1355a9f43795a3162b7cfd93d1e39cd4aba0b460fef572fced1c036473a222ab[.]exe

resource
1355a9f43795a3162b7cfd93d1e39cd4aba0b460fef572fced1c036473a222ab.exe
unpack001/$PLUGINSDIR/AdvSplash.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

1355a9f43795a3162b7cfd93d1e39cd4aba0b460fef572fced1c036473a222ab.exe

IMPHASH e160ef8e55bb9d162da4e266afd9eef3
SHA256 1355a9f43795a3162b7cfd93d1e39cd4aba0b460fef572fced1c036473a222ab
MD5 17ae700cf861e07d94a5ef0422fca187
SHA1 c9f1e8c56848bf06e94788b922b9323f96eda4bd
SHA512 600ea27beab1702d509c8d2d5acfb448752cf2bdc4e050f51ff7ea1b0edb4bee81a7e77bb761708a02c9dae119a48fc1d08860538463de32e77763fee68020a1
SSDEEP 12288:QC3wdew5NKr6XviorEgLZJwXSzmC7ZKlB1m91:QAmewTW6fior/DCC7Z8B1
TLSH
T13BD4E0C2F14086E1EBDE1FF0187A9D6A43673D26C9A4064A7A46779A1FF3352603F907
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12491

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetTickCount GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA SearchPathA GetShortPathNameA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess SetEnvironmentVariableA GetWindowsDirectoryA GetTempPathA Sleep CloseHandle LoadLibraryA lstrlenA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA ReadFile lstrcpyA lstrcatA GetSystemDirectoryA GetVersion GetProcAddress GlobalAlloc CompareFileTime SetFileTime ExpandEnvironmentStringsA lstrcmpiA lstrcmpA WaitForSingleObject GlobalFree GetExitCodeProcess GetModuleHandleA SetErrorMode GetCommandLineA LoadLibraryExA FindFirstFileA FindNextFileA DeleteFileA SetFilePointer WriteFile FindClose WritePrivateProfileStringA MultiByteToWideChar MulDiv GetPrivateProfileStringA FreeLibrary

user32

CreateWindowExA EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard GetDC SystemParametersInfoA RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx DestroyWindow CreateDialogParamA SetTimer GetDlgItem wsprintfA SetForegroundWindow ShowWindow IsWindow LoadImageA SetWindowLongA SetClipboardData EmptyClipboard OpenClipboard EndPaint PostQuitMessage FindWindowExA SendMessageTimeoutA SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA

advapi32

RegCloseKey RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegEnumValueA RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

CoCreateInstance CoTaskMemFree OleInitialize OleUninitialize

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/AdvSplash.dll

IMPHASH 2e8d5524d09b794f343fa9e2df0a1d87
SHA256 5e71559df5cbcc4d98ebd9d4ddffabe18b047f9a50d98a96e46a4c0ac589105c
MD5 7a514e97fb29eccff3c7ab5147f4de9a
SHA1 e573f6e51d26d5601c68b7370fa94a030e561a9f
SHA512 f320dd5b60c5f1a6cba69b399d32151ca13c2b10f873f0c3cc05c3f1707ca80b396c5fc71175269117e0a6c13e56c51b89ea1dee47879fcc62d29f6ea8087604
SSDEEP 96:0NcIcmLEjNev3O2obNnNlXUjDftqlqCstWpgwoS:xIpLSG3O9XX+qlqntWpg
TLSH
T1EBC1B877B7C215F3C35541F12955336387E9843563A2A4680AB3EBCAAAB285BDD34703
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4448

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 484f8e9f194ed9016274ef3672b2c52ed5f574fb71d3884edf3c222b758a75a2
MD5 960a5c48e25cf2bca332e74e11d825c9
SHA1 da35c6816ace5daf4c6c1d57b93b09a82ecdc876
SHA512 cc450179e2d0d56aee2ccf8163d3882978c4e9c1aa3d3a95875fe9ba9831e07ddfd377111dc67f801fa53b6f468a418f086f1de7c71e0a5b634e1ae2a67cd3da
SSDEEP 192:jVL7iZJX76BiqsO7+UZEw+RlthVEoC0O3XB:g7ssOpZs/hS3X
TLSH
T19A323918036442F3E5D5C83D186A3BAB5B28252196F08F53DFB39881FE386D66D39362
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10027

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsDialogs.dll

IMPHASH 38e7b5c3ee58b43a91f9679e94aabd09
SHA256 495bddc0be6e18e981db82fab9d1de55c7e269ab4ec3ff43035193bc017a307b
MD5 8ced0b79f7b9033d0795aab3be6d627c
SHA1 90c2043ffccd068f407c624c50ac7b795db1e132
SHA512 e38f63a342729f5ff6d0db607d7877b65c33ed19e2b5a97dd868ece8c2a3e829d4153624943444be2f0de885496161d54c1da9594bdc0a5a0bcc8b727e2facb0
SSDEEP 96:3Rp41CMj95rKhkfL5RkEdKkcxM2DjDf3GEEE9v5E9av+Yx4indY7ndS27gA:3RujesS4HREEK5MYxDdqn420
TLSH
T1FC12F9675A0010B3E9A36239316A2D3F8B7C9325D0A37C03C677AE562BF431A7D3A355
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

7410

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Forker135.txt

SHA256 295df39032f49e7ce7c47b4e4c0a6e2d5b7cd8bb3adb9f47f8b5c24324a62983
MD5 e0fa5d623b0f74b3372f72a6c16a3040
SHA1 63a23a9a11081d70040bda8bfc4609d0ce50f709
SHA512 2b35a41302b74d75ba764f90d42af379bad4d2bb1d4d61da39dd6dd06553ea2f7289dc07c102b7271bcc211eabf92a0f7b2f37d735dc041d47dc29afaa90eb99
TLSH
T17CF023F1DC091D805E0A9B5118D5C14BC71C270ACF960D3D2A988AC35B3326C13B8E25
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

Growable.Pri

SHA256 8318901b48d44f458a564b4e4df14521fb06578f37b8b57b1066d2ec17259324
MD5 83fa180151bfcac5bfcdc9b14bb61f93
SHA1 d126dd1fc5b75a76fa50000badf9582f4eea84e3
SHA512 fe7ec8bd5a3c4889df4b5b2a60ef9819bb7132b5281fd1d367a300456912eda789c33b1b6bfeee6b9aba1a6d6cabaf81f4e11c2b3675c7c6e9b45db715443ed1
SSDEEP 6144:YuaOtMIzOPs7u86vJ10yYJ1Q9v+6Jb+/lMig00tl95vsnLS9TCTO1IJ/CoXGk:YuMImsFuJ1sQF+6lmRg0CjAlO6/Cxk
TLSH
T10894F1B5FC31FE5C622DAA73919581B097CDCC914529835C9226BAE36CB33900ECDE1B
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Locutor28.cit

SHA256 fb786392baa21a6733340b30344a37718341e76d274d8267d2d0fac07f1cea64
MD5 3b11e6d5d5da9539e19142ed45fb7b4a
SHA1 822125496e96046a419ada97d4c67ce004035aba
SHA512 5c3fd97d9b5b3a6a2e410428094ec85d46d7032f0fe78869f2cec3135bdcec9688f38b8e42e7ff270f4a0f4ca91ef12a02279ef3a04e75fb30dd5811aef59819
TLSH
T195413D2986F072D5D88088794D94B27BAD30359B3188A2DC1909A13FCEFC23730C47CC
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

Lrlingekontrakternes.Gge

SHA256 7466e2715dce4c3a6d61cb5afde6177de183712dcd76c65673618d57393c6b40
MD5 25b4985f2b60f7a3ab5ab37c93bc1e85
SHA1 b9a1da0f614b432966f9bd975e7f081e5541ac07
SHA512 dedbc8294ffb10f27ade0b448499e310bf551d07f8631ef6670aa58aa89748760e57d0b50e03ace13701e5470be05d673d321b5e586776f0997942ae194cff97
SSDEEP 1536:YjtsC6bdzQ0hhdlKNA135DftoIqL/WaJPmZZ31YHDh:YqRbW4jlh3F+IEWIOZCN
TLSH
T1C9D3B052DB6A8DFAC907C938C05F22968CB870059F0FE4BDA175E815C19B5F297306BE
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Pussyfoots80.slu

SHA256 d53c671f46c589bd88ffa0db66c2dfa53f975f6dd983708c981c94352db4b7ff
MD5 2e014a447f0db015bf55d8dcfd780aa6
SHA1 7dc9b07bdf85fcaeb5ded5e3c531c7c931d71dfd
SHA512 9bcf3830e862e43949069130a5e394dd93904da5e9a024563191d5586e4ac132dfd584c763fc80e5f4a610da690bbdd495706a1704251dcf86c09e0ec2020b21
SSDEEP 96:AKj3bNex89dJb1I4isCWQPOri0W95Rh2psTgZ1G6Z7TTFhMshA5yZZUDecVtoN5:A8bM89vy1fPOmB95R+GmB7HFhvA5yDz3
TLSH
T1B4A1AF4B661DF26DE810B832BB7394B9CB40159D6F095DD70694BD2CD1134770C064CB
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Spongoblast/Udgrundet.red

SHA256 6f0e8f35ea03a6e58df06371e0578be68743e60ba55ad41b310a8caade15ae35
MD5 edc0cf304b67c7d5b6290bdb7fbcb332
SHA1 05c408b6f504d94bfb0caca5e197bf326a6cca65
SHA512 7c7d2bb9addd6726522513abc147868a213240b8ae97798756c86678ab09740994b3b0db09e9053a235680703b8f6d716717f71be123a65dc58e59f3d1d42129
SSDEEP 96:bYAnT9tP8AaftmtyG4HGP5BfpwsZJWD9GQKolCGcwpBa2KQHvH8y:bYABt0RsAmBBysZgDBK78soHf8y
TLSH
T197C1AFEC535CEBD9F2D746BCFACD30064146C40A463E1CCB3CC57AE207860A293D929A
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Spongoblast/Underbemandes/fulgtes.and

SHA256 ce1f75953ef722f2c16021cc0ae9e45f8382107f479c9c5392a9adbd5ac0678d
MD5 94c99ab740dffde35d317caa54622476
SHA1 f950e58888657d80cb1a92fa89ff67c4a5f0c189
SHA512 ede78b41d728a41d31883a5f831a871e48b153f61f5d85984c465585ebf6d33a6a2ac18317badfcff2f1ceec13d0c92f18727b0bbdb528c1687b0d55c17c5a8c
SSDEEP 192:R4E1r9hhmHwuYb2nPGOJaymT5zAvdEVl/5:f1r9hhmHtOUPGOJUKdi5
TLSH
T1A6E19E3ABDC0E500D83216F6AE6378218EE363DAC9E35335B1444CC51CD656CB9AEB83
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Spongoblast/canvassed.gig

SHA256 b6673aca4870902aabe978592c8b7c63283d7db98f3c8cd713a9cc3f537238e2
MD5 3eac5ed8d3dcb5f7e22d26e67a485cc7
SHA1 861bbb82dbee93ee53ddc1192b27b628de149a44
SHA512 e77ea3d9bcd37934647c64647e50ff220813b3a682b4f6e9ed57946bcda66dbdeff40b714449e8f281a7fe778cbdc3fc34f958c28426351c5ecd0c3ecc1c19ad
SSDEEP 96:g6D744S/ipBwuf8uOVmEIkjVUgtL471nWI2OcSjSyQ9KthDLXFxIBW/yqf:L7BSoBrmYLYVUgtEgESKt5Tk8Kqf
TLSH
T14DC1AE0D6196C589F08EBAFDF82BD888733C75A8DF8A15C01B00AC435C9D2DDC86E13A
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

1355a9f43795a3162b7cfd93d1e39cd4aba0b460fef572fced1c036473a222ab.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/AdvSplash.dll

kernel32

user32

gdi32

winmm

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

Forker135.txt

Growable.Pri

Locutor28.cit

Lrlingekontrakternes.Gge

Pussyfoots80.slu

Spongoblast/Udgrundet.red

Spongoblast/Underbemandes/fulgtes.and

Spongoblast/canvassed.gig

Sharing

General

Malware Config

Signatures

File Explorer

1355a9f43795a3162b7cfd93d1e39cd4aba0b460fef572fced1c036473a222ab.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/AdvSplash.dll

kernel32

user32

gdi32

winmm

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

Forker135.txt

Growable.Pri

Locutor28.cit

Lrlingekontrakternes.Gge

Pussyfoots80.slu

Spongoblast/Udgrundet.red

Spongoblast/Underbemandes/fulgtes.and

Spongoblast/canvassed.gig