d28b8c88540db937fd047e391aa986a7617c64a80191f970ea297de4d655c4a9[.]exe

resource
d28b8c88540db937fd047e391aa986a7617c64a80191f970ea297de4d655c4a9.exe

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

d28b8c88540db937fd047e391aa986a7617c64a80191f970ea297de4d655c4a9.exe

IMPHASH e160ef8e55bb9d162da4e266afd9eef3
SHA256 d28b8c88540db937fd047e391aa986a7617c64a80191f970ea297de4d655c4a9
MD5 d61b3f540307b55fda16c01cda137e6b
SHA1 a49650facd316439308700ac3eb3b0e0b9ff6654
SHA512 4dd685cd81d9ea6d0151a21d31a814d3bbd12045734140464f750e78998e93d03d4824d43d5f8da40f618dbc84bb292306a20816a933e28cf252d3d0d6e9f9f7
SSDEEP 12288:qBGmPOtATld0VbEevsnT7scuQux0HPmc8qyy3ESRze8vJWiG9:JmBlFevsTFuQCOsXv
TLSH
T10AE42395FD92CF2FE45E9A363035EEF8E4FD7A40400982D72374A28B7819A5B0D5B364
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

07:72:5f:0d:88:58:5d:f1:37:e6:9f:c5:e7:c8:93:1e:0c:a3:41:1b:af:4f:aa:c3:56:a6:b4:6e:87:c6:9b:f1

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Colophon,O=Colophon,L=Kingston,ST=England,C=GB,1.2.840.113549.1.9.1=#0c0e52657374736b6174404b6c2e7472

Chains

Apr 14, 2025

CN=Colophon,O=Colophon,L=Kingston,ST=England,C=GB,1.2.840.113549.1.9.1=#0c0e52657374736b6174404b6c2e7472

Subject

CN=Colophon,O=Colophon,L=Kingston,ST=England,C=GB,1.2.840.113549.1.9.1=#0c0e52657374736b6174404b6c2e7472

Serial Number

40:a8:5c:8b:db:93:33:ce:83:8b:80:6d:31:c8:e0:70:85:40:e9:97

Issuer

CN=Colophon,O=Colophon,L=Kingston,ST=England,C=GB,1.2.840.113549.1.9.1=#0c0e52657374736b6174404b6c2e7472

Revocation Status

Not revoked

Timespan

Feb 7, 2025 - Feb 7, 2026

Subject

CN=DigiCert Timestamp 2024,O=DigiCert,C=US

Serial Number

0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 26, 2024 - Nov 25, 2035

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

12514

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetTickCount GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA SearchPathA GetShortPathNameA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess SetEnvironmentVariableA GetWindowsDirectoryA GetTempPathA Sleep CloseHandle LoadLibraryA lstrlenA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA ReadFile lstrcpyA lstrcatA GetSystemDirectoryA GetVersion GetProcAddress GlobalAlloc CompareFileTime SetFileTime ExpandEnvironmentStringsA lstrcmpiA lstrcmpA WaitForSingleObject GlobalFree GetExitCodeProcess GetModuleHandleA SetErrorMode GetCommandLineA LoadLibraryExA FindFirstFileA FindNextFileA DeleteFileA SetFilePointer WriteFile FindClose WritePrivateProfileStringA MultiByteToWideChar MulDiv GetPrivateProfileStringA FreeLibrary

user32

CreateWindowExA EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard GetDC SystemParametersInfoA RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx DestroyWindow CreateDialogParamA SetTimer GetDlgItem wsprintfA SetForegroundWindow ShowWindow IsWindow LoadImageA SetWindowLongA SetClipboardData EmptyClipboard OpenClipboard EndPaint PostQuitMessage FindWindowExA SendMessageTimeoutA SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA

advapi32

RegCloseKey RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegEnumValueA RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

CoCreateInstance CoTaskMemFree OleInitialize OleUninitialize

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

Fibrolitic.Big

SHA256 2a07a75f46c3581a3d4c8476ccd99d5bfc245068e8ccf8c63062c8ad454f2667
MD5 af700753cb0342bab72d54e1802e8267
SHA1 3ed6f6444bb29a9712f3d4ea3a552df947e1f053
SHA512 43582ffb10b3bcc3d5c61b45d3ea6519f7575c74b91780f42c86e5778765997eefe6abd58718aa3893aead787baceba9d102ba8b923a9b9bdeb9d05a6c4745b6
SSDEEP 768:EYeDV5sQeeXv2o2ATtEG2soZeLkkU8zY4guLn1z225KCqRnzvqNRc1ws:3eDVDf2DATtNloZeLkkSuLnR24EeRy
TLSH
T10633D154AB6C161C0901226697420A223FFC4E7CF5EDC9B6C91715AF32C55BD86ACEFC
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Lagdelingens.Kbe

SHA256 44dc1046531e40deeb033a4dc8ea225b5d6e90a2b924fb852d78a597895d7288
MD5 969fbf2f1f0cba3680bed559734b95ab
SHA1 efa2971ae3b8b412c797618898021f4c06d37021
SHA512 24b4c4dc351f8a5a3b3c1d29dfbdf526172ed0b505ede81983751f7dca843071cf2ab7596625c662124dbe2a22ecedccde1340b0f42fda855cbf3cb47eb64672
SSDEEP 6144:uzgzgN37e+T3K+rdgeOthQflDNPF1VlTUf+xPTraTVc+qGPXllcYnWW/f4RYDmjj:igzgpe+r+kPdlQeraT+Q1lcY//fY++
TLSH
T17A8402C1A1D4176DCE7822F1462F07FAB4D6A47246F90A243591C913BA1990CAD2FEFF
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Lycodes69.jpg

SHA256 132ea1da9bd9b592ff9ffdb5f473304d31d2b0e13339b2cd4174a943156632a6
MD5 702f8be99597dd1fce7a9b231e09f544
SHA1 05935b92dcc8cbc202c18006d2b0e87aad377ad0
SHA512 8ef3f55c8b186e87000ecdbdb1e6ba7a74cbd1c9da1c57b215d1e5f19473bb7c68badaa6bbfed665503bf1714d5973316c2a05dadae89c7229ec682a41afd899
SSDEEP 384:PNJxmKk/t+lD06UlOiV6hKEJnOrHep81AEGrijpkz4PyptAr:PNJ4Kc+lD0n9VZzjAji646py
TLSH
T13062BFEF54877B338F125F0066355169A6A3197970B4E8329BBEADAF5200E3C68844F5
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Prechart/teacupsful.jpg

SHA256 a9ec717e80b0cbe9eb47809933534c2751a8c8acf016b3e79cdc5efaca2e18c2
MD5 b3ea5d0475aa66be779d67e54d983887
SHA1 0eb327facc9a9b805c23b4feb13ffc649e60ba79
SHA512 7585008407b3f5a0c4f9c9a38c7fb2dac404e7f5931d29465f4cc6a5ab052f71b08b5452153968a13a5e838df63988e848bca64cb45d33fa3dc538422ceb4477
SSDEEP 768:fvyFDLHWXBKGNYUTXCNzBZ91bTUl7uBERcQBb5kad35KyWf8U86MDQ:fAnGkstLChBZb4lp3k0Jbex8VQ
TLSH
T1F0E2D063AE11B52BCF0B5E696D8C3BDC1628229D3524757EBD32C453AD64E7C0C2AA18
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Prechart/udlbet.jpg

SHA256 87893b95d1809054ab132e91a607fe4bee7f7f922e430c0092b5ff295c63fadc
MD5 144d7917f674f06af3856341ae6fb953
SHA1 de38a6983c2b6c9374b89dbe97a27b874472b68f
SHA512 e6ee78fb2cfdae542b6296363c0dae519da80678763c4dd47c11946e8587a1357a500ce1197e4ddb30a427fdf0e1b25f9f2d35a27240ac66020d2aa4a37b65d0
SSDEEP 192:Lhh7nUE/dHjcJDvu59aDtHdgwyKx2UR8jLvrtvpjP25nu8:NhJ/BIvLDt97NpqPvr5pjP25p
TLSH
T12A229E0632FAF25C1FE246CCC231113693A89B316099DB7549E1B1B08225CB319DCCEA
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Prechart/ulcerous.txt

SHA256 5d714146654d1e1641c2b5bbe5e3370cdbd57be725d52a14aaabcfda52a4081c
MD5 9d706e95a10eb8c38bbd2570cebbdb48
SHA1 a62845df07745b4c05f9a18962fd8459ea94e55f
SHA512 2ae94971a58801ee6fcd19ae4614b056792281d083c270d99f46bcb2a813a200cb161e1932dbc2a76e2ada6586cce29680d1ba34a6f0deaece1daf84300339a3
TLSH
T11EF09635F70138114DA78396F1588C838A1C870A84BCC0F16E9C2A3D3685CBED23C708
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

Reluktansen/smalskuldret.txt

SHA256 aea52d27230b89ca1b732866afbe137a98e65100049a56b3293def8d5fe7dda0
MD5 ed19ca99581136d44b35bbb2240a6bf6
SHA1 d0ac1626cb4713dd5e6b3ff63d818efac90ab4b3
SHA512 d785955c6486bbfdd24879a66814e7fec52a179f2a1b41a010e5896da3cf0753b1ae0ec4db029b6f4e2fb545fcd3b633fc3196f7d1c0cf643b9ba7755a1292a1
MD5 SHA1 SHA512

NSIS installer

installer

bremsernes.bla

SHA256 a4513418203c7c71da6f04fb5cd697d76443331b8843ed3b0afeb6d585b83a70
MD5 822e4af65f6003924c68fffb9b8ae417
SHA1 6b76bd2b8f54cbb0de47f0cdfff8ade730b2ec18
SHA512 4ab1179a4a6fc36401bed0d3247fb0b6677a8db7df4faeb84dbf6904d81fd185072158e93ea408166818f61d3447d036dcf0915f0d6704f45fe8d43f33d72a43
SSDEEP 384:vyAILrqcqYmpWENJpZ3H2AqW9XfS2BW3Vtx+86Guc/dGcS5:vyAgqYqIUaltvuc/dLS5
TLSH
T119D4D0046815DF244AFA993976EA778F547422CE7E94028F594CC4FA7E04BEC50ACC36
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

intermedious.jpg

SHA256 9a837ddbe0837d16db61fb5b9e4aad7315053716ab58d5a2368c17e7c83d150c
MD5 e1fa331e352722a3287c386d4bf4cc5c
SHA1 f69d79e42cdfb8963750d2aa01bc4cdc665866c8
SHA512 6f32de325b510bfc6790e5994979446ebb4dc96b60e25218108850e0c5de17288e5e785ee5b2ebbcf17ffd046a757f7fb3d80ea7c6c7abe91f67fb99cdc23762
SSDEEP 768:bbK+a4c4D3NSpEBJFiTK184EEDtUIwQJuN98fw1/MuWIOgm1Z+pYMPre8N:bbK+a4dEpBT7ibJki0/Ip9KR
TLSH
T19603F14FFD12271227FA9B5E7B493B025B563B02FD027056A551A6DC2C20F36A60F72E
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

lymphangiectodes.spk

SHA256 12a74293a01078906ce14f80314eb7fa6f1b99080c5f8c4069523b53559d5e37
MD5 a4c3fcc59ac519ce7328f14ae746102c
SHA1 ea0cdbd11072becb889d50f309d36f253c7ccc73
SHA512 82ac281a4ae952342d23a1fb4accd27c3c41e2336c3361c580fec89d954a29328fce71039ac72024bece560f7b8f4625a34da53cdae3ff3a5b3da2293f36424d
SSDEEP 96:k6yT+4SpgRmrAVu0jAsldUvyGi12W9czi9Tf1tpXHmxc59ZcgW2gsT2xZZ0e8Wdb:MZi
TLSH
T19BB4C094EEF47E929CB018EF4AC24414F73ACB648D5853B4087720A6FF5D4ACE35A5E4
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

ndsagedes.kro

SHA256 53237a9f5409076abb84feb4122112934bdc27f7b491fdab701aec18ca1d6109
MD5 d1a90bf932fc66b53107756ad082ff54
SHA1 e40d414a7aea7c5baca7f7f13f9e841ad372d798
SHA512 15edcb181f01c5c5b27f87e333df0cd492b678692e310f6223f90d6891b79d8303b6672c8f7675f1bf1780c4fd7c24c73d253d82a499eae8c828c6ca37cf6848
SSDEEP 3072:ynmUaVkYGkQP57sAjCkH8cNq5gRgXJK93r/jSZTSVw3hjeXileFxZRyq8xZWzBSK:xlg
TLSH
T13EE502D6C656BFA637AF67AFCE6BA4B3F8677E0701DC5BC73007D688104805B6514122
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Sharing

General

Malware Config

Signatures

File Explorer

d28b8c88540db937fd047e391aa986a7617c64a80191f970ea297de4d655c4a9.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

Fibrolitic.Big

Lagdelingens.Kbe

Lycodes69.jpg

Prechart/teacupsful.jpg

Prechart/udlbet.jpg

Prechart/ulcerous.txt

Reluktansen/smalskuldret.txt

bremsernes.bla

intermedious.jpg

lymphangiectodes.spk

ndsagedes.kro