a6a86646b0066a630d7e6004ce08d52e70d81e77d98268b98a34b588cacded0a[.]exe

resource
a6a86646b0066a630d7e6004ce08d52e70d81e77d98268b98a34b588cacded0a.exe
unpack001/$PLUGINSDIR/System.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

a6a86646b0066a630d7e6004ce08d52e70d81e77d98268b98a34b588cacded0a.exe

IMPHASH b78ecf47c0a3e24a6f4af114e2d1f5de
SHA256 a6a86646b0066a630d7e6004ce08d52e70d81e77d98268b98a34b588cacded0a
MD5 ef0f924151f234c344bc8b995c24602e
SHA1 1ac2bbb4f2c3c8135e85bb681da577001c71bfe1
SHA512 3d4a0333ffb2a5b2d42836ceecafdde79469e0c6871be3e9bf6287f71caff255963edd664a4ad1d18754f825bb4e03ee92804eb090ad16db28f26006a3b3ac60
SSDEEP 6144:Pz20GHu6JDLDQSP4v95xtTyxYjFK3/Xr0attVfHNTvJ1UDN:KDHVPWtlKhRFvoZ
TLSH
T1E5849C67FA53C0EBCF7813F2F5D3E5BB1DFD68566C94909A67E29A927000E321A0D124
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12559

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetEnvironmentVariableA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA GetFileAttributesA SetFileAttributesA GetWindowsDirectoryA GetTempPathA GetCommandLineA lstrlenA GetVersion SetErrorMode lstrcpynA ExitProcess GetFullPathNameA GlobalLock CreateThread GetLastError CreateDirectoryA CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA ReadFile WriteFile lstrcpyA MoveFileExA lstrcatA GetSystemDirectoryA GetProcAddress CloseHandle SetCurrentDirectoryA MoveFileA CompareFileTime GetShortPathNameA SearchPathA lstrcmpiA SetFileTime lstrcmpA ExpandEnvironmentStringsA GlobalUnlock GetDiskFreeSpaceA GlobalFree FindFirstFileA FindNextFileA DeleteFileA SetFilePointer GetPrivateProfileStringA FindClose MultiByteToWideChar FreeLibrary MulDiv WritePrivateProfileStringA LoadLibraryExA GetModuleHandleA GetExitCodeProcess WaitForSingleObject GlobalAlloc

user32

ScreenToClient GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard PostQuitMessage GetWindowRect EnableMenuItem CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndDialog RegisterClassA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx GetDC CreateDialogParamA SetTimer GetDlgItem SetWindowLongA SetForegroundWindow LoadImageA IsWindow SendMessageTimeoutA FindWindowExA OpenClipboard TrackPopupMenu AppendMenuA EndPaint DestroyWindow wsprintfA ShowWindow SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA

advapi32

RegDeleteKeyA SetFileSecurityA OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges RegOpenKeyExA RegEnumValueA RegDeleteValueA RegCloseKey RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/System.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 681382f3134de5c6272a49dd13651c8c201b89c247b471191496e7335702fa59
MD5 2ae993a2ffec0c137eb51c8832691bcb
SHA1 98e0b37b7c14890f8a599f35678af5e9435906e1
SHA512 2501371eb09c01746119305ba080f3b8c41e64535ff09cee4f51322530366d0bd5322ea5290a466356598027e6cda8ab360caef62dcaf560d630742e2dd9bcd9
SSDEEP 192:vPtkumJX7zB22kGwfy0mtVgkCPOsE1un:k702k5qpdsEQn
TLSH
T178325C15135046F3E1D2853C542B3AAB6FB869118AF04E43CFB36852EF386C79D79352
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

9995

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Anthramin/idiotropian.sep

SHA256 b158098cc0a14f7a786725bc9fbfc7b4b9fa896afabcd5422f8fe81af302a700
MD5 d9d6a5eee8535ec751610560c4a385e9
SHA1 16e3289f47ba69a6aac8f07278dc5375b94353b9
SHA512 2c05711d50acfe6836d01d4a301cccb1fba18c50e4aca92855be88abe7710c6b2a51d8b105af0ae5c62ca76d05243f729048d1dc3de8ba65767d5c20370cee22
SSDEEP 12:TSN8+MqLNK8QuT6OHtzoCTi/dWQTz+y95im+WOTyX+0OfxLkD+H:uNKANauuEoCm/dvzp8RXWXMqDe
TLSH
T19F3228D05FB1C831DFCB0C1005E235B98D455D7441C4520213C0937E1549073CD47D61
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Anthramin/strikkede.gno

SHA256 db912fac886127b285df64505474f2e8bf57f515e24c9149be7a9399341aba21
MD5 ca754f2c2cf404fed05448979f17510a
SHA1 5004e310d00cf952dd4f3e62552eeff1cb9484e8
SHA512 f3fc5de3c3d2029f54b6ae610febd592be0398154d28f699f663c3c8ff8955d371f2de36461f989c8138e67fddf02247a76dd03d55dd9ad94a9e43a5febe6ae0
SSDEEP 24:Q5OHDBQKhUOKBQkbgWaYPAl8YHIm09REJC:Q8HVhUOijbfaVlH909REJC
TLSH
T1C962D49F540F1B16C25C90451F81BD4E75F904AA9366F7828640451D43DC55A2E21549
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Caricology

SHA256 c13690a425fd2a62fe82cc03317ed1e97fe7bbc9a98672adf40f3786cdb06127
MD5 0fcebfd498b601a2168ed75e9d36e1d6
SHA1 e63e3238096ddadae04b0846da9f22317da3e6c5
SHA512 4934644b439a81d78575316a4020c9f65ee3fbaf639ee5d02fdefb675ba5e65ca8a2f823939cd789f9dc188945c16fbe682b7f390608626b2c322b1bf05e2c9a
SSDEEP 3072:dAypCsB3QTR+w2n0OwleB+YYUJNm5xOHPPPPPPPPPPPPALJ:2un0OwMAYTkOALJ
TLSH
T10CD3F1A10ED4DCC7D8559939E31DF0B185631C333E0EA18B25BAEB86C5BFCE046567A8
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Confessionary.abb

SHA256 1b39270f5c3063595ddce972fdb5d26fb998fd6fbd649b422afd6db178be5ebe
MD5 86474929558e962df09ce23fbddc9994
SHA1 d6cc036d451409ad7234c38b14aa6e3c8af77d1d
SHA512 c4e9bfef69dae4375475d9323935ca5cbb92136b5477aaaf9445c3eea94525b60c4f7a61e0bb96b469b74881b59db58c7a2421ea877294fd6e32e0e449920342
SSDEEP 6:iQ8m+kFETM4qIBh0IB9DghuHaxIuIBW+DQUDgUi1IB3+WIBdIBOX+BEc:F19FEwVIrYut5DQUDm1IZXIrIkXIt
TLSH
T1BE0272031488B9E370D93EC8EE2F0FB692789889ECC8845594E3E23402C04260012326
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Rabiate

SHA256 0e8ad286a06e2473a940270498af0643fde9d32d383c67ed10df5940263d1521
MD5 808b9196b13cb7eedc354c64a0e8decd
SHA1 ca7facb1eeae8286f116e98e20a6cb85b6cad65e
SHA512 48a36856b961b06fca367a5174d0b3ef084bc5a6a3af4210e92e9584c68b3a9ccee1c16fa5929e16b958a75cf7db64532f7864f674b0077e46f8694e38639eb2
SSDEEP 384:oID4tIhK2f5QOzRp6lQUkhe3ZLxLCicLQjuPz:omkIE2f5Q/lV3ZEiYz
TLSH
T1C3B28D5B8F465DB7CD87C230E6AA10EB0DD63012472BA0FC7172C854C9936F7A735A6A
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Rodger167/Printkorrektur.fal

SHA256 e010b82e674235518cc5f78c2c5923104520f7b26cb8a15231e59a0545c4f35f
MD5 8f639a2c3b17ba16ecb57b4ea5cac31f
SHA1 f5b8be61943f16f529483d378dcfa1d5e2260727
SHA512 4d8b9d934555502ca9093f7533bf87f2fb07638bbc1e59b78028cb2698bac87bca81f31d22a91b22559291f33682186756f9bc23b4e1a370eced5dbd6bd5e3a6
TLSH
T134711214DB21E31AA330C07EDC0146409109C66690F765FCE038238E34273405A7DA9A
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

Royaltyerne/Foredragsforeningers/gease.out

SHA256 081f68b6bdbdc4ebc41cb21b04b116bc0de7c0bda9466384ab79c3f45eabcf5c
MD5 bc5d41ab60117d407b004b8cecd43e19
SHA1 7c5eb1ac22fd35deb5d1459d2a41c6a1471ba6af
SHA512 87bca5b56d7ed441cdb9b54b49e6cc0618aeac671f579a3d811c34cef172f8c228093107f80f78aae48145d0299a89f4983d85e0bf4c0136fb8743ceca5ab854
SSDEEP 24:U7z61RayMchqEoTCpIfDMHa82Nnk8DsZqusW4ALd4I5:CYRMsoTCe4Hh2O8UMW4A35
TLSH
T16E62759836445BDF00790DE96DD3F4C4AC095307271411747757416CE24A23224E8F2F
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Royaltyerne/democracies.tea

SHA256 059beb70d47fc134316136d6cf86e328f974e48c92e232de23d3ea9c8966dacd
MD5 0b26999d3f2bf47c02692d6b2dc1d427
SHA1 94e8927480904d2e3dae0b3f3cdf8337742a17fa
SHA512 7583bea42541743edbc9565d5108af6f28b30283c860bb68a7fa24166ebcda5fedd32e83a7df1fbd585e79b024d187901eb3e0f52e9ccf788320817ae5f9be0e
TLSH
T1F8819B6759046825517D0B16155C980E0D3965E115BAA0D6780267D61906184D616755
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

a6a86646b0066a630d7e6004ce08d52e70d81e77d98268b98a34b588cacded0a.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Anthramin/idiotropian.sep

Anthramin/strikkede.gno

Caricology

Confessionary.abb

Rabiate

Rodger167/Printkorrektur.fal

Royaltyerne/Foredragsforeningers/gease.out

Royaltyerne/democracies.tea

Sharing

General

Malware Config

Signatures

File Explorer

a6a86646b0066a630d7e6004ce08d52e70d81e77d98268b98a34b588cacded0a.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Anthramin/idiotropian.sep

Anthramin/strikkede.gno

Caricology

Confessionary.abb

Rabiate

Rodger167/Printkorrektur.fal

Royaltyerne/Foredragsforeningers/gease.out

Royaltyerne/democracies.tea