unclassified-nsis-dropper: 5212423b — "PI_24000032.exe", 2022-build MSVC 14.29 sibling

Executive Summary

Seventh confirmed sibling of the NSIS v3 SFX dropper cluster. Masquerades as a proforma invoice (PI_24000032.exe) and is a Nullsoft self-extracting installer embedding four LZMA-compressed files: a Danish word-salad text decoy, an oversized obfuscated PowerShell cradle (161 KB), a null-padded encrypted payload (347 KB, 98% nulls), and a small high-entropy encrypted blob (7 KB). Unlike prior siblings, this sample was built with MSVC 14.29 (Visual Studio 2019/2022) in October 2022 — a toolchain upgrade from the MSVC 6.0 observed in earlier cluster members. The fabricated self-signed certificate uses a US state theme (Florida/Miami). Static-only analysis (no CAPE Windows guest); inner payload decryption requires runtime. See cluster analysis at unclassified-nsis-dropper for shared fingerprint.

What It Is

• File: PI_24000032.exe ^[triage.json]
• SHA-256: 5212423bac835b8c3268e4cf2b195043bdcd403e7d98f9182830098585ef2d1a
• Type: PE32 executable (GUI) Intel 80386, Nullsoft Installer self-extracting archive, 5 sections ^[file.txt]
• Size: 649,992 bytes (635 KB) ^[triage.json]
• Timestamp: Tue Oct 25 10:32:10 2022 UTC ^[pefile.txt:34]
• Linker: MSVC 14.29 (MajorLinkerVersion 0xE, MinorLinkerVersion 0x1D) ^[pefile.txt:46]
• Subsystem: Windows GUI ^[pefile.txt]
• Dynamism: Static-only. CAPE skipped — no Windows guest available. ^[dynamic-analysis.md]

How It Works

Outer Loader

The binary is a standard NSIS v3 Unicode exehead self-extractor. The embedded BZip2-compressed archive starts at file offset 0x72168 and contains four user files plus $PLUGINSDIR with System.dll and nsExec.dll:

The disusance.nar file is almost entirely null padding with scattered single non-null bytes — a null-padding anti-triage technique that inflates file size while hiding the actual encrypted payload. The Spitten.Cla file is much smaller than the high-entropy blobs observed in prior siblings (~350 KB). The PowerShell cradle is roughly 3× larger than prior siblings' ~50 KB cradles, suggesting either a larger secondary payload or additional obfuscation layers. ^[binwalk.txt]

PowerShell Cradle

Static extraction of the decoded PowerShell script from Svangerskabsafbrydelsen.Cri was unsuccessful. The file contains UTF-16LE-like wide-character padding with scattered printable sequences. The strings iEX was recovered ^[strings.txt], indicating the cradle likely decodes to an Invoke-Expression reflective-execution chain. Based on cluster behavior, it is expected to use the same character-skip cipher (stride 6, offset 5) with dead-code variable padding observed in siblings f7f089f7, b3fb616d, and 78c5e8ca, but this sample's larger cradle size may indicate additional encoding layers. ^[character-skip-cipher-powershell-obfuscation]

Certificate Masquerade

A fabricated self-signed X.509 v3 certificate sits inside the PE overlay. Subject fields use a US state theme:

• C: US
• ST: Florida
• L: Miami
• CN: Nonsuccessive
• OU: Indpakkende Disinfections transmigratory
• O: Nonsuccessive
• Email: Prophylactics@Svaghedernes.Im
• Serial: 13:f1:c7:54:5d:44:0c:80:a2:d0:99:75:bd:a9:da:cb:d8:52:e5:b0
• Valid: 2023-08-17 to 2026-08-16

This is a new fabricated cert per-sample — structurally identical to prior siblings (same PKCS#7 wrapper, same 2,440-byte DER layout) but with a fresh US-themed word-salad subject. Prior siblings used German/Dutch themes (Roetgen, Daleres, Udskoling Begravedes Subscheme). ^[strings.txt:605-626]

VS_VERSIONINFO Masquerade

Version-info fields are machine-generated nonsense, not identical to prior siblings:

• Comments: bedimpled
• CompanyName: excerpting
• FileVersion: 3.1.0.0
• LegalTrademarks: uddybendes cranberries

The actor generates fresh word-salad strings per build rather than copying a fixed template. ^[exiftool.json:36-39]

Decompiled Behavior

Static analysis only. The NSIS exehead stub (entry point 0x34CE, 105 functions discovered by radare2) performs standard installer behavior: BZip2 decompression, file drop to %TEMP%, and execution of the embedded PowerShell script via CreateProcessA. No anti-debug or VM checks in the stub itself — evasion is delegated to the encrypted inner payloads and the multi-layer PowerShell obfuscation. ^[rabin2-info.txt]

C2 Infrastructure

No plaintext C2 recovered. The inner payload decryption is runtime-only. Based on sibling behavior, the decoded PowerShell likely downloads a final stage from a hardcoded or DGA-resolved HTTPS endpoint. Static extraction cannot confirm this.

Interesting Tidbits

1. Filename lure: PI_24000032.exe — "Proforma Invoice" + numeric tracking code, targeting procurement/finance workflows. Different from the "Pagamento", "Quots", "EX", "Revised_PI", "Documents", and "Ref_" themes of prior siblings. ^[triage.json:5]
2. Toolchain evolution: MSVC 14.29 linker (Oct 2022 build) vs. MSVC 6.0 (Aug 2015) in prior siblings. The actor updated their NSIS build environment. ^[pefile.txt:46]
3. Certificate theme shift: First observed US state-themed fabricated cert (Florida/Miami) in this cluster. Prior siblings used European city/country themes. ^[strings.txt:605-614]
4. Archive layout delta: Only 2 payload files (vs. 4 in prior siblings), but the PowerShell cradle is 3× larger (161 KB vs. ~50 KB). Possible shift toward heavier script-based staging vs. multi-PE drops. ^[binwalk.txt]
5. Null-padding anti-triage: disusance.nar is 347 KB but 98% null bytes — a crude but effective size-inflation technique that may defeat naive sandbox file-count heuristics.

How To Mess With It (Homelab Replication)

1. Download NSIS v3 Unicode from https://nsis.sourceforge.io/
2. Create a .nsi script that packs 3-4 encrypted payload files with gibberish filenames into $INSTDIR
3. Add an Exec command to run a PowerShell script after extraction
4. Build with makensis.exe /V4 script.nsi
5. Use openssl req -x509 -nodes -days 365 -subj "/C=US/ST=Florida/L=Miami/CN=Nonsuccessive" to generate a self-signed cert
6. Append the cert to the PE overlay with a hex editor
7. Modify VS_VERSIONINFO with verpatch.exe or Resource Hacker to insert nonsense strings
8. Verification: 7-Zip should list the archive contents and show BZip2 compression; binwalk should flag the embedded XML manifest and DER certificate

Deployable Signatures

YARA rule

rule nsis_sfx_dropper_cluster_unclassified : dropper {
    meta:
        description = "Unclassified NSIS SFX dropper cluster — fabricated self-signed cert, word-salad VS_VERSIONINFO"
        author = "pp-hermes"
        date = "2026-07-09"
        sha256 = "5212423bac835b8c3268e4cf2b195043bdcd403e7d98f9182830098585ef2d1a"
        family = "unclassified-nsis-dropper"
    strings:
        $nsis_manifest = "Nullsoft.NSIS.exehead" ascii
        $nsis_error = "http://nsis.sf.net/NSIS_Error" ascii
        $cert_fl = "Florida1" ascii
        $cert_miami = "Miami1" ascii
        $cert_nonsuc = "Nonsuccessive" ascii
        $cert_prophy = "Prophylactics@Svaghedernes.Im" ascii
        $vi_bedimpled = "bedimpled" ascii wide
        $vi_excerpting = "excerpting" ascii wide
        $vi_cranberries = "uddybendes cranberries" ascii wide
    condition:
        uint16(0) == 0x5A4D and
        $nsis_manifest and
        $nsis_error and
        (
            (any of ($cert_*)) or
            (any of ($vi_*))
        ) and
        filesize < 2MB
}

Behavioral fingerprint

This binary is a NSIS v3 self-extracting installer that drops 3–6 files to %TEMP% and immediately executes a PowerShell script. The dropped files have computer-generated Danish/French gibberish names (e.g., Svangerskabsafbrydelsen.Cri, disusance.nar). The installer carries a fabricated self-signed X.509 certificate with word-salad subject fields and VS_VERSIONINFO metadata containing nonsense strings. Network activity, if any, originates from the PowerShell cradle after decode — not from the NSIS stub itself.

IOC list

Detection Signatures

References

• Artifact ID: da2c551b-9106-4e8a-8999-2c601dffa972
• Source: OpenCTI / MalwareBazaar
• Related wiki: unclassified-nsis-dropper
• Sibling analyses: /intel/analyses/4978e16a7f6b716c324810ec44d5a82eeecd80382e4d5ccb4dc031cdc2559d9f.html, /intel/analyses/f7f089f7f7753da939649fe98a4d274e44b837a61b72d022897858e1998cc7c4.html, /intel/analyses/78c5e8ca9474815c1cd85825b00d9be487a0e049fb827b12ef74bc57580cd3f5.html

Provenance

• file.txt — file(1) 5.44
• exiftool.json — ExifTool 12.76
• pefile.txt — pefile 2023.2.7
• strings.txt — strings (GNU binutils) 2.40
• binwalk.txt — binwalk v2.3.4
• rabin2-info.txt — radare2 5.9.2
• capa.txt — capa 7.0.0 (installer limitation warning)
• 7z extraction — 7-Zip 23.01
• Certificate dump — openssl 3.0.13
• Static-only analysis; no CAPE detonation available (no Windows guest)