familyunclassified-nsis-dropperconfidencelowcreated2026-06-10pedropperevasionsigninginstaller

SHA-256: 4978e16a7f6b716c324810ec44d5a82eeecd80382e4d5ccb4dc031cdc2559d9f

unclassified-nsis-dropper: 4978e16a — NSIS v3.12 self-extracting installer with fabricated self-signed certificate, Italian payment lure, and encrypted 145 KB payload

Executive Summary

A 482 KB PE32 NSIS (Nullsoft Scriptable Install System) v3.12 Unicode self-extracting installer, compiled April 2026, masquerading as an Italian/Portuguese payment document (Pagamento22052026.exe). The binary carries a fabricated self-signed X.509 certificate with nonsense subject fields, gibberish version-info metadata, and embeds seven LZMA-compressed artefacts — including a 145 KB high-entropy payload (Tyrolerne) that does not decrypt under common XOR keys. Static analysis only; CAPE skipped (no Windows guest). The outer binary is a dropper/loader; the threat logic lives inside the encrypted NSIS payload.

What It Is

File: Pagamento22052026.exe — 482,344 bytes ^[file.txt]
Format: PE32 executable (GUI) Intel 80386, 5 sections, NSIS-3 Unicode self-extracting archive ^[file.txt]
Linker: MSVC 6.0 (MajorLinkerVersion 0x6, MinorLinkerVersion 0x0) ^[pefile.txt:46-47]
Compile timestamp: Sun Apr 19 20:38:47 2026 UTC ^[pefile.txt:34]
Subsystem: Windows GUI ^[pefile.txt:67]
Security features: /GS canary enabled, NX compatible, ASLR/DYNAMIC_BASE, NO_SEH, TerminalServerAware ^[rabin2-info.txt]
Certificate: Self-signed X.509 v3 at offset 0x75290 (2,460 bytes) with fabricated nonsense fields:
- CN = Sandblserens ^[strings.txt:935-950]
- O = Sandblserens
- OU = Samraads Euler
- email = Aktieboom@Crustier2.Unr
- Validity: 2026-04-08 → 2027-04-08 ^[openssl output from terminal]
Version-info masquerade: ProductName preopercle, Comments wassermannprvers subbranches poikilocythemia, LegalTrademarks atmans religionistic victimizables ^[exiftool.json]

How It Works

The outer PE is a standard NSIS v3.12 exehead stub. On execution it decompresses an LZMA-solid archive embedded after the PE header (offset ~0x10420) into a temporary directory and executes the embedded script logic. ^[binwalk.txt] ^[strings.txt:228]

Seven files were recovered via 7z extraction:

File	Size	Type	Assessment
`$PLUGINSDIR/System.dll`	21,733	PE32 DLL (NSIS system plugin)	Legitimate NSIS plugin; provides `Call`, `CopyFiles`, `RegDLL`, etc. ^[file output]
`Tyrolerne`	145,140	data	Primary payload. 12,846 null bytes + 132,294 bytes of uniformly distributed high-entropy data (256 unique byte values). No recognizable header under XOR with keys 0x00–0xFF. Likely AES or custom stream-cipher encrypted. ^[terminal hexdump]
`Afruster`	21,733	data	Smaller entropy blob; same random-byte distribution pattern. Possible secondary payload or config.
`Harborward251.ini`	579	gibberish text	Nonsense words (`SOVIETIZATIONS OUTCHAMBER`); anti-analysis padding or decoy.
`Jauking/slices.ini`	~500	gibberish text	Same pattern; bracketed nonsense headers (`grounders majoriteters`).
`Jauking/Upwith.txt`	~400	gibberish text	Nonsense Danish/German-sounding words (`overmaade bibliotheke`).
`Jauking/glasrrets.imp`	data	Unknown format; likely import table or config fragment.

All embedded filenames are generated nonsense words — an obfuscation tactic to evade static YARA and human triage.

The NSIS stub imports registry manipulation, file I/O, and process-creation APIs: RegCreateKeyExW, RegSetValueExW, CreateProcessW, ShellExecuteExW, CopyFileW, MoveFileW, DeleteFileW, AdjustTokenPrivileges. ^[pefile.txt:278-504] This profile is consistent with a dropper that extracts a payload to %TEMP%, optionally writes a registry Run key, and executes the payload with elevated privileges.

No C2 strings, URLs, or network-related artefacts were recovered from the outer binary. Network behaviour is expected to be payload-resident.

Decompiled Behavior

Static analysis of the NSIS stub (radare2 entry0 at 0x00403557) shows a standard exehead main loop: initialise Common Controls, parse command line, decompress the LZMA archive to a temp path derived from GetTempPathW, and dispatch to the NSIS bytecode interpreter. ^[r2:entry0] No anti-debug or VM-detection logic was identified in the stub itself; the opaqueness is achieved by encrypting the payload rather than hardening the loader.

The $PLUGINSDIR/System.dll exports typical NSIS system-call wrappers (Call, Get, Put, CopyFiles, CreateDirectory, RemoveDirectory, RegDLL, UnRegDLL, etc.). These are legitimate NSIS helper functions being repurposed by the attacker’s install script.

C2 Infrastructure

None recovered statically. The outer binary contains no hardcoded IP, domain, URL, or Telegram bot token. C2 is expected to be resolved or contacted by the decrypted Tyrolerne payload at runtime.

Interesting Tidbits

Filename social engineering: Pagamento22052026.exe targets Italian/Portuguese-speaking victims with a fake payment document dated 22 May 2026. ^[triage.json]
Certificate as anti-analysis: The self-signed cert is not for trust — it is for padding and to make the binary appear "signed" in superficial triage. The subject fields are random word-salad generated by a script. ^[strings.txt:935-950]
Version-info as anti-analysis: ProductName preopercle and Comments wassermannprvers subbranches poikilocythemia are semantically-empty generated strings, similar to the certificate fields. ^[exiftool.json]
Payload naming: Tyrolerne, Afruster, Harborward251, Jauking, glasrrets, Upwith, slices — all computer-generated nonsense words. This prevents signature-based detection on filenames and complicates open-source intelligence pivoting.
Null-byte padding in payload: Tyrolerne contains 12,846 null bytes interspersed with 132,294 random bytes. The nulls may act as alignment padding or as a simple entropy-reduction trick to evade crude entropy thresholds.
CAPE limitation: capa flagged the sample as an installer and refused deep analysis: "capa cannot handle installers well." ^[capa.txt] No behavioural signatures were generated.

How To Mess With It (Homelab Replication)

Reproduce a comparable NSIS dropper:

Install NSIS 3.x on a Windows research VM.
Write a .nsi script that uses File directives to embed an encrypted payload and Exec/ShellExec to run it post-extraction.
Compile with makensis.exe /INPUTCHARSET UTF8 script.nsi.
Optionally sign with a self-signed cert using OpenSSL: openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 365 -nodes -subj "/CN=NonsenseWord".
Embed the certificate into the PE security directory using signtool or a custom signer.
Verify: file reproducer.exe should show "Nullsoft Installer self-extracting archive" and 7z l reproducer.exe should list embedded files.

Deployable Signatures

YARA Rule

rule NSIS_Dropper_FabricatedCert_ItalianLure
{
    meta:
        description = "NSIS installer with fabricated self-signed cert and Italian payment lure"
        author = "triage"
        date = "2026-06-10"
        hash = "4978e16a7f6b716c324810ec44d5a82eeecd80382e4d5ccb4dc031cdc2559d9f"
    strings:
        $nsis_manifest = "Nullsoft.NSIS.exehead" ascii wide
        $nsis_desc = "Nullsoft Install System v3.12" ascii wide
        $payment_it = "Pagamento" ascii wide nocase
        $cert_cn = "Sandblserens" ascii wide
        $cert_email = "Aktieboom@Crustier2.Unr" ascii wide
        $product_name = "preopercle" ascii wide
        $comment = "wassermannprvers subbranches poikilocythemia" ascii wide
        $lzma_props = { 5D 00 00 80 00 }
    condition:
        uint16(0) == 0x5A4D and
        $nsis_manifest and
        $nsis_desc and
        ( $payment_it or $cert_cn or $cert_email or $product_name or $comment ) and
        $lzma_props
}

Sigma Rule

title: NSIS Installer Execution with Suspicious Embedded Payload
logsource:
    product: windows
    category: process_creation
detection:
    selection_exec:
        CommandLine|contains:
            - 'Pagamento'
            - '.exe'
    selection_temp:
        CommandLine|contains:
            - '%TEMP%'
            - '\\Temp\\'
    selection_nsis_indicators:
        - ImageLoaded|contains: 'System.dll'
        - ImageLoaded|endswith: '.exe'
    condition: selection_exec and selection_temp and selection_nsis_indicators
falsepositives:
    - Legitimate NSIS installers
level: medium

IOC List

SHA-256: 4978e16a7f6b716c324810ec44d5a82eeecd80382e4d5ccb4dc031cdc2559d9f
Filename: Pagamento22052026.exe
Certificate CN: Sandblserens
Certificate email: Aktieboom@Crustier2.Unr
ProductName: preopercle
Comments: wassermannprvers subbranches poikilocythemia
Embedded payload file: Tyrolerne (SHA-256: d5c6122e2eb24739582a6a050e581bec472664d60a5af4ade54eeb317f5e0886)
NSIS version: v3.12 Unicode

Behavioral Fingerprint

This binary presents as a Windows GUI executable carrying a valid PE header and a self-signed X.509 certificate. On closer inspection the certificate subject contains computer-generated nonsense strings. The file is a Nullsoft Installer (NSIS) v3.12 self-extracting archive that decompresses an LZMA-compressed payload to a temporary directory. The embedded archive contains a legitimate NSIS System.dll, one or more high-entropy encrypted data blobs with nonsense filenames, and text files containing gibberish words. The outer binary imports registry-write and process-creation APIs consistent with persistence and payload execution, but contains no hardcoded network indicators. Network behaviour is expected to originate from the decrypted inner payload at runtime.

References

Artifact ID: 1ad73046-75f1-4e3d-8e43-105c1bb4667b ^[metadata.json]
MalwareBazaar entry for SHA-256 4978e16a... (source: OpenCTI connector)

Provenance

file.txt — file(1) output
pefile.txt — pefile Python module full header dump
rabin2-info.txt — radare2 binary info
strings.txt — GNU strings output
exiftool.json — ExifTool metadata
binwalk.txt — Binwalk embedded artefact scan
capa.txt — Mandiant capa capability detection (installer limitation warning)
dynamic-analysis.md — CAPE sandbox summary (skipped, no Windows guest)
Manual extraction via 7z x and certificate inspection via OpenSSL
Terminal-based XOR bruteforce and entropy analysis of payload Tyrolerne

> Analysis · 4978e16a7f6b_