unclassified-nsis-dropper: 9c43b920 — "Documents.exe", NSIS v3.02 with six-file embedded payload

Executive Summary

Fifth confirmed sibling of the NSIS v3 SFX dropper cluster. Masquerades as a benign document (Documents.exe) but is a Nullsoft self-extracting installer embedding six LZMA-compressed files under gibberish filenames. Build is NSIS v3.02 Unicode exehead with MSVC 14.29 linker, timestamped Sep 2022. Carries a fabricated self-signed X.509 certificate with Danish word-salad subject fields. Static-only analysis (no CAPE Windows guest); inner payload decryption requires runtime. This sample is smaller than siblings but shares the identical certificate-template and filename-generation pattern.

What It Is

• File: Documents.exe ^[triage.json]
• SHA-256: 9c43b920900fe218212dec879c49c6b31b17ad0cda091818acff94a062b75fb8
• Size: 590,584 bytes (577 KiB) — notably smaller than prior siblings (4978e16a: ~1.1 MB, f7f089f7: ~4.5 MB, cf9a061d: ~1.4 MB, b3fb616d: ~3.2 MB) ^[file.txt]
• Family: unclassified-nsis-dropper — fifth confirmed sibling of the cluster. Same certificate template, same VS_VERSIONINFO word-salad pattern, same gibberish-filename generation.
• Build: NSIS v3.02 Unicode exehead self-extractor ^[strings.txt:755]
  • Linker: MSVC 14.29 (MajorLinkerVersion 0xE, Minor 0x1D) ^[pefile.txt:46]
  • Timestamp: Wed Sep 21 10:28:46 2022 UTC ^[pefile.txt:34]
  • Compilation: Wed Sep 21 10:28:46 2022 UTC ^[rabin2-info.txt:11]
• Certificate: Fabricated self-signed X.509 v3, RSA-4096, SHA-256
  • Subject: C=GB, ST=England, L=Kingsley Green, O=Indeklimaindsatsen, CN=Earthboard Venstrehngt Yock ^[strings.txt:1302-1306]
  • Issuer == Subject (self-signed) ^[pefile.txt:192-194]
  • Validity: Nov 8 2023 → Nov 7 2026 ^[openssl output]
  • Serial: 2a:c2:29:05:61:55:5e:06:3b:f2:69:d9:c4:98:ad:61:74:68:50:95
• Version Info: Word-salad fields ^[exiftool.json:36-41]
  • FileDescription: trapezian lovbundne
  • InternalName: nonhereditable landsskatteretskendelserne.exe
  • LegalCopyright: multiwall sliberis
  • LegalTrademarks: cestus
  • FileVersion/ProductVersion: 3.3.0.0
• Sections: Standard NSIS 5-section layout: .text, .rdata, .data, .ndata (null-padded BSS, 0x43000 vsize), .rsrc ^[pefile.txt:76-177]

How It Works

The binary is a standard NSIS v3 Unicode exehead self-extractor. On execution, the stub decompresses the LZMA archive embedded after the PE header and writes files to a temporary directory (typically under %TEMP%), then executes the NSIS install script. The outer PE has minimal anti-analysis: no packer, no VM checks, no debug detection. The threat logic is entirely contained in the embedded payloads, which are encrypted or obfuscated.

Embedded Archive Contents

Extracted via 7z x from the PE overlay:

The four .tis/.opd/.bes files exhibit entropy near 0.67 — characteristic of encrypted/null-padded PEs where the bulk is zeros or repeating blocks. The .Ran file at 7.35 entropy is the actual payload distribution target: a high-entropy encrypted binary that decrypts to a PE at runtime. The Puppen.Und file at 4.52 entropy may be a script cradle or configuration block.

Character-Skip Cipher / Word-Salad Obfuscation

The thrawartness.txt file contains a single 411-character line of Danish/German nonsense words:

daystreak domsudskrifterne kwmikalievirksomheders returbilletter afgjorde
saamnd,paaklderens oboistens balterens.pamfletist familieskaberne violettas
bowerbirds diaphany.travlbet sikkerhedskopiens netadresse forrider
nedarvninger vestsydvest taintment.nyhavn marginspekulationernes fingret
disjunct opmrksomhedsfelterne vegetarisme lewis.phyllomorphic lynchedes
mnstring karakteristikonet telegrafvsen euripupi,

This matches the Danish word-salad pattern observed in all four prior siblings. In siblings f7f089f7 and cf9a061d, a similar text file was paired with a .Mas/.Inc PowerShell cradle that used a character-skip cipher (stride 6, offset 5 and stride 8, offset 7 respectively) to decode an IEX reflective-execution chain. In this sample, no paired PowerShell cradle was found in the extracted files; the obfuscation may be embedded in Puppen.Und or the cipher may have been abandoned in this build morph. The 34-word vocabulary is consistent with the cluster's generation pattern: compound Danish/German nonce words with occasional English loanwords (daystreak, bowerbirds, diaphany). ^[thrawartness.txt]

Certificate Fabrication

The self-signed certificate uses the same template as sibling b3fb616d:

• Identical C=GB, ST=England, L=Kingsley Green subject locality
• Identical O=Indeklimaindsatsen organization name
• CN=Earthboard Venstrehngt Yock — a compound of English (Earthboard) and Danish (Venstrehngt) nonsense
• RSA-4096 with SHA-256 signature algorithm
• CA:TRUE basic constraint (self-signed root)

This certificate is not stolen — it is machine-generated for anti-triage masquerade. The consistency across siblings suggests a shared build pipeline that generates certificates from a fixed template with randomized CNs.

Decompiled Behavior

Static analysis via radare2 (analysis level 2, 101 functions) confirms standard NSIS exehead entry-point behavior:

• Entry at 0x004036fc (entry0) ^[r2:entry0]
• Calls SetErrorMode(0x8001) to suppress error dialogs ^[r2:sym.imp.KERNEL32.dll_SetErrorMode]
• Queries GetVersionExW to determine Windows version ^[r2:sym.imp.KERNEL32.dll_GetVersionExW]
• Loads UXTHEME, USERENV, SETUPAPI, APPHELP, PROPSYS, DWMAPI, CRYPTBASE, OLEACC, CLBCATQ, NTMARTA, RichEd20, RichEd32 via string-table DLL loading ^[strings.txt:81-92]
• Initializes COM (OleInitialize) and common controls (InitCommonControls) ^[r2:sym.imp.ole32.dll_OleInitialize]
• Retrieves command line and processes installer arguments ^[r2:sym.imp.KERNEL32.dll_GetCommandLineW]
• Standard NSIS error strings present: "Error writing temporary file...", "NSIS Error", "Installer integrity check has failed..." ^[r2:strings]

No anti-debug, anti-VM, or obfuscation logic is present in the outer stub. The threat is entirely post-extraction.

C2 Infrastructure

No C2 indicators recovered statically. The outer PE has no hardcoded IPs, domains, or URLs. Network indicators would be present only in the decrypted inner payload (Importunement.Ran or Puppen.Und), which requires runtime decryption. The certificate CRL/OCSP URLs (https://d.symcb.com, http://ts-ocsp.ws.symantec.com) are standard Symantec timestamping infrastructure, not attacker-controlled. ^[strings.txt:1331-1349]

Interesting Tidbits

• Smallest sibling: At 577 KiB, this is the smallest of the five confirmed siblings. Prior siblings range from 1.1 MB to 4.5 MB. The size reduction comes from fewer/larger compressed payloads rather than a stripped stub.
• No PowerShell cradle visible: Unlike f7f089f7 (stride-6 .Mas file) and b3fb616d (stride-6 Yod.Kat file), this sample does not expose an obvious PowerShell script in the extracted archive. The cradle may be embedded in Puppen.Und or the delivery chain may have shifted to a different execution mechanism.
• Identical certificate template: The X.509 subject fields match b3fb616d exactly, confirming shared tooling.
• Linker version drift: This sample uses MSVC 14.29 (VS 2019/2022); prior siblings used MSVC 6.0 (MajorLinkerVersion 0x6) for the NSIS stub. This indicates a rebuild or toolchain update in the cluster's evolution.
• Filename lure: Documents.exe is a generic masquerade — less specific than the payment-document (Pagamento..., Revised_PI...) or PDF (Quots-...-pdf.exe) lures of prior siblings, suggesting broader targeting or a different distribution channel.
• PNG resources: binwalk identifies two 256×256 PNG images in the .rsrc section ^[binwalk.txt:5-6]. These are likely NSIS installer branding/banner images, not steganographic carriers (entropy 5.21 in .rsrc is consistent with compressed images).

How To Mess With It (Homelab Replication)

• Toolchain: NSIS v3.02 Unicode + MSVC 14.29 linker
• Method: Compile a benign NSIS installer with makensis, then embed encrypted payload files using the File directive. Use lzma compression (SetCompressor lzma).
• Certificate: Generate a self-signed RSA-4096 cert with OpenSSL, populate subject fields with word-salad, and attach via SignTool or PE resource editor.
• Verification: Extract with 7z x <file.exe> and confirm NSIS-3 Unicode subtype, embedded files, and word-salad certificate.
• What you'll learn: How legitimate installer frameworks are repurposed for malware distribution; how to identify embedded payloads vs. installer bloat.

Deployable Signatures

YARA Rule

rule nsis_dropper_unclassified_sibling_9c43b920 {
    meta:
        description = "NSIS v3 SFX dropper cluster — unclassified-nsis-dropper sibling"
        author = "PacketPursuit"
        reference = "/intel/analyses/9c43b920900fe218212dec879c49c6b31b17ad0cda091818acff94a062b75fb8.html"
        date = "2026-07-02"
        hash = "9c43b920900fe218212dec879c49c6b31b17ad0cda091818acff94a062b75fb8"
        confidence = "medium"
    strings:
        $nsis_manifest = "Nullsoft.NSIS.exehead" ascii wide
        $nsis_desc = "Nullsoft Install System" ascii wide
        $cert_cn1 = "Earthboard Venstrehngt Yock" ascii wide
        $cert_org = "Indeklimaindsatsen" ascii wide
        $cert_locality = "Kingsley Green" ascii wide
        $desc1 = "trapezian lovbundne" ascii wide
        $desc2 = "nonhereditable landsskatteretskendelserne" ascii wide
        $desc3 = "multiwall sliberis" ascii wide
        $desc4 = "cestus" ascii wide
    condition:
        uint16(0) == 0x5A4D and
        pe.number_of_sections >= 5 and
        ($nsis_manifest or $nsis_desc) and
        any of ($cert_*) and
        any of ($desc*)
}

Sigma Rule

title: NSIS SFX Dropper Execution with Suspicious Filename
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\\Documents.exe'
            - '\\Pagamento*.exe'
            - '\\Revised_PI_*.exe'
            - '\\Quots-*.exe'
            - '\\EX*.PDF.exe'
        CommandLine|contains:
            - '/S'
            - '/NCRC'
    condition: selection
falsepositives:
    - Legitimate NSIS installers using similar naming
level: medium

IOC List

Behavioral Fingerprint Statement

This binary is a 32-bit NSIS v3 Unicode self-extracting installer (exehead) compiled with MSVC 14.29 linker, timestamped September 2022. It carries a fabricated self-signed X.509 certificate with Danish/English word-salad subject fields (Indeklimaindsatsen, Earthboard Venstrehngt Yock). Its VS_VERSIONINFO is populated with semantically empty strings (trapezian lovbundne, multiwall sliberis, cestus). On execution, the stub extracts an LZMA-compressed archive containing multiple files with computer-generated gibberish names (e.g., Importunement.Ran, Puppen.Und, thrawartness.txt). The extracted payloads exhibit bimodal entropy: most files are low-entropy (0.67, null-padded encrypted PEs), with one high-entropy file (~7.35) representing the actual encrypted inner payload. No network indicators are present in the outer PE; C2 is resolved only by the decrypted inner payload at runtime.

Detection Signatures

• MITRE ATT&CK: T1204.002 (Malicious Link / User Execution), T1574.002 (Hijack Execution Flow), T1036.004 (Masquerade Task or Service), T1036.005 (Match Legitimate Name or Location), T1620 (Reflective Code Loading — inferred)
• capa: No capabilities identified — capa flagged as installer and declined analysis ^[capa.txt]
• YARA: PE_File_Generic only ^[yara.txt]

References

• SHA-256: 9c43b920900fe218212dec879c49c6b31b17ad0cda091818acff94a062b75fb8
• Artifact ID: f94f4283-4455-45bd-bf47-84912cb2ef87
• Source: MalwareBazaar via OpenCTI
• Sibling: unclassified-nsis-dropper
• Sibling reports: /intel/analyses/4978e16a7f6b716c324810ec44d5a82eeecd80382e4d5ccb4dc031cdc2559d9f.html, /intel/analyses/f7f089f7f7753da939649fe98a4d274e44b837a61b72d022897858e1998cc7c4.html, /intel/analyses/cf9a061d02b0601036e3fd138e6b59ee6cdba3e5a40f8472171a56771ace341c.html, /intel/analyses/b3fb616de3993830d09c675bca2c146618abd5fbf8cd564702642d2eeb8aef10.html

Provenance

• file.txt — file(1) output
• exiftool.json — ExifTool metadata extraction
• pefile.txt — pefile Python library header/section/import analysis
• strings.txt — GNU strings (default 4-char min)
• floss.txt — FireEye flare-floss (failed — invalid CLI args)
• capa.txt — Mandiant flare-capa (installer limitation warning)
• binwalk.txt — binwalk embedded artefact scan
• rabin2-info.txt — radare2 binary header summary
• ssdeep.txt — ssdeep fuzzy hash
• tlsh.txt — TLSH hash
• yara.txt — YARA generic rule match
• metadata.json — OpenCTI artifact metadata
• triage.json — triage pipeline metadata
• dynamic-analysis.md — CAPE sandbox (skipped: no Windows guest)
• radare2 decompilation — entry0 at 0x004036fc
• 7-Zip 23.01 extraction — NSIS-3 Unicode archive decompression
• OpenSSL — X.509 certificate parsing from PE security directory