51e21ba467683d83fa2d9856dba5c40375b05d6b5627c7c37f8024af959e235f[.]exe

resource
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll

resource
51e21ba467683d83fa2d9856dba5c40375b05d6b5627c7c37f8024af959e235f.exe

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

51e21ba467683d83fa2d9856dba5c40375b05d6b5627c7c37f8024af959e235f.exe

IMPHASH 57e98d9a5a72c8d7ad8fb7a6a58b3daf
SHA256 51e21ba467683d83fa2d9856dba5c40375b05d6b5627c7c37f8024af959e235f
MD5 c0c0dedfb87d4c312363a9cd0259a128
SHA1 d83c9b52e96203f4f976ab2762a023d3b0bf141c
SHA512 717bd664a5465edde1b4ee771966157ee4db94be9e6b8be889263dee3a8005c6a671460223a5d5c970e9522b2ddf6a0b15ad6cceecf6160b7cbf792a0ca471ae
SSDEEP 6144:I5OhgOWGGYoXGEJE17bKiGJotXLeH14Xk1IAMRER43QtYm26Ndj:fhgOc92AE17HtEAQtYm2Odj
TLSH
T16854120437D8E0B3C92352715A3BCB5F1FA2A9006A98534FA7504F9BBD73541CE6E6B2
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

2e:9a:54:1d:f5:2a:ed:67:d8:42:c2:8a:a7:34:6a:be:f2:a6:b1:dd:94:ee:20:37:1a:0e:0e:6f:1b:df:77:c3

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Justeringsns,OU=Archqiologisches Grundstdt\ ,O=Justeringsns,C=FR,1.2.840.113549.1.9.1=#0c1846696e64657273404b6c756e736e696e676572732e536967

Chains

Jul 17, 2026

CN=Justeringsns,OU=Archqiologisches Grundstdt\ ,O=Justeringsns,C=FR,1.2.840.113549.1.9.1=#0c1846696e64657273404b6c756e736e696e676572732e536967

PE Signature issue

Digest

52:2b:36:1a:e9:d5:49:4b:b8:46:3e:dc:79:33:bf:a6:e0:3a:04:51

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Justeringsns,OU=Archqiologisches Grundstdt\ ,O=Justeringsns,C=FR,1.2.840.113549.1.9.1=#0c1846696e64657273404b6c756e736e696e676572732e536967

Chains

Jul 17, 2026

CN=Justeringsns,OU=Archqiologisches Grundstdt\ ,O=Justeringsns,C=FR,1.2.840.113549.1.9.1=#0c1846696e64657273404b6c756e736e696e676572732e536967

Minor OS version

0

Major OS version

4

Entry point

13096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetEnvironmentVariableA CreateFileA GetFileSize GetModuleFileNameA ReadFile GetCurrentProcess CopyFileA Sleep GetTickCount GetWindowsDirectoryA GetTempPathA GetCommandLineA lstrlenA GetVersion SetErrorMode lstrcpynA ExitProcess SetCurrentDirectoryA GlobalLock CreateThread GetLastError CreateDirectoryA CreateProcessA RemoveDirectoryA GetTempFileNameA WriteFile lstrcpyA MoveFileExA lstrcatA GetSystemDirectoryA GetProcAddress GetExitCodeProcess WaitForSingleObject CompareFileTime SetFileAttributesA GetFileAttributesA GetShortPathNameA MoveFileA GetFullPathNameA SetFileTime SearchPathA CloseHandle lstrcmpiA GlobalUnlock GetDiskFreeSpaceA lstrcmpA FindFirstFileA FindNextFileA DeleteFileA SetFilePointer GetPrivateProfileStringA FindClose MultiByteToWideChar FreeLibrary MulDiv WritePrivateProfileStringA LoadLibraryExA GetModuleHandleA GlobalAlloc GlobalFree ExpandEnvironmentStringsA

user32

ScreenToClient GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard PostQuitMessage GetWindowRect EnableMenuItem CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndDialog RegisterClassA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx GetDC CreateDialogParamA SetTimer GetDlgItem SetWindowLongA SetForegroundWindow LoadImageA IsWindow SendMessageTimeoutA FindWindowExA OpenClipboard TrackPopupMenu AppendMenuA EndPaint DestroyWindow wsprintfA ShowWindow SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation ShellExecuteExA SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA SHFileOperationA

advapi32

AdjustTokenPrivileges RegCreateKeyExA RegOpenKeyExA SetFileSecurityA OpenProcessToken LookupPrivilegeValueA RegEnumValueA RegDeleteKeyA RegDeleteValueA RegCloseKey RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/System.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 a1390a78533c47e55cc364e97af431117126d04a7faed49390210ea3e89dd0e1
MD5 fbe295e5a1acfbd0a6271898f885fe6a
SHA1 d6d205922e61635472efb13c2bb92c9ac6cb96da
SHA512 2cb596971e504eaf1ce8e3f09719ebfb3f6234cea5ca7b0d33ec7500832ff4b97ec2bbe15a1fbf7e6a5b02c59db824092b9562cd8991f4d027feab6fd3177b06
SSDEEP 192:yPtkiQJr7V9r3Ftr87NfwXQ6whlgi62V7i77blbTc4DI:N7Vxr8IgLgi3sVc4
TLSH
T107324A5503604AF3E986843C086A3BBF6F796B2196F04E53DFA384C0EE6D5C96D78352
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10465

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsDialogs.dll

IMPHASH ebc2d915841be8afc8fa1ee9f6850960
SHA256 3cdf3e24c87666ed5c582b8b028c01ee6ac16d5a9b8d8d684ae67605376786ea
MD5 ab101f38562c8545a641e95172c354b4
SHA1 ec47ac5449f6ee4b14f6dd7ddde841a3e723e567
SHA512 72d4b6dc439f40b7d68b03353a748fc3ad7ed10b0401741c5030705d9b1adef856406075e9ce4f1a08e4345a16e1c759f636c38ad92a57ef369867a9533b7037
SSDEEP 96:o3W4JlD3c151V1gQoE8cxM2DjDf3GEst+Nt+jvcx4K8qndYv0PLE:o3p3ggQF8REskpxZdO0PLE
TLSH
T13512F8235A4455B3C9E7223A31AA2F2ECB3C9324E0627D02C777DE562BF42166D3E355
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

7513

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Anodiserer

SHA256 80751cd79f7e204c230b4f1260ff94df49f0353ce48258229377ee3fde006dda
MD5 70daa5d64ec12bf32533e93f641a5d5b
SHA1 0583af79fd03dd171910a61ef264e1dbfaed2964
SHA512 b05d146a9fd4b1efa3b95038d1be1d17b12cd20db72d7f0e12d828a7a0367e097b6e6b31d8ff0f713f10a14e2f20466abf23657faebe9f6a7d805446d73743a8
SSDEEP 3072:W9GECHTZsSR5uQ7rm2CF+4UosgTIFdN/I8txjQ19oXITqk489icKd:W99uY4OHsgMZJzq/WOiX
TLSH
T190F3DFC253118D5BF2144874CD28FECF865A9C1B3F8AA4AB6E1B3184E177BFE9981C45
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Invincible.non

SHA256 aa6c60cad4351971a72dfd7ab9daf98fe2ec3c40ce73b369b376082bbd4f08ea
MD5 50646e4f8f89c20718f8851e8a1c19a3
SHA1 e77f8395c29e97a576e8a0a925615e4a290a50dd
SHA512 8c67ca59af990048a977f781cfa0fd221eb4c1b6af6265007989bd75fe6af92dab0a5072764ec2464116b9691b1540a594bcdd586062038fb22d535809fac207
SSDEEP 24:Bfu8OzgPgWyRcUcA2/vWsxneGVZdcE4sN9GobizZR:BnO3WyR3b2XWYodSiH
TLSH
T110E29460F7089E5F04A608420F20D54B9A400FF08167F6A083CA6FC7662868EE08249A
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Reilluminated/Mdrenes143.oto

SHA256 99a120df06aa823e77da6641cd0df22ee0e1ea84079c294b327dbcfdc1e9d9ab
MD5 bd1c7509b5130bfae3762f8e4c1d1d2f
SHA1 55776ab6df5d621673ddc27f7e7674bae3e856bf
SHA512 c1923fde8e6c1b2d2719dcefbe0e74f598846d026e189f9508b2dc1837adedaf5131144158f5a5348179f24b184fc5e1862a97c80bfc34d40787d2b32e0978c1
SSDEEP 24:oOoAT7BoLXn2cSp8JNuihW0ylshEYTgt8Iy2soyqMQjF:oQGLXaBiPymhXgt8p2s17YF
TLSH
T13413171284A10363EB7EA57C37A44ED9F248FBE47C55DE203E7A98CC0202086B3C8855
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Reilluminated/chesterfieldstolen.vks

SHA256 c497926de268957770f5835f3227bc643d25f3446a61b272b5ead2c622629765
MD5 8082f7c286d160d192800c76e6c6d485
SHA1 1c7da218c893d53898ba34ebc49a1f7d01798446
SHA512 7ffb126f7645451761a4a9affa1009ec75dbe0bbd7745c28fbdc70f0f7e2d976cc54f35357a7e75007c7f936c6d80f6e7c8510c29131deeb3187db1bd7f99001
SSDEEP 96:4dNBFVl81OcPmknNHwoDaCtcJtmN9YwnB:4dNXjbYNHwoWKcJtW3B
TLSH
T1EF43D7A0B1AA6BB4524FA34BA890B4D1180B453D07387C03DD72ADDD8B1B56A736D3E5
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Reilluminated/flourescent.ina

SHA256 bc26dc87cb1f141c6fe25b6fddb16529e55cec9e1e98e73712ad98d25f71dd7d
MD5 b9f61b4199801e022266984fb9df0ec6
SHA1 96b56a339ad6877838a7912464d13eb03fe2acf0
SHA512 8fb8f74f613c1e88bf5576154d262cbb8afb8cb2d3704de2467b439fbea0bbb1d57b8c2b3b60b410232728c2c311785fafca1be085be788b8f23aae695b8ef59
SSDEEP 48:ck1OTdQ/4EqMiOgoot/gmTIMs+kJyo6Wbqu50eK4wrvO7vgG:+fFkmTIETFG7P
TLSH
T1E343E6F815A75A790481C68BAA22A3F8F2C00489AFE60966A491A68F4DE848C9FC151D
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Reilluminated/prefiguratively.bai

SHA256 dd93a9871442b66fc1c43b64278c513c4a05a6a6024e903dabca299c1299fd81
MD5 015e4a23a56812d09a4feec9dfe09ef3
SHA1 4d1e2be606ba18281281f36244f82fac13f67d59
SHA512 c7fbe5c42b6e25b77beeed9151ac47596c5c77169e98eb32121a40ac1ee0657c58815bf12442b369873ecd03c3cb04a70be0ced77b273562e8d84fa460bb246f
SSDEEP 12:tsYsBc7rIHhhEV/RriRhwrkc2sypsL9sceimsqrW9HYGr9WPj6YQslogh:toufIBhI/Rrkt/iaom5gH9Kj6wlZ
TLSH
T147A2B7711560CBB23572DE31D8C391F5E87049EC4E4EDFF44DCB0213450502872696B7
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Reilluminated/uvisheder.sac

SHA256 ffcfe953346fdd6c4b20a4ec3e36a4235dc210e743e7d07a3bd26180927fb2a0
MD5 9904534553dcf95aeeaa5bfb40615669
SHA1 0508d06615bcd5c5f7f7a2d97f1a85c7da747278
SHA512 0001b57f72f2a0cb0d9610df0f9796a544f8cc19d009fd8f4fb0141860f09c575273c3de424e1261eeca67dae92d0f48af21ec7ae95aa344f58d8d39ff959f60
SSDEEP 48:m8Oxr/kOhcEKSatVnjRfVFsFNQnNPe3FcghkYaO15Ft0t9j0BypsjJj:QgHSoVVFsnQNPeVc5h0BesjJj
TLSH
T11333068E0CE43B60B18EEC9040A86A67215099E24DCADCAC5688D112E24BE2C0B8C807
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Stereogengivelsens/Kommissorium

SHA256 e1b657088e7e36fd317cec0826e083ce00abedf947a155cb4e4b14f531498f5a
MD5 298e2eee9ae1654d15dc5d822fb3a423
SHA1 30472bf1cf9cbb94172ba41fa79a8e6a01292a23
SHA512 4201392f523ce5f009f9b3180e06ebe68c768a60193c81d6acfa8079df71f4578c46d459804bb5b644a8655759745656ae890f6ccedae598ea8fbedb8d67878f
SSDEEP 3072:OFq90DDe1+VYfgWN1MM1ijefkPIDm9kX4Xl:leDO+VYfgWsM8efLDm9Q4Xl
TLSH
T182942B5075C98AE0F61A5984EA78FFB211733973AFCA1CD22324F5004BBE5513A8DA5F
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

51e21ba467683d83fa2d9856dba5c40375b05d6b5627c7c37f8024af959e235f.exe

PE Signature issue

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

Anodiserer

Invincible.non

Reilluminated/Mdrenes143.oto

Reilluminated/chesterfieldstolen.vks

Reilluminated/flourescent.ina

Reilluminated/prefiguratively.bai

Reilluminated/uvisheder.sac

Stereogengivelsens/Kommissorium

Sharing

General

Malware Config

Signatures

File Explorer

51e21ba467683d83fa2d9856dba5c40375b05d6b5627c7c37f8024af959e235f.exe

PE Signature issue

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

Anodiserer

Invincible.non

Reilluminated/Mdrenes143.oto

Reilluminated/chesterfieldstolen.vks

Reilluminated/flourescent.ina

Reilluminated/prefiguratively.bai

Reilluminated/uvisheder.sac

Stereogengivelsens/Kommissorium