71QdmT0cHYuuE7R+nRFge/H6k8jZlBUNvEpxThb:vym+oU1Qdw0gBR+nzgChIl2ipxp
TLSH
T12233D7914D1265CADD468DDB3698BF83AD0982C62DC22827041F0D434124EBAB9B1E2B
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Hamada235.cat

SHA256 2b85fe2d53bfab1d1a98968a57c9cdbad4a2d52e085fb517fa93bfb83f5188df
MD5 3c322fd3359a6e1b0c52de353c60f494
SHA1 636834fc7e55eda2288417b3aeb696f2d9173b9c
SHA512 2c448932e25f11213842087056b6374af16231ddc9e504f2ed2e5007e6944c03e725c5dd9f70830c0a04cd42331b91465f82f01d3d3e52f89077a35bece91015
SSDEEP 48:MBtZQcaOscGQQ6BJ5XIbVdBLkQ8ODz01xDnPCflR:YtKcHQ6BJaJGNPCfX
TLSH
T1D333F88E64344CAD8886EB3DFAE006DD61CD959E6A048E9C4064818BB76DB3021254AC
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Heddet

SHA256 3c483ca372323af1346c4c51a68a45a4f2e684b771d8e5f1b096d3df360c4449
MD5 8efad16633f8a444be40dc391bb2ad31
SHA1 781694dabf819aa326a57a5cc3f2e6a1c422685f
SHA512 c4557bf88388154b7874db59f89c536ed20f18cd2e8d7cc47958e9d162535815e25ba408fcccf872723c71b49628b708ec26a48b0d01ad843b52345f1bae80cd
SSDEEP 6144:Ml8CqR5Q7APROF+9ohCCEgFQ1TAmH8Awbd+CFvfjpcMS:0vqRy7YOF+9vCgAhPZJRE
TLSH
T1C944F1984B9BC458D1513DFCC47AEBD0F8B65F5AF76AFCEE28146C180694A5B31E0283
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

7101c5945c026bef41d2cbf5bb5865976af92b56d326336b89523c385680f2aa.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Demilancer/Bilagsmaterialet

Demilancer/Possodie.aag

Demilancer/adjudanturerne.prg

Demilancer/africanist.til

Demilancer/anacyclus.ref

Demilancer/successionssynspunkts.stj

Hamada235.cat

Heddet

Sharing

General

Malware Config

Signatures

File Explorer

7101c5945c026bef41d2cbf5bb5865976af92b56d326336b89523c385680f2aa.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Demilancer/Bilagsmaterialet

Demilancer/Possodie.aag

Demilancer/adjudanturerne.prg

Demilancer/africanist.til

Demilancer/anacyclus.ref

Demilancer/successionssynspunkts.stj

Hamada235.cat

Heddet