Orden de compra 67321[.]exe

resource
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/nsExec.dll

resource
Orden de compra 67321.exe

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

Orden de compra 67321.exe

IMPHASH 9a16e282eba7cc710070c0586c947693
SHA256 f0f8c5389c9639798e99825b0ef038868c6170d7225d7fd7509cb8a246fb411b
MD5 411ba5fe7a02e876911a832fe105657d
SHA1 bf3b34479b707b5653f521e4ad68cde6eee4723d
SHA512 d184942822715d9480acf3115822c496ff987deb599ad6e6d62d45ee3a5106f1edad33da81abc4242694be3fa604ced2a40c5d2f30933d2b7e0b867aa1bd5b3b
SSDEEP 6144:Uh0sesiM+Hz5+LykB61h1sME7Sec9S1pLNCQwsFieYznM:lsiM+Hz5+LyhsuS1OQwGief
TLSH
T173547C1B3A899E35C8E0A97E38D77EB4B7D3EBFC254446C2210A67063831B5116DE739
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

c6:13:39:5b:3d:a2:d1:a2:b1:cc:66:fd:74:61:10:83:8c:b7:10:c6

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Operationalizations,OU=Bristens Nonmetal Produktionstekniske\ ,O=Operationalizations,C=US

Chains

Jul 17, 2026

CN=Operationalizations,OU=Bristens Nonmetal Produktionstekniske\ ,O=Operationalizations,C=US

Minor OS version

0

Major OS version

4

Entry point

13277

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueA RegEnumKeyA RegQueryValueExA RegSetValueExA RegCloseKey RegDeleteValueA RegDeleteKeyA AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken RegOpenKeyExA RegCreateKeyExA

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA SHFileOperationA ShellExecuteExA

ole32

OleUninitialize OleInitialize IIDFromString CoCreateInstance CoTaskMemFree

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create

user32

SetDlgItemTextA GetSystemMetrics CreatePopupMenu AppendMenuA OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcA GetMessagePos CheckDlgButton LoadCursorA SetCursor GetSysColor SetWindowPos GetWindowLongA IsWindowEnabled SetClassLongA GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassA SystemParametersInfoA CreateWindowExA GetDlgItemTextA DialogBoxParamA CharNextA ExitWindowsEx DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow ShowWindow wsprintfA SendMessageTimeoutA FindWindowExA IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint MessageBoxIndirectA CharPrevA PeekMessageA GetClassInfoA DispatchMessageA TrackPopupMenu

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor

kernel32

CreateFileA GetTempFileNameA ReadFile RemoveDirectoryA CreateProcessA CreateDirectoryA CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceA lstrcpynA SetErrorMode GetVersionExA lstrlenA GetCommandLineA GetTempPathA GetWindowsDirectoryA SetEnvironmentVariableA WriteFile CopyFileA GetCurrentProcess GetModuleFileNameA GetLastError GetFileSize GetTickCount Sleep SetFileAttributesA GetFileAttributesA SetCurrentDirectoryA MoveFileA GetFullPathNameA GetShortPathNameA SearchPathA CompareFileTime SetFileTime CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc GetModuleHandleA LoadLibraryExA FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA MulDiv lstrcpyA MoveFileExA lstrcatA WideCharToMultiByte GetSystemDirectoryA GetProcAddress GetExitCodeProcess WaitForSingleObject ExitProcess

$PLUGINSDIR/System.dll

IMPHASH 240ca92ecc1c291801c451c447e16c12
SHA256 a44ca08afb3f6bafd76aa35c259f3d599fe34f6f49ea5118626c1c1a540b0f03
MD5 81e268e27dbbcadbf116b5a9402195ab
SHA1 bd2b701b2e5e279786e179bceee2dc132a2afc37
SHA512 784115c69df4a6f180efb4d48cf5c6e8c2393b8ce9aa664f192abf5a260984880c668dd0f93564126d2fc718130570c4f6224d1373d73bcb8343f04f6ede25de
SSDEEP 192:VFiQJ77pJp17C8F1A5xjGNxrgFOgb7lrT/d93:97pJp48F2exrg5F/d
TLSH
T10C424B1583618EF3F5961E3C00667E2F2B79BE3416F104A39FE34481AD9A1CF99B5392
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10673

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsDialogs.dll

IMPHASH cfc8bb9e11188db414351d2620c98f39
SHA256 7853be9190489ba84dae8232e9a967cec02d941732cb4137bc9ae6a392e89fb8
MD5 3fbd78c889fa40a2e5567b980c57b7db
SHA1 303564bfa6fd5ab7a65d35ae1cd14a05643b6b5d
SHA512 95ccd599cdacb1128aa35694aa5428f12f50a20d95bb500e9b180b3ab322b1870ae301f77f7ca0e8674c78742a1eb5c82ba3cee05c67d3d961a695563c8c1514
SSDEEP 96:oX7lf7AR1VhrfzBik0cxM2DjDf3GEkniJnifvcx418qndYv0PLE:oXl7wrLBn0REc0JxedO0PLE
TLSH
T1371207135A0044B3D9E2223A31AA2F2ED73C932490527D02C777DE5A2BB43166D3E351
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

7513

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsExec.dll

IMPHASH 9076fa7961baeaeda0746cb0928f486a
SHA256 e20666c498941d36bfd0eae411ad73c475d043cee39b50c31734a70eecaae0bb
MD5 13bd8e89dc79004d85ab02626e08c3c5
SHA1 0ef0efb3237233de26f55c4420753ed0fed418ad
SHA512 58841cc9e8313775a097a93e68952d8005b826bf1349dc24d49e3128b87e9021a028d2d4e738997390f1625f7ae7744a9ff85289f6c78f5ebd67c0da61ef2120
SSDEEP 96:pOBtYZKtPsrqBApt1JHpb9XWk7Qe06iE6mE6YNFyVOHd0+uUwEX:ptZKtrAJJJbP7iEHEbN8Ved0Pw
TLSH
T1F7D1F83A2AD12DF3D04889702827793ACBB9C8360F500650DF671EE225E1DE7DB2038B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4231

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Actinostome

SHA256 bdfe9f9ec4c19cd78a835c873bc150cf1dc268e59dac7074cbdb87ffa07ff4ef
MD5 bd63b9bf0455e0a8b33d10055f31fb28
SHA1 00c589f193cc4423c843bdfdbf8aabfaf38aaec3
SHA512 cad3b7444278bb9a4636c1ded431e3349f8a378e9747e6da508bfde942bf7e22f506e916662a038d22c7fb7808602cce5b6d8769afc6dd725104d816aa7f4954
SSDEEP 96:wf/jTFQ2F3tUSM/NRNi85yZysWr5MG6/Rs3FFRq1VJOdeJNqofE90:wtDFdUx/NDAcrT6Zofq1V4efN
TLSH
T1F9C15E81D612CCF7ED176434CC8E1756EA699424BFCDA52D18BE9408D71104B33984FA
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Molluscoidean

SHA256 59a0a696bdf46dcd85769d5d1f9db303221e8ee1ebc74ee762d7d24ea68e8323
MD5 5213de5a94713045c444a257c3a1f339
SHA1 62f17e80a33a8cec42b02c55ea1aa0dd30eb97aa
SHA512 28376593869627df261f5fba1b28571b336c94d0c29bb07ef7b55561fd717bf13ad38301567040382754ed6341aa08e968fd9a0548cdddc0611149d6ade91895
SSDEEP 3072:1x9KJYMUQFfxuQuwn1OlA9kRJdGJ4MA+P1Q5O8VbixPATd:D0YMFhPuskRJMSMfPy5O0ehAB
TLSH
T129D301E276038B18E123CA72067DC1B89557758F3423C3875C5469F4BBBAEB64B79328
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Stablevognene.ser

SHA256 63e7fdf1e051f8a5863f665b8beb4e74db86c4c4f7e345c1be41c95267e2d531
MD5 a9fbc2d071c8a9f0c59a8efb2b6db85d
SHA1 e0df4aae7b48003a77100c56af81f6af2e654c72
SHA512 6b5d53ca3698e07ea783b39255c16d46edec6640d3d40d092f39fe230146d32c4cf5ef4e68377b4b9faa9dd39681b0f94274e78a88172a4beb953c674130dc1f
SSDEEP 48:oLiSxAFE5n/+xL/OM/UpUQroZUgzLmW4o2iZshVbb2wCad:y1xRMxbOMsp1U2cLmRo2iZS52wCW
TLSH
T1BD232EC554C4D43BC4820D5DD6E89D5361C4A352605E2566B5330D50E0F4C974D37F91
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

drmmeferie.jud

SHA256 a9edda79aad3ddaea1f34e638de8c8a67ee15494164caaf576e6d3df7e3a1479
MD5 84149b3ea8a49cd7c4971c3b35dccc8d
SHA1 1106e944f2972ef4a5a9e0ef3f7d9fca8478b813
SHA512 dbe068c036ed912fc654034494e4f869f1b8ae45ec7c239d2db50a5966176e6a976525dcf22c9b6c06a6f8d0fa56256fc660bba6f59b824c0baf05f630ad96ef
SSDEEP 48:8mCaTOshJhwow6jPzzwebes9VCM6oWW9Pgwl1nFAfOUSXwjt9t:cPG66zAE6s9PgYmf1B
TLSH
T1B833DA8304FF0E4F8F1E14593B62585E36155B0EED22E31642EE2F93095F5A6EC82A74
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

nonlucrativeness.udk

SHA256 59f19bc646a63b2189944ea699b7bd89d8ae7faf422960abbdf02c70e8a21ef8
MD5 4a6396dea8cb6a2d26594af12729ea8f
SHA1 4b624a42a1815fd8c2f2e68eed336daf94b45897
SHA512 5d197df36018f91759f7c734a756e46f17c756a9a6090780ac1a629124fe77fb59c092a92301e3f7631cb21394f66a72c3e68a37cc9575f4f6d4695a7103a9c2
SSDEEP 24:eimsVssJb8Nogf3bM6FGDxpKKy56sPlYnJvphhHYz/VykkFfCb2SVf4diWgpjuGm:m+gPg6FGDXK16UlWTJkVBkFXhsgQ23k6
TLSH
T128030A5BD01E25871FCA133D43682854899F3A368F48B8B3A05C93F4320E7036061867
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

stiklagener.hyp

SHA256 807cb04192bde37d75e0b6474cf0fbeb242b19304ef30cba0a94d86493e3d63c
MD5 fab1e60096500f52a782ddadcfdac8a2
SHA1 dfa4d31c79b67be94f9bcd93aea83430e916df43
SHA512 7594695ec76fb3220f5788615c13e251d0bed7e82a2b30a811f2bab03563b9e988d60b30942eaabcfe54609f648a466045608735a97e3893453eb6bf5cd38e8a
TLSH
T108512208088C0C000FCBCC00A0F083B20B0800B22BBA2800A00F0E83CA2A20C3AB3220
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

Orden de compra 67321.exe

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

$PLUGINSDIR/nsExec.dll

advapi32

user32

kernel32

generic

Actinostome

Molluscoidean

Stablevognene.ser

drmmeferie.jud

nonlucrativeness.udk

stiklagener.hyp

Sharing

General

Malware Config

Signatures

File Explorer

Orden de compra 67321.exe

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

$PLUGINSDIR/nsExec.dll

advapi32

user32

kernel32

generic

Actinostome

Molluscoidean

Stablevognene.ser

drmmeferie.jud

nonlucrativeness.udk

stiklagener.hyp