d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005[.]exe

resource
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/nsExec.dll

resource
d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe

IMPHASH b78ecf47c0a3e24a6f4af114e2d1f5de
SHA256 d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005
MD5 12573405bc4fca639ff9be8299c4c61f
SHA1 e04f94a8659b47974efc4540b9a4edef5e414c22
SHA512 9b2d29b8727dcf97a1075d9e4d255ee8f0b4462105990fb4cafe0e6a6a78627762c04ec064a1654d0973b03936ca8935399191fd515e28f6f008d9bc0bbda72c
SSDEEP 6144:QpZgUXltNBTzfMVuEMqHJ54z8ayCipum5u6Hmk5:AFf4uEMqHJ56HCHz
TLSH
T11454E186B080D4EBD9666831D4BBDD2147263F6A83D15B0F2366773EA873163072F64B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

cf:d6:10:a0:8b:5f:e8:ef:50:3c:53:c7:2f:36:19:4c:a3:67:1e:2d

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Babylonierens,OU=Beautification Amtsavis appetite\ ,O=Babylonierens,C=FR,1.2.840.113549.1.9.1=#0c154d6f757373616b6140436172696f6361732e50726f

Chains

Aug 6, 2026

CN=Babylonierens,OU=Beautification Amtsavis appetite\ ,O=Babylonierens,C=FR,1.2.840.113549.1.9.1=#0c154d6f757373616b6140436172696f6361732e50726f

Minor OS version

0

Major OS version

4

Entry point

12707

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetEnvironmentVariableA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA GetFileAttributesA SetFileAttributesA GetWindowsDirectoryA GetTempPathA GetCommandLineA lstrlenA GetVersion SetErrorMode lstrcpynA ExitProcess GetFullPathNameA GlobalLock CreateThread GetLastError CreateDirectoryA CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA ReadFile WriteFile lstrcpyA MoveFileExA lstrcatA GetSystemDirectoryA GetProcAddress CloseHandle SetCurrentDirectoryA MoveFileA CompareFileTime GetShortPathNameA SearchPathA lstrcmpiA SetFileTime lstrcmpA ExpandEnvironmentStringsA GlobalUnlock GetDiskFreeSpaceA GlobalFree FindFirstFileA FindNextFileA DeleteFileA SetFilePointer GetPrivateProfileStringA FindClose MultiByteToWideChar FreeLibrary MulDiv WritePrivateProfileStringA LoadLibraryExA GetModuleHandleA GetExitCodeProcess WaitForSingleObject GlobalAlloc

user32

ScreenToClient GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard PostQuitMessage GetWindowRect EnableMenuItem CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndDialog RegisterClassA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx GetDC CreateDialogParamA SetTimer GetDlgItem SetWindowLongA SetForegroundWindow LoadImageA IsWindow SendMessageTimeoutA FindWindowExA OpenClipboard TrackPopupMenu AppendMenuA EndPaint DestroyWindow wsprintfA ShowWindow SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA

advapi32

RegDeleteKeyA SetFileSecurityA OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges RegOpenKeyExA RegEnumValueA RegDeleteValueA RegCloseKey RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/System.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 fa4ab1d6f79fd677433a31ada7806373a789d34328da46ccb0449bbf347bd73e
MD5 3f176d1ee13b0d7d6bd92e1c7a0b9bae
SHA1 fe582246792774c2c9dd15639ffa0aca90d6fd0b
SHA512 0a69124819b7568d0dea4e9e85ce8fe61c7ba697c934e3a95e2dcfb9f252b1d9da7faf8774b6e8efd614885507acc94987733eba09a2f5e7098b774dfc8524b6
SSDEEP 192:OPtkumJX7zB22kGwfy0mtVgkCPOsX1un:/702k5qpdsXQn
TLSH
T1A8325C15136046F3E1D2853C542B3AAB6FB869118AF04E43CFB36852EF396C79D79352
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

9995

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsDialogs.dll

IMPHASH ddbd50fe6279559edf7d1f1d89b42c2c
SHA256 f2c1409faf2952c1c91f4b5495158ef5c7d1a1db6eea4a18f163574bd52fcad0
MD5 b3070cf20db659fdfb3cb2ed38130e8d
SHA1 aa234b0620bebddde1414ff6b0840d883890b413
SHA512 4849a4cf24ea8a26cd04eb132d479cc093d4e204ed3866a77646d03778f4c128e20722a0c3cd62ea98a37deea4ce505fe632420158c71a10b0c8c5e32b38e3f1
SSDEEP 96:oEqZ4zC5RH3cXX1LlYlRowycxM2DjDf3GEst+Nt+jvDYx40qndYHnxss:oEq+CP3uKrpyREs06YxEdGn
TLSH
T1DE121A635A4055F3D5D7223A21AA2F2FD73C9324A062BC0287779E462BF531A7D3A351
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

7429

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsExec.dll

IMPHASH 46f8b6973f33717335c0f6d8087de67b
SHA256 288100583f65a2b7acfc0c7e231c0e268c58d3067675543f627c01e82f6fd884
MD5 b5a1f9dc73e2944a388a61411bdd8c70
SHA1 dc9b20df3f3810c2e81a0c54dea385704ba8bef7
SHA512 b9c8d71b5da00f2aff7847b9ec3bd8a588afeb525f47a0df235b52f7b2233edb3928a2c8e0b493f287c923cc52a340ad6fee99822595d6591df0e97870de92a8
SSDEEP 96:p7GUxNkO6GR0t9GKKr1Zd8NHYVVHp4dEeY3kRnHdMqqyVgNQ3e:lXhHR0aTQN4gRHdMqJVgNH
TLSH
T16BD1097675E22EB3C50ACA313C127A2B57F8C8111B9401549B938BD238C5EB3EA28282
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4231

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Curarize

SHA256 0a9f9840c17304fd49af92b07874963dc103b6815b679fe809ad988d89081b3d
MD5 41754048cb985eed0a35d0484bf622eb
SHA1 be5b77e9cdb5b13d9e94199ac88873b39ee99437
SHA512 5b24b77ea0ded07a39ab3a9e037cc71e9a07ad877f34bd34dc399de2b408ccbaf97dc7b59bc67a42eb0780955b9f342fceaaa113e29e829664740fd8af4de444
SSDEEP 3072:RAWxKEPx1Xc8zlECeewSMonYbKKY0PO2BsFqnR9E:RAZEbsXCee3MonwKKY0PO2u0Q
TLSH
T112D3E0D3EF19B101FEB4653362A28527EB340ED8A70E0B68718483F7DD57F50E15A86A
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Lipogenic.fac

SHA256 0dbbdd1570fb34e19ec3cc6262bfa67fb5d3256e1af43e84d589a11b0263b787
MD5 8088172f6c04655496405220d9f52150
SHA1 17a9581ba9556fe2f84fb547081d854c5846bf42
SHA512 ef7ec5bf1d4179c503e8951a076ee077f7e420062f7ad2d46ee4fe7a3317121e7794fb4c99c40051be1b8633e95ce6d61d5b48ac1e13538042ca19eb3dc5add7
SSDEEP 24:s8ncR61iTCr8sipFNwfLkmXiMMTs9uoUEjztgw4:/cHT/si2fLP9MI9Cw4
TLSH
T1468275666DFECA102608FD36343BCBB0D1EA12794A149797E00D3F54C5048C9FA5C22D
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Skalmuringen.man

SHA256 3bc5227800546b93cc8f851f23ba9fedafde70f87db70d938c881f19efca84f0
MD5 f3838d33f11b51f2688d906c5ec0a78b
SHA1 ea8ed95c65fa8f48bfd54031cee9da5086cc9419
SHA512 af68b4522553d69804e5c3e62af7ce662cc3b6b0982ddf64c3b0bbe6abaa6552a51290e035e36201801ad2d8e7c4c9c32ce953c7c0b982db252f2dede9a2f2b2
SSDEEP 96:4l8VWODvRU/LJJ1VkAJnIhM1ZmvwR+3Uv0JSdbdJgKPy7v:rVWOD50LjkWQM1MoR+20EsK67v
TLSH
T164731925301A5214945365F18F588D01117FB3BDC26156BFE41B1C6B9CDDBAB2D0E25F
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Supervastly

SHA256 aa457b083eebe630c3969698f147bc522846352f6570fce84f5052ee3d66cc52
MD5 a25b761f55f0a411b68ffdcba26d9496
SHA1 a6027b8e2238a738be87b346efff5834899b5274
SHA512 4e1936fe505074c184656b448bbdd0a66d4baf1dcdd92b6d42486c5912b8dc9966f51867ff3b0a73e9abf26d5e3117f64a3931f4fab39af78b47306061653b25
SSDEEP 192:9sLgiOz+CKKAkxxX78Nj/yX9FaFszYyHa5YAysl9B/3bXD4m6V1PzRkYnTq:9QgiOz+CKSj8tuFajygl9db8m6vbKkq
TLSH
T170628CA9E72ACCB7FC034D78E00B2251CC155522564FC0ED267AAE64C5DB52B27391FB
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

oprindelsens.bes

SHA256 77e7b4d416dc830f8ddf5cfd97cf5fe2599defbe5c93d8711788d47f8d9aea21
MD5 70b9467972e22f2a199a1b30080f35b7
SHA1 f549be15515d9a009b594b3157f022e27487cc35
SHA512 4f42f26fe811a296ad9021a9903dddc2032f0e5070df752b7af50be93a9068ec50b88f3c865086af56e8c1150bb3cd52ac9c7a673ae8510783c25c55eca6a00b
SSDEEP 24:Sg7AJA/TkKuGBkej0vCAh3cUAWi+wrdF6AaF4xuaz59r6ky365ZL28dE0sKf1qz:SgjTkKkewCAh3hAZxaAa2by3KCNUNqz
TLSH
T1FBD286C31E033E8E23B975C8787DFB5BA927AD875CF92681B3360855D146518B529C05
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

priests.bur

SHA256 35fedeb09e3c03f90bf46fd34fb553e61b1d7ec32a109a0bf2270b8171f00a18
MD5 33d1021e14c4dd760d5fe3b13de20932
SHA1 1d4bb75050bc6b484372b37bcd28913ae82821c6
SHA512 c79487507afcf1522ec04eb05967c19519a3c2bfc9c389edfafb63f38e78b21ade6cca773a1afd9a2d94a9e1c025493dfeea61aa4ef2477634e8d0bb916fecdb
SSDEEP 24:m0csiY1wr8eFpk96bdddd1Isqsy8kfNzFpBcVtvzXBdpBKCdeZkVsgbC:m0nQs6RWsGfP7cPb5BKCgmk
TLSH
T1C9534CC6C121514E494468B9AFCAA7CF24FC8FA20944E8AAD43CDDC2FDB0145C17E770
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

$PLUGINSDIR/nsExec.dll

kernel32

user32

advapi32

generic

Curarize

Lipogenic.fac

Skalmuringen.man

Supervastly

oprindelsens.bes

priests.bur

Sharing

General

Malware Config

Signatures

File Explorer

d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

$PLUGINSDIR/nsExec.dll

kernel32

user32

advapi32

generic

Curarize

Lipogenic.fac

Skalmuringen.man

Supervastly

oprindelsens.bes

priests.bur