d1e75f4de10a7e3d6c59bd425c671d806b2d081c67f07f4c8602b2cb99c6a9a1[.]exe

resource
unpack001/$PLUGINSDIR/System.dll

resource
d1e75f4de10a7e3d6c59bd425c671d806b2d081c67f07f4c8602b2cb99c6a9a1.exe

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

d1e75f4de10a7e3d6c59bd425c671d806b2d081c67f07f4c8602b2cb99c6a9a1.exe

IMPHASH e160ef8e55bb9d162da4e266afd9eef3
SHA256 d1e75f4de10a7e3d6c59bd425c671d806b2d081c67f07f4c8602b2cb99c6a9a1
MD5 7ce9d9629fcb36a1015290badf3fb4d4
SHA1 37c0a6923e420e970bcf18b8c6e118f8a3ed9ed1
SHA512 9e86fabda1c7ab7d465e9c1f3aace652c2629f06656f2175b1f07bff4d618442d49480dd0322cbc1eacbc543ca3251e6cf0184df00a255ded64061a8f2584a95
SSDEEP 24576:khDLUKUORadp/XqGXeo7D8K5M6LaPZYnWpi9Pm/YGX2ci8Pe:2DLUKUORS/qGXeSSuWpwPm/tX2XKe
TLSH
T1362502A1F394C8D9E8F90D71543799222437BCDEB8A1149E76EB366FE573302026790B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

51:90:7f:f9:27:a1:df:d2:e2:25:26:67:bd:eb:62:41:20:be:e7:ce:c7:38:9e:6b:6e:2b:fa:e1:9b:ff:c5:8e

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Kerneoperation,OU=arpen Evolutionistiskes\ ,O=Kerneoperation,L=Touillon,ST=Bourgogne-Franche-Comté,C=FR,1.2.840.113549.1.9.1=#0c134b726b6f6d6e657340556e7461636b2e4b6572

Chains

Jul 2, 2026

CN=Kerneoperation,OU=arpen Evolutionistiskes\ ,O=Kerneoperation,L=Touillon,ST=Bourgogne-Franche-Comté,C=FR,1.2.840.113549.1.9.1=#0c134b726b6f6d6e657340556e7461636b2e4b6572

PE Signature issue

Digest

8c:95:2f:f1:1a:65:2b:75:5b:60:42:2b:37:e8:a5:eb:16:fb:3d:41

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Kerneoperation,OU=arpen Evolutionistiskes\ ,O=Kerneoperation,L=Touillon,ST=Bourgogne-Franche-Comté,C=FR,1.2.840.113549.1.9.1=#0c134b726b6f6d6e657340556e7461636b2e4b6572

Chains

Jul 2, 2026

CN=Kerneoperation,OU=arpen Evolutionistiskes\ ,O=Kerneoperation,L=Touillon,ST=Bourgogne-Franche-Comté,C=FR,1.2.840.113549.1.9.1=#0c134b726b6f6d6e657340556e7461636b2e4b6572

Minor OS version

0

Major OS version

4

Entry point

12514

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetTickCount GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA SearchPathA GetShortPathNameA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess SetEnvironmentVariableA GetWindowsDirectoryA GetTempPathA Sleep CloseHandle LoadLibraryA lstrlenA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA ReadFile lstrcpyA lstrcatA GetSystemDirectoryA GetVersion GetProcAddress GlobalAlloc CompareFileTime SetFileTime ExpandEnvironmentStringsA lstrcmpiA lstrcmpA WaitForSingleObject GlobalFree GetExitCodeProcess GetModuleHandleA SetErrorMode GetCommandLineA LoadLibraryExA FindFirstFileA FindNextFileA DeleteFileA SetFilePointer WriteFile FindClose WritePrivateProfileStringA MultiByteToWideChar MulDiv GetPrivateProfileStringA FreeLibrary

user32

CreateWindowExA EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard GetDC SystemParametersInfoA RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx DestroyWindow CreateDialogParamA SetTimer GetDlgItem wsprintfA SetForegroundWindow ShowWindow IsWindow LoadImageA SetWindowLongA SetClipboardData EmptyClipboard OpenClipboard EndPaint PostQuitMessage FindWindowExA SendMessageTimeoutA SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA

advapi32

RegCloseKey RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegEnumValueA RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

CoCreateInstance CoTaskMemFree OleInitialize OleUninitialize

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/System.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 75ed40311875312617d6711baed0be29fcaee71031ca27a8d308a72b15a51e49
MD5 a436db0c473a087eb61ff5c53c34ba27
SHA1 65ea67e424e75f5065132b539c8b2eda88aa0506
SHA512 908f46a855480af6eacb2fb64de0e60b1e04bbb10b23992e2cf38a4cbebdcd7d3928c4c022d7ad9f7479265a8f426b93eef580afec95570e654c360d62f5e08d
SSDEEP 192:aVL7iZJX76BisO7+UZEw+Rl59pV8ghsVJ39dx8T:d7NsOpZsfLMJ39e
TLSH
T1BE324B19135442F3E5D5883D186A3ABB1F28762196E08F83DFB36881FF386D56D39312
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10020

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Duve.Ply

SHA256 4d05bb1b2cc8c357e44239220924b5414dd4c1fa4278b6fcd358fb921425c39c
MD5 2aa9f7c07bdac90273b4d4ce8ff9629f
SHA1 5f107040622959335eb6c2cba45de660f8d50bdf
SHA512 7dd0103467623b1a7f448032e19d1038304bbe285dd83b30418995d1f0c6dc5e7b88ddf78e2794a4398ec4df843d11810aeb11d1dc372e675d66de992155bb1d
SSDEEP 6144:NBGcBzGVNfIWDTIzzwyYaFabcamGodtsL56rac8MWz570:HGMzYfxTsYa0mHg56qz570
TLSH
T1A374128C86EB88CDDF516470F999131EA0DC7C5D3D1BA0BFD245E09B62D87EE212C166
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Halvlegsfringers213.fas

SHA256 dbb51c9af5038149b1ab268c84bab4858265db86c9831611af371158e8962e76
MD5 c74643babb4ae6899be5379a3c38c612
SHA1 200f85d007f06630eee39bc965101291bfad6ede
SHA512 7a458ac6e8519cfc64217af3a9814bd0e3f96b804a048e52457f367ee2a35bb9b2a208ba50d8a7ba60fb3da905906ee81bdef2fcc09e3ac4691576959da84d21
SSDEEP 6144:K2GACBK1d8akzAY1ryfdN6WQaXt1HB5GzBuOcUhiMcu4qEnUZ77hy0bIg+iOl31n:T
TLSH
T1314612768B6A8BD045D9130817062B73BB2727091F8D0D36C71FC283B9FBB991B45D6A
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Landbrugskrisens/rverhistories.jpg

SHA256 52376f8e97df1cbca48e9bc396da401a7198146b8eedf49260c86b4e723db179
MD5 2677cf0288e4beb1b275210d625af715
SHA1 8fcde93855238a24905accbaab83b303a5fe93b8
SHA512 a4f491e26965b238c4b34beb104ff6e04d37464252970019f13198bab3e53ef2ce2471492dd7a221fbb299c4b8e7a5d919818d9fb5d3bd2c8b14e4d3ef09c37a
TLSH
T18241D822B77B675C8B07046C7916736BB6C25EE056A44B361FE448B3D104CB95144BE8
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

Landbrugskrisens/tootlish.jpg

SHA256 779002a2735c21b8c681649b82e4dca9c455d1e0944d07e66178006b9c3467ce
MD5 f15f76edd004902cdc78bcf84a5acf81
SHA1 40c9a591ee425f0a970d27cce143173a19e98e3d
SHA512 9d5bbde9c0a6fc257f8a8b6731f78a249c50b54b5182046ad2b037c9dedd81401f4e89e97afeef77dfd78391f64f2ae3cb02d05daf282df2a60e5a02c1fdb14a
SSDEEP 384:3aNVZvpFphRH/t4VJhsDcT2lrCpS+zkqhS68kqQiSwplL82COymcySA:3aNfTzRHaJdyl6SOkVZoiPpZ828ySA
TLSH
T151C2E1498A4B642E378096F57608918937BF54AE0C2CE1FCF309955A4E60F76CD707D8
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

colognernes.fod

SHA256 46d31f14b71490f03339281af847f8284c174ac3884649b68a58b688fe7db3aa
MD5 7e4eebd7952ed181301ad44ea655d039
SHA1 cb032c9372c6bcb6b22f1bdcce6b3d566e2ab7c0
SHA512 65950a66e1b256c6b69d820f9acf45e0d2f7dae4a04cf0ea3565f94d4c4788edd4fabc5e514ba0c50416f15f63febbe7646330e4831bd9a7273358b2fea3b9c2
SSDEEP 3072:e672SIXynb9nGENtnK/JW2Wt/SpcWEAxP9yob4kDk49qX9VhaFmNQkIC2mHY40PF:E
TLSH
T15616123032718B464BBA4C775E9AD054ECEE4B1400CBF1538F409F6E8157256E7EAB9E
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

perlekde.dis

SHA256 d7ecce48466a3ae6acae5a32db845b40c6ef84bcc030e397b7eec54cea85f78b
MD5 b5c700fe95a9fb0631ef96bdbd894258
SHA1 192814f374999289221be46d866010ea5135b5aa
SHA512 ab4dfad76eec1a2ce64b3d7e24811816473ed58c832a63a95a729f224bb8f51f82f66b1e6c335d967b1bb084b1445e687863450d60f8b2c7f4de71ec71e5e392
SSDEEP 12288:Vu7Xbug6QVYUEznt/HyaPi2Rh0+I2d8t9sVwGg9ChoXaJiiJpE9CNlJHIl5U/lDv:wo
TLSH
T1292612E947653677AB63781C688B1F2CE704A8A10D0DC91477E21A7DBEAFA21EC06417
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

d1e75f4de10a7e3d6c59bd425c671d806b2d081c67f07f4c8602b2cb99c6a9a1.exe

PE Signature issue

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Duve.Ply

Halvlegsfringers213.fas

Landbrugskrisens/rverhistories.jpg

Landbrugskrisens/tootlish.jpg

colognernes.fod

perlekde.dis

Sharing

General

Malware Config

Signatures

File Explorer

d1e75f4de10a7e3d6c59bd425c671d806b2d081c67f07f4c8602b2cb99c6a9a1.exe

PE Signature issue

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Duve.Ply

Halvlegsfringers213.fas

Landbrugskrisens/rverhistories.jpg

Landbrugskrisens/tootlish.jpg

colognernes.fod

perlekde.dis