NordInstaller[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
NordInstaller.exe
Size 11.6MB
Sample261012-wae2esvx3m
SHA256 c78c8e68178d6a418d427ab7d65bd47c2d30cb2247ea3d9f450a5d72d8ebeb08
MD5 57b0720a90f41b39efe967b8d8979cb7
SHA1 07a854af6518206dc46c111c9ad507e6fb28264f
SHA512 099e517bf59a83a86709ef096ca535e08da24a4b54acf7db26f17fe68b3fc3a6a7b2cb72588f84eacc54dc8f4cca13bc45fe9b2e275c578f0d621e1deb1092b5
SSDEEP 196608:nXHFfrILtboXG15JpcyO1jrAdD6H0NDMavyWKvuEf/WwZoh29:XlGtqGMb1jcB60NeNm++m
TLSH
T16AC68E309352D235C4572A3196BE37716368BF1012270A0F3E5DE9CA5BA57B85B0F3AB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

NordInstaller.exe

.exe 11.6MB

NordInstaller.exe

IMPHASH 5e23c27b3824708b2d383803a4d51854
SHA256 c78c8e68178d6a418d427ab7d65bd47c2d30cb2247ea3d9f450a5d72d8ebeb08
MD5 57b0720a90f41b39efe967b8d8979cb7
SHA1 07a854af6518206dc46c111c9ad507e6fb28264f
SHA512 099e517bf59a83a86709ef096ca535e08da24a4b54acf7db26f17fe68b3fc3a6a7b2cb72588f84eacc54dc8f4cca13bc45fe9b2e275c578f0d621e1deb1092b5
SSDEEP 196608:nXHFfrILtboXG15JpcyO1jrAdD6H0NDMavyWKvuEf/WwZoh29:XlGtqGMb1jcB60NeNm++m
TLSH
T16AC68E309352D235C4572A3196BE37716368BF1012270A0F3E5DE9CA5BA57B85B0F3AB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

d9:75:a6:28:03:ab:02:67:31:0d:da:f8:86:63:cb:13:cb:25:ac:cf:53:79:a0:e5:45:e4:cf:fc:52:d6:3c:4f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=155694934,CN=nordvpn s.a.,O=nordvpn s.a.,L=Panama City,ST=Panama,C=PA,1.2.840.113549.1.9.1=#0c1161646d696e406e6f726476706e2e636f6d,1.3.6.1.4.1.311.60.2.1.3=#13025041,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Aug 21, 2026

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Mar 18, 2029

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

Serial Number

62:cd:f8:18:8d:36:a4:cf:37:a3:34:fd

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 18, 2024 - Jun 14, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

4791833

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CancelIoEx CancelSynchronousIo CancelThreadpoolIo CloseHandle CloseThreadpoolIo CloseThreadpoolWait CloseThreadpoolWork CompareStringEx CompareStringOrdinal CreateDirectoryW CreateEventExW CreateFileW CreatePipe CreateProcessW CreateThread CreateThreadpoolIo CreateThreadpoolTimer CreateThreadpoolWait CreateThreadpoolWork DeleteCriticalSection DeleteFileW DeviceIoControl DuplicateHandle EnterCriticalSection EnumCalendarInfoExEx EnumTimeFormatsEx ExpandEnvironmentStringsW FileTimeToSystemTime FindClose FindFirstFileExW FindNLSStringEx FindStringOrdinal FlushFileBuffers FormatMessageW FreeLibrary GetCPInfo GetCPInfoExW GetCalendarInfoEx GetCommandLineW GetConsoleCP GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentProcessorNumberEx GetCurrentThread GetCurrentThreadId GetDynamicTimeZoneInformation GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesExW GetFileInformationByHandleEx GetFileType GetFullPathNameW GetLastError GetLocaleInfoEx GetLongPathNameW GetModuleFileNameW GetNativeSystemInfo GetOverlappedResult GetProcAddress GetProcessId GetStdHandle GetSystemDirectoryW GetSystemTime GetThreadPriority GetTickCount64 GetTimeZoneInformation GetUserPreferredUILanguages InitializeConditionVariable InitializeCriticalSection IsWow64Process K32EnumProcesses LCMapStringEx LeaveCriticalSection LoadLibraryExW LocalAlloc LocalFree LocaleNameToLCID MoveFileExW MultiByteToWideChar OpenProcess OpenThread QueryPerformanceCounter QueryPerformanceFrequency QueryUnbiasedInterruptTime RaiseFailFastException ReadFile ResetEvent ResolveLocaleName ResumeThread SetDefaultDllDirectories SetEvent SetFileInformationByHandle SetFilePointerEx SetLastError SetThreadErrorMode SetThreadPriority SetThreadpoolTimer SetThreadpoolWait Sleep SleepConditionVariableCS StartThreadpoolIo SubmitThreadpoolWork SystemTimeToFileTime TzSpecificLocalTimeToSystemTime VirtualAlloc VirtualFree WaitForMultipleObjectsEx WaitForSingleObject WaitForThreadpoolWaitCallbacks WakeConditionVariable WideCharToMultiByte WriteFile AddVectoredExceptionHandler GetModuleHandleW RtlCaptureContext RaiseException FlsAlloc FlsGetValue FlsSetValue WaitForSingleObjectEx CreateEventW SwitchToThread SuspendThread FlushProcessWriteBuffers GetThreadContext SetThreadContext FlushInstructionCache GetSystemTimeAsFileTime VirtualProtect CreateMemoryResourceNotification QueryInformationJobObject GetModuleHandleExW GetProcessAffinityMask CopyContext InitializeContext GetEnabledXStateFeatures SetXStateFeaturesMask VirtualQuery DebugBreak SleepEx GlobalMemoryStatusEx GetSystemInfo GetLogicalProcessorInformation GetLargePageMinimum VirtualUnlock GetWriteWatch ResetWriteWatch VirtualAllocExNuma IsProcessInJob GetNumaHighestNodeNumber K32GetProcessMemoryInfo IsDebuggerPresent LoadLibraryExA InitializeCriticalSectionEx EncodePointer FlsFree RtlUnwind SetUnhandledExceptionFilter InitializeSListHead IsProcessorFeaturePresent

api-ms-win-crt-heap-l1-1-0

_aligned_free _set_new_mode _callnewh free malloc calloc _aligned_malloc

api-ms-win-crt-math-l1-1-0

_libm_sse2_pow_precise _libm_sse2_sin_precise _libm_sse2_sqrt_precise _libm_sse2_tan_precise floor _libm_sse2_cos_precise __setusermatherr ceil _libm_sse2_log_precise modf

api-ms-win-crt-string-l1-1-0

strncpy_s _stricmp strcpy_s

api-ms-win-crt-convert-l1-1-0

strtoull

api-ms-win-crt-stdio-l1-1-0

__p__commode __acrt_iob_func _set_fmode __stdio_common_vsprintf_s __stdio_common_vsscanf __stdio_common_vsnprintf_s __stdio_common_vfprintf

api-ms-win-crt-runtime-l1-1-0

_controlfp_s terminate _seh_filter_exe _set_app_type _crt_atexit _configure_wide_argv _initialize_wide_environment _get_initial_wide_environment _initterm _initterm_e exit _exit __p___argc __p___wargv _cexit _c_exit _register_thread_local_exe_atexit_callback _register_onexit_function _initialize_onexit_table abort

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

NordInstaller.exe

kernel32

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic