2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc[.]exe

resource
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/nsExec.dll

resource
2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe

IMPHASH b78ecf47c0a3e24a6f4af114e2d1f5de
SHA256 2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc
MD5 3970164bd18987cfc471ad7cc228b0c9
SHA1 47d4cc9959d92c7f19fe29fd7584d49100267710
SHA512 97b8e19ca6da292c5b4c625c745c1c1856b1f7b06778d06cfe5dc8a1be434f5822105692a15e2ad833c48a6b6ade4562a83b3a2dcc1fac506b06e36d2a3798ff
SSDEEP 6144:5pZgUXltNBTzuVuEEpTsnKZ0+PtF3eh9GSBLkd:rF6uEEpGK1lBwbBY
TLSH
T1A254E0867684D4EAD9366471C8BBDD220B277E6A97D15B0F33B1362E6873113072FA07
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

e1:44:44:4b:f8:5f:28:bd:c4:82:e6:6e:fa:0f:63:08:8e:06:ca:a5

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Matchably,OU=Diplobacillus Trvlernes Monoparental\ ,O=Matchably,C=FR,1.2.840.113549.1.9.1=#0c2053616d6d656e766f6b736564653136384042766572726f747465726e652e5472

Chains

Jul 17, 2026

CN=Matchably,OU=Diplobacillus Trvlernes Monoparental\ ,O=Matchably,C=FR,1.2.840.113549.1.9.1=#0c2053616d6d656e766f6b736564653136384042766572726f747465726e652e5472

Minor OS version

0

Major OS version

4

Entry point

12707

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetEnvironmentVariableA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA GetFileAttributesA SetFileAttributesA GetWindowsDirectoryA GetTempPathA GetCommandLineA lstrlenA GetVersion SetErrorMode lstrcpynA ExitProcess GetFullPathNameA GlobalLock CreateThread GetLastError CreateDirectoryA CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA ReadFile WriteFile lstrcpyA MoveFileExA lstrcatA GetSystemDirectoryA GetProcAddress CloseHandle SetCurrentDirectoryA MoveFileA CompareFileTime GetShortPathNameA SearchPathA lstrcmpiA SetFileTime lstrcmpA ExpandEnvironmentStringsA GlobalUnlock GetDiskFreeSpaceA GlobalFree FindFirstFileA FindNextFileA DeleteFileA SetFilePointer GetPrivateProfileStringA FindClose MultiByteToWideChar FreeLibrary MulDiv WritePrivateProfileStringA LoadLibraryExA GetModuleHandleA GetExitCodeProcess WaitForSingleObject GlobalAlloc

user32

ScreenToClient GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard PostQuitMessage GetWindowRect EnableMenuItem CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndDialog RegisterClassA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx GetDC CreateDialogParamA SetTimer GetDlgItem SetWindowLongA SetForegroundWindow LoadImageA IsWindow SendMessageTimeoutA FindWindowExA OpenClipboard TrackPopupMenu AppendMenuA EndPaint DestroyWindow wsprintfA ShowWindow SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA

advapi32

RegDeleteKeyA SetFileSecurityA OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges RegOpenKeyExA RegEnumValueA RegDeleteValueA RegCloseKey RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/System.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 fa4ab1d6f79fd677433a31ada7806373a789d34328da46ccb0449bbf347bd73e
MD5 3f176d1ee13b0d7d6bd92e1c7a0b9bae
SHA1 fe582246792774c2c9dd15639ffa0aca90d6fd0b
SHA512 0a69124819b7568d0dea4e9e85ce8fe61c7ba697c934e3a95e2dcfb9f252b1d9da7faf8774b6e8efd614885507acc94987733eba09a2f5e7098b774dfc8524b6
SSDEEP 192:OPtkumJX7zB22kGwfy0mtVgkCPOsX1un:/702k5qpdsXQn
TLSH
T1A8325C15136046F3E1D2853C542B3AAB6FB869118AF04E43CFB36852EF396C79D79352
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

9995

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsDialogs.dll

IMPHASH ddbd50fe6279559edf7d1f1d89b42c2c
SHA256 f2c1409faf2952c1c91f4b5495158ef5c7d1a1db6eea4a18f163574bd52fcad0
MD5 b3070cf20db659fdfb3cb2ed38130e8d
SHA1 aa234b0620bebddde1414ff6b0840d883890b413
SHA512 4849a4cf24ea8a26cd04eb132d479cc093d4e204ed3866a77646d03778f4c128e20722a0c3cd62ea98a37deea4ce505fe632420158c71a10b0c8c5e32b38e3f1
SSDEEP 96:oEqZ4zC5RH3cXX1LlYlRowycxM2DjDf3GEst+Nt+jvDYx40qndYHnxss:oEq+CP3uKrpyREs06YxEdGn
TLSH
T1DE121A635A4055F3D5D7223A21AA2F2FD73C9324A062BC0287779E462BF531A7D3A351
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

7429

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsExec.dll

IMPHASH 46f8b6973f33717335c0f6d8087de67b
SHA256 288100583f65a2b7acfc0c7e231c0e268c58d3067675543f627c01e82f6fd884
MD5 b5a1f9dc73e2944a388a61411bdd8c70
SHA1 dc9b20df3f3810c2e81a0c54dea385704ba8bef7
SHA512 b9c8d71b5da00f2aff7847b9ec3bd8a588afeb525f47a0df235b52f7b2233edb3928a2c8e0b493f287c923cc52a340ad6fee99822595d6591df0e97870de92a8
SSDEEP 96:p7GUxNkO6GR0t9GKKr1Zd8NHYVVHp4dEeY3kRnHdMqqyVgNQ3e:lXhHR0aTQN4gRHdMqJVgNH
TLSH
T16BD1097675E22EB3C50ACA313C127A2B57F8C8111B9401549B938BD238C5EB3EA28282
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4231

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Lipogenic.fac

SHA256 0dbbdd1570fb34e19ec3cc6262bfa67fb5d3256e1af43e84d589a11b0263b787
MD5 8088172f6c04655496405220d9f52150
SHA1 17a9581ba9556fe2f84fb547081d854c5846bf42
SHA512 ef7ec5bf1d4179c503e8951a076ee077f7e420062f7ad2d46ee4fe7a3317121e7794fb4c99c40051be1b8633e95ce6d61d5b48ac1e13538042ca19eb3dc5add7
SSDEEP 24:s8ncR61iTCr8sipFNwfLkmXiMMTs9uoUEjztgw4:/cHT/si2fLP9MI9Cw4
TLSH
T1468275666DFECA102608FD36343BCBB0D1EA12794A149797E00D3F54C5048C9FA5C22D
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Rayoners

SHA256 e46a486007dfb8392ed448488579b805f8f1aeb364eeaf5c7fbf3260714ed054
MD5 219b0bfac02e4fd11580c0e055b418b1
SHA1 4ccf4bbd9b74cb8a2dd2cbafc858cebb0fd672aa
SHA512 0daea1a51dfddc64ac880e161a1a582c5eb4cffd562b04132acf7483fb58334bf4cb2c9761410dcdf65fa586997d935f6b64e8453fa30022cd7463e0fe60554c
SSDEEP 384:Q1XV7IbzXtstF+ZxMfwuxHG63DTvCQ/o8dLWodOxVv5bWw:QhV7I3XoWMfZxHG63H6KFn6v5v
TLSH
T11E828DC1D35E8CF9CD47063CD8B992F6946CB409038FB07E322ABE5292D61D63254B6E
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Skalmuringen.man

SHA256 3bc5227800546b93cc8f851f23ba9fedafde70f87db70d938c881f19efca84f0
MD5 f3838d33f11b51f2688d906c5ec0a78b
SHA1 ea8ed95c65fa8f48bfd54031cee9da5086cc9419
SHA512 af68b4522553d69804e5c3e62af7ce662cc3b6b0982ddf64c3b0bbe6abaa6552a51290e035e36201801ad2d8e7c4c9c32ce953c7c0b982db252f2dede9a2f2b2
SSDEEP 96:4l8VWODvRU/LJJ1VkAJnIhM1ZmvwR+3Uv0JSdbdJgKPy7v:rVWOD50LjkWQM1MoR+20EsK67v
TLSH
T164731925301A5214945365F18F588D01117FB3BDC26156BFE41B1C6B9CDDBAB2D0E25F
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Swayer61

SHA256 b351ff3a6e9f00685bfd496158161afe74eafa86fbc8aea85f121105fed95a13
MD5 64fe930f6d580d8513a0f3012b26f415
SHA1 da374c04a245cabb7c0ffdd05ffa533185ca9c65
SHA512 33baeee9ad0c57670e17058eb6803f9e214721eba5362fbf4676d442d8908153f7f54cfe6a2876cd1c225b1197b7b77cb056ed9a844b3c5c7ee99892b64bbeac
SSDEEP 3072:55rAeWMEDjSFFFFFFFFFFFFFFFvOUYAMB/zVFEkDXM7GrwE2ixjglrrrrrrrrrrV:55r+qFFFFFFFFFFFFFFFvnYA+/zVrr6z
TLSH
T14AE302DC2521CF9EDC6134112225A6D0167BFF8A0D892667C1BC49F7F69E88E7901FE8
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

superfinance/oprindelsens.bes

SHA256 77e7b4d416dc830f8ddf5cfd97cf5fe2599defbe5c93d8711788d47f8d9aea21
MD5 70b9467972e22f2a199a1b30080f35b7
SHA1 f549be15515d9a009b594b3157f022e27487cc35
SHA512 4f42f26fe811a296ad9021a9903dddc2032f0e5070df752b7af50be93a9068ec50b88f3c865086af56e8c1150bb3cd52ac9c7a673ae8510783c25c55eca6a00b
SSDEEP 24:Sg7AJA/TkKuGBkej0vCAh3cUAWi+wrdF6AaF4xuaz59r6ky365ZL28dE0sKf1qz:SgjTkKkewCAh3hAZxaAa2by3KCNUNqz
TLSH
T1FBD286C31E033E8E23B975C8787DFB5BA927AD875CF92681B3360855D146518B529C05
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

superfinance/priests.bur

SHA256 35fedeb09e3c03f90bf46fd34fb553e61b1d7ec32a109a0bf2270b8171f00a18
MD5 33d1021e14c4dd760d5fe3b13de20932
SHA1 1d4bb75050bc6b484372b37bcd28913ae82821c6
SHA512 c79487507afcf1522ec04eb05967c19519a3c2bfc9c389edfafb63f38e78b21ade6cca773a1afd9a2d94a9e1c025493dfeea61aa4ef2477634e8d0bb916fecdb
SSDEEP 24:m0csiY1wr8eFpk96bdddd1Isqsy8kfNzFpBcVtvzXBdpBKCdeZkVsgbC:m0nQs6RWsGfP7cPb5BKCgmk
TLSH
T1C9534CC6C121514E494468B9AFCAA7CF24FC8FA20944E8AAD43CDDC2FDB0145C17E770
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

$PLUGINSDIR/nsExec.dll

kernel32

user32

advapi32

generic

Lipogenic.fac

Rayoners

Skalmuringen.man

Swayer61

superfinance/oprindelsens.bes

superfinance/priests.bur

Sharing

General

Malware Config

Signatures

File Explorer

2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

$PLUGINSDIR/nsExec.dll

kernel32

user32

advapi32

generic

Lipogenic.fac

Rayoners

Skalmuringen.man

Swayer61

superfinance/oprindelsens.bes

superfinance/priests.bur