unclassified-nsis-dropper: 3c63a3c0 — Unsigned .com-masquerade variant with stride-6 Danish PowerShell cradle

Executive Summary: Ninth confirmed sibling of the NSIS v3 Unicode dropper cluster. Delivered as WORK_REPORT_FOR_YOUR_FILLING_AND_SUBMITTING_SCAN0012_PDF.com — a .com-extension masquerade rather than the usual .exe. Unsigned (no fabricated certificate, unlike prior siblings). Embeds six files in a LZMA:23 solid archive: two high-entropy encrypted payloads, two low-entropy null-padded encrypted PEs, a 55 KB stride-6 Danish character-skip PowerShell cradle (Rockendes.Pot), and a Danish word-salad text decoy. The decoded PowerShell sets up byte arrays, hex-decodes nested payloads, and reflectively executes via .($Foreface) $Twinborn. Static-only — no CAPE detonation (no Windows guest).

What It Is

How It Works

1. Social engineering: The .com extension is a masquerade — the file is a PE32 NSIS installer. The filename masquerades as a scanned PDF document. ^[triage.json]
2. NSIS extraction: On execution, the NSIS stub extracts six files to a temporary directory. ^[7z extraction]
3. PowerShell cradle: Rockendes.Pot (55,351 bytes) is a Danish-themed, character-skip-obfuscated PowerShell script. It defines decoder function Aktricernes with stride 6, offset 5, dead-code variable assignments ($Spejlingernes='Frugivorous', $Svartypesesprent='Indkaldelsestidspunkts'), and reflectively executes the decoded payload via .($Foreface) $Twinborn. ^[Rockendes.Pot decode]
4. Nested payloads: The decoded PowerShell reveals New-Object byte[] arrays, hex-decode functions (Verandahs111), and references to nested payload files (Flashbulb.Ind, Nordamerikaneren.hyl, lenene.cul, uddelegeringer.twe). Static extraction of the final PE is not possible without the decryption key. ^[Rockendes.Pot decode]
5. Decoy: Rooing.txt contains Danish word-salad (salvingernes maalesteder anekdotens rejicerer...) to pad the archive and confuse triage. ^[Rooing.txt]

Decompiled Behavior

The NSIS exehead entry point (r2 entry0 @ 0x0040344a) is a standard NSIS v3 bootstrap: ^[r2:entry0]

• Calls SetErrorMode(0x8001) and GetVersion() for Windows compatibility.
• Loads UXTHEME, USERENV, SETUPAPI, APPHELP, PROPSYS, DWMAPI, CRYPTBASE, OLEACC, CLBCATQ, RichEd32, RichEd20 via LoadLibraryA loop at fcn.0040657c.
• Initializes COM (OleInitialize) and common controls (InitCommonControls).
• Creates a dialog window and enters the NSIS script interpreter — no anti-debug or VM checks in the stub.

The import table is a standard NSIS v3 surface: KERNEL32.dll, USER32.dll, GDI32.dll, SHELL32.dll, ADVAPI32.dll, COMCTL32.dll, ole32.dll. ^[pefile.txt] ^[r2:imports]

C2 Infrastructure

No network indicators recovered statically. The PowerShell cradle decodes to byte-array setup and reflective execution, but the actual C2 URLs (if any) are likely inside the encrypted inner payloads (Flashbulb.Ind, Nordamerikaneren.hyl, lenene.cul, uddelegeringer.twe). Static decryption is not possible without the key.

Interesting Tidbits

• Unsigned deviation: Unlike siblings 4978e16a, f7f089f7, cf9a061d, b3fb616d, 9c43b920, 78c5e8ca, 5212423b, and 3a13583c — all of which carry fabricated self-signed X.509 certificates — this sample is completely unsigned. This may indicate a different build pipeline, a stripped-down variant, or a test build. ^[pefile.txt]
• .com extension masquerade: The first observed sibling to use .com instead of .exe. On some Windows configurations with PATHEXT ordering, a .com file takes precedence over .exe, making this a subtle execution-hijack vector. ^[triage.json]
• Shallow VS_VERSIONINFO: Only Comments and InternalName are populated with Danish word-salad; previous siblings had richer fabricated version blocks (ProductName, LegalCopyright, etc.). ^[exiftool.json]
• Six-file archive: The archive structure matches the cluster pattern (high-entropy encrypted blob + low-entropy null-padded PE + PowerShell cradle + word-salad text). ^[7z listing]
• Danish linguistic fingerprint: Variable names (Frakendelsesperioden, Aktricernes, Spejlingernes) and the decoder function name are Danish, consistent with the cluster. The VS_VERSIONINFO Comments field shrugs stoppekurvens droges is a mix of English and Danish nonsense. ^[Rockendes.Pot] ^[exiftool.json]

How To Mess With It (Homelab Replication)

Goal: Build a comparable NSIS SFX dropper with an embedded PowerShell cradle.

1. Install NSIS v3 and create a .nsi script that includes SetCompressor /SOLID lzma.
2. Embed multiple files using File directives — mix real payloads with noise-padded decoys.
3. Add an Exec or ExecWait call that launches the embedded PowerShell cradle.
4. Compile with makensis to produce a self-extracting installer.
5. Verify with 7z l <output.exe> — should show Type = Nsis, Method = LZMA:23, SubType = NSIS-3 Unicode.

Toolchain: NSIS v3.01+ (Unicode), MSVC 6.0–14.0 linker, 7-Zip for verification.

Deployable Signatures

YARA Rule

rule NSIS_DanishDropper_SFX_3c63a3c0 {
    meta:
        description = "NSIS v3 Unicode SFX dropper with Danish character-skip PowerShell cradle"
        author = "PacketPursuit"
        date = "2026-07-13"
        hash = "3c63a3c0670132e07fb90ca3c29ba35d898f6293bd40619a5611cb705e8b8212"
        family = "unclassified-nsis-dropper"
    strings:
        $nsis_manifest = "Nullsoft.NSIS.exehead" wide
        $nsis_desc = "Nullsoft Install System v3.01" wide
        $nsis_desc2 = "Nullsoft Install System v3.0" wide
        $nsis_desc3 = "Nullsoft Install System v3." wide
        $danish_1 = "Frakendelsesperioden" ascii wide
        $danish_2 = "Aktricernes" ascii wide
        $danish_3 = "Spejlingernes" ascii wide
        $danish_4 = "forventnings" ascii wide
        $iex_equiv = ".($Foreface) $Twinborn" ascii wide
        $stride6_loop = "while($Microcosmus36[$Chromascope])" ascii wide
    condition:
        uint16(0) == 0x5A4D and
        $nsis_manifest and
        any of ($nsis_desc*) and
        2 of ($danish_*) and
        ($iex_equiv or $stride6_loop)
}

Sigma Rule

title: NSIS Danish Character-Skip PowerShell Cradle Execution
status: experimental
description: Detects execution of NSIS-extracted PowerShell scripts using Danish variable names and character-skip decode loops
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|contains:
            - 'Frakendelsesperioden'
            - 'Aktricernes'
            - 'Spejlingernes'
            - 'forventnings'
            - '.($Foreface) $Twinborn'
            - 'Chromascope+=6'
    condition: selection
falsepositives:
    - Unlikely — these strings are unique to this malware cluster
level: high

IOC List

Behavioral Fingerprint

This binary is a Nullsoft Installer SFX archive compiled with MSVC 6.0. Upon execution, it silently extracts six files to a temporary directory. One of those files is a 55 KB PowerShell script (Rockendes.Pot) containing a character-skip decoder (stride 6, offset 5) wrapped in Danish variable names. The decoder reassembles a secondary payload that sets up byte arrays, hex-decodes additional embedded files, and reflectively executes the result. No network indicators are visible in the outer layer; C2 is likely inside the encrypted inner payload. The sample is unsigned, unlike prior siblings in this cluster.

Detection Signatures

References

• Artifact ID: 6cae26df-045e-4a71-828f-28d1cbaaa35c
• MalwareBazaar: https://bazaar.abuse.ch/sample/3c63a3c0670132e07fb90ca3c29ba35d898f6293bd40619a5611cb705e8b8212/
• Cluster entity: unclassified-nsis-dropper
• Technique page: character-skip-cipher-powershell-obfuscation
• Concept page: version-info-masquerade
• Related sibling: /intel/analyses/78c5e8ca9474815c1cd85825b00d9be487a0e049fb827b12ef74bc57580cd3f5.html
• Related sibling: /intel/analyses/f7f089f7f7753da939649fe98a4d274e44b837a61b72d022897858e1998cc7c4.html

Provenance

• File type: file v5.44 — ^[file.txt]
• PE parser: python-pefile (pyc?) — ^[pefile.txt]
• Strings: strings GNU binutils — ^[strings.txt]
• radare2: r2 aa analysis — ^[r2:entry0] ^[r2:imports]
• Extraction: 7z 23.01 — ^[7z listing]
• PowerShell decode: Manual Python stride-6 decoder — ^[Rockendes.Pot decode]
• Metadata: ExifTool 12.76 — ^[exiftool.json]
• radare2 info: rabin2 -I — ^[rabin2-info.txt]