00c3e0990cada07e01a3b842cf3d36f36c6ec7dd7d3c1aba430c08d885d66567[.]exe

resource
unpack001/$PLUGINSDIR/System.dll

resource
00c3e0990cada07e01a3b842cf3d36f36c6ec7dd7d3c1aba430c08d885d66567.exe

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

00c3e0990cada07e01a3b842cf3d36f36c6ec7dd7d3c1aba430c08d885d66567.exe

IMPHASH ced282d9b261d1462772017fe2f6972b
SHA256 00c3e0990cada07e01a3b842cf3d36f36c6ec7dd7d3c1aba430c08d885d66567
MD5 00d1386ab7bc8a72d075813480cfb082
SHA1 35eb4ad99745ab2bdbac0553f71cdaa0f584d827
SHA512 fe23ed95154026594c49b7f365d7a530c599152ef170e2d5d2cc00aa25796e766f2277378d4f08309bd0b4a16f239be4520cf0fe137d5ae1c735ec4e3a735a6f
SSDEEP 24576:LPMMMMMMMMMMMMMuKMMMMMMMMMMMhMMG8xXT6dVUkbiF1Y58m+yCaJWk9yA0g:LPMMMMMMMMMMMMMuKMMMMMMMMMMMhMMq
TLSH
T1A11523173F90C967CCA61AB442BED9474BF23D0591E6668F37EABB053C5A1B3910F602
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

e3:f2:fc:b6:00:89:45:c8:3f:5c:03:45:8c:76:fc:af:a8:ff:bc:13:af:7c:2f:3a:f9:55:a0:07:49:a2:6e:26

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Pantebrevshandelen,OU=Stenstningen Argutation Handhole\ ,O=Pantebrevshandelen,C=GB,1.2.840.113549.1.9.1=#0c205374696c7265746e696e67656e4054696c747264656c73656e3235352e507273

Chains

Jul 31, 2026

CN=Pantebrevshandelen,OU=Stenstningen Argutation Handhole\ ,O=Pantebrevshandelen,C=GB,1.2.840.113549.1.9.1=#0c205374696c7265746e696e67656e4054696c747264656c73656e3235352e507273

Minor OS version

0

Major OS version

4

Entry point

13074

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCreateKeyExA RegEnumKeyA RegQueryValueExA RegSetValueExA RegCloseKey RegDeleteValueA RegDeleteKeyA AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken SetFileSecurityA RegOpenKeyExA RegEnumValueA

shell32

SHGetFileInfoA SHFileOperationA SHGetPathFromIDListA ShellExecuteExA SHGetSpecialFolderLocation SHBrowseForFolderA

ole32

IIDFromString OleInitialize OleUninitialize CoCreateInstance CoTaskMemFree

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

SetClipboardData CharPrevA CallWindowProcA PeekMessageA DispatchMessageA MessageBoxIndirectA GetDlgItemTextA SetDlgItemTextA GetSystemMetrics CreatePopupMenu AppendMenuA TrackPopupMenu FillRect EmptyClipboard LoadCursorA GetMessagePos CheckDlgButton GetSysColor SetCursor GetWindowLongA SetClassLongA SetWindowPos IsWindowEnabled GetWindowRect GetSystemMenu EnableMenuItem RegisterClassA ScreenToClient EndDialog GetClassInfoA SystemParametersInfoA CreateWindowExA ExitWindowsEx DialogBoxParamA CharNextA SetTimer DestroyWindow CreateDialogParamA SetForegroundWindow SetWindowTextA PostQuitMessage SendMessageTimeoutA ShowWindow wsprintfA GetDlgItem FindWindowExA IsWindow GetDC SetWindowLongA LoadImageA InvalidateRect ReleaseDC EnableWindow BeginPaint SendMessageA DefWindowProcA DrawTextA GetClientRect EndPaint IsWindowVisible CloseClipboard OpenClipboard

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateFontIndirectA CreateBrushIndirect DeleteObject SetTextColor SelectObject

kernel32

GetExitCodeProcess WaitForSingleObject GetProcAddress GetSystemDirectoryA WideCharToMultiByte MoveFileExA ReadFile GetTempFileNameA WriteFile RemoveDirectoryA CreateProcessA CreateFileA GetLastError CreateThread CreateDirectoryA GlobalUnlock GetDiskFreeSpaceA GlobalLock SetErrorMode GetVersion lstrcpynA GetCommandLineA GetTempPathA lstrlenA SetEnvironmentVariableA ExitProcess GetWindowsDirectoryA GetCurrentProcess GetModuleFileNameA CopyFileA GetTickCount Sleep GetFileSize GetFileAttributesA SetCurrentDirectoryA SetFileAttributesA GetFullPathNameA GetShortPathNameA MoveFileA CompareFileTime SetFileTime SearchPathA lstrcmpiA lstrcmpA CloseHandle GlobalFree GlobalAlloc ExpandEnvironmentStringsA LoadLibraryExA FreeLibrary lstrcpyA lstrcatA FindClose MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA SetFilePointer GetModuleHandleA FindNextFileA FindFirstFileA DeleteFileA MulDiv

$PLUGINSDIR/System.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 d09a8b3ade4ba4b7292c0b3da1bcb4b6c6e2012e0ccfd5e029a54af73a9e1b57
MD5 4ca4fd3fbefa2f6e87e6e9ee87d1c0b3
SHA1 7cdbeb5ff2b14b86af04e075d0ca651183ea5df4
SHA512 cf0f415a97fdc74568297fed4f1295d0d2aef487a308141144ef8d5f04c669ef4795c273e745b81065429adde113fcdedf4c22717a7aeef60fdcd8d4d46f97f8
SSDEEP 192:EPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4W:j7VpNo8gmOyRsVc4
TLSH
T198325C5503504AF3E996863C00263B7FAF796A2095F14D53CFA39480FE2E5C9AD78352
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10529

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Dulgte120.fur

SHA256 b9794ffe6b2b216f953c632ab9121b9c12666ae068e3b78662f9177bf3aee362
MD5 30bb289d5468ceb73c6d39099ce61b15
SHA1 dfe9b35b245bb16a6676c145a9700ca999e79a44
SHA512 9bf0fccd4faa8b2b99e36ed3d6bf0cb63dd4619e977706cf9993122f152367e6f77ce3ca12a6a3f1c5d0d678cb96660afd8a9c7b03072d66c3213476c0e2d11e
SSDEEP 3072:/M+Hq/oYZwK4Yj/ZJwDaiVrfEw+mgHQ5VnoKWmWSkL5DRS9kllpZUt9bjeqYZGuB:te6PE
TLSH
T14186231A2D9B7B0443762C9448625F1D620A65D9AD23B7E2DE3E3723317DE7B2C93348
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Hyperglycistia.jpg

SHA256 49ce76745c7a5ab6e5c4e1e26470c743dc98ea8364410be174d91e935c36a42b
MD5 a8ae4c68d2075d0f9bca93ebec19f91e
SHA1 c0b0dca56d472d4d6bab11a4ed8bd10e5785ecdc
SHA512 752fdba966b6caecb172ebd981b35f7bb6f2a45f16176e36635b7fb2898e442e89aed4cb02064e1887e6f5c53de9321c23b8bffdab5d42d33421b99925fbf063
SSDEEP 768:upYC5iaSsWWFp3m6ieIezv8Rj1Pgwzgr74PZ7xX+UWE299am4Oz:uCC5IsWWFp34r1YAgrAZtX+Z9Qm4Oz
TLSH
T14DF2E0403E5B08A052491D61D21AFFB12F9C2C02EAED723DC5F4B391AF81F356A4BDA1
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Prod/accessoirer.exu

SHA256 afb91cc98d1364bf75a1c9a58f9478b71df3c4aeb45dfb954f1adc7ba0052be9
MD5 d0c73a563fe7a96e96f72757c6be5616
SHA1 33300c6707cdf36f51d5fe76322b6f02f91330a5
SHA512 c19b1be051209f8af25a8c6109aff97c80a865a8036c5ebad95f10526e2dbfb275b4fb55fff755d63cec1d58cecc78d00662b4683fbe4fe4a867ef7b000e050d
SSDEEP 384:NigBVh7kj0IXYTINkpncn6yOAu5DZRXvaOGRaCEd6KvdfFosSbJMu22KEBWw4a/6:CmvOM4DRso8qqBkBh6VL
TLSH
T1486623FBFD487C58ADB0D3A94F5EC7AE8F0EF341012B05282A21EB2D964A5E5254071B
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Prod/attainture.jpg

SHA256 4e3ccb3db512ce25f15c5adca5f0a51f3e855d5d28cc6632feebc352a90aed62
MD5 b0424ccbdb725fd14081ffebf0b48dc3
SHA1 fd3cfd0fd51d7c7460aa72709f891ad640d86e33
SHA512 e436c47fb2682e32f33fff6ad3e532ab9a59eea26af588538f0a742c63ffe5bd7f2ff2f6209b577aca5abd2d39db7ed477c80f16279d7768baf81031e46e930e
SSDEEP 384:RhwakjSmPOVG1xacXMwYvVWv0Mq6WcMeTPooD7W/LIaJ1:Rhle2Hc/h7WznJ1
TLSH
T16E72D0023ED7F2738E9753D9CD69A841466D34EDA1A4153231A2E3C3C930EF44295E58
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Prod/chrimsel.jpg

SHA256 1e612471b3f0220fd887dbf4565b1e1798a53f47ac29a9ba7e6efa29bf155127
MD5 d023b7597c32219808ffb8970a987703
SHA1 209b550e5fea1d45432344cc0a32c42815252f8e
SHA512 fe17374ec8c9555b8f92b78f27ca86d07ec014a439c8b8b179026e23a185d838a463793942f645c8edd696d981ea64f0fff10c88471269b4e7792fe646da48bd
TLSH
T10C414C226B53577ACB21963A7428B113B0D8471235516EB83D21E8ADF554CF8C054234
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

Prod/feltdefinitionernes.ini

SHA256 3385b9879216eb11d3e85f4af7e4ac083f64285b4b4f556a7dce31a9104122bd
MD5 5d3509055777577a710867621347d5ac
SHA1 28c650885428a7c584ee3bac387092e50630a2ca
SHA512 cfb8c40368a77a8b1f1a290ea552d5372a96b12ab13ad534d75210c48a6abe8cbb0a7867b0dfe06d0437f2fae514dce234711ac4263e9848f965d4e69891d757
TLSH
T130F02374A35935478E820505F9A40A804E50295CC413E6B7AF32048CC07E25EA7E137C
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

Prod/gumweeds.ini

SHA256 3f9456934c30665b48ef0e45164175c5ec0621e0fd694c7bdc92534b13c67789
MD5 f1417d8fce02046b1ee3dda8a1a165f4
SHA1 085bca915c38f3b0d1d4149e74cfeaa1a7808b1a
SHA512 387b0dc20d220f9d72003b24dfaea18db6a4f627eddc1088a56146cb07de13c2b1c1d2153a670bf9dd913d8e843569a1c87528ebc894cba857597ec74b258aee
TLSH
T1EAD0E768970B161A531112CCE4853F40031C80207F914016D5E1538F22876D8F10D94D
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

Prod/modelings.txt

SHA256 06ef59621eb4ef01efcb983b7142471a367b57e9cba81c77dba8353fb03f023e
MD5 27b357b4828764c49ab91d3e41b2e4b1
SHA1 b74aeaf9d53f1461b5896f67d9e79aedfb110f54
SHA512 3b4864b689625b48cf8d7b2ed9243172c9d41e4146caca0f0edcb4180e46a23cb77c9b719916d59cbddc46b9ff931a9e7ee2cf33fa123a430b93b559570266a1
TLSH
T142F02019E135A3EA2B43636BE0010142D82E183E1537227B72C7031DA7E3AFC827C619
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

Prod/sprjtemaling.jpg

SHA256 ff3d0af2ea253a96b25c22a0c6942ba6f454625b036017334a041b16ba35e95c
MD5 05f2371709acc7036d3c944e9b92d11e
SHA1 aeec94bd54220817990cac8a1d9b198bc693f9b0
SHA512 b270df79ea61558c8094b1977bbe37a0ac4c0ab84ce10fd1d809f0cf542eff70f537e44322ca49f8832e21694a7bf8b35ced86e65ffbbdc2a7d7703ddab43e5c
SSDEEP 3072:FQiA2WTDv1MEg/SmvV3FQxGnJ/17q6pQwA+X:2igbmo0nPWE3x
TLSH
T1DAB312DAAB93DC5B6D0F279102DC884E84D1B98D10CB3C64109E37BEAAD94BD618FD94
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Prod/udstyrede.txt

SHA256 1da47d77d98450ceb9fdbd608792152e5de1bb0e11f94833badf584b6b2b4762
MD5 017f11fa5e9bba0cb7177e067d37b429
SHA1 ec1ca46d0dcff8d918832dc9f3841d08c32421a1
SHA512 cd8f6bdadc5f7b65dbccc30828a4bbb79e4d27380e45477f72d2f6d59db1cfe673e5e036983a830ada29b30bca5fb8623ca47323e7686b83473bf081af665a5f
TLSH
T1D8E061445D738EEB0E15F62A19555042035D577FC526E0B1F3F7135D924745C83BC28D
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

Rabarberkvarter

SHA256 1ec06d527533648033cc410cc53b1a4faa4510675660ce385b94f729a51a0fef
MD5 934fbecac2d40c9788f8c4c608281342
SHA1 357c172ee42d1eedf391c8f10570d999e3af10ec
SHA512 63260fd6d9392e49b72e69c8d4d2716fc8dfb7ca57d7c1a9431362d98fc7009f4e58cfac15e0fbc477d31b15b835826b4c04857ab81904717663df6e39775480
SSDEEP 6144:mLc9dod5VjwDF0zzi3eFHzoRC/Ck8io+3Vt5:mw9oimyetUcvo+n5
TLSH
T18234F1A9A22F49F2C3E218B4F4E382DF821D765F4F5C67708208B94B562553534F1AEE
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Skamlsest.jpg

SHA256 b9d76fd2e7df6843dd502739105536fac668e71b55fc7d0a18321e4e7da9f018
MD5 4c34a04373e63ca421848358a9a7d7e1
SHA1 6d7ca472288b695822f9348de19fabb4d62e4f77
SHA512 87557f4b523b486ec73e733bec2135423afb37b5adc78abe91dd5130e9a4ced00783c1e9d720b93d2dfdeced0c425741e09991cb3b9d9a9a1df377e0735d5267
SSDEEP 192:LHyfRM/zUMQ+DsQfgs6wZlvw29V4lG9eS63xhjcCJxVu:rypM/AMIVUln9V4QcTjzVu
TLSH
T16902BF52C28DF1CB6B3AD1F99E655185C9C1C60356543A7E3D7CB2BD9790C34EF84019
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Systemkvaliteters

SHA256 4354608882b7d0a0021d7b271c297453d7ca71124550e979dbba1d306610b95d
MD5 bf3a7f38946cd8fe1371bb4f52c45398
SHA1 897ff01ddbd82b1a0b850acf1372edd3b918c7f1
SHA512 293720723952dd5b98f01c7e6852496f80331e11b332df5550ff36164e6c96d308807fd8223cdc2cf70bdfa1b7426d6aa85e348d981473f6ce1b6fd7e0ed4ad9
SSDEEP 384:E3LQlOKB3YT02jZKdZ6CB2n5OgCXsZn0kZYElw+Mq8fhH26AZ:E3MoKBoT0l+yZgHxfavlXA
TLSH
T197828D42D3E5CCB9D542C238D19F01DA9DD86127AB1DEC7DE0BAA4A4C2931E60B25B72
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Yong.jpg

SHA256 67c3a7478b67d6a843a43a17d6d688cd27d6645deb6b3ef4e431ec73f424b2ae
MD5 8eb0f0dd7da1face24220f23677c3a27
SHA1 e5da4b4542041f41a32821a9532deee9d5867826
SHA512 5ea14da7aa4c79e113a8982273a89110709282934a520f50b03280ad2a59de92c07818d77cfb64218446869cc3515b09907ac7dfc4174359216afb29e4526cc0
SSDEEP 192:LnQiIB69n+dpxXKA3JYLLShrhd/hNf6pPTK0bd8KuNrmleW1E+tdzyW9IQyXjm8F:jQiIqOUSV/h96NxdgEeeEILIQyXjTp
TLSH
T1DB52BF2E79541790DF62F2ABAD4D1096D7E49A3D3D8A8B371C7347F1C008CB0D999297
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

00c3e0990cada07e01a3b842cf3d36f36c6ec7dd7d3c1aba430c08d885d66567.exe

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Dulgte120.fur

Hyperglycistia.jpg

Prod/accessoirer.exu

Prod/attainture.jpg

Prod/chrimsel.jpg

Prod/feltdefinitionernes.ini

Prod/gumweeds.ini

Prod/modelings.txt

Prod/sprjtemaling.jpg

Prod/udstyrede.txt

Rabarberkvarter

Skamlsest.jpg

Systemkvaliteters

Yong.jpg

Sharing

General

Malware Config

Signatures

File Explorer

00c3e0990cada07e01a3b842cf3d36f36c6ec7dd7d3c1aba430c08d885d66567.exe

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Dulgte120.fur

Hyperglycistia.jpg

Prod/accessoirer.exu

Prod/attainture.jpg

Prod/chrimsel.jpg

Prod/feltdefinitionernes.ini

Prod/gumweeds.ini

Prod/modelings.txt

Prod/sprjtemaling.jpg

Prod/udstyrede.txt

Rabarberkvarter

Skamlsest.jpg

Systemkvaliteters

Yong.jpg