9272a0ca7542ef993f431fc943f3a2eb9bf395dbb1dbbf2c483fc36cba365bb2[.]exe

resource
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/nsExec.dll

resource
9272a0ca7542ef993f431fc943f3a2eb9bf395dbb1dbbf2c483fc36cba365bb2.exe

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

9272a0ca7542ef993f431fc943f3a2eb9bf395dbb1dbbf2c483fc36cba365bb2.exe

IMPHASH 3abe302b6d9a1256e6a915429af4ffd2
SHA256 9272a0ca7542ef993f431fc943f3a2eb9bf395dbb1dbbf2c483fc36cba365bb2
MD5 991c574817e1e53def29dfbb96222480
SHA1 e0117c241037364afd92ea0f5f84c45936a3b7b0
SHA512 b8309e02f414a0faae76ab19c4067b5528032309d973193b41998f862208f667867e487ffa2d5e5b21c072cb052dacbb46c0bdfb992b28c619a32569f7977004
SSDEEP 12288:WT2Zk/ELBdJi8WBAn5FDMcPErM+NburfkqmRUWCjNXfLNkVYW86joMAZHLlbbHOl:WqeQvqWFDMcPkjbT9cjNXfLeGeJA7OxT
TLSH
T1D3E412A53E90C896FAA96BB05D278024A4F47CDD05E3830EF7BB377692F6391550F206
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

97:09:b5:06:f0:4f:5d:63:32:dd:64:93:6f:98:5e:96:5c:d4:26:aa

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Bnderkarlenes,OU=Picumninae Illipene swazilndernes\ ,O=Bnderkarlenes,C=FR,1.2.840.113549.1.9.1=#0c12496e77656176654053616b736f732e416371

Chains

Jul 2, 2026

CN=Bnderkarlenes,OU=Picumninae Illipene swazilndernes\ ,O=Bnderkarlenes,C=FR,1.2.840.113549.1.9.1=#0c12496e77656176654053616b736f732e416371

Minor OS version

0

Major OS version

4

Entry point

12785

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetTempPathA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess SetEnvironmentVariableA Sleep GetTickCount GetCommandLineA lstrlenA GetVersion SetErrorMode lstrcpynA GetDiskFreeSpaceA GlobalUnlock GetWindowsDirectoryA SetCurrentDirectoryA GetLastError CreateDirectoryA CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA ReadFile WriteFile lstrcpyA MoveFileExA lstrcatA GetSystemDirectoryA GetProcAddress GetExitCodeProcess WaitForSingleObject CompareFileTime SetFileAttributesA GetFileAttributesA GetShortPathNameA MoveFileA GetFullPathNameA SetFileTime SearchPathA CloseHandle lstrcmpiA CreateThread GlobalLock lstrcmpA FindFirstFileA FindNextFileA DeleteFileA SetFilePointer GetPrivateProfileStringA FindClose MultiByteToWideChar FreeLibrary MulDiv WritePrivateProfileStringA LoadLibraryExA GetModuleHandleA GlobalAlloc GlobalFree ExpandEnvironmentStringsA

user32

ScreenToClient GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard PostQuitMessage GetWindowRect EnableMenuItem CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndDialog RegisterClassA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx GetDC CreateDialogParamA SetTimer GetDlgItem SetWindowLongA SetForegroundWindow LoadImageA IsWindow SendMessageTimeoutA FindWindowExA OpenClipboard TrackPopupMenu AppendMenuA EndPaint DestroyWindow wsprintfA ShowWindow SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation ShellExecuteExA SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA SHFileOperationA

advapi32

AdjustTokenPrivileges RegCreateKeyExA RegOpenKeyExA SetFileSecurityA OpenProcessToken LookupPrivilegeValueA RegEnumValueA RegDeleteKeyA RegDeleteValueA RegCloseKey RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/System.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 b80a5cba69d1853ed5979b0ca0352437bf368a5cfb86cb4528edadd410e11352
MD5 c9473cb90d79a374b2ba6040ca16e45c
SHA1 ab95b54f12796dce57210d65f05124a6ed81234a
SHA512 eafe7d5894622bc21f663bca4dd594392ee0f5b29270b6b56b0187093d6a3a103545464ff6398ad32d2cf15dab79b1f133218ba9ba337ddc01330b5ada804d7b
SSDEEP 192:cPtkumJX7zBE2kGwfy9S9VkPsFQ1MZ1c:N7O2k5q9wA1MZa
TLSH
T1B2324C15031086F3E1D2853D682B39AB2FB969118AF04E438FB36952FE346C7AD79352
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

9993

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsDialogs.dll

IMPHASH ddbd50fe6279559edf7d1f1d89b42c2c
SHA256 5157fe688cca27d348171bd5a8b117de348c0844ca5cb82bc68cbd7d873a3fdc
MD5 12465ce89d3853918ed3476d70223226
SHA1 4c9f4b8b77a254c2aeace08c78c1cffbb791640d
SHA512 20495270bcd0cae3102ffae0a3e783fad5f0218a5e844c767b07a10d2cfab2fab0afb5e07befa531ba466393a3d6255741f89c6def21ec2887234f49adceea2f
SSDEEP 96:oOYqZ4zC5RH3cXX1LlYlRowycxM2DjDf3GEst+Nt+jvDYx4L7qndYHnxss:oOYq+CP3uKrpyREs06YxA2dGn
TLSH
T1C4121A635A4455F3D5D7223A21AA2F2FD73C9324A062BC0287779E462BF431A7D3A341
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

7429

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsExec.dll

IMPHASH 46f8b6973f33717335c0f6d8087de67b
SHA256 370e47364561fa501b1300b056fb53fae12b1639fdf5f113275bee03546081c0
MD5 0a6f707fa22c3f3e5d1abb54b0894ad6
SHA1 610cb2c3623199d0d7461fc775297e23cef88c4e
SHA512 af0c8ca0c892f1b757fbd700061f3d81417dff11d89bdff45e977de81ad51c97862406cf7e230e76cf99497f93f57bf09609740953cd81b0d795465ac2623ea8
SSDEEP 96:e97GUxNkO6GR0t9GKKr1Zd8NHYVVHp4dEeY3kRnHdMqqyVgN0u3e:eBXhHR0aTQN4gRHdMqJVgN0N
TLSH
T130D1097675E22EB3C50ECA353C527A2B57F8C8111B9401549B938BD238C5EB3EA39282
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4231

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Anormality208

SHA256 3ca42efbefcf99612676908bcf5ab6d157fe72fb0b97e4b5fff68c3206a39cdd
MD5 4f40397a01f76c26e8608d8df502ec6f
SHA1 faff3770f7cb91ce3a231fc34add6e52c94b54aa
SHA512 5ea4d903e257c3e6ccf8aa6ff839c330fe38d098db7c31a3a0840bdd42f8d8e5decaaf586fe5a2f6e93fc729559f3575fbf7a44d99966546702070e1fbcc42ef
SSDEEP 96:3L9/jznmz+Z/jO873gGzPxDFoxG8etMHiQa9/Ei5vAwUlRo3x25DZ1EugI6v:7Vns+Z7O8bgGzP4AK29sVcxKfTgI6v
TLSH
T1C3E15B54CB565CFFD903A8BD885D6AD29E61142A234DA87C81E8F424E1662C2333B23F
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Debatgruppe/Antipode/precolourables.lou

SHA256 74c815b65790c75f6e2483485b199bc9e52f887988a0542473a002380e116bec
MD5 130f188f9f96dd7da3bf9a1225efeffd
SHA1 877bd74370722ecd73742cac0aa8337ea3320c44
SHA512 10da44dd9fc65b69d42057b9dde3a815e20a15a8b9b0cb51d55a30ce958a88ebd72693dbca5ee7d3eba44bc9dcbcf5a2464dd60b60a28c1a330ad29cf932752c
SSDEEP 768:0qmVPAnSigsQc12ye5FJRQ8OYmnomWT0PyYIOR0ZKECE32dMKdRG/hdoQ5nZrPLX:qjr4nulmuB
TLSH
T1EA66136884387813FEACC92C6984CA629E4D1535C9BFE7589064B17FD52022DFFB71A3
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Debatgruppe/Antipode/sammenstyrtningsfarers.cic

SHA256 e949ba18b4e22a9846bb637ad04927335961c87f0788bd986f534bd020be789b
MD5 ddae0dd1564dfcc20d31c9d27f0bbfe3
SHA1 0afb255ef94fb6f4a582e6939ecc8460d570600b
SHA512 b3b3c95952ab2ade5265fe0085b6504b8cefe3276ae336e6fc1110ba8c04b45ac4970b9d5f59a0e7b991c5d06b90485553e06145d1a889fe38ad2c8d178ec9c3
SSDEEP 1536:ZsO8GUrAqwdQI73CPU7oBG0cuZPGMAtSpoAOLKOE/AB8IXns32O6pOPOQ4Ii6eCK:vb
TLSH
T1B5A50190450DEA569B9CB63F0CC4864D9FCF8EB0F6B6320BE8B1003998B376D1897D11
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Debatgruppe/patrimonially.ini

SHA256 0c662d9743e351c5fb8a9d1263fee6f475b3c188a4f6d3a65eabe415800abeb6
MD5 b5d984aa1a3fa9764416697d7ffb3fab
SHA1 a1cad797494a336feb5e19cda99d6e3d5d6bb992
SHA512 e55799a7475ed96dba9bae8849dd98f5ca04b4a0aab6ca92b467b4e387e9f6d67028a5f59087351a7783724d89bf70bf5a814b8d44b8b01650b7a646715e5b2b
TLSH
T1C1D0E72844A15D0B1D385A44391120C117B5D3446434D572779027D83460118A35C337
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

Klvebrnde.ini

SHA256 1f6e5898f1061288fe5fac6dde419558efb675e8d88a14e7ea7b5ea4ddff54ed
MD5 2c34431203fb43972f6dbdecfb2fddd4
SHA1 45ea6b28653d499db2f753378cdb532c6a393f4e
SHA512 3e917be0f57d87ff1c92502a6adeb062983f04f4191c166e5945fc6942427643aa929a797c2f02fe97ca46795bade7bdd27b2166ce655222fe5b292da3d71f6a
TLSH
T182F0DDC0C5408EFD0D431B676E8618D245AE695B8ABAE672E1A786256468429E339228
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

Selvbiografiske

SHA256 0d26379f90fa3f1b8da64e2d97dcc81ee40e7b4f635f436074418814aba05546
MD5 626b6b17831621747d43bee5856a1eba
SHA1 a7e0a6b95c8c77601707a8a9435e39de66b21a36
SHA512 5b43d1a5a10d5e75c2eaa04a98bbf760add71cbda0b8bd43f8c9e13295ca0f4b42135dad4aef98522551ca0559c38f1b6f7e6accb71e1c383faa5dd7a2ffc4d6
SSDEEP 6144:NGsymfBofOQcKn1CrIWi9M025zV6euMh5VsG7Uo:AM5TQcE9OJrfVs0n
TLSH
T1E644F12B50106ECBF4E7B7714E9EC4682025C1D77E7447AF857EE08CA4D71A2E18BDA2
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Skider201.ini

SHA256 74bf4859b0b9d806b3ca9860344da9bd25090832b121d4498752efa09e36ef2f
MD5 3387b12f417ce43e20582c3c9f9f2b00
SHA1 45ec848181defbc908a4874933882b25ba4bcd63
SHA512 49f4aef8e2413fd67ebdeb688f7a57d0237a601c125da52dfc38b7ae83e27fba6efc468f34b18bae708ff3b4c7b2cbc0a1329e1f71cd8aaa1ca8dd04e4b45b21
TLSH
T170F02034C6446B8E4F69AF39AE6A6086F42D3A8C03044019DD4347FF9B916AD6D7D310
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

dandyish.txt

SHA256 7dc9571a7fb24dfa23d0d6302ff1b4fe0265a84433d96e0986385aff169e7c02
MD5 59884eca3dfb921267a2f518bf5c4002
SHA1 eb85a1daccd21ad7118e26b4e881253596bd2698
SHA512 d2efb302db45306d8f4364fd2d82d3227de0eaea80ede17844b10b64c9c698e92724d2765f028917fa7e96bcfdb8e00bf52f7509e493f7c640a9e2f5cfde9853
TLSH
T12BF0057EED05451D3612AAD955435D40C36C410CD9115760794F275DAC815D9539AF3C
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

emnetidsskrifternes.txt

SHA256 4eceb60df0f4ca5accf67ecde1217819e46d314dcea2b238aede0ecdc3692947
MD5 ebc44f487785b2d86c353283f2a2e1ea
SHA1 3bffd0468c9b7f6cfc461d58c258f22b70d55f25
SHA512 d6b7baf384f0239277d4afa6d577d901d5662f098987ec5215c160ced2211d2caaa3703a5cb92d066ee8d586949ab6cf9e1b072a16f5b906c6098d17f1b64f64
TLSH
T134F06848ECA015040ECE06B504DC0035023E28593703F375FDED3A8E0503CACF776599
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

kasusendelse.txt

SHA256 90d076ef3c4e6648472e1426ec2dde754f5948ac33f86090e956df71b7f5ccfb
MD5 75014ed283094fb798f50487f44a5e98
SHA1 b81f1468671db01a994567ae6ce181f6f67fc0c8
SHA512 641913a42736adb8caf2a97f0c8490d56dcc7723127ae8bf93651e209ecee3d8f5a93732d91e8957c9e62e25c68cfb2b0b9ef9a1952a48280630d5f486579933
TLSH
T1EAF0D455164E156C9E1D839DDC05AC10F5795399C9472055D9DCD307174B70CC57C7B8
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

paaskyndelsers.txt

SHA256 973033e3c5c273d2d47f382bd17a2f04b7c283d40e63622e0c383980e9217057
MD5 63b138c4077d544f0e17afa03f17a8e1
SHA1 cf3ca67c5a41f6f1f621f04650d16dea51fea6dc
SHA512 5b64f5855f7f1606d6108aae0ce1699a07d7aeb2225e07f98f5c5d2b91806375f044d47fb2a8322ef345441532cfa7358bc1560274ca1bd3840e5c208008b71a
TLSH
T196012380EF10A64A8AF2130BACC1C77241ECEC7F8F42012127F283620007114BBBD116
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

9272a0ca7542ef993f431fc943f3a2eb9bf395dbb1dbbf2c483fc36cba365bb2.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

$PLUGINSDIR/nsExec.dll

kernel32

user32

advapi32

generic

Anormality208

Debatgruppe/Antipode/precolourables.lou

Debatgruppe/Antipode/sammenstyrtningsfarers.cic

Debatgruppe/patrimonially.ini

Klvebrnde.ini

Selvbiografiske

Skider201.ini

dandyish.txt

emnetidsskrifternes.txt

kasusendelse.txt

paaskyndelsers.txt

Sharing

General

Malware Config

Signatures

File Explorer

9272a0ca7542ef993f431fc943f3a2eb9bf395dbb1dbbf2c483fc36cba365bb2.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

$PLUGINSDIR/nsExec.dll

kernel32

user32

advapi32

generic

Anormality208

Debatgruppe/Antipode/precolourables.lou

Debatgruppe/Antipode/sammenstyrtningsfarers.cic

Debatgruppe/patrimonially.ini

Klvebrnde.ini

Selvbiografiske

Skider201.ini

dandyish.txt

emnetidsskrifternes.txt

kasusendelse.txt

paaskyndelsers.txt