c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5[.]exe

resource
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/nsExec.dll

resource
c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe

IMPHASH 9a16e282eba7cc710070c0586c947693
SHA256 c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5
MD5 86666c4287b523e0b80c14dbda780f08
SHA1 9e3b5d55d1d97611ba8fca903eb8bddf8a9b0810
SHA512 404ab18ab9b7a06e51aaf6cf5e8c3cb712d2ff5df7a581b548baa540edc6c226b15de08b993ebce942b60cb386235e852b0f21656a5343f216a7b0ecaeff0394
SSDEEP 24576:hv6Dmf5/CEa+Q1NQhaM6gpmaITJXe+56LqgBA:8qR6D1ir6gM1f8BA
TLSH
T160152392FB60E967D490DDB24CB4F02E47E7EC40D9A5870AFB01B64AF83C5C5994E722
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

a9:6c:1e:7d:96:ca:cd:e8:95:ec:6e:08:d5:bd:82:04:31:00:38:d2

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Vikingernes,OU=Atomlres Falderebstrappens\ ,O=Vikingernes,C=FR,1.2.840.113549.1.9.1=#0c1c4e6575726f736369656e6365404e6f6e706561726c697469632e5361

Chains

Jul 31, 2026

CN=Vikingernes,OU=Atomlres Falderebstrappens\ ,O=Vikingernes,C=FR,1.2.840.113549.1.9.1=#0c1c4e6575726f736369656e6365404e6f6e706561726c697469632e5361

Minor OS version

0

Major OS version

4

Entry point

13331

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueA RegEnumKeyA RegQueryValueExA RegSetValueExA RegCloseKey RegDeleteValueA RegDeleteKeyA AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken RegOpenKeyExA RegCreateKeyExA

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA SHFileOperationA ShellExecuteExA

ole32

OleUninitialize OleInitialize IIDFromString CoCreateInstance CoTaskMemFree

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create

user32

SetDlgItemTextA GetSystemMetrics CreatePopupMenu AppendMenuA OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcA GetMessagePos CheckDlgButton LoadCursorA SetCursor GetSysColor SetWindowPos GetWindowLongA IsWindowEnabled SetClassLongA GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassA SystemParametersInfoA CreateWindowExA GetDlgItemTextA DialogBoxParamA CharNextA ExitWindowsEx DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow ShowWindow wsprintfA SendMessageTimeoutA FindWindowExA IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint MessageBoxIndirectA CharPrevA PeekMessageA GetClassInfoA DispatchMessageA TrackPopupMenu

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor

kernel32

CreateFileA GetTempFileNameA ReadFile RemoveDirectoryA CreateProcessA CreateDirectoryA CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceA lstrcpynA SetErrorMode GetVersionExA lstrlenA GetCommandLineA GetTempPathA GetWindowsDirectoryA SetEnvironmentVariableA WriteFile CopyFileA GetCurrentProcess GetModuleFileNameA GetLastError GetFileSize GetTickCount Sleep SetFileAttributesA GetFileAttributesA SetCurrentDirectoryA MoveFileA GetFullPathNameA GetShortPathNameA SearchPathA CompareFileTime SetFileTime CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc GetModuleHandleA LoadLibraryExA FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA MulDiv lstrcpyA MoveFileExA lstrcatA WideCharToMultiByte GetSystemDirectoryA GetProcAddress GetExitCodeProcess WaitForSingleObject ExitProcess

$PLUGINSDIR/System.dll

IMPHASH 240ca92ecc1c291801c451c447e16c12
SHA256 a44ca08afb3f6bafd76aa35c259f3d599fe34f6f49ea5118626c1c1a540b0f03
MD5 81e268e27dbbcadbf116b5a9402195ab
SHA1 bd2b701b2e5e279786e179bceee2dc132a2afc37
SHA512 784115c69df4a6f180efb4d48cf5c6e8c2393b8ce9aa664f192abf5a260984880c668dd0f93564126d2fc718130570c4f6224d1373d73bcb8343f04f6ede25de
SSDEEP 192:VFiQJ77pJp17C8F1A5xjGNxrgFOgb7lrT/d93:97pJp48F2exrg5F/d
TLSH
T10C424B1583618EF3F5961E3C00667E2F2B79BE3416F104A39FE34481AD9A1CF99B5392
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10673

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsDialogs.dll

IMPHASH cfc8bb9e11188db414351d2620c98f39
SHA256 7853be9190489ba84dae8232e9a967cec02d941732cb4137bc9ae6a392e89fb8
MD5 3fbd78c889fa40a2e5567b980c57b7db
SHA1 303564bfa6fd5ab7a65d35ae1cd14a05643b6b5d
SHA512 95ccd599cdacb1128aa35694aa5428f12f50a20d95bb500e9b180b3ab322b1870ae301f77f7ca0e8674c78742a1eb5c82ba3cee05c67d3d961a695563c8c1514
SSDEEP 96:oX7lf7AR1VhrfzBik0cxM2DjDf3GEkniJnifvcx418qndYv0PLE:oXl7wrLBn0REc0JxedO0PLE
TLSH
T1371207135A0044B3D9E2223A31AA2F2ED73C932490527D02C777DE5A2BB43166D3E351
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

7513

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsExec.dll

IMPHASH 9076fa7961baeaeda0746cb0928f486a
SHA256 e20666c498941d36bfd0eae411ad73c475d043cee39b50c31734a70eecaae0bb
MD5 13bd8e89dc79004d85ab02626e08c3c5
SHA1 0ef0efb3237233de26f55c4420753ed0fed418ad
SHA512 58841cc9e8313775a097a93e68952d8005b826bf1349dc24d49e3128b87e9021a028d2d4e738997390f1625f7ae7744a9ff85289f6c78f5ebd67c0da61ef2120
SSDEEP 96:pOBtYZKtPsrqBApt1JHpb9XWk7Qe06iE6mE6YNFyVOHd0+uUwEX:ptZKtrAJJJbP7iEHEbN8Ved0Pw
TLSH
T1F7D1F83A2AD12DF3D04889702827793ACBB9C8360F500650DF671EE225E1DE7DB2038B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4231

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Applicancies

SHA256 aa7df66a7cafb118f89381ed9de04fc8ef23fc85f29e30419cbfdc23e4bb6dc4
MD5 5e9eac70670d587efcd0dee5c3a27ce5
SHA1 2226db5a4ce6ef07eb179b9ad74ce88226b1b5b2
SHA512 72e94750a9f858fae751764c5a21fd087e39d4a8b28b5acc918f75f0d2b4e362a6f3d4f7f813e2b8bbcdf065b84d733d8cdfb53ed875484a18be7e391345ed98
SSDEEP 6144:z21z1yKx2cstekHJOeV+c9ajFl3gXM1AQOnFaQx:WzAKx2dtzpWc9ajo81AQ4r
TLSH
T17234F1E55C9E6094D8954BF5543280A723CA77BE136403AE73721FA03A229E71F27FB4
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Bahawder.txt

SHA256 18af51d51d22803bf50753a1dae01266ad6c153b6dddb44f048bfb33ed70f708
MD5 e9a35b32b413eb7f6695fee7e6900fe3
SHA1 e5806b0b17fd9edd9a58fbd48857fb465a735e60
SHA512 a227d39e0b5e0541a4285ab346b76817da7f1a99366aeee668c5f76e141ddf2df31329f43f7d2bee6c02a9e3c9628dffa1c757e29826084ede798679668a2dcd
TLSH
T116D09517661A5C547E07548BCC1C5452132070C5C31C47E87241C35E70D70C8B37C3DC
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

Invasioner/Outranking/Maximizing.pig

SHA256 dc2d4c173536fc3f80381190450ff3611f78d1002dc805a885b615b0341293e7
MD5 2d79391a2ab67566c731935f20d0fda1
SHA1 dfcdd6da5dfa1470dbc422144c79d7a6ee2f99bf
SHA512 29db013d4ce5eaf59d05012c4aa1e2626e9aa9c7c8d194f520243a5399460c86651268eeb3d03070d755ce61f46e4c94b2998a39e4961da428de2b5a24aefa2b
SSDEEP 6144:1QYJ7KAMPIxXGLWSjLrO2wr9sKv3X0frop78ugUDnbpPWIzkCg/t4LxL6za+P/Sy:SM6
TLSH
T15F86130FDBD6201B6AFF34F6B763D44780C69744348A1E48AB2642A9D77767BF0B8024
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Invasioner/Outranking/Utraquism72.ini

SHA256 595e8b51f142e81581dfb1437cc17b35f5c81f7474d733cd6233d31dbf7edf96
MD5 357dc20b655c966a3c80de4801caf163
SHA1 7b5742f55bd932a3c60494f898cb52676e9603d5
SHA512 9b00e1e7252052ea7fb1135ea715fd68e78aacbc76c03207dbfd2f904aac603cc55d2d352f2ea9fe543962e0ee044d36c0ae1ad400734c8c7e0ab0ab69253190
TLSH
T1EFF020A8EC4A219AC6332B59AC460D1398F1C1B54031362490E5935C60F684CA7FF60D
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

Invasioner/Outranking/esset.ini

SHA256 71fce393e6e1e38b5368b01d4240614fc4b7fe1070e6dfc4544873e55da71da0
MD5 4a7759f2130753f943e452c6c79ded1f
SHA1 654a09d021354e4b0155c319b4ae87f323192b11
SHA512 e3463e6360927768eafe4f7aef6b40b675c9a1d6a756c904debd6f7cf677660848cb21f6be901a318b5dbd7a3d4cf0be98812d9cc68c3c47d86e8180e7a436d3
TLSH
T1A3F00C4782D661F90C966A95A8EA4C8822CD0CA8454462A9315F0318008A0B8E23C70D
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

Invasioner/Outranking/fiskerlejets.jpg

SHA256 26bbc2313d29d0c0b61d8471c5b1b8bda42706073b23d34bc1277c1b70e75890
MD5 a2b7c121c1d57cf9e3302ab5d772a353
SHA1 96e2b40987d515788d9db3ecca158c284ffc9095
SHA512 d6ac50b4a0e6d5bbb6d482554d25731f17953a8bd63a0b0c541956bc61d1ecf0adaa4936d8fe5fff610c28d77c11d0fdf25fa0b3eecad140e7d270b471bb3854
SSDEEP 768:W+0q5U0W8x5X2hD9Z+X+WoJ8iiZ0OU82L8eRy1:WPq5bxoJZNDbiGN82LXRo
TLSH
T1B8E2E12CEA5C4F09151D3A30064F364776DBEE205F5D4A94B482E35C27A9EBF5D28263
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Invasioner/Outranking/overnegligently.jpg

SHA256 fc7d14bad52933bb5a802b3e38eb86267e03507acefb00b9394cf50bb40e5b63
MD5 6267f9a08638003a3aeac900e092d7d9
SHA1 3aa2b082f6db77bb889bca01be5335b1dc4bdc95
SHA512 f482d3a87a6e0a2e48f243093cdf8f18c45d0cbfa2a851f2acdb13db8427d4c8658b5c08985ae6b25d744d6dc37a8a90b3efdd37242b9e6173f717a15ec48f98
SSDEEP 192:LoNCtxCbxtexuB2/yN2npaWkOhIGY0M5NiZvPRVQNoqIekUP/bZBzG4Fzq:sk3CDB2Gqa8ix5kxPLQv7zP1Fzq
TLSH
T1DE32BF13EA6AA1F2D78F51504A9644EFA3A4684874C4B7F43072CC959194C731E88FEE
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Invasioner/Outranking/prostrike.ini

SHA256 49d26a418bd4b139c4c97ee0da5c087030a8e4e6eb6c6aea7edec4a77fb1f31a
MD5 9adc69d52ba5c5b572ac284e5ea82328
SHA1 2c25e96c0cdec161a9cc5629ad87f8b0bac2c813
SHA512 92bad5b73ca75a2fe5eae733d2c58a6f242180a9c585aff9c183b39113545fbab33bfa5e717ec6042563256a377a1abb0a21c817ff48edcb73933bd0cfd18cf2
TLSH
T165E0F194FCC1262E55A21FD6E668008C0176E12E0A39653DD793070F29407ACFA6EF6E
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

Invasioner/Outranking/pseudoeconomical.jpg

SHA256 2b39cb22cf1d3ebf51e3682fb8463e48044e935f110fef7eed4fccf91dbe647d
MD5 70c1eb26ef9be6715750e57fa565af96
SHA1 678e0074e059b13aef9ed961890358038e022dcf
SHA512 e7c9e7c52f87d3854459900cfe227bb011b722a224532abe25110f12a5428aa26982b502a9f43382a309dcb4cd78efab08d0db8459a52da7b22743dfc7afb894
SSDEEP 192:L/EyGgJh6uo2wiZX0LBjZovVT8bxzo/8pq5uQ2WIA:jrGah6uo9iZYZuVIO8pqt
TLSH
T169E1AFC572072D4467008EF255139F26E1AEAD24F8D4B375C25A65D9BB46CFED221314
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Invasioner/Outranking/rigdomskildernes.ini

SHA256 dcb38eca6f8005b521a7bca61d960e8b183ae7aedb26ae39ce66a4ff19901212
MD5 2f8377ffa8fcf0ce7e543e5669fb9b84
SHA1 38f13f43aa01c7cc4ae30cee23c7acf67ee4f672
SHA512 7b74c566a19a365ca668a0803ed5b115e4939752db06d60f2259cb19647c971a6a36b4828a86f5ace69205e702533333542c136fb9afe4a800c93fae52d38bb3
TLSH
T114E0AB59CC260309768D0642A04204D2F1ECC4F0C9959ED1B97A27F5E32B05CE23EE9C
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

Invasioner/Outranking/tutterne.txt

SHA256 f980ae19a89a7d6154dba3e7b66966e80e2b07c3a9fe55ea7a8c89f194ab0551
MD5 9df643264cce59ab9ae2dc869b05c8f3
SHA1 58d2af307e81d21e4e1522132ce9eeeb1d82e2d9
SHA512 6453556d0a5e08ed2086dd8635569d392a467ec643d7427c33f759df45d05f00d7112b762e228726497798d9be2704be25ca50db63d722ac4926bc4818b5a743
TLSH
T191C022AD9CAC11C7CE045A103ED0EE8020614C8098545230E3CF0A050E60591FE3DE2F
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

Invasioner/Outranking/unkosher.fer

SHA256 0327e82506315ee23f3a315aafa96ee47b594816c08a11fe6418b51c3be5c9d5
MD5 1913c7e4ffe714a4e8484d18e5076b20
SHA1 ceb71e7ce08e70a977ab66c2e8a3ecd4960340b6
SHA512 b697e80bc6825c4937fe36e6238cdddf2df400054c53fe012956714f616381b3f84b51d344aed739932e5c8b4bdf175b6c4628200fbdc29fa4b7ee3614bf9bcc
SSDEEP 6144:z2qa8Xsz0bvDnsP/eG03xHWxVbgvxk1aJ5VtZBnU6W0qrN8Jf4CmOhrW3/Ha9rlP:d
TLSH
T1308622DC8A1BEC6FE8E497D9D2BEE5E72494761C1073765C0CC04BAAE0AA10678F7171
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Invasioner/Outranking/vaskeskinds.txt

SHA256 ac72d8e195fa3881677d19d664e9ee90a7cae6c4eadacd02b62e6623ea1e1760
MD5 0688052ec783a0457fc37e2128f972c5
SHA1 c055bdad49c63d1b0d9e820d99cab6b7af393f2b
SHA512 0c7330430740cd954d59f7da324c6beb677617c6b560f1e0da71da34986d83313df00d45617478c2c0bfba571183bf22e6705b60155f226b1fb1528a31865bb0
TLSH
T1AFF00290C8F6B90F60961E1DED1216A68D2A4B4094195912E295C72A28029A4F26A168
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

Invasioner/Uphale

SHA256 af512a872f02e76466830b4099f67a3ea796e6d97c13168799b3a307f79be869
MD5 f7e99c05a6ed73a62825246fe2a3f747
SHA1 dabaa981c5d46b056c83b227e3402b1da3780b04
SHA512 877c84b7837eb2d512e6dd29dbc79e6dadc31326cf51ca861d0face06676739fc87b9f0d61ea2cf2b723689a61d23139d956ff5ac08545b50c098da0c2261ceb
SSDEEP 96:y/jv6O+hNKb3nHXOKLGB33GN5vrSzn2pIsgqr/o/hP+7uSgtuD5nYkHNEakrHTdL:f3NaOKLO3exTgB/06CnuawTXTqTUXWd2
TLSH
T125128DC697149CBECC17E438826EEE7208E4902257CBDCBD31385E86D55B29A379D336
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Sharing

General

Malware Config

Signatures

File Explorer

c9624e6bd4e2336c04ac9a5ccbb67a5f66312528fa839547e4a543f12aa46ad5.exe

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

$PLUGINSDIR/nsExec.dll

advapi32

user32

kernel32

generic

Applicancies

Bahawder.txt

Invasioner/Outranking/Maximizing.pig

Invasioner/Outranking/Utraquism72.ini

Invasioner/Outranking/esset.ini

Invasioner/Outranking/fiskerlejets.jpg

Invasioner/Outranking/overnegligently.jpg

Invasioner/Outranking/prostrike.ini

Invasioner/Outranking/pseudoeconomical.jpg

Invasioner/Outranking/rigdomskildernes.ini

Invasioner/Outranking/tutterne.txt

Invasioner/Outranking/unkosher.fer

Invasioner/Outranking/vaskeskinds.txt

Invasioner/Uphale