2f375aa830e096b51493699c2b117efc3ad4cf559b9a25ecc42cfbd37d4a35ea

Sharing

Copy URL Twitter E-mail

General

Target
2f375aa830e096b51493699c2b117efc3ad4cf559b9a25ecc42cfbd37d4a35ea
Size 568KB
Sample260826-js2xpacc57
SHA256 2f375aa830e096b51493699c2b117efc3ad4cf559b9a25ecc42cfbd37d4a35ea
MD5 6145540a3fdf7ad948f116451f59dd7a
SHA1 47e6f4c9cf2f29cbfe95b992a876f1ba4392453b
SHA512 190c58c4afc936add812fd6f268cece4ace50ea8b46d5746fb36d607d5dd50a26b53a35dd2348efd3a6f9afb79d99f3058f6f59648e503bf67c08959167678ba
SSDEEP 12288:Rw2DngHTVx549xd/rNhwranvxCSAXoXmzB0VL8UsGGwClTnl2wYu:R6xi9xdbYSAXoC098UpGrz
TLSH
T108C42306518025B3E55149B02CB8B7F0D376ECE2AC1DD9BBAFAADF5F15356438C840AB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

installer

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/$PLUGINSDIR/jjff.dll
unpack001/$PLUGINSDIR/nsisunz.dll

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2f375aa830e096b51493699c2b117efc3ad4cf559b9a25ecc42cfbd37d4a35ea

NSIS installer 2 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

File Explorer

2f375aa830e096b51493699c2b117efc3ad4cf559b9a25ecc42cfbd37d4a35ea

.exe 568KB
$PLUGINSDIR/jjff.dll

.dll 104KB
$PLUGINSDIR/nsisunz.dll

.dll 40KB
insHv26.bhcabfebbff

454KB

2f375aa830e096b51493699c2b117efc3ad4cf559b9a25ecc42cfbd37d4a35ea

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 2f375aa830e096b51493699c2b117efc3ad4cf559b9a25ecc42cfbd37d4a35ea
MD5 6145540a3fdf7ad948f116451f59dd7a
SHA1 47e6f4c9cf2f29cbfe95b992a876f1ba4392453b
SHA512 190c58c4afc936add812fd6f268cece4ace50ea8b46d5746fb36d607d5dd50a26b53a35dd2348efd3a6f9afb79d99f3058f6f59648e503bf67c08959167678ba
SSDEEP 12288:Rw2DngHTVx549xd/rNhwranvxCSAXoXmzB0VL8UsGGwClTnl2wYu:R6xi9xdbYSAXoC098UpGrz
TLSH
T108C42306518025B3E55149B02CB8B7F0D376ECE2AC1DD9BBAFAADF5F15356438C840AB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

0b:1e:54:18:1b:cc:44:fa:13:92:85:7b:01:f6:d4:e5:0d:c4:0d:8f

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=BEST APP,O=BEST APP,L=Dublin,ST=Dublin,C=IE

Chains

Aug 21, 2026

CN=BEST APP,O=BEST APP,L=Dublin,ST=Dublin,C=IE

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Minor OS version

Major OS version

Entry point

12538

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/jjff.dll

IMPHASH 0d7fd4a8983b2a7c90efd972505b2b18
SHA256 0a804028761c5d7510d574ba72ae48d363ab3343e3d25be72efcb3be77b89cd0
MD5 b6a2b722d6b5ba44802de7b2e36bf2a0
SHA1 04d03c9430eaf8b6c06f41530e4806870bf3a8d8
SHA512 2c06012bfdc53528d8964d777b832572adfb07d5fb850940fbc10e1aa697c0612205995b11926a4b9cdc891833baf042d76f1923616100b61b78e8042a7402c4
SSDEEP 1536:Yn6lLkgfR1KKd29JAHC/wqPfmvw/mubNewvOQBgx2Xa+G:86lLdfR1W9CK9JJvOQBgx2X
TLSH
T1BFA36C117189C032D15B563C4A25F7B19BABB8A1CDB1AD8B3FE50ABE5F742C1DA34306
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

21433

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

lstrcpyA GlobalFree InterlockedIncrement InterlockedDecrement Sleep InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection EncodePointer DecodePointer GetLastError HeapFree GetCurrentThreadId GetCommandLineA RaiseException RtlUnwind HeapAlloc WideCharToMultiByte LCMapStringW MultiByteToWideChar GetCPInfo TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent SetHandleCount GetStdHandle InitializeCriticalSectionAndSpinCount GetFileType GetStartupInfoW IsProcessorFeaturePresent HeapCreate HeapDestroy GetProcAddress GetModuleHandleW ExitProcess WriteFile GetConsoleCP GetConsoleMode SetFilePointer ReadFile FlushFileBuffers CloseHandle TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetModuleFileNameW GetLocaleInfoW HeapSize GetACP GetOEMCP IsValidCodePage GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale GetStringTypeW HeapReAlloc LoadLibraryW WriteConsoleW SetStdHandle CreateFileW SetEndOfFile GetProcessHeap

$PLUGINSDIR/nsisunz.dll

IMPHASH 0f92772da9c737d2bac38919e9863980
SHA256 6e87ecb7f62039fbb6e7676422d1a5e75a32b90dde6865dcb68ee658ba8df61d
MD5 5f13dbc378792f23e598079fc1e4422b
SHA1 5813c05802f15930aa860b8363af2b58426c8adf
SHA512 9270635a5294482f49e0292e26d45dd103b85fe27dc163d44531b095c5f9dbde6b904adaf1a888ba3c112a094380394713c796f5195b2566a20f00b42b6578e5
SSDEEP 384:KExN66Yf2xL5Q4IsjuUjUZfqRDpImexpf88FwHxXvjX3hwlHt6oIfESxSHoOO8n9:O2x64GcVpI3xC8ynToIf1SIOhW4
TLSH
T188038EA392C146FBC5F8843931DA6E1D6A9EFC301BC16103CB2DBDA52D153967A642CF
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

17930

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

2f375aa830e096b51493699c2b117efc3ad4cf559b9a25ecc42cfbd37d4a35ea

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/jjff.dll

kernel32

generic

$PLUGINSDIR/nsisunz.dll

kernel32

user32

generic

insHv26.bhcabfebbff