unclassified-nsis-dropper: 78c5e8ca — "Ref_7021929821US20240709031221650.exe", stride-6 Danish character-skip PowerShell

Executive Summary

Sixth confirmed sibling of the NSIS v3 SFX dropper cluster. Masquerades as a US payment reference document (Ref_7021929821US20240709031221650.exe) but is a Nullsoft self-extracting installer embedding six LZMA-compressed files: one obfuscated PowerShell cradle, four low-entropy encrypted PE payloads, and a Danish-language word-salad text file. The PowerShell script uses a character-skip cipher (stride 6, offset 5) with dead-code variable padding to decode itself into an IEX reflective-execution chain. Static-only analysis (no CAPE Windows guest); inner payload decryption requires runtime. See cluster analysis at unclassified-nsis-dropper for shared fingerprint.

What It Is

• File: Ref_7021929821US20240709031221650.exe ^[triage.json]
• SHA-256: 78c5e8ca9474815c1cd85825b00d9be487a0e049fb827b12ef74bc57580cd3f5
• Type: PE32 executable (GUI) Intel 80386, Nullsoft Installer self-extracting archive, 5 sections ^[file.txt]
• Size: 1,298,344 bytes (1.25 MB) ^[triage.json]
• Timestamp: Wed Aug 5 00:46:24 2015 UTC ^[pefile.txt:34]
• Linker: MSVC 6.0 (MajorLinkerVersion 0x6) ^[pefile.txt:46]
• Subsystem: Windows GUI ^[pefile.txt]
• Dynamism: Static-only. CAPE skipped — no Windows guest available. ^[dynamic-analysis.md]

How It Works

Outer Loader

The binary is a standard NSIS v3 Unicode exehead self-extractor. The embedded LZMA archive starts at file offset 0x71898 and contains six files:

The three .alk/.kom/.lob files exhibit entropy near 1.25 — characteristic of encrypted/null-padded PEs. The .Fal file at 7.76 entropy is the high-entropy encrypted payload. This is the same archive structure observed in siblings b3fb616d, 9c43b920, etc.

PowerShell Cradle — Character-Skip Cipher

The Rkvrker.hul script is a single line wrapped in Danish comment blocks. Three strings are defined:

• $dodgem — a 13,662-character noise-padded literal (Danish/French gibberish)
• An unnamed middle string — 30,608 characters of noise
• A third string — 7,046 characters with embedded hex sequences

A while loop walks the first string with stride 6, offset 5:

$Spirobranchiateuddhismens=0;
while($Occamism[$Spirobranchiateuddhismens]) {
    $forbrndingsprocessernes+=$Occamism[$Spirobranchiateuddhismens];
    $Spirobranchiateuddhismens+=6;
}

The decoded output is 2,266 characters of additional PowerShell containing IEX + secondary payload staging. Dead-code variables ($Vellignendesarsagsforklaringers, $Occamism) pad the decoder body. This is the same technique as the b3fb616d sibling but with fresh variable names. ^[character-skip-cipher-powershell-obfuscation]

Certificate Masquerade

A fabricated self-signed X.509 v3 certificate sits at file offset 0x13C618 inside the PE overlay. Subject fields are word-salad:

• CN: Udskoling Begravedes Subscheme
• O: Comoquer
• OU: (absent)
• L: Roetgen
• C: DE
• Serial: 72:71:12:62:5e:5d:1c:2f:a7:27:08:f7:d8:8d:60:e8:b5:8d:99:09
• Valid: 2023-09-08 to 2026-09-07

This is a new fabricated cert — not identical to the b3fb616d sibling's Daleres/Shere cert, but structurally identical (same 2,440-byte PKCS#7 wrapper, same self-signed DER layout). The actor generates a fresh cert per sample.

VS_VERSIONINFO Masquerade

Version-info fields are machine-generated nonsense:

• Comments: ufordjede spiritedness tidsfulgte
• FileDescription: autolakererierne
• InternalName: immunreaktion returkampe.exe
• LegalCopyright: ulgelige begynderkursussets
• ProductName: udbrnd ^[exiftool.json:36-42]

Identical to the b3fb616d sibling — same strings, same field layout. The actor copies a template VS_VERSIONINFO block between builds.

Decompiled Behavior

Static analysis only. Ghidra/radare2 decompilation of the NSIS exehead stub (entry point 0x31ff, 91 functions discovered) reveals standard installer behavior: LZMA decompression, file drop to %TEMP%, and execution of the embedded PowerShell script via CreateProcessW. No anti-debug or VM checks in the stub itself — evasion is delegated to the encrypted inner payloads and the multi-layer PowerShell obfuscation. ^[rabin2-info.txt]

C2 Infrastructure

No plaintext C2 recovered. The inner payload decryption is runtime-only. Based on sibling behavior, the decoded PowerShell likely downloads a final stage from a hardcoded or DGA-resolved HTTPS endpoint. Static extraction cannot confirm this.

Interesting Tidbits

1. Filename lure: Ref_7021929821US20240709031221650.exe — US-centric "Reference" + date-stamp + "US" suffix social-engineering theme, targeting procurement/finance workflows. Different from the "Revised_PI" and "Documents" themes of prior siblings. ^[triage.json:5]
2. Certificate polymorphism: New fabricated self-signed cert with fresh word-salad subject fields (Udskoling Begravedes Subscheme / Comoquer) per sample. Same structure, different content.
3. VS_VERSIONINFO template reuse: Identical field values to b3fb616d — this is a copy-paste template, not generated per-sample.
4. PowerShell variable name polymorphism: Fresh dead-code variable names ($Spirobranchiateuddhismens, $Vellignendesarsagsforklaringers, $Occamism) replace the $Spinderok249/$Lenticularentiexpressive names of b3fb616d. Same stride, new noise.
5. No capa results: capa detects only the generic "installer file limitation" warning and refuses to map capabilities. ^[capa.txt:1-20]
6. floss failure: flare-floss was invoked with incorrect arguments (--no without a mode choice), producing no decoded strings. ^[floss.txt:1-6]
7. Sixth confirmed sibling: This sample extends the cluster from five to six confirmed members. The archive structure (3× low-entropy PE + 1× high-entropy blob + 1× PS cradle + 1× text decoy) is now a cluster invariant.

How To Mess With It (Homelab Replication)

See cluster analysis at unclassified-nsis-dropper for full replication notes. The delta for this sample:

• Use a "Ref_" + date + "US" themed filename
• Generate a fresh fabricated X.509 cert with Danish/Germanic word-salad subject
• Copy the existing VS_VERSIONINFO template (same field values)
• Generate fresh dead-code variable names for the PowerShell stride-6 decoder

Deployable Signatures

YARA Rule

rule NSIS_DanishStrideDropper_78C5E8CA {
    meta:
        description = "NSIS SFX dropper with Danish character-skip PowerShell obfuscation"
        author = "PacketPursuit SOC"
        sha256 = "78c5e8ca9474815c1cd85825b00d9be487a0e049fb827b12ef74bc57580cd3f5"
        family = "unclassified-nsis-dropper"
    strings:
        $nsis_manifest = "Nullsoft.NSIS.exehead" ascii wide
        $nsis_desc = "Nullsoft Install System" ascii wide
        $stride_var1 = "$Spirobranchiateuddhismens" ascii wide
        $stride_var2 = "$forbrndingsprocessernes" ascii wide
        $stride_var3 = "$Vellignendesarsagsforklaringers" ascii wide
        $stride_var4 = "$Occamism" ascii wide
        $iex_short = "$Faldrater" ascii wide
        $cert_cn = "Udskoling Begravedes Subscheme" ascii wide
        $cert_o = "Comoquer" ascii wide
        $ver_internal = "immunreaktion returkampe.exe" ascii wide
        $ver_comment = "ufordjede spiritedness tidsfulgte" ascii wide
    condition:
        uint16(0) == 0x5A4D and
        $nsis_manifest and
        2 of ($stride_var*) and
        ($cert_cn or $cert_o or $ver_internal)
}

Behavioral Hunt Query (Sigma)

title: NSIS Dropper PowerShell Character-Skip Execution (78c5e8ca variant)
logsource:
    product: windows
    category: process_creation
detection:
    selection:
        CommandLine|contains:
            - '$Spirobranchiateuddhismens'
            - '$forbrndingsprocessernes'
            - '$Vellignendesarsagsforklaringers'
            - '$Occamism'
            - '$Faldrater'
            - '$Klapstoles'
    condition: selection
falsepositives:
    - Unlikely — these are non-lexical Danish strings specific to this cluster
level: high

IOC List

Behavioral Fingerprint

This binary is a Nullsoft self-extracting installer that drops an obfuscated PowerShell script using a Danish-themed character-skip cipher (stride 6, offset 5). The script decodes to IEX followed by a secondary payload of ~2,200 characters containing hex-split encrypted data. Three low-entropy encrypted PE files, one high-entropy (~7.8) encrypted binary blob, and one Danish word-salad text decoy accompany the script in the LZMA archive. The actor generates fabricated self-signed X.509 certificates with word-salad subject fields for each sample, but reuses the same VS_VERSIONINFO template. No hardcoded C2 survives static extraction; the inner payload decrypts at runtime.

Detection Signatures

• capa detects only installer file limitation — no capability mapping possible on the outer stub. ^[capa.txt]
• MITRE ATT&CK mappings (inferred from static + sibling behavior):
  • T1204.002 — Malicious Link / User Execution
  • T1574.002 — Hijack Execution Flow (legitimate NSIS installer framework)
  • T1036.004 — Masquerade Task or Service
  • T1036.005 — Match Legitimate Name or Location
  • T1620 — Reflective Code Loading (inner payload, inferred)
  • T1059.001 — PowerShell (obfuscated cradle)
  • T1027.010 — Obfuscated Files or Information: Command Obfuscation

References

• Sibling analyses:
  • /intel/analyses/4978e16a7f6b716c324810ec44d5a82eeecd80382e4d5ccb4dc031cdc2559d9f.html — First observed sibling; stride 4
  • /intel/analyses/f7f089f7f7753da939649fe98a4d274e44b837a61b72d022897858e1998cc7c4.html — Second sibling; stride 6
  • /intel/analyses/cf9a061d02b0601036e3fd138e6b59ee6cdba3e5a40f8472171a56771ace341c.html — Third sibling; stride 8
  • /intel/analyses/b3fb616de3993830d09c675bca2c146618abd5fbf8cd564702642d2eeb8aef10.html — Fourth sibling; stride 6 (same stride, new variable names)
  • /intel/analyses/9c43b920900fe218212dec879c49c6b31b17ad0cda091818acff94a062b75fb8.html — Fifth sibling; stride 6 with MSVC 14.29 linker
• Family page: unclassified-nsis-dropper
• Technique: nsis-lzma-embedded-payload
• Technique: character-skip-cipher-powershell-obfuscation
• Concept: version-info-masquerade

Provenance

Analysis derived from:

• file.txt (file(1) output)
• pefile.txt (pefile Python module)
• exiftool.json (ExifTool 12.76)
• strings.txt (strings -n 6)
• floss.txt (flare-floss invocation, failed due to CLI error)
• capa.txt (Mandiant capa v9.0, installer limitation warning)
• binwalk.txt (binwalk signature scan)
• rabin2-info.txt (radare2 binary info)
• triage.json (triage-fast metadata)
• Manual NSIS archive extraction via 7-Zip 23.01
• Manual PowerShell deobfuscation via Python 3 re module
• Certificate extraction via OpenSSL 3.x

Static-only. No CAPE detonation. Inner payload decryption requires runtime execution.