2e767a8e51b002ff7f6cb69bca4e0787b3ba0310040ab73a17c76036da73edf1

resource
2e767a8e51b002ff7f6cb69bca4e0787b3ba0310040ab73a17c76036da73edf1
unpack001/$EXEFILE
unpack001/$PLUGINSDIR/Banner.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsisdl.dll
unpack001/$TEMP/$EXEFILE

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

IMPHASH b40f29cd171eb54c01b1dd2683c9c26b
SHA256 2e767a8e51b002ff7f6cb69bca4e0787b3ba0310040ab73a17c76036da73edf1
MD5 babbfa9c2837d5d4c953b6deb9b4363c
SHA1 48390616920f6a98dda8367a4195e4787ef187dc
SHA512 91757772014ae34d138df232cefcbdd658a0df1e04e83748a2142373445a8a873df2d03f5978ae88f56f6178d7163fc69ee8bd187e0ef6837fbd63fb80fff148
SSDEEP 6144:o+K03SwpNXT2TPGLURQN3vTLWBQ/7TzttuCMNhGK6DgsQQYO:p3Bxq7HqFvfW6jTz3uCMNQKagQ
TLSH
T12C6422110BE898BBDD8707F542B253E6EAB5CA02A625E9477B907F2F7B33097D8041D1
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12508

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

Sleep GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA CompareFileTime SearchPathA GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess SetEnvironmentVariableA GetWindowsDirectoryA SetFileAttributesA lstrcmpiA SetErrorMode LoadLibraryA lstrlenA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrcpyA lstrcatA GetSystemDirectoryA GetVersion GetProcAddress WaitForSingleObject SetFileTime CloseHandle GlobalFree lstrcmpA ExpandEnvironmentStringsA GetExitCodeProcess GlobalAlloc GetModuleHandleA LoadLibraryExA GetCommandLineA GetTempPathA FreeLibrary FindFirstFileA FindNextFileA DeleteFileA SetFilePointer ReadFile FindClose GetPrivateProfileStringA WritePrivateProfileStringA MulDiv WriteFile MultiByteToWideChar

user32

CreateWindowExA EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard GetDC SystemParametersInfoA RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx DestroyWindow CreateDialogParamA SetTimer GetDlgItem wsprintfA SetForegroundWindow ShowWindow IsWindow LoadImageA SetWindowLongA SetClipboardData EmptyClipboard OpenClipboard EndPaint PostQuitMessage FindWindowExA SendMessageTimeoutA SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA

advapi32

RegCloseKey RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegEnumValueA RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

CoCreateInstance CoTaskMemFree OleInitialize OleUninitialize

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$EXEFILE

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 6334231bf67a2c5b52ea79cd234298cb0da81da4f939835a4adf243d19f886ae
MD5 5861e9267892e1f14793b1097508b325
SHA1 5a6a89e6a42673c0662396bdd63053f387a34b33
SHA512 1790085c5a4f1ae5ce6bac8d755e9f9c8a6444769a784197b58714d778ea624caccc6628546005146902235a83743ea13c615694411d0e50c1a3f68df371779f
SSDEEP 96:O7x4GFlhgpfbhTX/Rfo/EsL2fZ3JLBOCCMtmOaxhwwT:OxVfKbFX/RASR3uCvtmhHD
TLSH
T14AC1931667984A33DDFA47FADCB353C4B3B0FA11D963DE6F4CD6815E68822180E91760
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12062

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

$EXEFILE.config

SHA256 689393cb6ef8116640554d67c5c5d1742817bb53afb754f14a28134ea8abed8b
MD5 26d995b829f45c1588f33b0e5b465c57
SHA1 1d6a7acaeb2623bbab9b04da4b2e799aa9927a4b
SHA512 3b16c66eee1a4d439f4e4c0a6fb5770e604ddca61527795db766334d9be389159393605337a830f5f99a37bd3f212bc3b3738e059e3f4f37732765341ecfaa76
TLSH
T11301474609C8AABB46321557F6200A51DF34E1C7B0AA5415B4ED76930F334D943E73B1
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

$PLUGINSDIR/Banner.dll

IMPHASH f81377f1c55b7962f1e18d52fc7eb628
SHA256 de59710bad95741c41e608f946d9eb4edacdf73ab92a1a3341f8a160b8952c66
MD5 fcca36e21ca7c4ecfc29f6804acbd76b
SHA1 2f1972d5a0ec8377e043b9b304e62c24c6c38506
SHA512 1885aaf379e6547e519a65751d192beb9f078d63f056886cbcdae75f37f12bf8e89c98fa3c45aa60967e19ba51329a8384cf7a64d851ab10b648b17daf9b175e
TLSH
T18E81D87B73E43EF3C5530B3310031BD356AAA844AB68421D8D57A8E7BB56847DA3C702
MD5 SHA1 SHA512 TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4759

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 3b6a5cb2a3c091814fce297c04fb677f72732fb21615102c62a195fdc2e7dfac
MD5 cf85183b87314359488b850f9e97a698
SHA1 6b6c790037eec7ebea4d05590359cb4473f19aea
SHA512 fe484b3fc89aeed3a6b71b90b90ea11a787697e56be3077154b6ddc2646850f6c38589ed422ff792e391638a80a778d33f22e891e76b5d65896c6fb4696a2c3b
SSDEEP 96:3IsUxO9udx4qYp7AJb76BykUbQMtHUOA5Iv+RnsrqeXV+d1g2IW9t2c+cEwF9oug:YVL7ikJb76BQUoUm+RnyXVYO2RvHoug
TLSH
T112327D19436481F3D5D1843D146A7ABB6F2C762196F44FD3CFB39880BE285C6AD79322
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

9922

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsisdl.dll

IMPHASH 35098e8775f91723e90a28745ef6495b
SHA256 72c65f7cd4a611b077b1ad0be8185780909e9cb04c53ecdac3e17fc72c99b245
MD5 1dadb63a5dfaa0679485c5dbaf96033f
SHA1 d1717aab683c55bd13bbd520d2a91178efa0d676
SHA512 46535c2d96937d49ee7c222428db4a8d61eb346efa0845fcd88e06523ed7836518e5a72d623e9c5563bf6759b449b6d2fcb0340b98a6e7966027bc983db4f722
SSDEEP 384:wck76gi51kE5aYOMLDC4UnDp9B0Jc5HNw2PE:wck76gibLCMLDLCx04HNVPE
TLSH
T149622A51691009F6C761127430D73BBE6BB38E314B1585C39BE39A8EBD24A039676ECB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

8905

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$TEMP/$EXEFILE

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 6334231bf67a2c5b52ea79cd234298cb0da81da4f939835a4adf243d19f886ae
MD5 5861e9267892e1f14793b1097508b325
SHA1 5a6a89e6a42673c0662396bdd63053f387a34b33
SHA512 1790085c5a4f1ae5ce6bac8d755e9f9c8a6444769a784197b58714d778ea624caccc6628546005146902235a83743ea13c615694411d0e50c1a3f68df371779f
SSDEEP 96:O7x4GFlhgpfbhTX/Rfo/EsL2fZ3JLBOCCMtmOaxhwwT:OxVfKbFX/RASR3uCvtmhHD
TLSH
T14AC1931667984A33DDFA47FADCB353C4B3B0FA11D963DE6F4CD6815E68822180E91760
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12062

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

$TEMP/$EXEFILE.config

SHA256 689393cb6ef8116640554d67c5c5d1742817bb53afb754f14a28134ea8abed8b
MD5 26d995b829f45c1588f33b0e5b465c57
SHA1 1d6a7acaeb2623bbab9b04da4b2e799aa9927a4b
SHA512 3b16c66eee1a4d439f4e4c0a6fb5770e604ddca61527795db766334d9be389159393605337a830f5f99a37bd3f212bc3b3738e059e3f4f37732765341ecfaa76
TLSH
T11301474609C8AABB46321557F6200A51DF34E1C7B0AA5415B4ED76930F334D943E73B1
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

$TEMP/34ef3d279dee46f183e6cd6da04f1226.txt

SHA256 01f7c0b4e7539db0a0005331a29bd1a393064fa3942924f2dd5309f1de5af9dd
MD5 6a701c0f5ee06f40192df7686da2de2b
SHA1 cd8ee3a8a1d818aad00ddb8ebdda71d1d4cd4a82
SHA512 33524ed618638f5ab04f906a3e00bc31385cb80cf932dafebcf53298f84f58f959689b1a710114fc67cfc8355a481bd0645b59d06d44bafddab4e0f550fd4321
SSDEEP 6144:eoTIS4woXObA9sRDfxB4IW/wR3cwoeHJXRJBW0h:e55zJsZ/4rIR3cyJXVNh
TLSH
T1303423FF84B00DA7C216617AA5E700EE385723C94C9871EB43E26A477ACD123229D57E
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

34ef3d279dee46f183e6cd6da04f1226.txt

SHA256 01f7c0b4e7539db0a0005331a29bd1a393064fa3942924f2dd5309f1de5af9dd
MD5 6a701c0f5ee06f40192df7686da2de2b
SHA1 cd8ee3a8a1d818aad00ddb8ebdda71d1d4cd4a82
SHA512 33524ed618638f5ab04f906a3e00bc31385cb80cf932dafebcf53298f84f58f959689b1a710114fc67cfc8355a481bd0645b59d06d44bafddab4e0f550fd4321
SSDEEP 6144:eoTIS4woXObA9sRDfxB4IW/wR3cwoeHJXRJBW0h:e55zJsZ/4rIR3cyJXVNh
TLSH
T1303423FF84B00DA7C216617AA5E700EE385723C94C9871EB43E26A477ACD123229D57E
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer