46f9a60811fcd548da210c8e7bfe6989cc79412f6a2b245491f69c2f50b38042[.]exe

resource
unpack001/$PLUGINSDIR/System.dll

resource
46f9a60811fcd548da210c8e7bfe6989cc79412f6a2b245491f69c2f50b38042.exe

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

46f9a60811fcd548da210c8e7bfe6989cc79412f6a2b245491f69c2f50b38042.exe

IMPHASH ced282d9b261d1462772017fe2f6972b
SHA256 46f9a60811fcd548da210c8e7bfe6989cc79412f6a2b245491f69c2f50b38042
MD5 8d17b06464f37338ce8b369ceffe5b65
SHA1 d2680a0f70a175ac37afe9d1d4c4824de0d3dad3
SHA512 e365ef022f6003b3e02710523ac40a0cc0b67e79aa613ec55fb8edc28185b66762d9008eb400078a43b519265654aa9574a8e632cf949d59cbab37b1a1274161
SSDEEP 6144:sqjIcRE6w/RSFHMR9aCXGa/NQNbhCkrvCWLN:pVRvw5N9/i/COvj
TLSH
T1DF341266B2E8CA67CB6F52704D3BA591BFE5E3110158174B4B5CBF98BD14E52022F883
MD5 SHA1 SHA512 SSDEEP TLSH

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

35:45:c9:27:a0:6f:a1:b7:14:ec:64:19:f8:53:1d:13:c7:c7:96:20:1c:04:e9:10:43:58:d9:e6:df:f0:3a:07:51:c6:44:99:df:1a:5a:9f:68:9f:cd:39:a2:4d:23:01

Digest Algorithm

sha384

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Underteksters,OU=Virgula Eks Instrumentalmusik\ ,O=Underteksters,C=FR,1.2.840.113549.1.9.1=#0c1e52616666696e6572657240536564696d656e746f6c6f677933342e53766d

Chains

Jul 24, 2026

CN=Underteksters,OU=Virgula Eks Instrumentalmusik\ ,O=Underteksters,C=FR,1.2.840.113549.1.9.1=#0c1e52616666696e6572657240536564696d656e746f6c6f677933342e53766d

PE Signature issue

Digest

b3:3d:f0:31:52:81:e5:48:9c:89:ea:f6:9b:96:ed:be:30:81:e7:ce:b7:5c:e0:5d:11:52:48:fe:5e:b9:0c:c7

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Underteksters,OU=Virgula Eks Instrumentalmusik\ ,O=Underteksters,C=FR,1.2.840.113549.1.9.1=#0c1e52616666696e6572657240536564696d656e746f6c6f677933342e53766d

Chains

Jul 24, 2026

CN=Underteksters,OU=Virgula Eks Instrumentalmusik\ ,O=Underteksters,C=FR,1.2.840.113549.1.9.1=#0c1e52616666696e6572657240536564696d656e746f6c6f677933342e53766d

Minor OS version

0

Major OS version

4

Entry point

13074

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCreateKeyExA RegEnumKeyA RegQueryValueExA RegSetValueExA RegCloseKey RegDeleteValueA RegDeleteKeyA AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken SetFileSecurityA RegOpenKeyExA RegEnumValueA

shell32

SHGetFileInfoA SHFileOperationA SHGetPathFromIDListA ShellExecuteExA SHGetSpecialFolderLocation SHBrowseForFolderA

ole32

IIDFromString OleInitialize OleUninitialize CoCreateInstance CoTaskMemFree

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

SetClipboardData CharPrevA CallWindowProcA PeekMessageA DispatchMessageA MessageBoxIndirectA GetDlgItemTextA SetDlgItemTextA GetSystemMetrics CreatePopupMenu AppendMenuA TrackPopupMenu FillRect EmptyClipboard LoadCursorA GetMessagePos CheckDlgButton GetSysColor SetCursor GetWindowLongA SetClassLongA SetWindowPos IsWindowEnabled GetWindowRect GetSystemMenu EnableMenuItem RegisterClassA ScreenToClient EndDialog GetClassInfoA SystemParametersInfoA CreateWindowExA ExitWindowsEx DialogBoxParamA CharNextA SetTimer DestroyWindow CreateDialogParamA SetForegroundWindow SetWindowTextA PostQuitMessage SendMessageTimeoutA ShowWindow wsprintfA GetDlgItem FindWindowExA IsWindow GetDC SetWindowLongA LoadImageA InvalidateRect ReleaseDC EnableWindow BeginPaint SendMessageA DefWindowProcA DrawTextA GetClientRect EndPaint IsWindowVisible CloseClipboard OpenClipboard

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateFontIndirectA CreateBrushIndirect DeleteObject SetTextColor SelectObject

kernel32

GetExitCodeProcess WaitForSingleObject GetProcAddress GetSystemDirectoryA WideCharToMultiByte MoveFileExA ReadFile GetTempFileNameA WriteFile RemoveDirectoryA CreateProcessA CreateFileA GetLastError CreateThread CreateDirectoryA GlobalUnlock GetDiskFreeSpaceA GlobalLock SetErrorMode GetVersion lstrcpynA GetCommandLineA GetTempPathA lstrlenA SetEnvironmentVariableA ExitProcess GetWindowsDirectoryA GetCurrentProcess GetModuleFileNameA CopyFileA GetTickCount Sleep GetFileSize GetFileAttributesA SetCurrentDirectoryA SetFileAttributesA GetFullPathNameA GetShortPathNameA MoveFileA CompareFileTime SetFileTime SearchPathA lstrcmpiA lstrcmpA CloseHandle GlobalFree GlobalAlloc ExpandEnvironmentStringsA LoadLibraryExA FreeLibrary lstrcpyA lstrcatA FindClose MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA SetFilePointer GetModuleHandleA FindNextFileA FindFirstFileA DeleteFileA MulDiv

$PLUGINSDIR/System.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 6fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e
MD5 fccff8cb7a1067e23fd2e2b63971a8e1
SHA1 30e2a9e137c1223a78a0f7b0bf96a1c361976d91
SHA512 f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c
SSDEEP 192:xPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4v:g7VpNo8gmOyRsVc4
TLSH
T116326D5503504AF3E996863C00263B7FAF796A2095F14D53CFA394C0FE2E5C9AD38352
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10529

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Essayet148.bue

SHA256 0cf544317fb533537ac7e3e1249a70a4d30433b7cae3b2d591106e0353f64d25
MD5 c2f61a391a30c7137c4c5b66744a4e18
SHA1 bb4c717ad110daa40f75a28e149bd3e1d5525068
SHA512 b0018a9bf36132523b803b93de72c2550b0be819fe335c4480c229ca3796a90a7b9ce27a024857429041dc1506fb5cafbbb37e97969139431ff6df27329f12f2
SSDEEP 48:dB1u87CJ8zB4Abv0gCLbiSpn++VO2XWfrtZMlj/4:d7fyk9T0gCL7krtZ24
TLSH
T1A5D20D618A5CDFC7A2C56D5453CB43408866F4BF77327575156537B5010F7887531C4E
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Fyldepenneblk

SHA256 bf72f975f579e32a0b0704bc8c27c67dad8f957a9381681a7e579306ee695f96
MD5 d1fb09e06c7ccd78b844a2f4a64be917
SHA1 26f544a93a5b306d25386f6aa4b47c3c786ba719
SHA512 c139ff62470dd6e72b1c478d2ac4e9723c8053581fd622862f1485a7a78f7ae59c2922bad4c1a9b1c5784e5046ac81a3cdce5a178d18a4dd70c77b2c19a2b5c1
SSDEEP 768:DeBc3Dmp2j+dYTjLfZVF1/oTkwd66/R30JwDbyOIl2:aBcgY+2TjpEd6653u+byrY
TLSH
T108E29E92E3519CFEC82AC834D5AD42ADCD1975124F1FC0ADD173E850C2836A7676CBAB
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Ufredstidernes

SHA256 396ae91284457bf72295b164686d7845f0c872fe72df6322d176294bae183b13
MD5 e4edede61a8a6bfda91e2714b8775e73
SHA1 a346fbcb2d835d6225cc4788c73b49922879a19c
SHA512 806508ddf8b76a86dd95e4eed87ca32f1d2d521ed9f77845d15b8240461a43ecf48bbc9f45c3c1a4e9dff2b213c465a4e5a787946cc5f97c403d4af0419b953b
SSDEEP 3072:OOTDiqURbyxG6fUYDq5zQIUpnOndpC8SrYXGOBn9ICSIfrnk31jKaJN4:NDsFifUYDqbGOndpC5Hsf43pm
TLSH
T17F14DF686A87D9B1FE4FAA3DC497433E07117F5D22D9EF87F490A4933913A50362262C
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Xanthomatosis/tilbagevistes.cat

SHA256 5956133656faf7c9e1c19910416f1cfaa7ff0f5d0d6c4dd3f51d90c43ec11629
MD5 51d949901193e2fa5443fcdfd9292714
SHA1 cc1981e68eea89723ce20907a8f46180a9d86268
SHA512 d104307db845d63c2ab3613dfb67051907946a2b48c2d5b60e4bde542f714c4a0d55bd8e30d03f735ad717d83ab56a7aaed5701bc8ff99be54b3f23b620412ed
SSDEEP 24:m5xHjhfcQEXh0l3/q7y+LU+Ejq4gv8g5YvwAX91Ng2nhQ:m7HFfPExa3/Opgve982YvwyPmshQ
TLSH
T1A462DA32FB1013FADDF1485B814D342DD9889D59944021A75C39F5E276B03AF913F754
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

agons.pro

SHA256 aa0d01d8c1f447e6b68c52a559940335ed0e36ab95326aa7b3bab6e451568e3e
MD5 8dbaf272dc1205556e0389c4848f4287
SHA1 e22f0e1a9def9e5761f0222b8f216e783da86ff3
SHA512 6eb9ca8c5017ecd8e0c1f69ed6176396a3bf3bd4fab5f5cb7854ed90eaf26b063f4d6967cf9c075dba6583b5d0c1af97550463451a49841f2293ff0cc88fabdc
MD5 SHA1 SHA512

NSIS installer

installer

discrepate.out

SHA256 5d036a00588c5b7bef7479653e823ff4912b9621d19d611fa086ab09617f897e
MD5 19dd9d60a5c5563faaca34d8cb6d2114
SHA1 528516cbe1438921c7e63b52f7a70dcc6e86b962
SHA512 0bc72ae1e418ee752075a320a8ac4544e56f99e41a7211a86b3cb772a6d486b29d6d178d88a130d4faa343dba6b516037e226e5dd38112d1d7ea21cc077a369f
TLSH
T1C53112046A02E0B4043451C498885C46658650C308148063DF4C98E4001DC614457171
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

haandvrksbagerens.tek

SHA256 0b99322c14ebbf72ade7b7fd12b76a2984c871202986d3d14a849427f46fcace
MD5 70018e219e0496582908fac172d313ef
SHA1 a04ac8a7d04faa383149f266af8959c178727756
SHA512 6d097aded5c8c8541c779ceba6098def88ffc1d9161a4083472d8c9662aa3f20a2b942b0cccdab614b94fe0a54056534a20fa80ef3044a0682f57b3d8833ad0a
SSDEEP 48:nKtWr2yVEfvXEND1R/kLd3ARICGoO87uYd0248:nIW2vUNj/Ud3ARICPfK80q
TLSH
T176C22A78D1B6018DFFB260D1113CEEF135879BCA92CE726D44828791FB00460ED26A2D
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

subtraktionsmaskinens.pak

SHA256 919116dd5d6d51974f443b9ac8a57886d5f1e8b01499d941f31fa3b3c022932b
MD5 42f77eb1c962ba740f59afe0e01355da
SHA1 6ad6d0f61371a09f10de7cdcdbe90cd846ff5f40
SHA512 a25ccfce76f9819c2449606d3da3676486440f6300a26e10697fb160c163f6d422719823c8c98ce0ff79dee05c84666fc60fac9b9026b36d5c4516243dd24fe8
SSDEEP 96:hMdzB62BKTwuumfbCHshbnaXToRog6Wz4njNGLzpWgLVG93l:hQzB6CK0Mf2Hs1ajo2WWjCx63l
TLSH
T1DE232B61D682B8E374C16808412792F5B2509D665CAFFBD553C788842B81D1C6D6F2BA
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

46f9a60811fcd548da210c8e7bfe6989cc79412f6a2b245491f69c2f50b38042.exe

PE Signature issue

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Essayet148.bue

Fyldepenneblk

Ufredstidernes

Xanthomatosis/tilbagevistes.cat

agons.pro

discrepate.out

haandvrksbagerens.tek

subtraktionsmaskinens.pak

Sharing

General

Malware Config

Signatures

File Explorer

46f9a60811fcd548da210c8e7bfe6989cc79412f6a2b245491f69c2f50b38042.exe

PE Signature issue

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Essayet148.bue

Fyldepenneblk

Ufredstidernes

Xanthomatosis/tilbagevistes.cat

agons.pro

discrepate.out

haandvrksbagerens.tek

subtraktionsmaskinens.pak